Archived
jschoubben
96f90ab986
A module may not declare an action: the link may not carry a command to run, and that bound is what limits a compromised control plane to shapes it cannot turn into arbitrary code (novox/hq ADR 0005). The host enforces it, correctly and in the right place. But a module's resources reach a machine over the link, so a manifest carrying an action was accepted here, stored, resolved, planned and pushed — and refused on the machine, in the host's log, with nothing connecting it back to the manifest that caused it. The rule held. It was just unusable, which is the same shape as the network shape earlier today: the refusal was right, arrived far from its cause, and nobody was reading the log. The refusal names the rule and what to do instead, because "you may not" with no alternative is where a module author stops. Found while checking a claim I had written in the coverage document — that a module cannot declare one. It could; it just could not deliver it. The document is corrected.