jochen 0694f17934 Refuse a node's accounts through any verb, and a stale or service-account agent verdict ...

The generic command verb ran node account and node agent-account, so an agent
could name itself the operator account and have the next send grant it root
(hq ADR 0266 review). Refuse every node subcommand but list and show through
any verb; refuse the operator account as the agent account in both
directions and well-known service accounts as an agent account; and count a
verdict heard more than 15 minutes ago as not judged, so stopping the
node-engine cannot freeze a healthy one. Re-pin mesh-host to its review head.

2026-10-08 21:46:10 +02:00

..

migrations

Name the account agents run as on a node, and say whether it can become root

2026-10-08 21:46:10 +02:00

addresses.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

adoption_test.go

A repeat assignment says nothing changed (ADR 0115)

2026-09-26 19:02:35 +02:00

adoption.go

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

agent_account_test.go

Refuse a node's accounts through any verb, and a stale or service-account agent verdict

2026-10-08 21:46:10 +02:00

artifacts_test.go

Answer what the records keep, collect on a person's word, and name a machine's images (hq ADR 0251)

2026-10-08 12:04:42 +02:00

bindings_test.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

bindings.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

buildinput_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

builds_test.go

A merge rebuilds what it changed, and what packages it

2026-09-28 09:20:01 +02:00

builds.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

busrecords_test.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

busrecords.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

busstep.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

bususers_test.go

Genesis can raise a mesh on the new bus, and the carried user list is checked against the composer

2026-09-27 16:39:19 +02:00

bususers.go

One runtime principal per node carries every assigned module's tools (hq ADR 0175, to-be 38 WP2.1)

2026-10-02 18:16:14 +02:00

catalogue_test.go

Refuse the tools-container shape for every module (to-be 38 WP4b's last step)

2026-10-04 02:28:54 +02:00

catalogue.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

collection_test.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

collection.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

data_test.go

Measure each item its own way; never compare a partial size (hq ADR 0233)

2026-10-06 17:00:22 +02:00

data.go

Measure each item its own way; never compare a partial size (hq ADR 0233)

2026-10-06 17:00:22 +02:00

dependencies_test.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

dependencies.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

doing_test.go

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

durations_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

durations.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

forget_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

fortest.go

Give each pending assignment its own condition, and keep a raised row until it clears

2026-10-08 16:45:43 +02:00

gate.go

Name the hq issue by its number: 294 was taken on an open branch, this is 295

2026-10-07 19:28:54 +02:00

given_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

given.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

heals_test.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

heals.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

health.go

Name the account agents run as on a node, and say whether it can become root

2026-10-08 21:46:10 +02:00

heldhere_test.go

Issue only the recorded holder a seat held once for the mesh (novox/hq issue 218)

2026-10-03 23:30:27 +02:00

hold_plans_test.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

hold_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

hold.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

holdings_test.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

inventory_test.go

Review of 083: finishing an enrolment whose token was spent takes proof of the key's private half, a live lease and a first delivery — a public key alone cannot replay a spent token; shutdown leaves held messages for the broker; identical builds supersede; what is held leaves room in the prefetch

2026-09-22 14:33:13 +02:00

inventory.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

mirrored_test.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

named_peer_test.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

nodes.go

Refuse a node's accounts through any verb, and a stale or service-account agent verdict

2026-10-08 21:46:10 +02:00

older_build_test.go

An older build request never replaces a newer one's artifact

2026-10-04 00:22:11 +02:00

operator_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

operator.go

Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

2026-09-21 21:03:22 +02:00

order_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

order.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

pending_test.go

Make pending assignments safe to race, settle them on a tick, and say only what was checked

2026-10-08 16:38:11 +02:00

pending.go

Give each pending assignment its own condition, and keep a raised row until it clears

2026-10-08 16:45:43 +02:00

people_test.go

Tests follow the grants and issue 203: a person may ask what answers; the resolver test mints its credential

2026-10-03 23:15:57 +02:00

pin_completed_test.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

plans_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

plans.go

Put a broken module back at once, and excuse a wait only for a move that added an account group (hq issue 318 review)

2026-10-08 15:25:58 +02:00

ports_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

ports.go

Read the foundation's ports from each node's settings, wherever a port is used (hq ADR 0100)

2026-09-22 17:31:07 +02:00

public_domain_test.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

reachable_test.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

reachable.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

reported.go

Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

2026-10-06 20:31:10 +02:00

retire_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

seats_test.go

Give the build verb the command's other two shapes, so a changed base or a source that moved can be rebuilt through the console

2026-10-08 01:37:30 +02:00

seats.go

Let failed join the seat optional, and let a seeded row carry both changes

2026-10-07 20:05:01 +02:00

secrets_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

secrets.go

Say a machine waiting for its push as waiting, not uncomposable (hq issue 275)

2026-10-06 18:05:38 +02:00

sent_builds_test.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

sent_bus_users_test.go

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

settings_judged_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

source.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

store_as_run_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

tunnel_test.go

Adopt the tunnel as a mesh fact, refuse a mismatched takeover, and rekey after enrolment

2026-09-24 00:02:07 +02:00

tunnel.go

The mesh's interface takes over the found tunnel's MTU

2026-09-26 22:40:42 +02:00

unknown_field_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

unseen_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

unseen.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00