Vouch for the account that runs mesh-cli, and ask the controller its line (hq ADR 0272)

The records send the operator to "the controller's terminal", and nothing
reaches it (hq issue 343). mesh-cli holds no credential: it asks the engine
on its own machine over a socket. The engine reads the asking account from
the kernel (SO_PEERCRED), never from the program, and asks the controller on
mesh.control.<node>.cli, its own node's subject, so the bus server says which
node asked. The controller decides what the line may do; nothing received
on the socket is run or applied here, and the socket has no network address
(ADR 0004 stands).

The local protocol is the SDK's go/cli package, at a pseudo-version of its
branch until that merges and is tagged go/v0.1.8.

internal/link/bus.go

@@ -67,6 +67,11 @@ func (b OverNATS) Health(ctx context.Context, node string, body []byte) error {
 	return b.Conn.FlushWithContext(flush)
 }
 
+// CLISubject is where this node's engine asks the controller a line `mesh-cli` was given on this machine
+// (novox/hq ADR 0272 §3): its own node's, inside the grant every engine already has (`mesh.control.<node>.>`), so the
+// bus server is the authority on which node asked. Core NATS, never the CONTROL stream, which names its own subjects.
+func CLISubject(node string) string { return "mesh.control." + node + ".cli" }
+
 // ToolSubject is a module's tool on one machine's node tools — the subject a node-engine asks a declared
 // tool check on (novox/hq ADR 0240, to-be 48 §3), granted it for its own machine's instance and no other.
 func ToolSubject(module, tool, node string) string {

internal/link/queue.go

@@ -544,6 +544,23 @@ func (q *Queue) AskTool(ctx context.Context, module, tool string) (bool, string,
 	return ReadToolAnswer(reply)
 }
 
+// AskController asks the controller a line mesh-cli was given on this machine, on this node's own subject, over
+// the link open now (novox/hq ADR 0272 §3), and returns its answer as it came. No link open is said, not waited for.
+func (q *Queue) AskController(ctx context.Context, body []byte) ([]byte, error) {
+	q.init()
+	q.mu.Lock()
+	bus := q.bus
+	q.mu.Unlock()
+	if bus == nil {
+		return nil, errors.New("this machine has no link to the bus open now")
+	}
+	asker, ok := bus.(ToolBus)
+	if !ok {
+		return nil, errors.New("the link to the bus open now cannot ask the controller")
+	}
+	return asker.Ask(ctx, CLISubject(q.Membership.Node), body)
+}
+
 // ReadToolAnswer reads a tool's reply envelope — `{result, error}`, as the node tools answer every call —
 // as a health answer: an error is not healthy, and so is a result that does not say `healthy: true`.
 func ReadToolAnswer(reply []byte) (bool, string, error) {