Vouch for the account that runs mesh-cli, and ask the controller its line (hq ADR 0272)

The records send the operator to "the controller's terminal", and nothing
reaches it (hq issue 343). mesh-cli holds no credential: it asks the engine
on its own machine over a socket. The engine reads the asking account from
the kernel (SO_PEERCRED), never from the program, and asks the controller on
mesh.control.<node>.cli, its own node's subject, so the bus server says which
node asked. The controller decides what the line may do; nothing received
on the socket is run or applied here, and the socket has no network address
(ADR 0004 stands).

The local protocol is the SDK's go/cli package, at a pseudo-version of its
branch until that merges and is tagged go/v0.1.8.

internal/meshcli/peer_other.go

@@ -0,0 +1,16 @@
+//go:build !linux
+
+package meshcli
+
+import (
+	"errors"
+	"net"
+)
+
+// peerCredentials is unknown where the kernel's way of saying it is not built here: refused, never guessed.
+func peerCredentials(*net.UnixConn) (uint32, error) {
+	return 0, errors.New("this engine reads a peer's account on Linux only")
+}
+
+// notOwnDirectory is never satisfied where peers cannot be read.
+func notOwnDirectory(string) string { return "not served on this system" }