Merge remote-tracking branch 'origin/main' into feat/272-the-engine-vouches-for-mesh-cli

cmd/mesh-host/main.go

@@ -1111,7 +1111,7 @@ func runLink(ctx context.Context, opts options) error {
 		// And which units its service managers say failed, and whose each is (novox/hq issue 315).
 		unitJudge = units.New(units.Exec{Run: apply.ExecRunner, System: builtFor})
 		// And whether an account a module put in a group has it where it runs (novox/hq ADR 0252).
-		accountJudge = accounts.New(accounts.Exec{Run: accounts.Runner(apply.ExecRunner)})
+		accountJudge = accounts.New(accounts.Exec{Run: accounts.CLocale, Cache: &accounts.SetuidCache{Every: time.Hour}})
 	}
 
 	// **Standing aside for a successor happens between reconciles and nowhere else** (novox/hq ADR
@@ -1583,9 +1583,10 @@ func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, sa
 
 // healthAsReported is a statement as the report and the event carry it.
 func healthAsReported(st liveness.Statement, ns *network.Statement) *link.Health {
-	// ReadinessContract: this engine reads a resource's declared `health` and judges it (ADR 0240 Phase
-	// B), which is what tells the controller it may be sent the field.
-	h := &link.Health{Contract: link.ReadinessContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}}
+	// RootContract: this engine reads a resource's declared `health` and judges it (ADR 0240 Phase B), and
+	// judges a user's declared `root` (novox/hq ADR 0266), which is what tells the controller it may be sent
+	// either field.
+	h := &link.Health{Contract: link.RootContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}}
 	for _, r := range st.Resources {
 		h.Resources = append(h.Resources, link.ResourceHealth{Module: r.Module, Resource: r.ID, Kind: r.Kind,
 			Target: r.Target, State: r.State, Reason: r.Reason, Since: r.Since.UTC(), Streak: r.Streak,
@@ -1631,15 +1632,21 @@ func withUnits(h *link.Health, us *units.Statement) *link.Health {
 
 // withAccounts adds to a statement every account a module put in a group (novox/hq ADR 0252), as that
 // module's resource of kind account: healthy, or unhealthy with why — "relogin needed" when the account's
-// running session began before it was put in the group. Nil says nothing of them.
+// running session began before it was put in the group, or "can become root without a person" for one declared
+// never to (novox/hq ADR 0266), which is also marked root never. Nil says nothing of them.
 func withAccounts(h *link.Health, as *accounts.Statement) *link.Health {
 	if as == nil {
 		return h
 	}
 	for _, v := range as.Accounts {
-		h.Resources = append(h.Resources, link.ResourceHealth{Module: v.Module, Resource: v.ID,
+		rh := link.ResourceHealth{Module: v.Module, Resource: v.ID,
 			Kind: link.KindAccount, Target: v.Name, State: v.State, Reason: v.Reason, Since: v.Since.UTC(),
-			Streak: v.Streak, Account: v.Name})
+			Streak: v.Streak, Account: v.Name}
+		// Said, so the controller knows healthy here also means no way to root was found (novox/hq ADR 0266).
+		if v.Root {
+			rh.Root = declaration.RootNever
+		}
+		h.Resources = append(h.Resources, rh)
 	}
 	return h
 }

cmd/mesh-host/units_test.go

@@ -75,3 +75,26 @@ func TestTheStatementNamesTheAccountsManager(t *testing.T) {
 		}
 	}
 }
+
+// An account declared never to become root (novox/hq ADR 0266) is said with root never, under the contract
+// that tells the controller this engine judges it; an account judged for its groups alone is not.
+func TestTheStatementSaysAnAccountJudgedForRoot(t *testing.T) {
+	at := time.Date(2026, 10, 8, 12, 0, 0, 0, time.UTC)
+	as := &accounts.Statement{At: at, Accounts: []accounts.Verdict{
+		{Account: accounts.Account{Module: "claude-code", ID: "claude-code.agent", Name: "agent", Root: true},
+			State: accounts.Unhealthy, Reason: accounts.ReasonRoot + ": in the group docker, which grants root", Since: at},
+		{Account: accounts.Account{Module: "openrazer", ID: "openrazer.account", Name: "operator",
+			Groups: []string{"openrazer"}}, State: accounts.Healthy, Since: at},
+	}}
+	h := withAccounts(healthAsReported(liveness.Statement{At: at}, nil), as)
+	if h.Contract != link.RootContract || link.RootContract != 3 {
+		t.Fatalf("contract %d", h.Contract)
+	}
+	got := map[string]string{}
+	for _, r := range h.Resources {
+		got[r.Resource] = r.Root
+	}
+	if got["claude-code.agent"] != "never" || got["openrazer.account"] != "" {
+		t.Fatalf("root said: %v", got)
+	}
+}