Judge whether an account declared never to become root can, so a machine's agents are known confined

An account an agent runs as (novox/hq ADR 0266) is read on every look for a
uid of 0, a group that grants root, any sudo rule and a mesh secret it can
read; any way found is unhealthy and said, a read that fails is unknown.

cmd/mesh-host/main.go

@@ -1559,9 +1559,10 @@ func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, sa
 
 // healthAsReported is a statement as the report and the event carry it.
 func healthAsReported(st liveness.Statement, ns *network.Statement) *link.Health {
-	// ReadinessContract: this engine reads a resource's declared `health` and judges it (ADR 0240 Phase
-	// B), which is what tells the controller it may be sent the field.
-	h := &link.Health{Contract: link.ReadinessContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}}
+	// RootContract: this engine reads a resource's declared `health` and judges it (ADR 0240 Phase B), and
+	// judges a user's declared `root` (novox/hq ADR 0266), which is what tells the controller it may be sent
+	// either field.
+	h := &link.Health{Contract: link.RootContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}}
 	for _, r := range st.Resources {
 		h.Resources = append(h.Resources, link.ResourceHealth{Module: r.Module, Resource: r.ID, Kind: r.Kind,
 			Target: r.Target, State: r.State, Reason: r.Reason, Since: r.Since.UTC(), Streak: r.Streak,
@@ -1607,15 +1608,21 @@ func withUnits(h *link.Health, us *units.Statement) *link.Health {
 
 // withAccounts adds to a statement every account a module put in a group (novox/hq ADR 0252), as that
 // module's resource of kind account: healthy, or unhealthy with why — "relogin needed" when the account's
-// running session began before it was put in the group. Nil says nothing of them.
+// running session began before it was put in the group, or "can become root without a person" for one declared
+// never to (novox/hq ADR 0266), which is also marked root never. Nil says nothing of them.
 func withAccounts(h *link.Health, as *accounts.Statement) *link.Health {
 	if as == nil {
 		return h
 	}
 	for _, v := range as.Accounts {
-		h.Resources = append(h.Resources, link.ResourceHealth{Module: v.Module, Resource: v.ID,
+		rh := link.ResourceHealth{Module: v.Module, Resource: v.ID,
 			Kind: link.KindAccount, Target: v.Name, State: v.State, Reason: v.Reason, Since: v.Since.UTC(),
-			Streak: v.Streak, Account: v.Name})
+			Streak: v.Streak, Account: v.Name}
+		// Said, so the controller knows healthy here also means no way to root was found (novox/hq ADR 0266).
+		if v.Root {
+			rh.Root = declaration.RootNever
+		}
+		h.Resources = append(h.Resources, rh)
 	}
 	return h
 }

cmd/mesh-host/units_test.go

@@ -75,3 +75,26 @@ func TestTheStatementNamesTheAccountsManager(t *testing.T) {
 		}
 	}
 }
+
+// An account declared never to become root (novox/hq ADR 0266) is said with root never, under the contract
+// that tells the controller this engine judges it; an account judged for its groups alone is not.
+func TestTheStatementSaysAnAccountJudgedForRoot(t *testing.T) {
+	at := time.Date(2026, 10, 8, 12, 0, 0, 0, time.UTC)
+	as := &accounts.Statement{At: at, Accounts: []accounts.Verdict{
+		{Account: accounts.Account{Module: "claude-code", ID: "claude-code.agent", Name: "agent", Root: true},
+			State: accounts.Unhealthy, Reason: accounts.ReasonRoot + ": in the group docker, which grants root", Since: at},
+		{Account: accounts.Account{Module: "openrazer", ID: "openrazer.account", Name: "operator",
+			Groups: []string{"openrazer"}}, State: accounts.Healthy, Since: at},
+	}}
+	h := withAccounts(healthAsReported(liveness.Statement{At: at}, nil), as)
+	if h.Contract != link.RootContract || link.RootContract != 3 {
+		t.Fatalf("contract %d", h.Contract)
+	}
+	got := map[string]string{}
+	for _, r := range h.Resources {
+		got[r.Resource] = r.Root
+	}
+	if got["claude-code.agent"] != "never" || got["openrazer.account"] != "" {
+		t.Fatalf("root said: %v", got)
+	}
+}