5 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	f81e6147ae	Revert L3 (mesh-host, merge 0a4c35f): its node-engine removed every held module on novox, the bus server among them, at 08:54 CET on 2026-10-29 (issue 774) ... L3 lands again with two fixes: a held module is never removed, and the grants cover L3's new subjects.	2026-10-29 09:42:29 +01:00
jschoubben	81fa009bf4	The node seat's acts and the engine's own asks are the node-engine's declared state acts on the bus: one key each under its own node's keys, written by compare-and-set, one ask open per path made by a create; acts reads one by its id (issue 774, ADR 0563 §2, §3)	2026-10-28 20:35:33 +01:00
jschoubben	aaffc19232	The node seat node-engine served on the engine's link: its verbs with their proven caller, its acts kept in its own state, a hand-over or access act asked of the operator as node-engine-<node> and performed only on the warrant (issue 774, ADR 0563 §1-§3)	2026-10-28 20:35:33 +01:00
jschoubben	aad33dfe5c	Give the controller the contract it can fill (hq ADR 0325, issue 567) ... The controller cannot know the operator's account's uid, names an access by its declared id (which holds a slash), and should not parse words. A tool runner's account may now come by name alone and is read here (refused when absent or root's, its uid said in the access's listing); the take act matches the declared id exactly; an access wait says its reason (keep or disk) and, for a filesystem that refuses ACLs, whether the take act can enable them.	2026-10-12 19:51:09 +02:00
jschoubben	51e97a8c14	Give every module an identity and keep shared folders through ACL entries (hq ADR 0325, issue 567) ... A module's containers ran as whatever their image chose and shared folders were made writable by putting accounts in the folder's group (ADR 0312), which ADR 0325 supersedes. The engine now makes each declared module identity as a system account with the controller's numbers, runs a container declaring `identity` as it, and keeps each placed shared folder usable through one POSIX ACL entry per user, set through the kernel's xattrs on descriptors it opened itself. A folder holding data is kept only after the operator's warrant (the take act); a missing folder is made where its data lives and waits where its disk is not; root's data is never kept. A watch and a bounded sweep put back what an app narrows. The group grant is removed, and what it put an account in is taken back. Reuses the descriptor walks, the create act, the missing-path wait and the warrant- backed act message from the paused issue 567 branch.	2026-10-12 18:43:04 +02:00