3 Commits

Include renames

Author	SHA1	Message	Date
jochen	8e79403c21	Show how far the setuid search got, and start a fresh one when the terminal asks (hq issue 361) ... The walk kept its progress every minute and nobody could read it: root-free said only that a search ran. The account verdict now carries the progress (counts, times, mount points; never a path) as fields and in its reason, outside what makes a verdict changed. A signed ask from the controller's terminal throws the last search away and starts a full one, after the operator removed by hand what it found.	2026-10-10 01:55:58 +02:00
jochen	fc6c5a92e6	Believe a hand-over only signed by the mesh, and give it through no link (hq issue 356, review) ... Two holes the review proved. The ask's subject proved nothing — a responder can reach it through a reply — so the engine now verifies the mesh's signature over a fixed context with the key it verifies declarations with, before reading anything, and refuses an ask for another node, expired, good too long, without a nonce, or replayed. And the apply followed a link the hand-over had refused: a component swapped for a link after the record carried root's chmod and chown to its target. A handed-over directory must now still resolve to itself, and is changed only through one descriptor opened from / with no link followed (fchmod, fchown). Tests for the reply guard, the run loop's hook, the fallback renewal on proof and a non-regular fallback; 27 checks each removed in turn, each failing a test.	2026-10-09 19:45:00 +02:00
jochen	e74ee82a76	Renew the engine placed by hand to the proved build, and take a hand-over from the controller's terminal (hq issue 356) ... The file on PATH was the engine a person copied at installation, and every delivered engine ran from the versions directory: the operator typed hand-over and a build from before it answered "unexpected argument". A proved engine now copies itself over that file when the bytes differ (never a link). And the hand-over of a directory used as found (issue 339) gets its channel: the controller's terminal asks this node's engine on mesh.node.<node>.ask.hand-over; the engine judges every value — the ask's size and shape, who asked, the path as it states it, a directory and no link, through no link — and records it or refuses and records nothing. Every text the engine addresses to the operator names the nox line (ADR 0272); the engine's own subcommands are install-time and rescue, and its usage says so.	2026-10-09 18:34:10 +02:00