4 Commits

Include renames

Author	SHA1	Message	Date
jochen	4a5dcb0209	Say the login session a mesh-cli line comes from, and pin the SDK at go/v0.1.9 (hq ADR 0272) ... A service running as the operator — the tool runner, a unit of the account's user manager — shares the operator's user id, and was as much the terminal on the control-node as a person typing. The engine now reads the asking process's cgroup and sends its login session's scope (session-<id>.scope under the account's own user-<uid>.slice), or nothing; the controller makes nothing else the terminal. The SDK is pinned at its tag now that go/v0.1.9 exists.	2026-10-09 13:40:17 +02:00
jochen	f684967c3b	Merge main, and close what the confirmation review found (hq ADR 0272) ... - Any failure of a request the link may have delivered now says the line may have run; "nothing ran" is said only of a request the link knows it never asked (no link open, nobody listening: link.ErrNotAsked). - A test holds that a connection saying nothing is answered within its deadline, set at accept, and gives its slot back. - The README says the socket refuses a process outside the machine's own namespaces, so flatpak, toolbox and distrobox shells are refused.	2026-10-09 13:09:48 +02:00
jochen	564948c2f2	mesh-cli: follow a line to its answer, bound each account, refuse other namespaces (review of hq ADR 0272) ... - A request that timed out was said as "the controller was not reached, nothing ran", though the line may have run. The engine now follows a line the controller answers as running, by its call, until it ends; when no answer comes in time it says the line may have run and names the call. "Nothing ran" is said only of a request no controller took. - One account could hold the socket: accepting waited for a free slot, and a connection could stall before its deadline was set. The deadline is set at accept, before any lookup; each user id has two lines at once and the machine eight, and one over is answered busy at once. - A container running with the operator's user id shares the number, not the machine: a peer whose mount or user namespace is not the engine's is refused, and nothing is asked. SDK pinned at the go/cli branch's newest commit until go/v0.1.9 is tagged.	2026-10-09 12:48:20 +02:00
jochen	021d860ca4	Vouch for the account that runs mesh-cli, and ask the controller its line (hq ADR 0272) ... The records send the operator to "the controller's terminal", and nothing reaches it (hq issue 343). mesh-cli holds no credential: it asks the engine on its own machine over a socket. The engine reads the asking account from the kernel (SO_PEERCRED), never from the program, and asks the controller on mesh.control.<node>.cli, its own node's subject, so the bus server says which node asked. The controller decides what the line may do; nothing received on the socket is run or applied here, and the socket has no network address (ADR 0004 stands). The local protocol is the SDK's go/cli package, at a pseudo-version of its branch until that merges and is tagged go/v0.1.8.	2026-10-09 12:05:53 +02:00