The host mounts an operator-owned path and owns nothing (ADR 0051) #4

2026-09-05T20:48:00Z

jschoubben commented

2026-09-05 20:48:00 +00:00

Implements ADR 0051's host half. Adds a tenth vocabulary shape, access: the applier confirms the path is present (reports no change), refuses clearly if absent ("the operator must provide it… does not own"), and never creates/chowns/reconciles it; removal is forgotten (never touches the path). Updates the two vocabulary-guard tests (9→10, backed by ADR 0051) and adds access to full-host everyShape. Three unit tests (present-confirmed, absent-refused-not-created, undeclared-left-alone); full go test ./... green.

https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

Implements ADR 0051's host half. Adds a tenth vocabulary shape, `access`: the applier confirms the path is present (reports no change), refuses clearly if absent ("the operator must provide it… does not own"), and never creates/chowns/reconciles it; removal is forgotten (never touches the path). Updates the two vocabulary-guard tests (9→10, backed by ADR 0051) and adds `access` to full-host `everyShape`. Three unit tests (present-confirmed, absent-refused-not-created, undeclared-left-alone); full `go test ./...` green. https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

jschoubben added 1 commit 2026-09-05 20:48:00 +00:00

declaration: an access is mounted, and the host owns nothing about it f06eea5fa3

The tenth shape (novox/hq ADR 0051). Shared, pre-existing data — a media
library, a download spool several modules use — is the operator's, not
the mesh's. A `directory` resource is the host's own: it creates it,
chowns it, sets its mode and removes it when empty. An access is the
opposite on every axis.

Add the `access` type to the vocabulary. Its applier confirms the path is
present and changes nothing: it does not create, chown, reconcile or set
a mode. Absent is refused clearly — the operator must provide it — rather
than created, because a bind mount whose source is missing is made as
root by the container runtime with the wrong ownership (04-ISSUES/026).
Undeclaring an access forgets the record and never touches the path,
which is the data loss ADR 0030 prevents, on a directory the mesh never
made.

Full hosts speak it (it gates a bind mount, which needs the container
runtime); the vocabulary guard test records the decision that made it the
tenth shape. Unit tests cover present, absent-refused, and
undeclared-left-alone.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

jschoubben merged commit 91e0d6a4c7 into main

2026-09-05 20:48:14 +00:00

jschoubben deleted branch feat/mount-operator-owned

2026-09-05 20:48:14 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#4