Read the session record strictly, and make its tests hold (hq ADR 0272) #72

Merged

mesh-admin merged 1 commits from fix/272-the-session-record-read-strictly into main 2026-10-09 12:12:12 +00:00

Conversation 2 Commits 1 Files Changed 2

+54 -12

mesh-admin commented 2026-10-09 12:06:03 +00:00

Contributor

Copy Link

Copy Source

Follow-up to #71 (review of hq ADR 0272).

• First occurrence. UID, CLASS and SCOPE are read at their first occurrence in /run/systemd/sessions/<id>; a later line saying otherwise is not the record's word.
• Private format, said. A comment: the record is systemd's private format, not a promised interface; a systemd that changes it, renames a key or stops writing the file fails closed (no session, so nobody is the terminal).
• Tests that hold. Each was checked by taking out what it guards and seeing it fail:
  • the record's UID check alone: UID=1001, SCOPE=session-8.scope under user-1000.slice, asked as uid 1000 → refused (TestALoginSessionIsAUsersByItsOwnRecord);
  • the id's characters alone: session-a.b.scope with a record that would otherwise pass, and session-...scope → refused;
  • below a scope alone: session-9.scope/x.scope → refused by the direct-child check (TestTheLoginSessionAskingIsReadFromTheKernel);
  • first occurrence: a key said twice, either way round;
  • read at accept: the client sends its line only after the session was read, so moving the read into the forward fails TestTheSessionIsReadBeforeTheLine (3 s wait, then fail).
  • session-9.scope (taken) and x.scope (refused) stay.

merge-check.sh passes locally on main + this.

Follow-up to #71 (review of hq ADR 0272). - **First occurrence.** `UID`, `CLASS` and `SCOPE` are read at their first occurrence in `/run/systemd/sessions/<id>`; a later line saying otherwise is not the record's word. - **Private format, said.** A comment: the record is systemd's private format, not a promised interface; a systemd that changes it, renames a key or stops writing the file fails closed (no session, so nobody is the terminal). - **Tests that hold.** Each was checked by taking out what it guards and seeing it fail: - the record's UID check alone: `UID=1001`, `SCOPE=session-8.scope` under `user-1000.slice`, asked as uid 1000 → refused (`TestALoginSessionIsAUsersByItsOwnRecord`); - the id's characters alone: `session-a.b.scope` with a record that would otherwise pass, and `session-...scope` → refused; - below a scope alone: `session-9.scope/x.scope` → refused by the direct-child check (`TestTheLoginSessionAskingIsReadFromTheKernel`); - first occurrence: a key said twice, either way round; - read at accept: the client sends its line only after the session was read, so moving the read into the forward fails `TestTheSessionIsReadBeforeTheLine` (3 s wait, then fail). - `session-9.scope` (taken) and `x.scope` (refused) stay. `merge-check.sh` passes locally on main + this.

mesh-admin added 1 commit 2026-10-09 12:06:03 +00:00

Read the session record strictly, and make its tests hold (hq ADR 0272) ... b1e7b6d26e

- UID, CLASS and SCOPE are read at their first occurrence: logind writes
  each once, and a later line saying otherwise is not the record's word.
- A comment says /run/systemd/sessions is systemd's private format, and
  that a format change fails closed: no session, so nobody is the terminal.
- Tests that hold, each proved by the mutation it guards failing:
  - a record naming UID=1001 for session-8.scope under user-1000.slice,
    asked as uid 1000 (the record's UID check alone);
  - session-a.b.scope with a passing record (the id's characters alone);
  - session-9.scope/x.scope (the scope being the slice's direct child);
  - a key said twice, either way round (first occurrence);
  - the client sends its line only after the session was read, so reading
    the session in the forward fails the test.

mesh-admin commented 2026-10-09 12:06:14 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-host@b1e7b6d26ebd — delivered since 2026-10-09T12:19:08Z

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

• tier 0: mesh-host
• ace: receives mesh-host
• g14: receives mesh-host
• novox: receives mesh-host
• shanks: receives mesh-host

Machines

• mesh-host on ace: passed — healthy 3 times over 2m59s
• mesh-host on the rest running it: sent

Transitions

• 2026-10-09 12:06 (new) → proposed (announced): novox/mesh-host#72's head announced
• 2026-10-09 12:08 proposed → checked (checked): the verdict names this commit
• 2026-10-09 12:08 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-09 12:12 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-09 12:12 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
• 2026-10-09 12:19 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-host@b1e7b6d26ebd` — **delivered** since 2026-10-09T12:19:08Z **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host **Machines** - mesh-host on ace: passed — healthy 3 times over 2m59s - mesh-host on the rest running it: sent **Transitions** - 2026-10-09 12:06 (new) → proposed (announced): novox/mesh-host#72's head announced - 2026-10-09 12:08 proposed → checked (checked): the verdict names this commit - 2026-10-09 12:08 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-09 12:12 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-09 12:12 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-09 12:19 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented 2026-10-09 12:08:11 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at b1e7b6d2

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)
• mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

• tier 0: mesh-host
• ace: receives mesh-host
• g14: receives mesh-host
• novox: receives mesh-host
• shanks: receives mesh-host

Run by the build seat on shanks as build-1791547572015816170 (builds --log build-1791547572015816170).

--- the gate: mesh-host
mesh-host: ok
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T12:05:01Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T12:05:01Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.014s
ok  	github.com/novox/mesh-host/cmd/mesh-host	5.372s
ok  	github.com/novox/mesh-host/examples	1.018s
ok  	github.com/novox/mesh-host/internal/accounts	1.023s
ok  	github.com/novox/mesh-host/internal/apply	4.759s
ok  	github.com/novox/mesh-host/internal/bootstrap	1.658s
ok  	github.com/novox/mesh-host/internal/bundle	1.036s
ok  	github.com/novox/mesh-host/internal/declaration	1.088s
ok  	github.com/novox/mesh-host/internal/firewall	1.855s
ok  	github.com/novox/mesh-host/internal/identity	1.181s
ok  	github.com/novox/mesh-host/internal/image	1.043s
ok  	github.com/novox/mesh-host/internal/inventory	1.053s
ok  	github.com/novox/mesh-host/internal/link	10.349s
ok  	github.com/novox/mesh-host/internal/liveness	2.144s
ok  	github.com/novox/mesh-host/internal/meshcli	1.351s
ok  	github.com/novox/mesh-host/internal/network	1.101s
ok  	github.com/novox/mesh-host/internal/outward	1.054s
ok  	github.com/novox/mesh-host/internal/profile	1.534s
ok  	github.com/novox/mesh-host/internal/reachable	1.042s
ok  	github.com/novox/mesh-host/internal/store	1.275s
ok  	github.com/novox/mesh-host/internal/system	1.048s
ok  	github.com/novox/mesh-host/internal/tunnel	1.049s
ok  	github.com/novox/mesh-host/internal/units	1.033s
ok  	github.com/novox/mesh-host/internal/upgrade	1.208s
ok  	github.com/novox/mesh-host/internal/witness	4.843s
ok  	github.com/novox/mesh-host/packaging	1.042s
?   	github.com/novox/mesh-host/rootsearch	[no test files]
ok  	github.com/novox/mesh-host/validate	1.040s

**Merge check** at `b1e7b6d2` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host Run by the build seat on shanks as `build-1791547572015816170` (`builds --log build-1791547572015816170`). ``` --- the gate: mesh-host mesh-host: ok long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T12:05:01Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T12:05:01Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-host --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.014s ok github.com/novox/mesh-host/cmd/mesh-host 5.372s ok github.com/novox/mesh-host/examples 1.018s ok github.com/novox/mesh-host/internal/accounts 1.023s ok github.com/novox/mesh-host/internal/apply 4.759s ok github.com/novox/mesh-host/internal/bootstrap 1.658s ok github.com/novox/mesh-host/internal/bundle 1.036s ok github.com/novox/mesh-host/internal/declaration 1.088s ok github.com/novox/mesh-host/internal/firewall 1.855s ok github.com/novox/mesh-host/internal/identity 1.181s ok github.com/novox/mesh-host/internal/image 1.043s ok github.com/novox/mesh-host/internal/inventory 1.053s ok github.com/novox/mesh-host/internal/link 10.349s ok github.com/novox/mesh-host/internal/liveness 2.144s ok github.com/novox/mesh-host/internal/meshcli 1.351s ok github.com/novox/mesh-host/internal/network 1.101s ok github.com/novox/mesh-host/internal/outward 1.054s ok github.com/novox/mesh-host/internal/profile 1.534s ok github.com/novox/mesh-host/internal/reachable 1.042s ok github.com/novox/mesh-host/internal/store 1.275s ok github.com/novox/mesh-host/internal/system 1.048s ok github.com/novox/mesh-host/internal/tunnel 1.049s ok github.com/novox/mesh-host/internal/units 1.033s ok github.com/novox/mesh-host/internal/upgrade 1.208s ok github.com/novox/mesh-host/internal/witness 4.843s ok github.com/novox/mesh-host/packaging 1.042s ? github.com/novox/mesh-host/rootsearch [no test files] ok github.com/novox/mesh-host/validate 1.040s ```

mesh-admin merged commit 7a2ffc0a4c into main 2026-10-09 12:12:12 +00:00

mesh-admin deleted branch fix/272-the-session-record-read-strictly 2026-10-09 12:12:12 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

jschoubben miel.truyen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#72