jochen 5fc37b44a9 Follow no link below a home as root, and judge more ways to root ...

An account could replace ~/.claude with a link to /etc and have the
node-engine chown, chmod or write through it on the next apply. Below a
person's or an agent's home every component is now opened without
following a link, and a link refuses the resource in words.

The root judge also reads doas and polkit rules, the container runtimes'
sockets with their ACLs, ACLs on the secrets, and setuid-root programs no
package owns, in the C locale; Judged and NotJudged write down exactly
what it covers (hq ADR 0266 review).

2026-10-08 20:36:46 +02:00

..

access_test.go

declaration: an access is mounted, and the host owns nothing about it

2026-09-05 22:19:33 +02:00

apply_test.go

Carry the controller's new self-check grant; stop telling people to delete kept data (hq ADR 0233)

2026-10-06 16:47:49 +02:00

apply.go

Follow no link below a home as root, and judge more ways to root

2026-10-08 20:36:46 +02:00

archive_removal_test.go

An archive can be undeclared, and undeclaring one no longer stops the apply (hq issue 162)

2026-10-04 12:20:41 +02:00

archive_replace_test.go

Make an unpacked archive exactly the archive (novox/hq issue 220)

2026-10-04 00:17:50 +02:00

archive_unpacked.go

An archive can be undeclared, and undeclaring one no longer stops the apply (hq issue 162)

2026-10-04 12:20:41 +02:00

archive.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

block_test.go

review: rebuild a file the mesh once wrote whole, keep links, give back a missing line end, and release a hold only after the write (hq issue 128)

2026-09-27 00:09:34 +02:00

block.go

Parents the host makes inside an owner's home are the owner's (hq ADR 0182, to-be 41)

2026-10-04 04:07:40 +02:00

facts_test.go

A take is a comparison: the host's facts, former targets, and strays (hq ADR 0163)

2026-10-01 21:24:37 +02:00

file_handover_test.go

Hand a whole file to its new owner instead of removing it first (hq ADR 0223)

2026-10-05 23:35:40 +02:00

former_archive_test.go

An archive can be undeclared, and undeclaring one no longer stops the apply (hq issue 162)

2026-10-04 12:20:41 +02:00

found_test.go

A user unit waits for its account's manager, and lingering is the account's (hq ADR 0177)

2026-10-04 12:41:32 +02:00

groups_test.go

Give back only the groups the mesh added, and say when a new login is needed (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

groups.go

Give back only the groups the mesh added, and say when a new login is needed (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

handover_test.go

Hand a replaced resource over to the process that replaces it (hq issue 213)

2026-10-04 01:01:52 +02:00

health_check_test.go

Judge how a module says it is ready, beside whether it stays up (hq ADR 0240, to-be 48 Phase B)

2026-10-07 14:08:32 +02:00

hold_test.go

A take is a comparison: the host's facts, former targets, and strays (hq ADR 0163)

2026-10-01 21:24:37 +02:00

hold.go

A user unit waits for its account's manager, and lingering is the account's (hq ADR 0177)

2026-10-04 12:41:32 +02:00

home_links_test.go

Follow no link below a home as root, and judge more ways to root

2026-10-08 20:36:46 +02:00

home_links.go

Follow no link below a home as root, and judge more ways to root

2026-10-08 20:36:46 +02:00

home_parents_test.go

Parents the host makes inside an owner's home are the owner's (hq ADR 0182, to-be 41)

2026-10-04 04:07:40 +02:00

homes_linux.go

Follow no link below a home as root, and judge more ways to root

2026-10-08 20:36:46 +02:00

homes_other.go

Follow no link below a home as root, and judge more ways to root

2026-10-08 20:36:46 +02:00

inspect_scope_test.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

into_handover_test.go

Leave a unit alone when another declared service still holds it (hq issue 190)

2026-10-05 22:21:21 +02:00

into_test.go

Take a key or list member the host may have written itself as the mesh's, so undeclaring gives the file back (hq ADR 0102)

2026-09-22 19:57:15 +02:00

into.go

Parents the host makes inside an owner's home are the owner's (hq ADR 0182, to-be 41)

2026-10-04 04:07:40 +02:00

left_out_test.go

The mesh's own ban chain is a ban wherever it hangs; the front end's record is cited as 0180 (hq ADR 0186)

2026-10-02 18:42:16 +02:00

logging_test.go

A container may log to the journal (hq ADR 0179)

2026-10-02 17:02:49 +02:00

maintenance_window_test.go

An apply leaves a container a maintenance window holds still (hq issue 224)

2026-10-05 18:27:04 +02:00

maintenance_window.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

mesh_names_test.go

A container's mesh names are part of what it is

2026-09-28 17:19:38 +02:00

mode_test.go

Refuse a declaration for the other mode, or older than the mesh's last, and say what an apply would change first

2026-09-23 23:15:28 +02:00

mode.go

Refuse a declaration for the other mode, or older than the mesh's last, and say what an apply would change first

2026-09-23 23:15:28 +02:00

opening_test.go

The mesh's own ban chain is a ban wherever it hangs; the front end's record is cited as 0180 (hq ADR 0186)

2026-10-02 18:42:16 +02:00

opening.go

The mesh's own ban chain is a ban wherever it hangs; the front end's record is cited as 0180 (hq ADR 0186)

2026-10-02 18:42:16 +02:00

plan_test.go

review: a unit whose file the mesh wrote is stopped when undeclared, and what was found survives a failed first apply (hq ADR 0118)

2026-09-27 00:41:02 +02:00

plan.go

Hand a whole file to its new owner instead of removing it first (hq ADR 0223)

2026-10-05 23:35:40 +02:00

process_step_test.go

Run a run-once process as its oneshot unit (novox/hq design 38 WP4c)

2026-10-04 00:29:03 +02:00

process_test.go

A process runs its own bundle's binary, written ./name (hq ADR 0193)

2026-10-03 21:13:55 +02:00

process_witness_test.go

Roll a core build back by a witness that is not the new build (hq to-be 45 Phase 4)

2026-10-06 18:23:56 +02:00

process.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

reads_test.go

Look at what a container mounts directly, accept a pre-upgrade label, and write the genesis secret without a newline

2026-09-23 23:40:27 +02:00

remove_file_test.go

An undeclared file is deleted only when it holds what the host wrote; otherwise moved aside (hq issue 241)

2026-10-05 01:30:42 +02:00

restart_order_test.go

Restart a service only after every file it names is written (hq issue 260)

2026-10-05 21:55:47 +02:00

runonce_test.go

A resource's owner is read to the last dot, because a module's name may contain one

2026-09-28 15:44:59 +02:00

schedule_test.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

schedule.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

sealed_test.go

A user, bytes, and an archive — because most of what people install is

2026-08-30 03:22:38 +02:00

stateless_test.go

A service may omit its state, so unassigning an uplink module never stops the machine's network manager (hq ADR 0117)

2026-09-27 00:11:58 +02:00

stayed_running_test.go

The mesh's own ban chain is a ban wherever it hangs; the front end's record is cited as 0180 (hq ADR 0186)

2026-10-02 18:42:16 +02:00

store_away_test.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

store_away.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

strays.go

A take is a comparison: the host's facts, former targets, and strays (hq ADR 0163)

2026-10-01 21:24:37 +02:00

takeover_test.go

review: a retired configuration that comes back is retired again on its first original, and only wg-quick's own file is ever removed (hq ADR 0119)

2026-09-27 00:55:50 +02:00

takeover.go

review: a retired configuration that comes back is retired again on its first original, and only wg-quick's own file is ever removed (hq ADR 0119)

2026-09-27 00:55:50 +02:00

testing_dirs.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

user_numeric_test.go

An owner may be a number the machine has never heard of

2026-09-01 23:45:02 +02:00

user_test.go

Cite hq issue 228: 225 was taken on main while this branch was open

2026-10-04 10:30:57 +02:00

user_unix.go

A user, bytes, and an archive — because most of what people install is

2026-08-30 03:22:38 +02:00

user.go

Follow no link below a home as root, and judge more ways to root

2026-10-08 20:36:46 +02:00

userscope_test.go

A user unit waits for its account's manager, and lingering is the account's (hq ADR 0177)

2026-10-04 12:41:32 +02:00

vocabulary_test.go

the spec names the resolver and the address

2026-09-25 23:51:30 +02:00

whole_test.go

A file written over is given its kept original back when undeclared (hq ADR 0118, 0102)

2026-10-04 12:54:16 +02:00

whole.go

An undeclared file is deleted only when it holds what the host wrote; otherwise moved aside (hq issue 241)

2026-10-05 01:30:42 +02:00