jschoubben ccc86d3594 Put the tool runner in the own group of each module whose tools it runs (hq ADR 0334 §2) ...

A joining module's own directories belong to its own group, and its tools run in the
tool runner, which could not read them. An identity may now name the tool runner's
account: the engine puts it in mesh-<module> as it puts it in a library's group,
says the change as identity:<module> for the runner's unit to restart once, takes
it back when no identity names it, and refuses an account that is missing or root's.
The engine states contract 7.

2026-10-13 00:06:29 +02:00

..

access_test.go

Give every module an identity and keep shared folders through ACL entries (hq ADR 0325, issue 567)

2026-10-12 18:43:04 +02:00

agent_home_guard_test.go

Keep main's placement guard, and refuse only an archive or a written-into file below an agent's home

2026-10-09 10:10:05 +02:00

agent_home_guard.go

Keep main's placement guard, and refuse only an archive or a written-into file below an agent's home

2026-10-09 10:10:05 +02:00

apply_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

apply.go

Put the tool runner in the own group of each module whose tools it runs (hq ADR 0334 §2)

2026-10-13 00:06:29 +02:00

archive_removal_test.go

An archive can be undeclared, and undeclaring one no longer stops the apply (hq issue 162)

2026-10-04 12:20:41 +02:00

archive_replace_test.go

Make an unpacked archive exactly the archive (novox/hq issue 220)

2026-10-04 00:17:50 +02:00

archive_unpacked.go

An archive can be undeclared, and undeclaring one no longer stops the apply (hq issue 162)

2026-10-04 12:20:41 +02:00

archive.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

block_test.go

review: rebuild a file the mesh once wrote whole, keep links, give back a missing line end, and release a hold only after the write (hq issue 128)

2026-09-27 00:09:34 +02:00

block.go

Parents the host makes inside an owner's home are the owner's (hq ADR 0182, to-be 41)

2026-10-04 04:07:40 +02:00

facts_test.go

A take is a comparison: the host's facts, former targets, and strays (hq ADR 0163)

2026-10-01 21:24:37 +02:00

file_handover_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

former_archive_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

found_is_said_test.go

Give a handed-over directory through no link on every apply, not only the first (hq issue 356, review)

2026-10-09 19:58:27 +02:00

found_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

giveback_test.go

Say in the plan that a unit is restored only if it is still as the mesh held it

2026-10-09 02:03:51 +02:00

groups_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

groups.go

Judge a granted group by number, grant nothing a group cannot write, and keep the look bounded (hq ADR 0312, issue 537 review)

2026-10-12 12:53:42 +02:00

handover_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

health_check_test.go

Judge how a module says it is ready, beside whether it stays up (hq ADR 0240, to-be 48 Phase B)

2026-10-07 14:08:32 +02:00

hold_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

hold.go

A user unit waits for its account's manager, and lingering is the account's (hq ADR 0177)

2026-10-04 12:41:32 +02:00

home_links_test.go

Read the homes in one order, so their test does not depend on a map's

2026-10-09 12:36:56 +02:00

home_links.go

Read the homes in one order, so their test does not depend on a map's

2026-10-09 12:36:56 +02:00

home_parents_test.go

Parents the host makes inside an owner's home are the owner's (hq ADR 0182, to-be 41)

2026-10-04 04:07:40 +02:00

homes_linux.go

Believe a hand-over only signed by the mesh, and give it through no link (hq issue 356, review)

2026-10-09 19:45:00 +02:00

homes_other.go

Give a mesh directory its mode and owner only through a descriptor, and gate what the walk refuses (issue 358)

2026-10-12 14:00:53 +02:00

identities_test.go

Put busybox's account removal back, test the sample, and read a held lock as kept only for a running walk (hq ADR 0328 review)

2026-10-12 22:21:42 +02:00

identities.go

Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

2026-10-12 22:11:09 +02:00

inspect_scope_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

into_handover_test.go

Leave a unit alone when another declared service still holds it (hq issue 190)

2026-10-05 22:21:21 +02:00

into_test.go

Take a key or list member the host may have written itself as the mesh's, so undeclaring gives the file back (hq ADR 0102)

2026-09-22 19:57:15 +02:00

into.go

Parents the host makes inside an owner's home are the owner's (hq ADR 0182, to-be 41)

2026-10-04 04:07:40 +02:00

judge_directories_test.go

Judge a node's directories read-only before the walk refuses any (issue 358)

2026-10-12 13:57:52 +02:00

keep.go

Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

2026-10-12 22:11:09 +02:00

left_out_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

library_linux.go

Put busybox's account removal back, test the sample, and read a held lock as kept only for a running walk (hq ADR 0328 review)

2026-10-12 22:21:42 +02:00

library_test.go

Put the tool runner in the own group of each module whose tools it runs (hq ADR 0334 §2)

2026-10-13 00:06:29 +02:00

library.go

Put the tool runner in the own group of each module whose tools it runs (hq ADR 0334 §2)

2026-10-13 00:06:29 +02:00

logging_test.go

A container may log to the journal (hq ADR 0179)

2026-10-02 17:02:49 +02:00

maintenance_window_test.go

An apply leaves a container a maintenance window holds still (hq issue 224)

2026-10-05 18:27:04 +02:00

maintenance_window.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

mesh_dirs_apply_linux.go

Give a mesh directory its mode and owner only through a descriptor, and gate what the walk refuses (issue 358)

2026-10-12 14:00:53 +02:00

mesh_dirs_gate_test.go

Give a mesh directory its mode and owner only through a descriptor, and gate what the walk refuses (issue 358)

2026-10-12 14:00:53 +02:00

mesh_dirs_linux.go

Judge a node's directories read-only before the walk refuses any (issue 358)

2026-10-12 13:57:52 +02:00

mesh_dirs_test.go

Give a mesh directory its mode and owner only through a descriptor, and gate what the walk refuses (issue 358)

2026-10-12 14:00:53 +02:00

mesh_dirs.go

Judge a node's directories read-only before the walk refuses any (issue 358)

2026-10-12 13:57:52 +02:00

mesh_names_test.go

Give every module an identity and keep shared folders through ACL entries (hq ADR 0325, issue 567)

2026-10-12 18:43:04 +02:00

mode_test.go

Refuse a declaration for the other mode, or older than the mesh's last, and say what an apply would change first

2026-09-23 23:15:28 +02:00

mode.go

Refuse a declaration for the other mode, or older than the mesh's last, and say what an apply would change first

2026-09-23 23:15:28 +02:00

opening_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

opening.go

The mesh's own ban chain is a ban wherever it hangs; the front end's record is cited as 0180 (hq ADR 0186)

2026-10-02 18:42:16 +02:00

placed.go

Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

2026-10-12 22:11:09 +02:00

placement_guard_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

placement_guard.go

Give a mesh directory its mode and owner only through a descriptor, and gate what the walk refuses (issue 358)

2026-10-12 14:00:53 +02:00

placement_homes_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

plan_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

plan.go

Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

2026-10-12 22:11:09 +02:00

process_step_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

process_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

process_witness_test.go

Roll a core build back by a witness that is not the new build (hq to-be 45 Phase 4)

2026-10-06 18:23:56 +02:00

process.go

Clear a step's success only when it was started and failed, and say updated when it passes again (novox/hq issue 467)

2026-10-11 11:12:15 +02:00

reads_test.go

Give every module an identity and keep shared folders through ACL entries (hq ADR 0325, issue 567)

2026-10-12 18:43:04 +02:00

refused_directory_test.go

Say both a gated module and a machine stop, and count skipped apart (review of #83)

2026-10-11 18:51:04 +02:00

removal_order_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

remove_file_test.go

An undeclared file is deleted only when it holds what the host wrote; otherwise moved aside (hq issue 241)

2026-10-05 01:30:42 +02:00

replay358_test.go

Give a mesh directory its mode and owner only through a descriptor, and gate what the walk refuses (issue 358)

2026-10-12 14:00:53 +02:00

restart_order_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

root_moved_test.go

Keep the walk's paths as bytes, forget a walk root superseded, and leave other mounts unread (hq issue 361 review)

2026-10-10 01:10:56 +02:00

root_moved.go

Keep the walk's paths as bytes, forget a walk root superseded, and leave other mounts unread (hq issue 361 review)

2026-10-10 01:10:56 +02:00

roots.go

Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

2026-10-12 22:11:09 +02:00

runonce_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

runtime_roots_more_test.go

Ask the running runtimes where they keep their data, and read every form a unit says it in

2026-10-09 01:22:11 +02:00

runtime_roots_test.go

Read every runtime's data root, keep when a directory was found, and key a hand-over to its resource

2026-10-09 00:55:21 +02:00

schedule_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

schedule.go

Give every module an identity and keep shared folders through ACL entries (hq ADR 0325, issue 567)

2026-10-12 18:43:04 +02:00

sealed_test.go

A user, bytes, and an archive — because most of what people install is

2026-08-30 03:22:38 +02:00

ssh_home_test.go

Say every directory used as found, let a person hand it over, and refuse the runtime's data and any .ssh

2026-10-09 00:28:01 +02:00

stateless_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

stayed_running_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

step_failed_test.go

Clear a step's success only when it was started and failed, and say updated when it passes again (novox/hq issue 467)

2026-10-11 11:12:15 +02:00

store_away_test.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

store_away.go

Let a planned maintenance window fail no apply (hq issue 291)

2026-10-07 13:11:03 +02:00

strays.go

A take is a comparison: the host's facts, former targets, and strays (hq ADR 0163)

2026-10-01 21:24:37 +02:00

takeover_test.go

review: a retired configuration that comes back is retired again on its first original, and only wg-quick's own file is ever removed (hq ADR 0119)

2026-09-27 00:55:50 +02:00

takeover.go

review: a retired configuration that comes back is retired again on its first original, and only wg-quick's own file is ever removed (hq ADR 0119)

2026-09-27 00:55:50 +02:00

testing_dirs.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

user_numeric_test.go

An owner may be a number the machine has never heard of

2026-09-01 23:45:02 +02:00

user_test.go

Refuse to take over a system account as one that never becomes root

2026-10-09 10:07:52 +02:00

user_unix.go

A user, bytes, and an archive — because most of what people install is

2026-08-30 03:22:38 +02:00

user.go

Judge a granted group by number, grant nothing a group cannot write, and keep the look bounded (hq ADR 0312, issue 537 review)

2026-10-12 12:53:42 +02:00

userscope_test.go

Pass -- before every unit, and give a unit back only when it is exactly as the mesh held it

2026-10-09 01:54:26 +02:00

vocabulary_test.go

Give every module an identity and keep shared folders through ACL entries (hq ADR 0325, issue 567)

2026-10-12 18:43:04 +02:00

walk_linux.go

Give no account a home, keep old data's sub-paths for the warrant, and never hand out setgid (hq ADR 0328 review)

2026-10-12 22:18:16 +02:00

walk_other.go

Keep a root without asking only when its data beneath is the library's already (hq ADR 0328 §7)

2026-10-12 22:14:10 +02:00

walk.go

Give no account a home, keep old data's sub-paths for the warrant, and never hand out setgid (hq ADR 0328 review)

2026-10-12 22:18:16 +02:00

whole_test.go

A file written over is given its kept original back when undeclared (hq ADR 0118, 0102)

2026-10-04 12:54:16 +02:00

whole.go

An undeclared file is deleted only when it holds what the host wrote; otherwise moved aside (hq issue 241)

2026-10-05 01:30:42 +02:00