Prove the operator's answers end to end before anybody uses them (hq ADR 0259) #74

Merged

mesh-admin merged 9 commits from proofs/asks-answered-on-the-phone into main 2026-10-10 12:15:06 +00:00

Conversation 1 Commits 9 Files Changed 10

+1538 -3

9 Commits

Author	SHA1	Message	Date
jschoubben	a10aeb9843	asks: move to mesh-sdk go/v0.1.10	2026-10-09 16:25:00 +02:00
jschoubben	5ebb3520ec	asks: the live acceptance says when a new link can approve, and asks through mesh-cli ... Step 3 stopped silently 16 minutes later when the Telegram account was linked less than an hour before; it now says that approvals start at the local time the router gives. The script reaches the controller through mesh-cli, the controller's terminal on the control node (hq ADR 0272).	2026-10-09 15:37:57 +02:00
jschoubben	70bc7ad3db	asks: the live acceptance reads root-not-free, and gives the bot token at the controller's terminal	2026-10-09 14:26:19 +02:00
jschoubben	086a5eb7a0	asks: move to mesh-sdk 16984aa; the proof passes on the confirmation review's fixes (9 of 9 parts, 192 s)	2026-10-09 14:12:57 +02:00
jschoubben	01a541cadf	asks: prove the reviewed flow — the controller's root-free word asked before an approval, the desk on its own account, a tap only on the words shown, the question saying who asks and what each answer does, and a rehearsal at the terminal for the live acceptance	2026-10-09 12:44:21 +02:00
jschoubben	569a9e7ae8	asks: move to mesh-sdk 76902998, where an act is named fields digested canonically	2026-10-09 12:02:39 +02:00
jschoubben	a076ccfe51	Run the proof of the operator's answers in the Go toolchain on every pull request, and say NOT RUN loudly where it cannot ... The review of 2026-10-09: the build seat runs the lab's merge-check.sh in the TypeScript toolchain, which holds no Go, so the proof never ran there. It is now a declared part of its own (mesh-check-also), run against the controller, runtime and catalogue cloned beside the lab; a missing clone or a controller without the proof's fixture is said NOT RUN in capitals instead of failing every lab change.	2026-10-09 12:02:28 +02:00
jschoubben	8d24e7bbb5	asks: a granted publish is the control for every refusal the proof reads as the bus's	2026-10-09 11:24:17 +02:00
jschoubben	3a486014fc	Prove the operator's answers end to end before anybody uses them (hq ADR 0259) ... The bus the controller composes and raises, at its commit, for one machine; the mesh's runtime serving the router and the Telegram channel on their own credentials; a fake Bot API as the phone. It links the operator's account with the code shown on the desk, refuses an approval in the hour after a link, performs an approval exactly once with who and how in the warrant and the router's record, refuses a replayed tap and a redelivered warrant, tells the operator when another account answers, drops a tap from a group, does nothing on Decline and on expiry, offers no approval while an agent can become root where the channel runs, and has the bus refuse every forged warrant, ask and tap. live-acceptance.sh is the same after rollout, with a drill the operator approves on the phone.	2026-10-09 11:08:42 +02:00