Skip to content

v0.18.0 — owner-signed approvals over the mesh (observe-only / dry-run, default-off)

Choose a tag to compare

View all tags
@husker husker released this 29 Jul 01:35
· 31 commits to main since this release
v0.18.0
b8aae9d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fleet-adoption release for the #62 owner-signed-approval pipeline. Every step below is off by default, log-only or dry-run, and inert on 0.17.0 nodes — the fleet adopts the wire format before any node acts on an approval.

  • Phase A (#152) — mesh approve … --broadcast distributes an owner-signed grant; a receiver verifies it against the pinned owner pubkey and logs MESH_APPROVAL_OK/BAD. No action, no nonce consumed.
  • B1 (#153) — act_on_approvals opt-in (default off, operator-only, never frame-settable); when on, logs MESH_APPROVAL_WOULD_ACT, still no action.
  • B2a (#154) — a verified adopt-release grant writes an authenticated pending-adoption record + logs MESH_ADOPT_PENDING. Receive path runs no code.
  • B2b-1 (#155) — mesh adopt-supervise (operator-run, opt-in) reads a pending record, re-verifies the owner signature, detects install type, maps the pinned artifact to the op it would run, logs MESH_ADOPT_WOULDEXEC/REFUSED. Installs nothing, cycles nothing.

The real package-manager exec (B2b-2) is a separate, operator-gated slice — not in this release.

Assets 2
Loading