diff options
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 9f045c4..d1630f0 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1468,6 +1468,19 @@ issues invitations and reads the audit log. There is no server-rendered dashboar the desktop client's Node page and the CLI are the two consumers, and each operation endpoint is one `_op(...)` line onto `ops.py` (§5.4). +**Over MNP, the node's own controls need a proved operator device.** The +node-wide surface — `node_status`, which lists every group on the machine with +each root's absolute path, plus `node_settings_set`, `roster_read`, +`denylist_read`, `denylist_clear` and `node_reload` — is reachable when two +things hold: the account is the one the node belongs to, *and* the device on the +connection has proved (`device_hello`, §3.3) a key the roster holds as an +operator. The first alone is a claim in a token the hub issued, and **NS4** does +not allow it to be authority: a hub that can name the operator is a hub that can +be one. The second is what it cannot forge, since it holds no user keys and +cannot countersign a device — the same property device linking rests on. A +browser that has never been paired therefore reads nothing here, exactly as it +can already sign nothing (§5.4). + **The accepted cost, recorded as a choice:** on a headless server the only admin path is the CLI. The CLI covers every operation, so this is acceptable — but it is a real capability reduction, not an oversight. |