Decision — the Bus is open to every caller
Status: accepted 2026-10-26. Replaces Macro-file write authority (2026-10-24) and amends hostd, the host service (2026-10-12).
The decision
- Every Bus command answers every caller. An agent can do over the Bus anything a person can do at the keyboard, in every app and service, on every node. No command refuses a request because of who sent it (service name, account, uid, grant, operator list, allowlist) or where it came from (local or mesh, Bus or keyboard, drive input or a real click).
- There is no strict mode.
MIXOS_MESH_OPEN=0and every posture it switched are removed. The open posture is the only one. - Macro files are ordinary Bus state.
<app>.macros.put,remove,move,copyandnewaccept any caller, global and cross-app writes included. Workshop'sworkshop.macros.*,workshop.executeandworkshop.callforward them without a gate. - Workshop and the apps' windows add nothing a caller lacks. Workshop's window is a convenience, not an authority.
- File managers and panels act on Bus requests. Dopus runs
file.*actions and accepts its dialogs from the Bus and from drive input, as from the keyboard. The volume and network panels take changes from any caller. - Node-local answers are gone. notifyd answers and dismisses, and portald answers screen-share consent, for callers on any node.
- Operator lists are gone. maild and webd commands that named operators (vtokens, retention, Bayesian rebuild, listeners, TLS reload) accept any caller; property namespaces grant every capability to every caller.
- The broker opens its own commands.
noded.observe.startandnoded.tapaccept any caller on any node; native-session traffic may cross nodes.
hostd
hostd's writes are open to every caller on the same host, over the
local Bus or its Unix socket, with no grant file. Writes from another node
stay refused: a compromised node must not be able to rewrite every host's
network. hostd keeps what makes a write safe rather than who may make it:
typed commands, no generic exec, health checks with automatic revert,
receipts for hostd.undo, rate limits and freeze.
Consequences, accepted with the decision
- hostd's mesh refusal covers the direct Bus path only. Term, the pane shell and the scenes act for mesh callers, and they reach hostd as local callers. A caller on another node can therefore change a host through them. Rate limits, health-check revert and receipts bound it.
- Any caller on a host may thaw hostd.
freezestops mesh callers, not a local agent. - Secrets are readable from any node. Property reads return secret
fields to every caller, and
noded.tapmirrors traffic unredacted. - Anonymous callers are told apart by connection. The broker stamps
every request with its connection, so callers with no registered name
never share a replay or rate namespace. The exception is editd's
op_id: it exists to make a retry after a reconnect safe, so it is shared by all anonymous callers, and each picks unique ids.
What stays
These checks prove where a request came from or keep state consistent. They refuse no honest caller:
- The broker stamps every request with its origin and sender; a request with no stamp is malformed.
- A local request may not carry mesh provenance fields (forged origin).
- A topic is published by the service that owns it, so a settings change on the Bus is always settingsd's.
- A session record is changed by the account that owns it.
- A node joins the mesh only through admission.
- Argument validation, size and rate limits, freshness and replay checks, path containment, and read-only built-in files.
Why
An LLM has no hands. Every job an agent performs, it performs through the Bus, so every gate that tells an agent "only a person, only Workshop, only this node" is a job the agent cannot do. MixOS is agentic-first and default-open (ADR §1.9). Gates that defended against other processes of the same user, or against the user's own mesh, protected nothing and blocked the agents.