Module host_node_admin 

Node-admin methods on the workload.ctl wire (dashboard.status, dashboard.token.rotate): the same signed envelope, controller-key check, expiry and nonce replay guard as every other method, answered by a hook the daemon installs instead of by a workload adapter.

Trust is the host’s own: only a key in this node’s controller list reaches the hook at all (workload-host.json), and the hook may refuse further. Both ends chain the call (node_admin.request / node_admin.result) with the method, the requester and the outcome, never the body or any secret.

Constants

EVENT_NODE_ADMIN_REQUEST

Chain kind of an accepted node-admin request on the target.

EVENT_NODE_ADMIN_RESULT

Chain kind of its outcome.

Traits

NodeAdmin

What a node does when an authorised controller asks it to run a node-admin method. The result is returned to the controller verbatim, so it must not contain secrets.