novox/hq
18
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Design 51: cite ADR 0617 for the unnumbered-first image and hold; narrow hold to what the sweep keeps, never an image

Browse Source 
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
This commit is contained in:
jschoubben
2026-11-04 00:12:24 +01:00
parent 0ae7fc2e57
commit 0168a545c5
1 changed files with 17 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md
+17 -11
View File
@@ -15,6 +15,7 @@ decisions:
- "ADR 0612" - "ADR 0612"
- "ADR 0614" - "ADR 0614"
- "ADR 0613" - "ADR 0613"
- "ADR 0617"
- "ADR 0606" - "ADR 0606"
- "ADR 0607" - "ADR 0607"
- "ADR 0610" - "ADR 0610"
@@ -72,8 +73,8 @@ named, without a holder, until a build module publishes cargo packages.
**One contract, a seat definition** (design 26, *A seat's definition*). Verbs: `publish`, `publish-part` (ADR 0611), `versions`, `remove` (a **One contract, a seat definition** (design 26, *A seat's definition*). Verbs: `publish`, `publish-part` (ADR 0611), `versions`, `remove` (a
tagged version; the holder itself refuses `remove` of a version with no tag, but for the retention removal below), and tagged version; the holder itself refuses `remove` of a version with no tag, but for the retention removal below), and
on `container-image-registry` `mirror` and `tags`; the two seats `distribution` holds add `hold`, for the artifact on `container-image-registry` `mirror` and `tags`; the two seats `distribution` holds add `hold` and its release,
sweep. The five seats this milestone changes, these four and `mesh-broker`, are defined whole, their contracts moved with the events `held` and `released`, for the artifact sweep (ADR 0617 §2). The five seats this milestone changes, these four and `mesh-broker`, are defined whole, their contracts moved
into `mesh-contracts` (ADR 0613 §1; design 26). Events: `published`, `refused` (added to ADR 0605 §2's two, additively) and `removed`, each into `mesh-contracts` (ADR 0613 §1; design 26). Events: `published`, `refused` (added to ADR 0605 §2's two, additively) and `removed`, each
carrying the name, version, kind, tag, digest, fingerprint, commit and holder, and `refused` its reason; each seat's carrying the name, version, kind, tag, digest, fingerprint, commit and holder, and `refused` its reason; each seat's
events are its own family, `<seat>.events`, kept seven days. A holder stores events are its own family, `<seat>.events`, kept seven days. A holder stores
@@ -83,8 +84,9 @@ under the version it is given and counts nothing.
form ADR 0363 gives a restricted family: `publish` and `publish-part` the build modules, and a part only from the form ADR 0363 gives a restricted family: `publish` and `publish-part` the build modules, and a part only from the
proved caller that opened its transfer; `mirror` mesh-build-image; `remove` the builder, for a tagged version, and the proved caller that opened its transfer; `mirror` mesh-build-image; `remove` the builder, for a tagged version, and the
holder of the artifact sweep, for an untagged bundle, archive or copied base with the reason retention (ADR 0610 §3); holder of the artifact sweep, for an untagged bundle, archive or copied base with the reason retention (ADR 0610 §3);
`hold` (on the two seats `distribution` holds: keep one held thing from removal, and let it go again) the holder of `hold` (on the two seats `distribution` holds: keep one untagged bundle, archive or copied base that the artifact
the artifact sweep alone. Every removal, whoever asked it, emits `removed` with its reason. sweep's rules keep from removal by retention, and let it go again; never an image of its own) the module that runs
the artifact sweep alone (ADR 0617 §2). Every removal, whoever asked it, emits `removed` with its reason.
Declaring `invokes` alone grants nothing. The holder checks the caller identity the tool runner proved and stamps on Declaring `invokes` alone grants nothing. The holder checks the caller identity the tool runner proved and stamps on
the request (design 25 § 12.4), never a name in the request's body, and answers any other caller with a refusal naming the request (design 25 § 12.4), never a name in the request's body, and answers any other caller with a refusal naming
the verb. the verb.
@@ -192,10 +194,12 @@ the verb.
pseudo-version a consumer requires (the indexer's tool `indexer_requirements`). The builder numbers nothing for that pseudo-version a consumer requires (the indexer's tool `indexer_requirements`). The builder numbers nothing for that
name until all three answered (ADR 0606 §3), and writes a finding naming the silent one meanwhile, cleared once all name until all three answered (ADR 0606 §3), and writes a finding naming the silent one meanwhile, cleared once all
three answer. Today that gives Go `v0.1.14` and npm `0.1.18`; a name with none starts at `0.1.0`. three answer. Today that gives Go `v0.1.14` and npm `0.1.18`; a name with none starts at `0.1.0`.
- **An unknown floor does not stall the build of an image, bundle or archive.** The floor of `distribution`'s own - **An unknown floor does not stall the build of an image, bundle or archive** (ADR 0617 §1 for an image). The floor of `distribution`'s own
names is `distribution`'s `versions`, which only its new build serves, and the same holds for the forge module and names is `distribution`'s `versions`, which only its new build serves, and the same holds for the forge module and
the builder: waiting would never end. So a trunk build of an image, bundle or archive whose floor is not yet known the builder: waiting would never end. So a trunk build of an image, bundle or archive whose floor is not yet known
is built unnumbered and published by its digest (as a bundle or archive is from every done key, ADR 0605 §3). That is claimed with no number, so none travels in its build request, built unnumbered and published by its digest (as a
bundle or archive is from every done key, ADR 0605 §3; an image so by ADR 0617 §1). Such fingerprints are numbered
in merge order once the floor answers (ADR 0606 §1). That
publish is what wakes the floor: the builder hears the holder's `published` on its durable consumer of publish is what wakes the floor: the builder hears the holder's `published` on its durable consumer of
`<seat>.events` and asks the floor again then, never on a timer; once all three answer it numbers the build and emits `<seat>.events` and asks the floor again then, never on a timer; once all three answer it numbers the build and emits
`numbered`, which the build module consumes to call `publish` with the version and the held digest, which stores `numbered`, which the build module consumes to call `publish` with the version and the held digest, which stores
@@ -240,9 +244,9 @@ The retention of *The package registry* below, and the artifact sweep, keep work
removal emits `removed` and the builder marks its entry, so `versions` never says `published` for bytes that are gone. removal emits `removed` and the builder marks its entry, so `versions` never says `published` for bytes that are gone.
With the store's write side closed, the artifact sweep (seat `mesh-artifact-sweep`, held by artifact-store-tools) no With the store's write side closed, the artifact sweep (seat `mesh-artifact-sweep`, held by artifact-store-tools) no
longer deletes or holds by writing to the store: it calls `remove` on the seat that holds the thing, with the reason longer deletes or holds by writing to the store: it calls `remove` on the seat that holds the thing, with the reason
retention, and `hold` to keep a kept archive from removal, both granted to its holder alone by `distribution`'s retention, and `hold` to keep an untagged bundle, archive or copied base its rules keep from removal by retention,
caller list; its rules of what is kept (*The artifact store* below) stand, and it reads both reference forms. which then skips it (ADR 0617 §2), both granted to its module alone by `distribution`'s caller list; its rules of what is kept (*The artifact store* below) stand, and it reads both reference forms.
`distribution` keeps what is held in its own state `holds` (bus state, template state), emits `held` and `released` `distribution` keeps the holds in its own state `holds` (bus state, template state), emits `held` and `released`
on the seat's `<seat>.events`, and its tool `registry_holds` lists what is held, since when and for whom, and on the seat's `<seat>.events`, and its tool `registry_holds` lists what is held, since when and for whom, and
releases one by hand. A `remove` or `hold` the holder refuses to the sweep writes the sweep's finding, naming the releases one by hand. A `remove` or `hold` the holder refuses to the sweep writes the sweep's finding, naming the
thing and the reason, cleared by its next run with no refusal. thing and the reason, cleared by its next run with no refusal.
@@ -346,7 +350,7 @@ answers (a holder down whole is its module's own health check's); `registry_inco
- **Holder, added for the milestone.** A write to the store's port from any account but `distribution`'s process is - **Holder, added for the milestone.** A write to the store's port from any account but `distribution`'s process is
refused, and a read from a node's container runtime is answered; the artifact sweep's `remove` with the reason refused, and a read from a node's container runtime is answered; the artifact sweep's `remove` with the reason
retention removes an untagged bundle and emits `removed`, and the same call from another caller is refused; `hold` retention removes an untagged bundle and emits `removed`, and the same call from another caller is refused; `hold`
keeps an archive from removal, emits `held` and is listed by `registry_holds`, which releases it with `released`; a keeps an archive from retention's removal, a `hold` of an image or from another caller is refused, emits `held` and is listed by `registry_holds`, which releases it with `released`; a
refused sweep `remove` writes the sweep's finding and its next clean run clears it; the forge bridge says a refused sweep `remove` writes the sweep's finding and its next clean run clears it; the forge bridge says a
branch-deleted kind for the forge module's `forge.delete`, a `forge.delete` from another account is refused by the branch-deleted kind for the forge module's `forge.delete`, a `forge.delete` from another account is refused by the
bus, and an existing consumer of `forge` ignores the new kind; with the program stopped a read fails and the bus, and an existing consumer of `forge` ignores the new kind; with the program stopped a read fails and the
@@ -358,7 +362,9 @@ answers (a holder down whole is its module's own health check's); `registry_inco
it, and the build module, hearing `numbered`, publishes the version with the held digest; a package's trunk build it, and the build module, hearing `numbered`, publishes the version with the held digest; a package's trunk build
waits; a second trunk build of a package's revision held `published` keeps its version and publishes nothing, waits; a second trunk build of a package's revision held `published` keeps its version and publishes nothing,
while one numbered but refused is published by its second build under the same version; with `bridge_tags` while one numbered but refused is published by its second build under the same version; with `bridge_tags`
silenced (a floor source other than the publish target) the floor finding is written and cleared once it answers. silenced (a floor source other than the publish target) the floor finding is written and cleared once it answers;
with the image's own seat silent at the claim of `distribution`'s own image, the image is still built, published by
its digest, and numbered once its new build answers (ADR 0617 *How it is checked*).
- **Checker.** A changed build module invoking a verb no running holder serves is not run, and the verdict names the - **Checker.** A changed build module invoking a verb no running holder serves is not run, and the verdict names the
modules composed from their manifests instead, and the verb. modules composed from their manifests instead, and the verb.
- **Vault.** Reverting the milestone's merge mints the build modules' credentials again; the bootstrap's one-off - **Vault.** Reverting the milestone's merge mints the build modules' credentials again; the bootstrap's one-off