ADR 0103: what an adopted node holds and what its guard refuses; the node host and connectivity designs name 0102 and 0103

2026-09-22 17:52:58 +02:00
parent 84761f0600
commit 213ab898d6
4 changed files with 116 additions and 3 deletions
@@ -9,6 +9,7 @@ code:
  - mesh-host internal/apply (the service that reflects a rule set)
 updated: 2026-09-22
 decisions:
+  - 02-DECISIONS/0103-what-an-adopted-node-holds-and-what-its-guard-refuses.md
  - 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
  - 02-DECISIONS/0099-a-step-that-runs-once-names-what-it-reads.md
  - 02-DECISIONS/0098-a-fact-a-provider-makes-at-first-start-is-fetched-from-it.md
@@ -550,9 +551,13 @@ the found firewall in that firewall's own terms, marks it as the mesh's, removes
 marked, and re-checks every opening on each reconcile so a reload or a reboot does not lose it for
 longer than one reconcile. An opening is state, not a command, so it travels over the link like any
 other resource. **The mesh guards its own ports in a table of its own that only refuses** —
-passing everything by default and holding nothing but refusals of the foundation's own two ports,
-checked free at genesis, so it cannot close what the machine serves, and the found firewall's
-reload does not touch it. It refuses the store's port and the broker's management port except from
+passing everything by default and holding nothing but refusals, and the found firewall's reload
+does not touch it. Its ports are derived ([ADR 0103](../../02-DECISIONS/0103-what-an-adopted-node-holds-and-what-its-guard-refuses.md)): every machine port a
+*taken* module publishes that the filter admits from the private network only, with the store's
+port and the broker's management port. A port of a module not yet taken may still be the
+predecessor's, so it is not guarded; and only packets addressed to this machine are matched, so
+traffic it routes for others passes. An opening a found rule already answers is not added, so
+removing it never removes the operator's rule. It refuses those ports except from
 the private network and the machine itself — loopback and the container runtime's networks, known by the interface a packet arrives on, never by
 its source address alone — at
 the prerouting hook, before the container runtime redirects the packet, so it matches the port the