diff --git a/00-META/checks/__pycache__/cycle.cpython-314.pyc b/00-META/checks/__pycache__/cycle.cpython-314.pyc new file mode 100644 index 0000000..d786461 Binary files /dev/null and b/00-META/checks/__pycache__/cycle.cpython-314.pyc differ diff --git a/04-ISSUES/007-an-installed-package-is-not-a-capability/00-report.md b/04-ISSUES/007-an-installed-package-is-not-a-capability/00-report.md index 011eb1d..061215d 100644 --- a/04-ISSUES/007-an-installed-package-is-not-a-capability/00-report.md +++ b/04-ISSUES/007-an-installed-package-is-not-a-capability/00-report.md @@ -4,6 +4,7 @@ opened: 2026-08-23 located-in: [hal] fixed-by: - "the instance only: PR #962 — incus hook. Merged, ran on one node in 6s of a 60s budget; pipeline #6832 green in 48s. The class remains open." + - "partly, on the mesh: mesh-host 73c010e, 9d8239a — preflight and the profile detectors ask the daemon, not the package (installed-but-broken reports absent). The class question the report asks of hal is not answered" amended-design: --- diff --git a/04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md b/04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md index 9f20414..ff339b4 100644 --- a/04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md +++ b/04-ISSUES/025-a-module-must-pin-a-digest-and-nothing-produces-one/00-report.md @@ -1,8 +1,8 @@ --- -status: located +status: resolved opened: 2026-09-01 located-in: [mesh-control, mesh-host] -fixed-by: partly — mesh-control ee3cc1b +fixed-by: mesh-controller ee3cc1b (pinned() refuses a placeholder at compose), 43c9c97 (the builder publishes digests); proven by one-node-mesh.test.ts (the catalogue holds no placeholder digest). Six placeholders remain in three manifests deferred under issue 064 amended-design: --- diff --git a/04-ISSUES/026-the-data-directories-are-not-declared/00-report.md b/04-ISSUES/026-the-data-directories-are-not-declared/00-report.md index 9e39f1a..6afc292 100644 --- a/04-ISSUES/026-the-data-directories-are-not-declared/00-report.md +++ b/04-ISSUES/026-the-data-directories-are-not-declared/00-report.md @@ -2,7 +2,7 @@ status: located opened: 2026-09-01 located-in: [mesh-control] -fixed-by: partly — mesh-control 53eb000, withdrawn in 83c6a2f +fixed-by: partly — mesh-controller f5b03e1 declares the data directories; the gate refusing a container mount the module never declared (53eb000) was withdrawn in 83c6a2f and nothing replaces it amended-design: --- diff --git a/04-ISSUES/027-a-container-cannot-follow-a-file/00-report.md b/04-ISSUES/027-a-container-cannot-follow-a-file/00-report.md index c88562d..d75ee4c 100644 --- a/04-ISSUES/027-a-container-cannot-follow-a-file/00-report.md +++ b/04-ISSUES/027-a-container-cannot-follow-a-file/00-report.md @@ -1,8 +1,8 @@ --- -status: located +status: resolved opened: 2026-09-01 located-in: [mesh-host, mesh-control] -fixed-by: +fixed-by: mesh-host aa441ba, 652984b (container restart-on, PR #2, under issue 009); proven by mesh-lab runtime-restart-on-config.test.ts amended-design: --- diff --git a/04-ISSUES/033-runtime-config-change-does-not-restart/00-report.md b/04-ISSUES/033-runtime-config-change-does-not-restart/00-report.md index b7089ab..26c50ce 100644 --- a/04-ISSUES/033-runtime-config-change-does-not-restart/00-report.md +++ b/04-ISSUES/033-runtime-config-change-does-not-restart/00-report.md @@ -1,8 +1,8 @@ --- -status: open +status: resolved opened: 2026-09-04 located-in: [] -fixed-by: +fixed-by: mesh-host aa441ba (restart-on); mesh-catalog 550393b (runtime config as a mergeable file + restart-on); proven by mesh-lab runtime-restart-on-config.test.ts amended-design: --- diff --git a/04-ISSUES/035-reconciling-a-seed-file-wipes-what-grew-in-it/00-report.md b/04-ISSUES/035-reconciling-a-seed-file-wipes-what-grew-in-it/00-report.md index 8c8bd49..a7631ee 100644 --- a/04-ISSUES/035-reconciling-a-seed-file-wipes-what-grew-in-it/00-report.md +++ b/04-ISSUES/035-reconciling-a-seed-file-wipes-what-grew-in-it/00-report.md @@ -2,7 +2,7 @@ status: open opened: 2026-09-02 located-in: [] -fixed-by: +fixed-by: partly — mesh-host 24e9ae4 (a run-once step writes a seed only if absent, ADR 0052); mesh-catalog ec1e718 (mosquitto). A file resource itself has no create-once semantic, and no bed asserts a seed's grown content survives a re-apply amended-design: --- diff --git a/04-ISSUES/036-six-modules-own-what-they-must-share/00-report.md b/04-ISSUES/036-six-modules-own-what-they-must-share/00-report.md index 071d7df..230c47c 100644 --- a/04-ISSUES/036-six-modules-own-what-they-must-share/00-report.md +++ b/04-ISSUES/036-six-modules-own-what-they-must-share/00-report.md @@ -1,8 +1,8 @@ --- -status: located +status: resolved opened: 2026-09-02 located-in: [mesh-control, mesh-catalog, mesh-host] -fixed-by: 02-DECISIONS/0051-shared-data-is-the-operators.md +fixed-by: ADR 0051 access: mesh-controller aeb65a3, mesh-host f06eea5, mesh-catalog 69c8a5e; proven by mesh-lab assigned-catalogue-media.test.ts (sonarr and radarr share one operator-owned directory) amended-design: 02-DECISIONS/0051-shared-data-is-the-operators.md --- diff --git a/04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md b/04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md index ad36933..a66a0c8 100644 --- a/04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md +++ b/04-ISSUES/037-a-module-cannot-run-code-at-a-lifecycle-phase/00-report.md @@ -1,8 +1,8 @@ --- -status: located +status: resolved opened: 2026-09-05 located-in: [mesh-control, mesh-host, mesh-catalog] -fixed-by: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md +fixed-by: ADR 0052 run-once container: mesh-host 19e5dd8, PR #5 24e9ae4; ADR 0053 scheduled twin 9d1f001; proven by mesh-lab assigned-catalogue-mqtt.test.ts amended-design: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md --- diff --git a/04-ISSUES/040-the-install-procedure-exists-only-as-a-test/00-report.md b/04-ISSUES/040-the-install-procedure-exists-only-as-a-test/00-report.md index ee7c02f..c4a2061 100644 --- a/04-ISSUES/040-the-install-procedure-exists-only-as-a-test/00-report.md +++ b/04-ISSUES/040-the-install-procedure-exists-only-as-a-test/00-report.md @@ -1,8 +1,8 @@ --- -status: open +status: resolved opened: 2026-09-10 located-in: [] -fixed-by: +fixed-by: mesh-host cmd/mesh-bootstrap (ADR 0067); mesh-lab genesis.ts is the one description of genesis both beds call. Still open: a running mesh cannot say it was raised by the installer amended-design: --- diff --git a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md index 2e6088a..d7e79d2 100644 --- a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md +++ b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md @@ -56,3 +56,12 @@ either way. - What is the actual reach of the exposure on a node — which identities can talk to the container runtime, and is that set smaller than "anything running as the operator"? The answer decides whether this is a hardening item or something sharper. + +## Reconciled 2026-09-21 + +Still open, and worse than reported: the controller's own manifest now delivers its store +connections **and** its broker credentials through an env-file, so both halves reach the process +environment; 28 catalogue manifests use env-file for a secret, and nothing in the catalogue +engine refuses a `${secret:…}` placeholder in one. The vault work of +[ADR 0085](../../02-DECISIONS/0085-a-secret-is-a-provision.md) rests on the seal this weakens. + diff --git a/04-ISSUES/045-a-container-keeps-the-values-it-started-with/00-report.md b/04-ISSUES/045-a-container-keeps-the-values-it-started-with/00-report.md index dbf387e..4824f1e 100644 --- a/04-ISSUES/045-a-container-keeps-the-values-it-started-with/00-report.md +++ b/04-ISSUES/045-a-container-keeps-the-values-it-started-with/00-report.md @@ -1,8 +1,8 @@ --- -status: open +status: resolved opened: 2026-09-13 located-in: [] -fixed-by: +fixed-by: mesh-host e7f94e0 (restart-on digests folded into the container spec, a standing comparison); unit-tested in apply_test.go, no lab assertion yet amended-design: --- diff --git a/04-ISSUES/047-the-firewall-does-not-cover-published-container-ports/00-report.md b/04-ISSUES/047-the-firewall-does-not-cover-published-container-ports/00-report.md index f3f27e0..674fe3c 100644 --- a/04-ISSUES/047-the-firewall-does-not-cover-published-container-ports/00-report.md +++ b/04-ISSUES/047-the-firewall-does-not-cover-published-container-ports/00-report.md @@ -1,8 +1,8 @@ --- -status: open +status: resolved opened: 2026-09-14 located-in: [] -fixed-by: +fixed-by: mesh-controller c8d8211 (forward chain drops by default, never closes ssh), 25e42b3; proven by one-node-mesh.test.ts (a machine filters exactly what its modules declared) amended-design: --- diff --git a/04-ISSUES/050-the-catalogue-knows-nothing-built-before-it/00-report.md b/04-ISSUES/050-the-catalogue-knows-nothing-built-before-it/00-report.md index c22f42e..e9e800e 100644 --- a/04-ISSUES/050-the-catalogue-knows-nothing-built-before-it/00-report.md +++ b/04-ISSUES/050-the-catalogue-knows-nothing-built-before-it/00-report.md @@ -1,8 +1,8 @@ --- -status: open +status: resolved opened: 2026-09-14 located-in: [] -fixed-by: +fixed-by: mesh-controller 3ae7b88, 2b82872; mesh-catalog d2dce34; proven by one-node-mesh.test.ts (the catalogue holds every module the control plane built) amended-design: --- diff --git a/04-ISSUES/052-the-firewall-does-not-know-the-brokers-port/00-report.md b/04-ISSUES/052-the-firewall-does-not-know-the-brokers-port/00-report.md index 8ad3468..2d8ff95 100644 --- a/04-ISSUES/052-the-firewall-does-not-know-the-brokers-port/00-report.md +++ b/04-ISSUES/052-the-firewall-does-not-know-the-brokers-port/00-report.md @@ -1,8 +1,8 @@ --- -status: open +status: resolved opened: 2026-09-14 located-in: [] -fixed-by: +fixed-by: mesh-controller dda001d (the firewall opens the port the mesh itself runs on), 25e42b3; TestTheBrokersPortIsOpenedThoughNoModuleDeclaresIt amended-design: --- diff --git a/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md b/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md index 42e6a0c..8434d35 100644 --- a/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md +++ b/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md @@ -1,8 +1,8 @@ --- -status: open +status: resolved opened: 2026-09-15 located-in: [] -fixed-by: +fixed-by: mesh-tools b618057 (the SDK resolved by version from the registry, one pin); mesh-host 7986306; mesh-controller 4b9bc50. Caveat: the base image still builds with npm install and no lock, so the build is not reproducible amended-design: ---