Design 47: the found tunnel is decided at adoption; adoption and enrolled peers are read, not written (issue 1126, ADR 0555)

2026-10-26 18:26:53 +01:00
parent b5b84fafc6
commit 68f8a8c198
1 changed files with 6 additions and 5 deletions
@@ -687,8 +687,9 @@ backup holder backs up nothing, and the have says so.
  it merges (ADR 0549 §1, ADR 0555). It holds what a person decides of the node and nothing a machine observes:
  - the node's decided facts: its endpoint and site, whether it is the private network's hub, its address on the
    private network (a decision written once at enrolment; nothing allocates one at run time), the domain its
-    routed names are composed under, its operator and agent logins by name with their homes, and whether it is
-    adopted with the modules taken on it. No secret and no key material;
+    routed names are composed under, its operator and agent logins by name with their homes, whether it is
+    adopted with the modules taken on it, the tunnel found on it at adoption (no longer there to observe once taken
+    over), and on the hub the names given to that tunnel's peers. No secret, and keys only as public halves;
  - its modules in the order the composition reads them, each with its host ports by the port the software
    listens on, its bindings by provision, and its config placement (`places`, `accesses`, `networks`,
    `endpoints`, `expose`, `reach`, `ports`) as two layers: the mesh-wide one, repeated in every node's file so a
@@ -700,9 +701,9 @@ backup holder backs up nothing, and the have says so.
  once for the mesh held twice, two nodes with one address and more than one hub, each named in one answer.
 - **The node record.** What the machine observes of itself: its tunnel's public key, its capabilities, the
  public halves of its sealing and serving keys, the certificate issued for its internal name, its outward links
-  and networks, its node-engine's contract, the tunnel found on it, and on the hub alone whether the hub adopted
-  that tunnel and every peer it carries. Written at start and when an observed fact changes, only when it
-  differs (ADR 0555 §3).
+  and networks, and its node-engine's contract. Written at start and when an observed fact changes, only when it
+  differs (ADR 0555 §3). Whether the hub took its found tunnel over, and which node enrolled under a carried
+  peer's key, are read from the placement and the records together, never written.
 - **Composed again on events, never on a timer.** A changed input at the same fingerprint (a setting or given
  value, a secret rotated or moved, a credential issued, a provider's contribution, a peer added to the hub) is
  composed again when its event is heard, and applied as a revision of what runs (ADR 0547 §2).