From 68f8a8c1988438ee1b7091635da630ae093f5dae Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 26 Oct 2026 18:26:53 +0100 Subject: [PATCH] Design 47: the found tunnel is decided at adoption; adoption and enrolled peers are read, not written (issue 1126, ADR 0555) --- .../01-to-be/47-delivery-from-commit-to-delivered.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index c3422466..c353f80f 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -687,8 +687,9 @@ backup holder backs up nothing, and the have says so. it merges (ADR 0549 §1, ADR 0555). It holds what a person decides of the node and nothing a machine observes: - the node's decided facts: its endpoint and site, whether it is the private network's hub, its address on the private network (a decision written once at enrolment; nothing allocates one at run time), the domain its - routed names are composed under, its operator and agent logins by name with their homes, and whether it is - adopted with the modules taken on it. No secret and no key material; + routed names are composed under, its operator and agent logins by name with their homes, whether it is + adopted with the modules taken on it, the tunnel found on it at adoption (no longer there to observe once taken + over), and on the hub the names given to that tunnel's peers. No secret, and keys only as public halves; - its modules in the order the composition reads them, each with its host ports by the port the software listens on, its bindings by provision, and its config placement (`places`, `accesses`, `networks`, `endpoints`, `expose`, `reach`, `ports`) as two layers: the mesh-wide one, repeated in every node's file so a @@ -700,9 +701,9 @@ backup holder backs up nothing, and the have says so. once for the mesh held twice, two nodes with one address and more than one hub, each named in one answer. - **The node record.** What the machine observes of itself: its tunnel's public key, its capabilities, the public halves of its sealing and serving keys, the certificate issued for its internal name, its outward links - and networks, its node-engine's contract, the tunnel found on it, and on the hub alone whether the hub adopted - that tunnel and every peer it carries. Written at start and when an observed fact changes, only when it - differs (ADR 0555 §3). + and networks, and its node-engine's contract. Written at start and when an observed fact changes, only when it + differs (ADR 0555 §3). Whether the hub took its found tunnel over, and which node enrolled under a carried + peer's key, are read from the placement and the records together, never written. - **Composed again on events, never on a timer.** A changed input at the same fingerprint (a setting or given value, a secret rotated or moved, a credential issued, a provider's contribution, a peer added to the hub) is composed again when its event is heard, and applied as a revision of what runs (ADR 0547 §2).