From b3f18c54c64ff5e9635193f2c7ae53687b24b3aa Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 2 Oct 2026 21:46:01 +0200 Subject: [PATCH 1/2] =?UTF-8?q?Design=2038:=20WP3=20built=20=E2=80=94=20no?= =?UTF-8?q?de-tools=20beside=20mesh-tools,=20the=20three=20things=20the=20?= =?UTF-8?q?plan=20did=20not=20say,=20and=20the=20gate=20refuses=20spreadin?= =?UTF-8?q?g=20not=20standing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../38-building-the-operators-machine.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/03-DESIGN/01-to-be/38-building-the-operators-machine.md b/03-DESIGN/01-to-be/38-building-the-operators-machine.md index 564f920..1471c36 100644 --- a/03-DESIGN/01-to-be/38-building-the-operators-machine.md +++ b/03-DESIGN/01-to-be/38-building-the-operators-machine.md @@ -135,6 +135,14 @@ with the shortcut off answers the same. mechanism that keeps the old pattern from returning by habit. ADR 0188 widens it, after WP4: a module whose own code is an image artifact is refused, whatever image it is built on. + *Amended 2026-10-02, at WP3.* The gate refuses the pattern **spreading**, not standing: a module + new to the catalogue in that shape, or one that had already moved to a bundle and returns to it, + is refused; a module the catalogue already holds in that shape — judged from the manifest it + holds and what that module's newest build stood on — is rebuilt without complaint. The day the + runtime arrives some thirty such modules stand, each moves in its own change from WP4 on, and a + gate refusing every rebuild in the meantime would stop the catalogue's pipeline to make a point + this record already makes. + **Proof.** Composition tests: a node with three assigned modules, one holding a seat, yields one process, three archives, one node principal whose grants are the union, and the same three memberships as before. The gate's test: the packet-filter manifest as it is today is refused once @@ -155,6 +163,16 @@ runtime's `serve` keeps answering MCP on loopback; the person's end of it keeps wrote, `tools/list` on loopback answers as before, and the controller's verbs answer through it. This is the first live step, and it is reversible by re-assigning `mesh-console`. +*Decided 2026-10-02:* `mesh-tools` keeps its name as the module the TypeScript images come from, and +`node-tools` is a second module in the same repository ([ADR 0069](../../02-DECISIONS/0069-a-module-is-a-repository-and-a-path-within-it.md)) +rather than a rename — the thirty-five manifests that build `on` `mesh-tools` stay true. Three things +WP3 found that the plan did not say: a TypeScript bundle must carry its dependencies and a +`package.json` naming its files as ES modules, which the toolchain now copies in from its own image; +the runtime's credential must be owned by the account the runtime runs as, which the controller +composes; and `MESH_TOOL_MODULES` is empty on a node where the runtime is the only bundle, which the +runtime accepts. *Built 2026-10-02* (mesh-tools `c46f950`, mesh-controller `ca7e81e` `773b561` +`729a5f9`); the live proof follows node by node. + ## WP4 — The first holder moves: the packet filter *mesh-catalog. Half a day. The live proof of ADR 0175.* From 3e30846e0fed17a7bb4e43112c2f126034e26c8d Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 2 Oct 2026 21:46:34 +0200 Subject: [PATCH 2/2] Design 38: point at ADR 0069's real file name --- 03-DESIGN/01-to-be/38-building-the-operators-machine.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/03-DESIGN/01-to-be/38-building-the-operators-machine.md b/03-DESIGN/01-to-be/38-building-the-operators-machine.md index 1471c36..93bcc15 100644 --- a/03-DESIGN/01-to-be/38-building-the-operators-machine.md +++ b/03-DESIGN/01-to-be/38-building-the-operators-machine.md @@ -164,7 +164,7 @@ wrote, `tools/list` on loopback answers as before, and the controller's verbs an This is the first live step, and it is reversible by re-assigning `mesh-console`. *Decided 2026-10-02:* `mesh-tools` keeps its name as the module the TypeScript images come from, and -`node-tools` is a second module in the same repository ([ADR 0069](../../02-DECISIONS/0069-a-module-is-a-repository-and-a-path-within-it.md)) +`node-tools` is a second module in the same repository ([ADR 0069](../../02-DECISIONS/0069-a-module-is-a-repository-and-a-path.md)) rather than a rename — the thirty-five manifests that build `on` `mesh-tools` stay true. Three things WP3 found that the plan did not say: a TypeScript bundle must carry its dependencies and a `package.json` naming its files as ES modules, which the toolchain now copies in from its own image;