novox/hq
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

State the one rule the derivation does not yet reach

Browse Source 
A hub needs its overlay port open and a node that is not a hub does not, and
they are the same module — so listens, a static manifest field, cannot express
it while the overlay module's resources are computed per node. Written down
rather than left as an oversight for whoever first puts a firewall on a hub.
This commit is contained in:
jschoubben
2026-08-31 00:42:39 +02:00
parent a6872ac099
commit 890c3ee3fc
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/08-connectivity.md
+12
View File
@@ -317,6 +317,18 @@ something:
| **flush the ruleset** when loading | that empties every table on the machine, the runtime's among them. Only the mesh's own table is replaced, and it is declared empty first so the replacement works on a machine loading one for the first time | | **flush the ruleset** when loading | that empties every table on the machine, the runtime's among them. Only the mesh's own table is replaced, and it is declared empty first so the replacement works on a machine loading one for the first time |
| carry a **command to load itself** | the link may not carry an action ([ADR 0005](../../02-DECISIONS/0005-the-node-host.md)). A service is declared to reflect the file instead, so replacing it restarts what loads it — the shape that rule leaves, used here for the first time for its real purpose | | carry a **command to load itself** | the link may not carry an action ([ADR 0005](../../02-DECISIONS/0005-the-node-host.md)). A service is declared to reflect the file instead, so replacing it restarts what loads it — the shape that rule leaves, used here for the first time for its real purpose |
**One thing is derived from what is assigned and not yet from the overlay's shape**, and it is
stated here rather than discovered: **a hub's own listening port.** A hub accepts inbound
connections from every node at other sites; a node that is not a hub dials out and needs nothing
open, because a reply to a flow it started is already accepted. So the two want different rules on
an identical module — and `listens` is a static field on a manifest, while the overlay module's
resources are computed per node.
A machine that is not a hub is therefore correct today, and **a hub would have its own port closed
by a rule set derived this way.** The fix is that a computed module contributes listens the way it
contributes resources; until it exists, the firewall belongs on machines that are not hubs, and
this paragraph is the reason rather than an oversight to find later.
**And it is enforced, which is what separates this from `scope:`.** Checked on two real machines: **And it is enforced, which is what separates this from `scope:`.** Checked on two real machines:
two ports opened, one declared, and from the other machine the declared one answers and the two ports opened, one declared, and from the other machine the declared one answers and the
undeclared one does not — then the module is removed and the port closes with nobody editing a undeclared one does not — then the module is removed and the port closes with nobody editing a