ADR 0191: the mesh's names are known by where they were composed, not by their suffix

A progressive insight: the rule and its check were stated as a suffix test; the mesh composes both names of a route and publishes its internal one. The decision is unchanged.
2026-10-03 15:39:07 +02:00
parent 27c6881287
commit ca8a865e73
2 changed files with 17 additions and 9 deletions
@@ -425,15 +425,16 @@ the cost of not seeing it is inventing a mechanism that already exists.

 ### The mesh resolves only its own names; a public name resolves publicly

-**The mesh's resolver holds names under the mesh suffix and nothing else** — every machine, and through
-it every route's internal name `<label>.<node>.internal`
+**The mesh's resolver holds the names the mesh composes for itself and nothing else** — every
+machine's name, and every route's internal name `<label>.<node>.internal`
 ([ADR 0151](../../02-DECISIONS/0151-a-routes-internal-name-is-composed-under-the-node-that-serves-it.md)).
 **A public name the mesh serves is never given a private answer**: it is forwarded and resolves to the
 public address, from a member and from anything else the resolver answers — a resolver may serve a
 machine's LAN, and a phone on that LAN must get the address it can reach
 ([ADR 0191](../../02-DECISIONS/0191-the-meshs-resolver-holds-only-the-meshs-own-names.md)). Inside the
 mesh, a routed service is reached, and certified by the internal authority, under its internal name.
-*Checked by the controller's catalogue tests — every name the roster carries ends in the mesh suffix —
+*Checked by the controller's catalogue tests — the names served are routes' internal names, and no
+route's public name is among them —
 and on a machine by asking its resolver for a public name the mesh serves: the answer is the public
 address.*

@@ -1009,9 +1010,6 @@ The list is worth having in one place, because it is most of the argument:
  operator's to move between meshes, but the manifest layer still stores it as a literal — so today
  the composition is a per-node override rather than the design. The interpolation that would let a
  module carry a label and a node carry the domain, and the mesh join them, does not yet exist.
- **Withdrawing public names from internal resolution.** The roster still publishes every routed
-  public name at its serving node's private address, which ADR 0191 forbids; until the controller
-  stops, a resolver that answers a LAN hands that LAN's non-members addresses they cannot reach.

 ## The hub adopts the predecessor's tunnel