From cc872a58ce4d4c5ff8f31db7280defb8ed920c91 Mon Sep 17 00:00:00 2001 From: jochen Date: Sun, 30 Aug 2026 00:02:36 +0200 Subject: [PATCH] Binding is built except for the secret Which turned out to be the useful way to cut it. A provider says what a consumer needs in order to use it; a consumer says where it wants to be told; the mesh adds which machine and what that machine is called on the private network. So an app on one node reaches its database on another, by a name the mesh also created. The file says it carries no credential and why, because a missing field looks like a bug and a stated absence looks like a boundary. What remains is the secret itself, and the shape it will arrive in now exists. Also: two machines wired together across no private network is refused, and that only became checkable when the network stopped being something a machine has by virtue of holding an address. --- 02-DECISIONS/0009-modules-and-the-graph.md | 25 +++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/02-DECISIONS/0009-modules-and-the-graph.md b/02-DECISIONS/0009-modules-and-the-graph.md index c5f0753..24615df 100644 --- a/02-DECISIONS/0009-modules-and-the-graph.md +++ b/02-DECISIONS/0009-modules-and-the-graph.md @@ -162,10 +162,29 @@ software *on* the mesh rather than *of* it. It also costs the host nothing: a re file, which was checked by putting the control plane's output through the host's own parser rather than by asserting it. -**Binding is not built**, and it is the larger half. It needs a secret to exist, be stored, be -delivered to one node and not the others, and be rotated with every holder informed — which is +**Binding is built except for the secret**, and that turned out to be the useful way to cut it. + +A provider says what a consumer needs in order to use it — a port, a driver, a realm — and a +consumer says where it wants to be told. The mesh adds the half only it has: **which machine, and +what that machine is called on the private network.** So an application on one node is handed the +address of its database on another, as a file, and reaches it by a name the mesh also created. + +**The file states that it carries no credential, and why.** A missing field looks like a bug; a +stated absence looks like a boundary, and somebody wiring this up should not spend an afternoon +looking for a password that was never going to be there. + +**What remains is the secret itself**, and it is the larger half: it must exist, be stored, reach +one node and not the others, and rotate with every holder informed — which is [the invariant set](0001-mesh-brokers-nodes-host-agents-think.md) that was found violated three -ways at once, and the reason it is not something to add in passing. +ways at once, and the reason it is not something to add in passing. What is built is the shape it +will arrive in. + +**One check that only became possible now.** Two machines wired together across no private network +is a mesh that reports itself configured and does not work, and the failure surfaces as a +connection timing out — the slowest place to find anything. It is refused, and it is only +*checkable* because the network became [something a machine is +given](#what-a-domain-module-turns-out-to-be-and-why-it-is-not-the-one-refused-above) rather than +something it has by virtue of holding an address. **What the absence cost, measured.** Exactly two modules opened a direct connection to the control plane's database — the proxy and the VPN — and they are the reason every node permanently holds a