From e1713bf59a912e35fc750b149fdf0ccfa82cc24c Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 5 Nov 2026 13:22:52 +0100 Subject: [PATCH] Designs follow ADR 0636 v4: the seat-definitions verb, the indexer bootstrapped A full restart must bring back the part that serves the seat list, so the bootstrapped definitions now name mesh-catalog beside the foundation's seats, with a test of it. A seat defined outside the mesh's own contracts is taken from its own contracts module, not refused. The bus server's resources and the placement check get their owners, and two stale seat names in design 26's old table are corrected. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig --- 03-DESIGN/01-to-be/26-the-seats.md | 21 ++++++++++++------- .../47-delivery-from-commit-to-delivered.md | 6 +++--- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/03-DESIGN/01-to-be/26-the-seats.md b/03-DESIGN/01-to-be/26-the-seats.md index fc21773e..d827b750 100644 --- a/03-DESIGN/01-to-be/26-the-seats.md +++ b/03-DESIGN/01-to-be/26-the-seats.md @@ -163,9 +163,9 @@ convention, which later seats departed from. | `mesh-catalog` | `the-catalogue` | mesh | — | the indexer | | `npm-package-registry` | — (its rename to `mesh-*` stays deferred, ADR 0156 §8) | mesh | `npm-package-registry` | the forge | | `go-package-registry` | — (ADR 0605) | mesh | `go-package-registry` | the forge | -| `mesh-git` | `git` | mesh | `git` | the forge | +| `git` | — | mesh | `git` | the forge | | `mesh-build-machine` | `the-build-machine` | node | — | a builder | -| `mesh-resolver` | — | mesh | — | the mesh's resolvers, each holding every node's internal domain (ADR 0194); replicated, held on the anchor and the home server (ADR 0223) | +| `mesh-dns-resolver` | — | mesh | — | the mesh's resolvers, each holding every node's internal domain (ADR 0194); replicated, held on the anchor and the home server (ADR 0223) | | ~~`mesh-dns-port`~~ | `the-dns-port` | node | — | retired by ADR 0194: the local resolver became the mesh's one; deleted from the set, and from the store's table, once nothing claimed it (ADR 0220) | | `node-hostname` | `node-hosts-file` (renamed by ADR 0223; the former name an alias) | node | — | owns a machine's names: `/etc/hostname`, written from its holder's `hostname` setting with no default and taking effect at the next boot, and in `/etc/hosts` the machine's own lines and the operator's kept region, changed through its verbs `entries`, `add`, `remove` (ADR 0199). Held by the module `hostname`, formerly `hosts` | | `node-resolver` | — | node | — | a machine's own resolver, held only where something requires `split-dns`: it writes `/etc/resolv.conf` there (the uplink's holder steps back from it) and routes a VPN's domains to the VPN's servers over its link through its verbs `routes`, `route`, `unroute` (ADR 0247). Held by the module `systemd-resolved` | @@ -291,7 +291,7 @@ defined whole or at the seat list's grain (ADR 0635 §2). In the milestone of AD finding or condition stays under an old name. - **Every part learns the seat list from the bus, through the seat `mesh-catalog`** (ADR 0635 §1, as ADR 0636 §2 changes it). The manifest validator, the node-engine, the tool runner, claude-code and every other reader of the - list of seats call, through mesh-sdk's runtime, the verb of the seat `mesh-catalog` that answers every definition + list of seats call, through mesh-sdk's runtime, the verb `seat-definitions` of the seat `mesh-catalog`, which answers every definition on the trunks with its digest, at the grain each holds, and hear the seat's events `seat-definition-changed` and `seat-definition-removed`. A reader names no module: it calls the seat, never its holder, the indexer, by name. It acts only on definitions from a trunk, never on a pull request's head. No package carries the seat list, and @@ -300,14 +300,17 @@ defined whole or at the seat list's grain (ADR 0635 §2). In the milestone of AD without the seat's answer applies, composes, grants and judges nothing new and keeps running what it runs; it says in its health what it waits for, and raises a condition when it has waited five minutes, cleared by its first full read. It does act, from the bootstrapped definitions it carries (ADR 0608 §2), on the modules whose seats those - definitions name, which are the parts that serve the seat list, so they come back after a full restart. A reader + definitions name: the foundation's seats and `mesh-catalog`, so the bus, the store and the indexer, which serves the + list, come back after a full restart. A reader away longer than the events' retention reads the whole list again. A check that cannot read the definitions it needs fails, naming them, rather than passing without them. **Each reader's list has tools** (ADR 0636 §5): mesh-sdk's runtime bundle serves, in every reader, a tool that reads which definitions it holds (their source, digests and what it waits for) and one that makes it read the list again now. **How it is checked** (ADR 0635 §6, ADR 0636 §5): a test of the readers' start, with the seat unanswered, asserts - the reader acts on nothing but the bootstrapped modules and says so, then acts once the seat answers; mesh-sdk's + the reader acts on nothing but the bootstrapped modules and says so, then acts once the seat answers; a full + restart of the mesh with no reader holding the list brings the foundation and the indexer back first, then every + other module once `seat-definitions` answers; mesh-sdk's unit test refuses a module's name in the runtime; the indexer's tests read a seat-list-grain definition from a contracts module like a whole one, and a removed definition's seat is refused afterwards. - **The generator** is each language's build module's: the Go build module's package for Go, the Node and TypeScript @@ -331,9 +334,10 @@ defined whole or at the seat list's grain (ADR 0635 §2). In the milestone of AD trunk's unless a pull request's head is named, and says which it answered. **The delivery group's one check reads the seat definitions at every member's head**, so a group that changes a definition is judged by what it merges. A pull request's entries are removed on the forge bridge's event that it closed or merged. **A seat is defined only in - its domain's contracts module** (ADR 0636 §3, changing ADR 0608 §2): the indexer takes a seat's definition only from - the contracts module of the seat's glossary domain, `mesh-contracts` for a domain with none, and refuses one from any - other module with a finding naming both. A definition + its domain's contracts module** (ADR 0636 §3, changing ADR 0608 §2): the indexer takes a seat of the mesh's own + only from the contracts module of the seat's glossary domain, `mesh-contracts` for a domain with none, and a seat + defined outside the mesh's own contracts only from its own contracts module (ADR 0625 §7); it refuses a definition + of the same seat from any other module, with a finding naming both. A definition that does not parse fails its pull request's check; the trunk's stays. The merge is the only approval. The foundation's own definitions are bootstrapped before the bus exists, as the bootstrap of a fresh mesh has it (research 075). @@ -501,6 +505,7 @@ over its budget: each case below replaces or joins an existing one. | mesh-sdk's seat-naming, import and package-list tests; no module's name in the runtime | unit | mesh-sdk | | the readers' start: with the seat unanswered a reader acts on nothing but the bootstrapped modules and says so, raises its condition after five minutes, and acts once the seat answers; a reader away longer than the events' retention reads the whole list again; both list tools answer | unit, over a bus the test gives | mesh-sdk | | the indexer stopped mid-run: readers keep running what they run and act on nothing new until it answers again | a case of the indexer's whole-module test | mesh-delivery | +| a full restart with no reader holding the list: the foundation and the indexer start from the bootstrapped definitions, then every other module once `seat-definitions` answers | a case of the node-engine's whole-module test | `mesh-host` (the node-engine's repository) | | a trunk definition that does not parse writes its finding and a fixed one clears it; a trunk build end naming out-of-step types writes the finding, a clean build end of another contracts module of the same repository leaves it, and a clean one of the same module clears it | a case of the indexer's whole-module test | mesh-delivery | | `indexer_seat_definition` answers the trunk's entry while a pull request holds another; a pull request's entries go when it closes; a definition over 256 KiB is refused; a seat-list-grain definition is read from a contracts module like a whole one; a removed definition says `seat-definition-removed` and its seat is refused afterwards; a second module defining a seat is refused with its finding; each of the indexer's tools answers | cases of the indexer's whole-module test | mesh-delivery | | the manifest validator refuses a claim, an `invokes` or a grant naming `mesh-placement` or the seat `mesh-enrolment`, and a holder missing one of its seat's states in `requires` | unit | mesh-delivery | diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index c89ce45a..5fdf3291 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -739,7 +739,7 @@ backup holder backs up nothing, and the have says so. changes (place a module, take one off, pin a provider, hold a seat, set a decided field of a node, set a module's config placement or values); who proposes is the caller as the runtime proves it. The holder lays the changes over the current keys, names the revision of each, and refuses at once, naming every finding, what - the placement check of the seat's client refuses (ADR 0634 §1): a module the indexer does not hold or a node not enrolled, two modules of one + the placement check, the assigner's own package since only the assigner uses it, refuses (ADR 0634 §1): a module the indexer does not hold or a node not enrolled, two modules of one node on one host port, a pin, binding or holding naming a provider not placed where it says, a seat held once for the mesh held twice, two nodes with one address and more than one hub. Otherwise it writes the proposal and one candidate for each node whose key it changes, and the nodes answer. `withdraw` deletes both. Until the lease @@ -862,8 +862,8 @@ backup holder backs up nothing, and the have says so. accounts and secrets, its tools) while it keeps the server's container as it runs, with no record ask. Only a want that carries the operator's warrant (a put after the streams' snapshot, or the operator's hand write) replaces the server; until then the bus module's have names the fingerprint applied and the one the server runs, and the view - says the server waits. mesh-sdk names the resources the bus's - server holds, so the assigner and the node agent read one list; the assigner writes the bus module's want only to a + says the server waits. The contract of the seat `mesh-broker` names the resources the bus's + server holds (ADR 0634 §1), so the assigner and the node agent read one list; the assigner writes the bus module's want only to a node agent whose have says it keeps the server (the version it reports), so the node agent's keeping of the server is delivered before the assigner's change. Until then nothing writes the bus module's process accounts, and its tools that write to the bus fail (issue 774, the