Issue 129 is resolved: a workstation trusts the mesh, and stops when told to #200

2026-09-30T00:18:40Z

jschoubben commented

2026-09-30 00:18:40 +00:00

Group 0 of the work order is now complete — 118 and 129 both resolved.

ca-trust was merged and had never been registered with the mesh (39 of 76 catalogue manifests are), which is why "assign it to one machine" had no module to name. Registered from the catalogue, assigned to the workstation, pushed, verified.

Verified in the form ADR 0147 prescribes — against the authority's own API, so the handshake needs nothing else in the mesh to be right:

curl -sS -o /dev/null -w '%{http_code}' https://<authority>:9000/health   -> 200
issuer=O=Mesh Internal CA, CN=Mesh Internal CA Intermediate CA
Verify return code: 0 (ok)

Four routed internal names verify too, and git ls-remote https://git.<node>.internal/… works — the consequence the report named as forcing ssh-only clone URLs.

Removal exercised for the first time. Unassign and push removes the anchor, empties the trust store of the mesh's authority, and returns the plain client to unable to get local issuer certificate; assigning again restores it. That is the half 0147 claimed and nothing had ever shown.

One thing this found that is not in the module: removal works only because the host removes the service before the script. Stopping the unit is what deletes the certificate and refreshes the bundles, and it needs the script it calls to still exist. The symmetry 0147 claims rests on an ordering nothing states.

ADR 0147's "written, and not yet run" carries a dated progressive insight saying it has now run, on the live mesh rather than in the bed (ADR 0149), and that it ran on one machine of four.

Checks: records, index, cycle all pass.

**Group 0 of the work order is now complete** — 118 and 129 both resolved. `ca-trust` was merged and had never been registered with the mesh (39 of 76 catalogue manifests are), which is why "assign it to one machine" had no module to name. Registered from the catalogue, assigned to the workstation, pushed, verified. **Verified in the form ADR 0147 prescribes** — against the authority's own API, so the handshake needs nothing else in the mesh to be right: ``` curl -sS -o /dev/null -w '%{http_code}' https://<authority>:9000/health -> 200 issuer=O=Mesh Internal CA, CN=Mesh Internal CA Intermediate CA Verify return code: 0 (ok) ``` Four routed internal names verify too, and `git ls-remote https://git.<node>.internal/…` works — the consequence the report named as forcing ssh-only clone URLs. **Removal exercised for the first time.** Unassign and push removes the anchor, empties the trust store of the mesh's authority, and returns the plain client to `unable to get local issuer certificate`; assigning again restores it. That is the half 0147 claimed and nothing had ever shown. **One thing this found that is not in the module:** removal works only because the *host* removes the service before the script. Stopping the unit is what deletes the certificate and refreshes the bundles, and it needs the script it calls to still exist. The symmetry 0147 claims rests on an ordering nothing states. ADR 0147's "written, and not yet run" carries a dated progressive insight saying it has now run, on the live mesh rather than in the bed (ADR 0149), and that it ran on one machine of four. Checks: records, index, cycle all pass.

jschoubben added 1 commit 2026-09-30 00:18:40 +00:00

Issue 129 is resolved: a workstation trusts the mesh, and stops when told to 1f72e82b84

Registered ca-trust from the catalogue — it was merged and had never been
registered, which is why "assign it to one machine" had no module to name
— assigned it to the workstation, and verified.

Verified in the form ADR 0147 prescribes, against the authority's own API
so the handshake needs nothing else in the mesh to be right: 200, issuer
Mesh Internal CA, Verify return code 0. Four routed internal names verify
too, and `git ls-remote https://…` works, which is the consequence the
report named.

Removal exercised for the first time. Unassign and push removes the
anchor, empties the trust store of the mesh's authority, and returns the
plain client to the original error; assigning again restores it. That is
the half 0147 claimed and nothing had shown.

One thing it found that is not in the module: removal works only because
the host removes the service before the script. Stopping the unit is what
deletes the certificate and refreshes the bundles, and it needs the script
to still exist. The symmetry rests on an ordering nothing states.

0147's "written, and not yet run" now carries a progressive insight
saying it has run, where, and that it ran on one machine of four.

jschoubben merged commit 5036b927b9 into main

2026-09-30 00:18:52 +00:00

jschoubben deleted branch issue/129-a-machine-trusts-the-mesh

2026-09-30 00:18:52 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#200