Issue 209: a bundle's own SDK copy registers into a registry the runtime never reads; design 38 WP4 note #316

2026-10-03T10:47:38Z

mesh-admin commented

2026-10-03 10:47:38 +00:00

Found preparing design 38 WP4, before the first module's bundle was loaded beside the runtime's own: a bundle carries its own copy of the SDK (WP3's carry its dependencies), and the SDK's tool registry is the copy's own, so a loaded bundle registers its tools where the runtime never looks and serves nothing, silently. Proven with a two-copies probe; located in mesh-tools (node-tools).

04-ISSUES/209 — report with diagnosis, status: located; fixed by mesh-tools #32 (to be filled in fixed-by: on merge).
Design 38 WP4 gains a dated note: the issue, and the two things the package left to the module — escalation through sudo inside the tool, and the filter file read from the manifest's filtering path rather than a container env.

Checks: records, cycle, index all pass. Companion changes: mesh-tools #32, mesh-catalog #239.

Found preparing design 38 WP4, before the first module's bundle was loaded beside the runtime's own: a bundle carries its own copy of the SDK (WP3's *carry its dependencies*), and the SDK's tool registry is the copy's own, so a loaded bundle registers its tools where the runtime never looks and serves nothing, silently. Proven with a two-copies probe; located in mesh-tools (node-tools). - `04-ISSUES/209` — report with diagnosis, `status: located`; fixed by mesh-tools #32 (to be filled in `fixed-by:` on merge). - Design 38 WP4 gains a dated note: the issue, and the two things the package left to the module — escalation through `sudo` inside the tool, and the filter file read from the manifest's `filtering` path rather than a container env. Checks: records, cycle, index all pass. Companion changes: mesh-tools #32, mesh-catalog #239.

mesh-admin added 1 commit 2026-10-03 10:47:38 +00:00

Issue 209: a bundle's own SDK copy registers into a registry the runtime never reads; design 38 WP4 note 89a202f12e

Found preparing WP4, before the first module's bundle was loaded beside the runtime's own:
proven with a two-copies probe, located in mesh-tools (node-tools), fixed by mesh-tools #32.
Design 38 WP4 records it and the two things the package left to the module — escalation
through sudo, and the filter file read from the manifest's path rather than a container env.

jschoubben added 1 commit 2026-10-03 11:00:37 +00:00

Design 38 WP4: what the review of mesh-catalog #239 found — the credential goes, iptables is declared, escalation is an unchecked machine fact 55443b67e6

jschoubben added 1 commit 2026-10-03 11:07:44 +00:00

Issue 209 resolved by mesh-tools #32 a572868333

jschoubben added 1 commit 2026-10-03 11:20:15 +00:00

Design 38 WP4 built and proven live on all four machines; issue 209 proven live ce5f85f65e

jschoubben added 1 commit 2026-10-03 11:20:35 +00:00

Merge remote-tracking branch 'origin/main' into issues/209-a-bundles-own-sdk-copy-registers-nowhere eaae0e2b80

mesh-admin merged commit 502763ce5e into main

2026-10-03 11:20:39 +00:00

mesh-admin deleted branch issues/209-a-bundles-own-sdk-copy-registers-nowhere

2026-10-03 11:20:39 +00:00