Research 020: what a bundled tool is given; design 38 WP4: fail2ban followed, proven live #319

2026-10-03T13:11:21Z

mesh-admin commented

2026-10-03 13:11:21 +00:00

Two things from the afternoon of 2026-10-03.

Design 38 WP4: fail2ban followed the packet filter (mesh-catalog #240, aa5bf7d), same shape; proven on all four machines through the runtime — status, banned, fail2ban_settings answer, no mesh-fail2ban container, the runtime serving both bundles. Issue 210 noted as resolved the same day.

Research 020 — what a bundled tool is given. Measured before the other thirty-one move: 33 modules / 36 tool containers remain; 31 of them are handed, through the container's environment and mounts, things a bundle has no way to receive — the module's config file, its token or password file, the service's address with the mesh-chosen port, a provision's address, a grants directory. All of it is already on the host or already composed by the controller for the container. The SDK's tool contributor takes an environment the runtime never fills. Three options weighed; A (the bundle declares env on its artifact, composed as a container's, handed per bundle and kept apart) keeps tool code and the composer's vocabulary unchanged and makes the remaining conversion mechanical. What a decision must say is listed; no ADR yet.

Two things from the afternoon of 2026-10-03. **Design 38 WP4**: fail2ban followed the packet filter (mesh-catalog #240, `aa5bf7d`), same shape; proven on all four machines through the runtime — `status`, `banned`, `fail2ban_settings` answer, no `mesh-fail2ban` container, the runtime serving both bundles. Issue 210 noted as resolved the same day. **Research 020 — what a bundled tool is given.** Measured before the other thirty-one move: 33 modules / 36 tool containers remain; 31 of them are handed, through the container's environment and mounts, things a bundle has no way to receive — the module's config file, its token or password file, the service's address with the mesh-chosen port, a provision's address, a grants directory. All of it is already on the host or already composed by the controller for the container. The SDK's tool contributor takes an environment the runtime never fills. Three options weighed; A (the bundle declares `env` on its artifact, composed as a container's, handed per bundle and kept apart) keeps tool code and the composer's vocabulary unchanged and makes the remaining conversion mechanical. What a decision must say is listed; no ADR yet.

mesh-admin added 1 commit 2026-10-03 13:11:21 +00:00

Research 020: what a bundled tool is given; design 38 WP4: fail2ban followed, proven live ee17cddb74

mesh-admin merged commit 65c30c576a into main

2026-10-03 13:11:25 +00:00

mesh-admin deleted branch research/020-what-a-bundled-tool-is-given

2026-10-03 13:11:25 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#319