ADRs 0138 and 0139: an endpoint's reach, and networks forwarded because a module declared them #170

2026-09-28T21:03:48Z

mesh-admin commented

2026-09-28 21:03:48 +00:00

Answers issues 140 and 141. Both are the same rule applied twice: a node's configuration is
composed from the modules assigned to it, and two parts of connectivity were not.

0138 — an assignment binds an endpoint and says how far it reaches. A module declares named
endpoints; a route contribution names an endpoint instead of repeating a port; the assignment binds
each to a machine port and states its reach as internal, public or both. One value, three
readers: the filter's rules, the proxy's names, the certificate's authority. An endpoint that is not
routed — git over ssh — is reached and never named, which the model could not express at all. An
assignment that says nothing keeps the manifest's default, so no converged machine changes until it
speaks. This narrows ADR 0045: its decision stands, but a listen's from is no longer the whole of
public-versus-internal.

0139 — a network is forwarded because a module declared it. The forward chain forwarded two
constants plus the list ADR 0137 added. On the machine measured, six container networks fell outside
the constants: four were the mesh's own module networks, two were the predecessor's leftovers, and any
range wide enough to keep the four keeps the two. So the chain forwards the networks the node's
modules declared, with the host rendering the addresses because the runtime allocates them. This is
derivation from the declaration, not from the machine — neither of 0137's two objections applies — and
0137's mechanism keeps the case it was right for: guests no module declares, such as a test bed's range.

Design 08-connectivity amended with both, since it already held exposure, filtering and certificates
as three separate sections. Issues 140 and 141 moved to located with their owners and
amended-design recorded. records, cycle and index all pass.

Code does not exist yet for either. Next.

Answers issues 140 and 141. Both are the same rule applied twice: a node's configuration is composed from the modules assigned to it, and two parts of connectivity were not. **0138 — an assignment binds an endpoint and says how far it reaches.** A module declares named endpoints; a route contribution names an endpoint instead of repeating a port; the assignment binds each to a machine port and states its reach as `internal`, `public` or `both`. One value, three readers: the filter's rules, the proxy's names, the certificate's authority. An endpoint that is not routed — git over ssh — is reached and never named, which the model could not express at all. An assignment that says nothing keeps the manifest's default, so no converged machine changes until it speaks. This narrows ADR 0045: its decision stands, but a listen's `from` is no longer the whole of public-versus-internal. **0139 — a network is forwarded because a module declared it.** The forward chain forwarded two constants plus the list ADR 0137 added. On the machine measured, six container networks fell outside the constants: four were the mesh's own module networks, two were the predecessor's leftovers, and any range wide enough to keep the four keeps the two. So the chain forwards the networks the node's modules declared, with the host rendering the addresses because the runtime allocates them. This is derivation from the declaration, not from the machine — neither of 0137's two objections applies — and 0137's mechanism keeps the case it was right for: guests no module declares, such as a test bed's range. Design `08-connectivity` amended with both, since it already held exposure, filtering and certificates as three separate sections. Issues 140 and 141 moved to `located` with their owners and `amended-design` recorded. records, cycle and index all pass. Code does not exist yet for either. Next.

mesh-admin added 1 commit 2026-09-28 21:03:48 +00:00

ADRs 0138 and 0139: an assignment binds an endpoint and says how far it reaches, and a network is forwarded because a module declared it 14ff89fa40

Both follow from the same rule the mesh is built on — a node's configuration is
composed from the modules assigned to it. Reach was settled separately by the
filter, the proxy's names and the certificate authority, so "this must not be
public" could not be written; it becomes one value on the assignment that all
three read. And the forward chain consulted two constants plus a typed list
although modules already declare their networks; it now forwards what they
declared, with the host rendering the addresses it allocated.

mesh-admin merged commit 08108b569d into main

2026-09-28 21:03:50 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#170