2026-09-21 08:03:28 +00:00
16 changed files with 34 additions and 24 deletions
@@ -4,6 +4,7 @@ opened: 2026-08-23
 located-in: [hal]
 fixed-by:
  - "the instance only: PR #962 — incus hook. Merged, ran on one node in 6s of a 60s budget; pipeline #6832 green in 48s. The class remains open."
+  - "partly, on the mesh: mesh-host 73c010e, 9d8239a — preflight and the profile detectors ask the daemon, not the package (installed-but-broken reports absent). The class question the report asks of hal is not answered"
 amended-design:
 ---

@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-01
 located-in: [mesh-control, mesh-host]
-fixed-by: partly — mesh-control ee3cc1b
+fixed-by: mesh-controller ee3cc1b (pinned() refuses a placeholder at compose), 43c9c97 (the builder publishes digests); proven by one-node-mesh.test.ts (the catalogue holds no placeholder digest). Six placeholders remain in three manifests deferred under issue 064
 amended-design:
 ---

@@ -2,7 +2,7 @@
 status: located
 opened: 2026-09-01
 located-in: [mesh-control]
-fixed-by: partly — mesh-control 53eb000, withdrawn in 83c6a2f
+fixed-by: partly — mesh-controller f5b03e1 declares the data directories; the gate refusing a container mount the module never declared (53eb000) was withdrawn in 83c6a2f and nothing replaces it
 amended-design:
 ---

@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-01
 located-in: [mesh-host, mesh-control]
-fixed-by:
+fixed-by: mesh-host aa441ba, 652984b (container restart-on, PR #2, under issue 009); proven by mesh-lab runtime-restart-on-config.test.ts
 amended-design:
 ---

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-04
 located-in: []
-fixed-by:
+fixed-by: mesh-host aa441ba (restart-on); mesh-catalog 550393b (runtime config as a mergeable file + restart-on); proven by mesh-lab runtime-restart-on-config.test.ts
 amended-design:
 ---

@@ -2,7 +2,7 @@
 status: open
 opened: 2026-09-02
 located-in: []
-fixed-by:
+fixed-by: partly — mesh-host 24e9ae4 (a run-once step writes a seed only if absent, ADR 0052); mesh-catalog ec1e718 (mosquitto). A file resource itself has no create-once semantic, and no bed asserts a seed's grown content survives a re-apply
 amended-design:
 ---

@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-02
 located-in: [mesh-control, mesh-catalog, mesh-host]
-fixed-by: 02-DECISIONS/0051-shared-data-is-the-operators.md
+fixed-by: ADR 0051 access: mesh-controller aeb65a3, mesh-host f06eea5, mesh-catalog 69c8a5e; proven by mesh-lab assigned-catalogue-media.test.ts (sonarr and radarr share one operator-owned directory)
 amended-design: 02-DECISIONS/0051-shared-data-is-the-operators.md
 ---

@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-05
 located-in: [mesh-control, mesh-host, mesh-catalog]
-fixed-by: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md
+fixed-by: ADR 0052 run-once container: mesh-host 19e5dd8, PR #5 24e9ae4; ADR 0053 scheduled twin 9d1f001; proven by mesh-lab assigned-catalogue-mqtt.test.ts
 amended-design: 02-DECISIONS/0052-a-step-that-runs-once-before-a-container.md
 ---

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-10
 located-in: []
-fixed-by:
+fixed-by: mesh-host cmd/mesh-bootstrap (ADR 0067); mesh-lab genesis.ts is the one description of genesis both beds call. Still open: a running mesh cannot say it was raised by the installer
 amended-design:
 ---

@@ -56,3 +56,12 @@ either way.
 - What is the actual reach of the exposure on a node — which identities can talk to the container
  runtime, and is that set smaller than "anything running as the operator"? The answer decides
  whether this is a hardening item or something sharper.
+
+## Reconciled 2026-09-21
+
+Still open, and worse than reported: the controller's own manifest now delivers its store
+connections **and** its broker credentials through an env-file, so both halves reach the process
+environment; 28 catalogue manifests use env-file for a secret, and nothing in the catalogue
+engine refuses a `${secret:…}` placeholder in one. The vault work of
+[ADR 0085](../../02-DECISIONS/0085-a-secret-is-a-provision.md) rests on the seal this weakens.
+
@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-13
 located-in: []
-fixed-by:
+fixed-by: mesh-host e7f94e0 (restart-on digests folded into the container spec, a standing comparison); unit-tested in apply_test.go, no lab assertion yet
 amended-design:
 ---

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-14
 located-in: []
-fixed-by:
+fixed-by: mesh-controller c8d8211 (forward chain drops by default, never closes ssh), 25e42b3; proven by one-node-mesh.test.ts (a machine filters exactly what its modules declared)
 amended-design:
 ---

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-14
 located-in: []
-fixed-by:
+fixed-by: mesh-controller 3ae7b88, 2b82872; mesh-catalog d2dce34; proven by one-node-mesh.test.ts (the catalogue holds every module the control plane built)
 amended-design:
 ---

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-14
 located-in: []
-fixed-by:
+fixed-by: mesh-controller dda001d (the firewall opens the port the mesh itself runs on), 25e42b3; TestTheBrokersPortIsOpenedThoughNoModuleDeclaresIt
 amended-design:
 ---

@@ -1,8 +1,8 @@
 ---
-status: open
+status: resolved
 opened: 2026-09-15
 located-in: []
-fixed-by:
+fixed-by: mesh-tools b618057 (the SDK resolved by version from the registry, one pin); mesh-host 7986306; mesh-controller 4b9bc50. Caveat: the base image still builds with npm install and no lock, so the build is not reproducible
 amended-design:
 ---