--- status: accepted date: 2026-08-23 deciders: jochen reconstructed: false --- # 27. The product is Novox Mesh; Nox is an identity, not a second system ## Context The name `HAL` was never chosen. This began as a dotfiles repository, the first commits in February 2026 adopt dotfiles and per-node overrides, and the name arrived with the code — as recorded in [`03-DESIGN/00-as-is/10-module-catalogue.md`](../03-DESIGN/00-as-is/10-module-catalogue.md), most of the current shape is inherited from that origin rather than designed for a mesh. The name is part of the inheritance. Three things make it worth changing rather than living with. **It is borrowed, and borrowed badly.** HAL is the canonical *untrustworthy* machine intelligence. For infrastructure whose entire proposition is that it manages your machines, heals itself, and is trusted with credentials, that is an unhelpful flag to fly, and it is not a name anyone owns. **There is a name available that is owned.** The company is Novox. A product of Novox should carry that lineage rather than a film reference. **A platform and a persona are different things, and one name was doing both.** `HAL` named the mesh *and*, implicitly, the thing an operator talks to. Those are separate concerns — the platform is what runs; the persona is who answers. ## Considered options 1. **Keep `HAL`.** Rejected. Every reason to keep it is sunk cost, and the sunk cost is at its smallest today. 2. **Rename everything to a single new name covering platform and persona.** Rejected: it repeats the conflation that made `HAL` ambiguous. 3. **Separate the two: a product name and an identity.** Chosen. ## Decision **The product is `Novox Mesh`**, shortened to `mesh` in internal use — repository names, the module namespace, environment variables, paths. **`Nox` is an identity of Novox**, and specifically an **agent identity within the mesh's own model** — a named participant, exactly as [ADR 0012](0012-agents-are-persistent-employees.md) defines one. Not a separate product, not a separate runtime, not a privileged path. **Nox is the agent of the mesh, not of a node.** This is the part that carries weight: - **Every node keeps its own identity.** That already exists and stays — a node is a named participant with its own character, and addressing one directly remains possible and normal. - **Nox is scoped to the whole mesh.** It is what the mesh is called when the mesh itself speaks, rather than one machine within it. - **Nox addresses node identities.** Asking Nox for something that lives on one node is Nox talking to that node, not a human choosing a machine. - **A human mostly talks to Nox.** It is the front door. That last point makes Nox the concrete form of the vision in [`00-META/mission.md`](../00-META/mission.md): *an agent states an intent and the mesh carries it out — no console to open, no runbook to follow, no remembering which node holds which thing.* Nox is who that intent is stated to. The mission described the behaviour; this names the thing that has it. Nox holds no private channel. Whatever it can do, it does through the same surfaces every other agent uses — which is not a naming detail: a persona with its own path would be the one part of the mesh with no human checkpoint, and the skeleton already rules that out. `HAL` is retired. **Timing is the substance of this decision, not an aside.** The skeleton in [research 006](../01-RESEARCH/006-mesh-from-scratch/code-skeleton.md) is not built. Renaming before it exists costs a search and replace across research documents. Renaming after costs the same class of migration as everything else this repository is trying to avoid, and would therefore not happen. ## Consequences - **The as-is layer keeps `HAL`.** It describes what runs, and what runs is called HAL. The to-be layer uses `mesh`. The rename is part of the migration, and the two-layer split ([ADR 0020](0020-design-is-written-in-two-layers.md)) is what makes holding both names coherent rather than confusing. - **Records 0001–0026 keep `HAL`.** They are immutable and they say what was decided when it was decided. No record is edited for a name. - Tier 2 cannot be `mesh-mesh`. The control plane is **`mesh-control`**; `mesh-broker` was rejected because the substrate already contains a message broker. - The namespace, environment variable prefix, service names and on-disk paths all change. In the existing system that is a migration and is not attempted here. - **`mesh` is a generic word**, and it already means something specific in infrastructure — a service mesh is a different thing. Recorded as a known trade rather than an oversight: the full name `Novox Mesh` is distinctive, and the short form is internal. - The persona has a name before it has behaviour. That is the right order — it is an identity in a system that already has a model of identities, so it needs no new machinery to exist. - **Except in one respect, and it is a real gap.** [ADR 0012](0012-agents-are-persistent-employees.md) binds every agent to a home node, one to one, with a workspace on that machine. A mesh-scoped agent has no home node by definition, so the model does not currently have a shape for Nox. Extending it — an agent whose scope is the mesh rather than a machine — is a decision of its own and is not taken here. - Two levels of identity now exist where there was one: the node, and the mesh. The distinction has to stay visible in every surface, or "ask Nox" and "ask a node" collapse into each other and it stops being clear who is answering. ## References - [ADR 0012](0012-agents-are-persistent-employees.md) — what an identity is in this system, and why `Nox` needs no separate mechanism. - [ADR 0020](0020-design-is-written-in-two-layers.md) — why the as-is and to-be layers can legitimately use different names for the same system. - The dotfiles origin, and the naming inheritance it explains: [`03-DESIGN/00-as-is/10-module-catalogue.md`](../03-DESIGN/00-as-is/10-module-catalogue.md).