jochen
b5512bed32
The operator's wish written as intended behaviour for the NATS bus: every loop compares against what is, repairs by the ordinary path, never destroys, and raises a condition for what it cannot fix. What is done before NATS is limited to what survives the move.
2.5 KiB
status, initiated, touches
| status | initiated | touches | |||||||
|---|---|---|---|---|---|---|---|---|---|
| active | 2026-09-26 |
|
017 — A mesh that heals itself
What. The behaviour the operator wants: a mesh that runs itself. It notices what is wrong, repairs what it can, and hands what it cannot repair to someone who can, with the reason. This effort writes that wish down as intended behaviour, designed for the bus the mesh is moving to (ADR 0106: NATS). It also records what can be done pragmatically before that move.
Why. The mission is a mesh that controls itself (mission). The
mesh can tell whether it is up. It cannot tell whether it is right. The as-is page on observability says so
(as-is 09). To-be 06 names an
observability context in the controller and leaves its store undecided. Nothing routes a condition
the mesh cannot fix to anyone. The cost is measurable: 46 of the 116 issue reports in this
repository describe a failure that was silent. A mesh that heals itself is, first, a mesh that stops
failing silently.
What it touches. The controller's observability context, the node lifecycle's liveness, delivery (ADR 0010, ADR 0083), the provisioner harness, and rotation, which is proposed alongside to-be 27 as ADR 0114.
Documents.
- 01 — The intended behaviour: the wish, as principles and as how the mesh behaves once the bus is NATS.
- 02 — Now, pragmatically: what is done before NATS, why it does not build anything the move would throw away, and what has been done already.
Next. Two measurements this effort owes before it can graduate:
- Every loop in the mesh: what it converges, and whether it compares against observed state or against its own memory. Issue 120 found the provisioner harness trusting memory. The same pattern is expected elsewhere.
- The 46 silent failures, classified: a missing observation, a loop trusting memory, or a missing escalation. That shows which mechanism removes the most of them.