novox/hq

Files

T

jschoubben 87f4f29cc6 Novox Mesh, Nox, and HQ becomes company-scoped

ADR 0027 — the product is Novox Mesh, shortened to mesh internally. HAL was
never chosen: it arrived with the dotfiles repository this grew out of, it
is borrowed, and it is borrowed from the canonical untrustworthy machine
intelligence, which is an odd flag for infrastructure trusted with
credentials. Timing is the substance of the decision, not an aside — the
skeleton is not built, so renaming costs a search and replace now and a
migration later.

Nox is an identity of Novox, and specifically the agent of the MESH rather
than of a node. Nodes keep their own identities. Nox addresses them, and a
human mostly talks to Nox — which makes it the concrete form of the
mission's vision: state an intent, and the mesh works out which node holds
the thing. It holds no private channel. The gap this opens is recorded:
ADR 0012 binds every agent to a home node, and a mesh-scoped agent has
none, so the model needs extending.

ADR 0028 — HQ is company-scoped, novox/hq, with the mesh as its first
product. Checked rather than assumed: the company organisation already
holds live projects that the mesh builds and deploys, so they are tenants
rather than peers, and the mesh is the ground they stand on. There is also
company work outside the mesh already, which strengthens the case and means
the eventual split is closer than "some day" — so each document's scope is
fixed now, in a table, making that split mechanical instead of
archaeological. The folders are deliberately not restructured yet.

The skeleton takes the new vocabulary: mesh-host, mesh-substrate,
mesh-control, mesh-surfaces, mesh-catalog. Substrate drops to four services
now that identity is a hosted workload rather than a dependency.

Research 009 opens the migration, with the reframing that lowers its risk:
replace the control plane, do not move the workloads. Their data never
moves, so it is re-declared rather than adopted — which keeps adoption out
of scope, as the lab design requires. Self-hosting is the last phase, or a
failed cutover takes away the means to fix it.

2026-08-23 21:20:35 +02:00

6.0 KiB

Raw Blame History

status, date, deciders, reconstructed

status	date	deciders	reconstructed
accepted	2026-08-23	jochen	false

27. The product is Novox Mesh; Nox is an identity, not a second system

Context

The name HAL was never chosen. This began as a dotfiles repository, the first commits in February 2026 adopt dotfiles and per-node overrides, and the name arrived with the code — as recorded in 03-DESIGN/00-as-is/10-module-catalogue.md, most of the current shape is inherited from that origin rather than designed for a mesh. The name is part of the inheritance.

Three things make it worth changing rather than living with.

It is borrowed, and borrowed badly. HAL is the canonical untrustworthy machine intelligence. For infrastructure whose entire proposition is that it manages your machines, heals itself, and is trusted with credentials, that is an unhelpful flag to fly, and it is not a name anyone owns.

There is a name available that is owned. The company is Novox. A product of Novox should carry that lineage rather than a film reference.

A platform and a persona are different things, and one name was doing both. HAL named the mesh and, implicitly, the thing an operator talks to. Those are separate concerns — the platform is what runs; the persona is who answers.

Considered options

Keep HAL. Rejected. Every reason to keep it is sunk cost, and the sunk cost is at its smallest today.
Rename everything to a single new name covering platform and persona. Rejected: it repeats the conflation that made HAL ambiguous.
Separate the two: a product name and an identity. Chosen.

Decision

The product is Novox Mesh, shortened to mesh in internal use — repository names, the module namespace, environment variables, paths.

Nox is an identity of Novox, and specifically an agent identity within the mesh's own model — a named participant, exactly as ADR 0012 defines one. Not a separate product, not a separate runtime, not a privileged path.

Nox is the agent of the mesh, not of a node. This is the part that carries weight:

Every node keeps its own identity. That already exists and stays — a node is a named participant with its own character, and addressing one directly remains possible and normal.
Nox is scoped to the whole mesh. It is what the mesh is called when the mesh itself speaks, rather than one machine within it.
Nox addresses node identities. Asking Nox for something that lives on one node is Nox talking to that node, not a human choosing a machine.
A human mostly talks to Nox. It is the front door.

That last point makes Nox the concrete form of the vision in 00-META/mission.md: an agent states an intent and the mesh carries it out — no console to open, no runbook to follow, no remembering which node holds which thing. Nox is who that intent is stated to. The mission described the behaviour; this names the thing that has it.

Nox holds no private channel. Whatever it can do, it does through the same surfaces every other agent uses — which is not a naming detail: a persona with its own path would be the one part of the mesh with no human checkpoint, and the skeleton already rules that out.

HAL is retired.

Timing is the substance of this decision, not an aside. The skeleton in research 006 is not built. Renaming before it exists costs a search and replace across research documents. Renaming after costs the same class of migration as everything else this repository is trying to avoid, and would therefore not happen.

Consequences

The as-is layer keeps HAL. It describes what runs, and what runs is called HAL. The to-be layer uses mesh. The rename is part of the migration, and the two-layer split (ADR 0020) is what makes holding both names coherent rather than confusing.
Records 0001–0026 keep HAL. They are immutable and they say what was decided when it was decided. No record is edited for a name.
Tier 2 cannot be mesh-mesh. The control plane is mesh-control; mesh-broker was rejected because the substrate already contains a message broker.
The namespace, environment variable prefix, service names and on-disk paths all change. In the existing system that is a migration and is not attempted here.
mesh is a generic word, and it already means something specific in infrastructure — a service mesh is a different thing. Recorded as a known trade rather than an oversight: the full name Novox Mesh is distinctive, and the short form is internal.
The persona has a name before it has behaviour. That is the right order — it is an identity in a system that already has a model of identities, so it needs no new machinery to exist.
Except in one respect, and it is a real gap. ADR 0012 binds every agent to a home node, one to one, with a workspace on that machine. A mesh-scoped agent has no home node by definition, so the model does not currently have a shape for Nox. Extending it — an agent whose scope is the mesh rather than a machine — is a decision of its own and is not taken here.
Two levels of identity now exist where there was one: the node, and the mesh. The distinction has to stay visible in every surface, or "ask Nox" and "ask a node" collapse into each other and it stops being clear who is answering.

References

ADR 0012 — what an identity is in this system, and why Nox needs no separate mechanism.
ADR 0020 — why the as-is and to-be layers can legitimately use different names for the same system.
The dotfiles origin, and the naming inheritance it explains: 03-DESIGN/00-as-is/10-module-catalogue.md.

6.0 KiB Raw Blame History Unescape Escape