jschoubben
77f3a4cea7
Every remaining cluster merged. Each was one design that had been split across
several records because it was worked out over days rather than at once.
the node host 8 -> 1 applies not decides, depends on nothing,
per operating system, root service, the
launcher, episodic, what a declaration is,
actions from the bundle only
a node and how it joins 4 -> 1 what a node is, joining, the link as
security boundary, the enrolment token
modules and the graph 7 -> 1 everything is a module, no domain modules,
three edges, provisioning, the core library
substrate and control 6 -> 1 the test, seven contexts, one control plane,
plane the authority is not a database, the named
products, the pinned bundle
connectivity 3 -> 1 a route is a grant, reachability declared,
filter rules
delivery 5 -> 1 reconciliation not a pipeline, artifacts,
the three silos, a failed step, the verdict
the lab 5 -> 1 (earlier)
how this repository 10 -> 1 (earlier)
works
Nothing was dropped. Each consolidated record carries the reasoning of the ones
it absorbs -- the measurements, the incidents, the alternatives rejected --
because that reasoning is the only reason to keep a record at all. What is gone
is the fragmentation: eight files to read to understand tier 0, when tier 0 is
one component.
The four superseded records went too. They existed to point at their
successors, and the successors now contain what they said.
The checker made this safe. Each merge left dangling links -- 38 files after
the host merge alone -- and it named every one. Nothing was found by reading,
and a manual pass would certainly have missed some, including references inside
AGENTS.md which every session loads.
3.4 KiB
layer, status, code, updated, decisions
| layer | status | code | updated | decisions | |||
|---|---|---|---|---|---|---|---|
| as-is | implemented |
|
2026-08-23 |
|
Interfaces and observability
How the mesh is reached, and how anyone can tell what it is doing.
Capabilities are the primary interface
The mesh's primary interface is not a web console. It is a set of capabilities, exposed to a session and callable in language.
A capability is contributed by a module and is available on any node, wherever it actually runs: local ones directly, remote ones through a stand-in created at startup that forwards over the broker. The caller does not know the difference, and the credentials never move.
This is the mesh's stated vision made concrete — an agent states an intent and the mesh works out which node holds the thing. It is also why a capability's schema is load-bearing in a way that is easy to underestimate: a parameter name that collides with the transport's own reserved names breaks the call, and a validation-library version mismatch has silently dropped every argument while the call still appeared to succeed.
The board
A web interface presents the mesh — nodes, modules, pipelines, agents, work. It is a view. Its own guidance is that shared logic belongs in the mesh's library rather than inline in the board, precisely so the board does not quietly become a second implementation of the mesh's rules.
Public exposure
Nodes carrying a public name run a reverse proxy as the sole entry point. A module declares the names its interfaces answer on, portably, and the proxy's configuration is generated from those declarations rather than written — generated files are marked as such and anything hand-written beside them is left alone.
Nodes without a public role use a local equivalent with locally-trusted certificates. The generation step degrades quietly on a node with no proxy, which is intended and is one more place where "nothing happened" is the correct outcome and looks identical to a failure.
Certificate issuance currently always targets the public authority's production endpoint,
which consumes real quota for every experiment
(04-ISSUES/004).
Health
Nodes run checks and report. The mesh's health surface answers whether things are up.
What it does not answer is whether they are correct, and that gap is the recurring theme of this whole system: the deploy path reports transport rather than effect, so absence reads as success. A check that confirms a service is running does not confirm the service is running the code that was just deployed, and a node has been left on old code with a version marker that had already advanced.
Thoughts
Every node's daemon runs a periodic loop that surfaces observations from that node's own context. They are stored in the mesh and can inform a session or trigger action.
It is the one part of the mesh that is not request-driven — the mesh noticing things rather than being asked.
The honest summary
Observability tells you the mesh is up. Establishing that it is right currently means reading the operational record and checking by hand.
That is the gap the lab is designed to close
(01-to-be/01-end-to-end-testing.md): a place where a
change can be run end to end and a verdict produced, cheaply enough that producing one is
routine.