jschoubben
87f4f29cc6
ADR 0027 — the product is Novox Mesh, shortened to mesh internally. HAL was never chosen: it arrived with the dotfiles repository this grew out of, it is borrowed, and it is borrowed from the canonical untrustworthy machine intelligence, which is an odd flag for infrastructure trusted with credentials. Timing is the substance of the decision, not an aside — the skeleton is not built, so renaming costs a search and replace now and a migration later. Nox is an identity of Novox, and specifically the agent of the MESH rather than of a node. Nodes keep their own identities. Nox addresses them, and a human mostly talks to Nox — which makes it the concrete form of the mission's vision: state an intent, and the mesh works out which node holds the thing. It holds no private channel. The gap this opens is recorded: ADR 0012 binds every agent to a home node, and a mesh-scoped agent has none, so the model needs extending. ADR 0028 — HQ is company-scoped, novox/hq, with the mesh as its first product. Checked rather than assumed: the company organisation already holds live projects that the mesh builds and deploys, so they are tenants rather than peers, and the mesh is the ground they stand on. There is also company work outside the mesh already, which strengthens the case and means the eventual split is closer than "some day" — so each document's scope is fixed now, in a table, making that split mechanical instead of archaeological. The folders are deliberately not restructured yet. The skeleton takes the new vocabulary: mesh-host, mesh-substrate, mesh-control, mesh-surfaces, mesh-catalog. Substrate drops to four services now that identity is a hosted workload rather than a dependency. Research 009 opens the migration, with the reframing that lowers its risk: replace the control plane, do not move the workloads. Their data never moves, so it is re-declared rather than adopted — which keeps adoption out of scope, as the lab design requires. Self-hosting is the last phase, or a failed cutover takes away the means to fix it.
113 lines
6.0 KiB
Markdown
113 lines
6.0 KiB
Markdown
---
|
||
status: accepted
|
||
date: 2026-08-23
|
||
deciders: jochen
|
||
reconstructed: false
|
||
---
|
||
|
||
# 27. The product is Novox Mesh; Nox is an identity, not a second system
|
||
|
||
## Context
|
||
|
||
The name `HAL` was never chosen. This began as a dotfiles repository, the first commits in
|
||
February 2026 adopt dotfiles and per-node overrides, and the name arrived with the code — as
|
||
recorded in
|
||
[`03-DESIGN/00-as-is/10-module-catalogue.md`](../03-DESIGN/00-as-is/10-module-catalogue.md),
|
||
most of the current shape is inherited from that origin rather than designed for a mesh. The
|
||
name is part of the inheritance.
|
||
|
||
Three things make it worth changing rather than living with.
|
||
|
||
**It is borrowed, and borrowed badly.** HAL is the canonical *untrustworthy* machine
|
||
intelligence. For infrastructure whose entire proposition is that it manages your machines,
|
||
heals itself, and is trusted with credentials, that is an unhelpful flag to fly, and it is not
|
||
a name anyone owns.
|
||
|
||
**There is a name available that is owned.** The company is Novox. A product of Novox should
|
||
carry that lineage rather than a film reference.
|
||
|
||
**A platform and a persona are different things, and one name was doing both.** `HAL` named the
|
||
mesh *and*, implicitly, the thing an operator talks to. Those are separate concerns — the
|
||
platform is what runs; the persona is who answers.
|
||
|
||
## Considered options
|
||
|
||
1. **Keep `HAL`.** Rejected. Every reason to keep it is sunk cost, and the sunk cost is at its
|
||
smallest today.
|
||
2. **Rename everything to a single new name covering platform and persona.** Rejected: it
|
||
repeats the conflation that made `HAL` ambiguous.
|
||
3. **Separate the two: a product name and an identity.** Chosen.
|
||
|
||
## Decision
|
||
|
||
**The product is `Novox Mesh`**, shortened to `mesh` in internal use — repository names, the
|
||
module namespace, environment variables, paths.
|
||
|
||
**`Nox` is an identity of Novox**, and specifically an **agent identity within the mesh's own
|
||
model** — a named participant, exactly as
|
||
[ADR 0012](0012-agents-are-persistent-employees.md) defines one. Not a separate product, not a
|
||
separate runtime, not a privileged path.
|
||
|
||
**Nox is the agent of the mesh, not of a node.** This is the part that carries weight:
|
||
|
||
- **Every node keeps its own identity.** That already exists and stays — a node is a named
|
||
participant with its own character, and addressing one directly remains possible and normal.
|
||
- **Nox is scoped to the whole mesh.** It is what the mesh is called when the mesh itself
|
||
speaks, rather than one machine within it.
|
||
- **Nox addresses node identities.** Asking Nox for something that lives on one node is Nox
|
||
talking to that node, not a human choosing a machine.
|
||
- **A human mostly talks to Nox.** It is the front door.
|
||
|
||
That last point makes Nox the concrete form of the vision in
|
||
[`00-META/mission.md`](../00-META/mission.md): *an agent states an intent and the mesh carries
|
||
it out — no console to open, no runbook to follow, no remembering which node holds which
|
||
thing.* Nox is who that intent is stated to. The mission described the behaviour; this names
|
||
the thing that has it.
|
||
|
||
Nox holds no private channel. Whatever it can do, it does through the same surfaces every other
|
||
agent uses — which is not a naming detail: a persona with its own path would be the one part of
|
||
the mesh with no human checkpoint, and the skeleton already rules that out.
|
||
|
||
`HAL` is retired.
|
||
|
||
**Timing is the substance of this decision, not an aside.** The skeleton in
|
||
[research 006](../01-RESEARCH/006-mesh-from-scratch/code-skeleton.md) is not built. Renaming
|
||
before it exists costs a search and replace across research documents. Renaming after costs the
|
||
same class of migration as everything else this repository is trying to avoid, and would
|
||
therefore not happen.
|
||
|
||
## Consequences
|
||
|
||
- **The as-is layer keeps `HAL`.** It describes what runs, and what runs is called HAL. The
|
||
to-be layer uses `mesh`. The rename is part of the migration, and the two-layer split
|
||
([ADR 0020](0020-design-is-written-in-two-layers.md)) is what makes holding both names
|
||
coherent rather than confusing.
|
||
- **Records 0001–0026 keep `HAL`.** They are immutable and they say what was decided when it
|
||
was decided. No record is edited for a name.
|
||
- Tier 2 cannot be `mesh-mesh`. The control plane is **`mesh-control`**; `mesh-broker` was
|
||
rejected because the substrate already contains a message broker.
|
||
- The namespace, environment variable prefix, service names and on-disk paths all change. In
|
||
the existing system that is a migration and is not attempted here.
|
||
- **`mesh` is a generic word**, and it already means something specific in infrastructure — a
|
||
service mesh is a different thing. Recorded as a known trade rather than an oversight: the
|
||
full name `Novox Mesh` is distinctive, and the short form is internal.
|
||
- The persona has a name before it has behaviour. That is the right order — it is an identity in
|
||
a system that already has a model of identities, so it needs no new machinery to exist.
|
||
- **Except in one respect, and it is a real gap.**
|
||
[ADR 0012](0012-agents-are-persistent-employees.md) binds every agent to a home node, one to
|
||
one, with a workspace on that machine. A mesh-scoped agent has no home node by definition, so
|
||
the model does not currently have a shape for Nox. Extending it — an agent whose scope is the
|
||
mesh rather than a machine — is a decision of its own and is not taken here.
|
||
- Two levels of identity now exist where there was one: the node, and the mesh. The distinction
|
||
has to stay visible in every surface, or "ask Nox" and "ask a node" collapse into each other
|
||
and it stops being clear who is answering.
|
||
|
||
## References
|
||
|
||
- [ADR 0012](0012-agents-are-persistent-employees.md) — what an identity is in this system, and
|
||
why `Nox` needs no separate mechanism.
|
||
- [ADR 0020](0020-design-is-written-in-two-layers.md) — why the as-is and to-be layers can
|
||
legitimately use different names for the same system.
|
||
- The dotfiles origin, and the naming inheritance it explains:
|
||
[`03-DESIGN/00-as-is/10-module-catalogue.md`](../03-DESIGN/00-as-is/10-module-catalogue.md).
|