jschoubben
b163ed1fcc
The packet filter generates its rules from what modules declare they listen on. The broker is not a module, so it declares nothing, so its port is not opened. Every machine dials that port to enrol and to receive every declaration it is ever sent. Invisible where it is assembled and fatal on the next machine: a mesh of one never dials its own broker across the network, so the ruleset looks right. The first machine to join is refused at the packet filter during enrolment, several steps from anything that reports it — and assigning the firewall before joining machines is both the natural order and the one that breaks. This is 051 in a second place. That issue says the substrate cannot be updated because the mesh holds no record of it; the same absence means the firewall cannot know it exists. Ssh is already a floor for the same reason — a machine nobody can reach is a machine nobody can repair — and the broker may be the same class of fact. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx
04-ISSUES
The front door for "something is wrong" at the level of the mesh's design or governance. Diagnosis happens here, where the whole mesh is in view; the fix lands in the owning code repository.
What belongs here
| Belongs here | Belongs in the knowledge base |
|---|---|
| The design permits a failure to be silent | How to fix one occurrence of it |
| A documented rule is enforced by nothing | A command that works around it |
| A stated invariant is false in practice | A node-specific quirk |
| The owner is unknown and finding it needs the whole mesh in view | Symptom → fix, once the answer is known |
The knowledge base already holds the operational record and is indexed on symptoms. This folder is not a second copy of it. An issue here is a question HQ must answer; an entry there is an incident someone must clear. An issue whose answer is a general lesson belongs in both.
Structure
NNN-short-name/
00-report.md the symptom as observed, with the evidence; status in frontmatter
01-diagnosis.md the investigation trail, dated, including what was ruled out
Frontmatter, on 00-report.md
---
status: open | diagnosing | located | resolved | wontfix
opened: YYYY-MM-DD
located-in: [] # owning repo(s) or module(s), filled by diagnosis
fixed-by: # pull request or commit reference, filled at resolution
amended-design: # design doc path, when the root cause was a design gap
---
Rules
- Anyone may open an issue. No localisation is required to report one.
- The full flow is playbook
00-META/process/03-issues.md. - Closed issues are never deleted — they are the mesh's symptom-to-component memory.
wontfixis legitimate and requires a sentence saying why.