jschoubben
da6414c27c
ADR 0069 had already placed the controller's manifest in its own repository, and the raising design called the catalogue copy a thing to remove. The installer's step 3 was handed that manifest by the build and step 9 read a second copy anyway.
2.1 KiB
status, opened, located-in, fixed-by, amended-design
| status | opened | located-in | fixed-by | amended-design | ||
|---|---|---|---|---|---|---|
| located | 2026-09-21 |
|
03-DESIGN/01-to-be/17-raising-a-mesh.md |
The controller's manifest exists twice, and nothing keeps the copies equal
Symptom, as observed
The control plane's manifest lives at the root of its own repository, where the mesh reads it
whenever it builds the controller from source, and again in the catalogue under
modules/mesh-controller, where the installer reads it at genesis. The two differ only in how the
image is named — a build section in one, a placeholder digest in the other — and are otherwise
meant to be the same document.
Changing the catalogue copy alone (to make the controller read its credentials from files,
ADR 0086) produced a mesh that
installed correctly and then could not be pushed to: the first rebuild of the controller from
source replaced the mesh's record with the repository's copy, which still carried the old shape,
and every later push of the node was refused on the controller's behalf. status reported the
machine as doing what it was told throughout, because nothing had been sent.
Why it matters beyond this instance
- One module, two sources of truth. ADR 0069 says a module is a repository and a path; the controller has two paths, and which one the mesh believes depends on which command last touched it.
- The failure is silent at the wrong layer. The divergence surfaces as a resolution refusal on an unrelated push, not as a warning that the copies differ.
- It will happen again to whoever next edits the controller's manifest for any reason.
What would close it
Either the catalogue copy goes and genesis reads the controller's manifest from the controller's repository (the installer already has the checkout, since it builds from it), or a check refuses two copies that differ outside the image lines. The first is the honest one.