jochen
fa2c09a2c5
A secret comes into being seven ways today: provider credentials, own secrets (54 modules), broker accounts through a command that is easy to forget, a vault that only records what the controller mints (6 modules), operator values, licences, and root secrets. The vault was built to end own secrets and did not; the old path was never retired. 0113 is rewritten as a waterfall. The vault makes every secret and nothing else does. A provider that needs a secret for a consumer requires it from the vault, declared once in its provision's contract and expanded per consumer by resolution; the vault delivers it to both holders, each sealed to its own node, so a provider's code is unchanged. Own secrets, broker passwords, operator values and licence credentials take the same path. Genesis is not an exception: it raises the vault first and asks it, so there is one way a secret is made from the first one on. The vault can sit at the bottom because it requires nothing but a broker account. One shared mint function in the SDK was considered and rejected: generation becomes uniform but custody stays spread over every provider's machine, and each SDK language needs its own implementation. Rotation is asked of the vault and is provider-first: the value goes to the holder that accepts it, which confirms, before the holder that presents it gets it, so the lockout window shrinks to the consumer's own restart, and an unconfirmed provider holds the rotation rather than half-doing it. The host derives which processes to restart or recreate from the requirement a definition reads, so no definition declares restart-on for a secret. A rotation shows unconfirmed until each consumer restarted and passed its health check. Issue 103 becomes a prerequisite. The file is renamed to match what it now decides. 0112 follows.
8.9 KiB
8.9 KiB
03-DESIGN / 01-to-be
The mesh being built toward. Every statement here traces to a record in
02-DECISIONS/; nothing arrives by drafting.
A document here describes an intention. What currently runs is in
00-as-is/, and the two are never merged — when something ships, the as-is
document is written and this one's status becomes implemented.
| Document | Covers | Rests on |
|---|---|---|
00-work-breakdown.md |
How modules move across one at a time, until the old registry can be switched off | ADR 0001, ADR 0016 |
01-end-to-end-testing.md |
The lab: a real mesh a change can be run against before it reaches nodes | ADR 0016, 0029 |
02-scenario-declaration.md |
What a scenario declares — the underlay, and what to place on it | ADR 0016 |
03-scenario-lifecycle.md |
What happens to a scenario — raise, snapshot, restore, move, destroy | ADR 0016 |
04-lab-installation.md |
Getting the lab onto a clean machine, and why it verifies capability rather than installation | ADR 0010 |
05-the-node-host.md |
Tier 0 — the one thing installed by hand, and the only thing that changes a machine | ADR 0005 |
06-the-controller.md |
Tier 2 — what the term means, and the test for what belongs in it | ADR 0005 |
07-the-foundation.md |
Tier 1 — what the controller consumes and cannot grant itself | ADR 0004, 0048 |
08-connectivity.md |
One context in full — overlay, resolution, exposure, filtering, certificates | ADR 0007, 0050, 0051, 0055 |
09-the-node-lifecycle.md |
How a machine becomes a node, stays one, and stops being one | ADR 0004, 0051 |
10-delivery.md |
Modules, the three edges, and how a change becomes a running thing | ADR 0010, 0064, 0065 |
11-a-board.md |
What a person sees of the mesh, and why it is read from what runs | ADR 0008, ADR 0001 |
12-a-module-repository.md |
A module repository, and what builds it | ADR 0009, ADR 0010, ADR 0005 |
13-credentials-and-their-rotation.md |
Credentials, and moving them without a consumer holding one the provider does not know about | ADR 0001, ADR 0009 |
14-model-access.md |
Model access as a provision, and what a licence is bound to | ADR 0024, ADR 0009 |
15-the-agent-session.md |
One mechanism started twice — a node's session and the mesh's | ADR 0004, ADR 0026 |
16-module-coverage.md |
What a module must be able to say, measured against 127 that exist | ADR 0009, ADR 0005 |
17-raising-a-mesh.md |
How a mesh comes into existence, and how a machine joins one that exists | ADR 0067, ADR 0006, ADR 0005 |
18-building-a-module.md |
How a build is modelled, and why a recipe that is always a Dockerfile does not fit what a module is | ADR 0040, ADR 0039, ADR 0009 |
19-the-module-protocol.md |
What a module's code and the mesh say to each other; an SDK is an implementation of it | ADR 0074, ADR 0042, ADR 0043 |
20-writing-a-module.md |
A worked guide: one module, four capabilities, four languages, and the packages it publishes | ADR 0074, ADR 0040, ADR 0039 |
21-the-installation-in-full.md |
Every step from a bare machine to a mesh that maintains itself, and what is not yet true | ADR 0067, ADR 0073, ADR 0014 |
22-the-work-ahead.md |
Everything decided and not yet built, in dependency order, each phase ending at a run | ADR 0074, ADR 0075, ADR 0014 |
23-choosing-a-provider.md |
Which of several providers of a kind serves a consumer, and when a module carries its own instead | ADR 0084, ADR 0027 |
24-the-secrets-vault.md |
The module that owns a secret — a secret provision, and the boundary of what it owns |
ADR 0085, ADR 0031, ADR 0048 |
26-the-seats.md |
What a mesh can have one of, who fills each, and a seat's holder answering for the provision it delivers — including the git seat a build's source can live on |
ADR 0110, ADR 0111, ADR 0109 |
27-a-module-requires-the-mesh-resolves.md |
Proposed. One concept for everything a module needs: a requirement with a contract, answered by one of four kinds of provider, resolved at assignment or refused. Retires settings, placeholders, facts and paths in definitions | ADR 0112, ADR 0113, ADR 0110 |
Not yet written
- The remaining six contexts.
ADR 0006
settles the list at seven;
connectivityis the first written in full (08) and the other six do not exist yet. The work breakdown says in what order they are needed. Domain grouping outside the core.Not needed. ADR 0009 is superseded by ADR 0009: there is no domain module to group into, so there is no domain list to settle. Relationships are edges, and grouping is a tag and a query.