Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

One commit with exactly the tree of the reviewed head 35b4509c0a, on main 12c2574c9d, so two compiled programs added and removed on the branch leave no trace in history (issue 1577).
2026-10-30 02:21:51 +01:00
parent 12c2574c9d
commit 35ff67bda0
331 changed files with 24352 additions and 1792 deletions
@@ -0,0 +1,87 @@
+{
+  "module": "mesh-self-check",
+  "version": "1",
+  "runs-as": "mesh-self-check",
+  "claims": [
+    {
+      "name": "mesh-self-check",
+      "scope": "mesh",
+      "serves": [
+        "doctor",
+        "probes"
+      ]
+    }
+  ],
+  "invokes": [
+    "nats.nats_streams",
+    "nats.nats_closed_connections",
+    "seat:mesh-watchdogs.signals",
+    "seat:node-intrusion-prevention.banned"
+  ],
+  "reads": [
+    "mesh-delivery-assigner.placement",
+    "mesh-delivery-assigner.seat-holders",
+    "mesh-delivery-watchman.presence",
+    "mesh-host.health",
+    "disk-load.readings",
+    "restic.good",
+    "mesh-delivery-indexer.modules",
+    "mesh-delivery-indexer.manifests"
+  ],
+  "state": [
+    "findings",
+    "verdict",
+    {
+      "name": "verdicts",
+      "ttl-seconds": 604800
+    }
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-self-check",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-self-check",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-self-check"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-self-check",
+      "place": ".",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-self-check",
+        "binary": "mesh-self-check",
+        "loads": [
+          "mesh-self-check"
+        ]
+      }
+    ]
+  },
+  "config": {
+    "probes": {
+      "type": "list",
+      "description": "The ids of the probes that run, each judging one thing of the mesh (mesh-self-check.probes lists them with what each asserts). A probe not listed runs nothing and raises nothing, and what it raised before is cleared. D8 and DA are in the code and off by default.",
+      "trusted": true,
+      "default": [
+        "D13",
+        "D-fill"
+      ],
+      "runtime": true
+    }
+  }
+}