Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

2026-10-16 07:37:43 +00:00
parent 1a2c917abf
commit 9652b2d5ce
771 changed files with 52063 additions and 1774 deletions
@@ -43,7 +43,7 @@ whenever the node's tool runtime collects the module's tools:
 | file | holds |
 |---|---|
 | `managed-mcp.json` | the tool servers every session loads: the mesh's console as `mesh`, and the servers set in this module's `mcp_servers` setting. **Exclusive**: a server not listed here does not load — not one added with `claude mcp add`, not a project's `.mcp.json`, not a plugin's |
-| `managed-settings.json` | the keys set in this module's `managed_settings` setting — at the controller's terminal alone (hq issue 340) — under the mesh's own keys: the repositories' attribution convention, the claude.ai connectors kept beside the managed servers, the key-helper while the node holds an API-key licence, and the two that name the `nox-mesh` marketplace and enable its plugin |
+| `managed-settings.json` | the keys set in this module's `managed_settings` setting — at the controller's terminal alone (hq issue 340) — under the mesh's own keys: the repositories' attribution convention, the claude.ai connectors kept beside the managed servers, the key-helper while the node holds an API-key licence, git's credential file while the node holds the forge's read credential (below), and the two that name the `nox-mesh` marketplace and enable its plugin |
 | `CLAUDE.md` | how a session on this mesh works, this node's name and role, the conventions, the **"instead of" table** — then the instruction sections registered for every node and for this one |
 | `marketplace/` | the `nox-mesh` plugin (hq ADR 0216): the skills, subagents, commands and output styles registered for every node and for this one, offered in a session as `nox-mesh:<name>` — and the **guard on the agent's shell** (`guard/`), the mesh's own hook and the plugin's only one (hq issue 340). Replaced whole, staged beside and swapped in |

@@ -55,6 +55,17 @@ same content, and never through a directory that is a symbolic link. A placed fi
 alone, and one the person deleted stays deleted until the item is unregistered (hq ADR 0182). The status tool reads the rest of the home's
 items to report them; nothing else is read or written.

+**The forge's read credential** (hq ADR 0365 §4, issue 737). The module requires `gitea-read`, optionally: the forge
+mints this node's agent a token of its own account, `agent-<node>`, scoped to read repositories alone, and the vault
+keeps it for this module on this machine alone (issue 749); it arrives in the state as `gitea-read.secret`, git's
+credential-store lines. Every few seconds the module places them at `~/.config/mesh/forge.credentials` in the agent's
+home, mode 0600, written as the agent's account; puts the file back when git's store helper or a person changed it;
+and takes it back when none is held. A value that is not credential lines (one the mesh made before the forge was
+asked) is never placed. While one is held, `managed-settings.json` gives every session's environment
+`GIT_CONFIG_COUNT`, `GIT_CONFIG_KEY_0=credential.helper` and `GIT_CONFIG_VALUE_0=store --file='<that path>'`: the
+path, never the token. So `git clone` and `git fetch` of what the agent's account may read work with nothing typed,
+printed or put on a command line; pushing stays `gitea_commit`'s, and the forge refuses the token a push.
+
 ## Over NATS

 Everything between this module and the rest of the mesh is NATS, in three kinds: an **event** says that