6 Commits

Include renames

Author	SHA1	Message	Date
jochen	789d2d9d64	lab: clone the forge with the credential the mesh binds and seals to the lab (hq issue 624) ... mesh-tools-go is private, and the lab cloned over HTTP with no credential: a run failed at its checkout, "could not read Username". The lab now requires the package registry, as the build agent does; the forge's provisioner binds it an account and seals that account's password, and a run offers them to the forge's own origin through git's credential store, from a file beside the run and removed when it ends: never in a URL, the run's script, an argument or the log. lab_check reads every repository a run clones with that same credential and names one it cannot read.	2026-10-13 13:54:16 +02:00
jochen	685cb1cb1b	Declare every module's data; the backup holder measures it (hq ADR 0233) ... Backup lines are derived from each module's data section instead of written by hand; the holder measures declared items, reads the array under them, and deletes a retired item only after a last restore point; the Go providers say each held consumer's size so an empty replacement is seen.	2026-10-06 16:47:49 +02:00
jochen	f015aba34a	sudo: declare the operator account's passwordless escalation as a module ... Three modules' tools act through `sudo -n` and nothing declared that the account may; each machine said so in a hand-set line in /etc/sudoers. The module owns the package and /etc/sudoers.d/10-mesh-operator (0440), checked by visudo in its manifest test, and serves sudo_rules, sudo_check and sudo_drop_ins from a Go bundle. lab stops declaring the sudo package, which would collide with this module on the node that runs both (hq ADR 0207, to-be 42 Phase 1).	2026-10-04 12:50:20 +02:00
jochen	59c42b2086	lab: its tools run in the node's runtime (hq ADR 0198) ... The mesh-lab container goes with its Dockerfile, build bases, bus credential and state directory. What the image installed — git, make, python, file, iproute2, sudo, npm, go and the incus client — are packages of the machine, and docker and incus are reached through their sockets as the runtime's account. The forge is an operator's setting, which reaches a file and never a bundle's words, so the tools read it from the env-file the mesh already fills, at each call; that is the one code change.	2026-10-04 00:52:31 +02:00
jschoubben	b3865d240f	lab: declares the virtualisation capability, which grants its daemon's socket	2026-10-02 14:48:10 +02:00
jschoubben	67d1a400e8	lab: the lab as a module, running beds when the mesh asks ... Five tools on the machine the lab runs on: check, run beds against branches on the forge, a run's status, its log, and stop. A run checks out every repository the lab builds, side by side, and runs the suite; one at a time, answered at once with an id (novox/hq ADR 0172).	2026-10-02 14:15:42 +02:00