9 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	0f1d4c5e0f	pacman reads a node's declared packages in the node-engine seat's layout, not go/delivery's (B5e; ADR 0634 §1, §4; issue 1966) ... Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i	2026-11-05 15:39:13 +01:00
jschoubben	4497f26257	pacman reads a node's declared packages from the node-engine alone (ADR 0565 clause 6) ... The controller's declared-packages mirror ended with its lease: the view no longer falls back to it, the manifest no longer reads it, and a node whose engine wrote no key is named in the answer (declared_none) instead. The fallback rows of the view test became the no-key and unreadable-engine cases; no test added. (issue 774, 774/S7) Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-02 00:12:53 +01:00
jschoubben	37613ec6a9	pacman reads the node-engine's packages as mesh-host.packages, the bucket each engine writes (ADR 0565 clause 6, issue 1953) ... The read node-engine.packages named a bucket node-engine_packages that nothing writes: the engine's manifest is mesh-host's, so its state is mesh-host_packages, read as disk-load reads mesh-host.data. The view still names which source answered, the engine's key or the controller's mirror. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 16:09:50 +01:00
jschoubben	1db0181920	pacman reads the node-engine's packages first and the controller's mirror per node until the lease write; compare counts only an indexer that was read, and a forge not heard is said in the row (review round 1) ... Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 09:54:07 +01:00
jschoubben	1d3e2b8aca	pacman reads the node-engine's packages, not the controller's declared-packages mirror (ADR 0565 clause 6, issue 1953) ... Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 09:53:59 +01:00
jschoubben	098c6d3ec7	Place pacman's state outside the package manager's own directory, and refuse a module directory in a system package's (issue 1841) ... pacman's state directory said place ".", which resolves to /var/lib/pacman: the package manager's database directory. The node-engine used it as found and reported it unhealthy on every machine, and wrote keeper.json into it. It is now the mesh's directory for the module (place "mesh", /var/lib/mesh/pacman), as docker's is; keeper.json, the keeper's bus secret and the root helper's socket follow through ${dir:state}. checks/owned rule 5 refuses a directory that is, lies in or holds a /var/lib directory a system package owns (checks/owned/system, read from shanks through pacman_owns and tmpfiles.d), and any resource inside one. systemd and postgres collide today and are listed in checks/owned/system-known under issue 1873; that list only shrinks.	2026-10-22 21:19:15 +02:00
jschoubben	28ef6e9e27	issue 1841/S9: carry out the upgrade's root acts through a root helper on a socket only the keeper opens, so no sudo rule lets the keeper's account run anything as root (ADR 0510)	2026-10-22 17:34:20 +02:00
jschoubben	f550f1c6b2	issue 1841/S8: upgrade the nodes one at a time in a weekly round in upgrade-order, stopping at a failure and passing a node only on the operator's Approve, so one bad upgrade never reaches every machine	2026-10-22 14:44:17 +02:00
jschoubben	eb717cc514	Declare the pacman keeper and its bus shapes, so upgrades run as rounds on the bus instead of a weekly timer on every node at once (issue 1841/S1, with 1840/S5's manifest) ... The keeper process runs under its own account with a bus account of its own, keeps the six states and emits the nine events of ADR 0507 and ADR 0508; its config (upgrade-order, record-days, round-start-minutes) lands in its config file and restarts it. shapes.go fixes every key's value and event body as the interface the keeper and the verbs share. The weekly timer and its service are dropped, which the node-engine removes.	2026-10-22 14:23:22 +02:00