5 Commits

Include renames

Author	SHA1	Message	Date
jochen	8d8dcd5ebb	lab: a read-only forge account of its own, and no credential left on disk after a stop (hq issue 624, review 196) ... The lab's credential came from the package team, which also writes the @novox packages, and the branches a run clones are not reviewed yet. The lab now contributes {"access": "read"} to its npm-package-registry requirement, and gitea's provisioner puts such a consumer on a team of its own, readers: code read on the org's repositories, package read, no write, and off the package team. The build agent, which publishes, stays on packages. A stop's SIGTERM to the run's process group killed the wrapper before it removed the credential file. The run's script now removes it as soon as its clones are done and traps every way it ends, and a run's start and lab_check remove what a crash or a reboot left.	2026-10-13 14:00:59 +02:00
jochen	0cb0f814b4	Every credential provider says whether it still holds a consumer ... holds() for postgres, mssql, mongodb, minio, lavinmq, mosquitto, mailu and gitea, so the harness makes again a login the backend lost (hq issue 120). Each checks the mesh's password as the consumer presents it, or compares it read-only, and returns false only when the backend says the credential is absent or wrong; an unreachable backend throws.	2026-09-26 01:09:52 +02:00
jschoubben	ed094031fd	The forge mints its own API token with the admin account the vault delivers ... The runtime beside the forge served 0 tools: GiteaClient.fromEnv required a token (settings or MESH_GITEA_TOKEN), nobody had one to give — the mesh raised the forge — and putting one in settings would store a secret in plaintext in the inventory. So the fifteen tools registered nothing and the watcher logged "not watching". What the mesh does deliver is the admin account: a login the manifest names and a password the vault minted and the host unsealed into a file (ADR 0086). That is enough to mint a token, so the module does (hq issue 100, the forge's tools): POST /users/{admin}/tokens over basic auth, scoped to write:repository and write:issue — the least the tools and the repo watcher need — kept at 0600 in the module's own state (/var/lib/mesh/gitea/state, a new directory resource the runtime mounts writable), read back on the next start, and minted afresh when the forge answers 401 to it or the kept file is gone. A forge whose data came from the predecessor has no mesh-admin: that is reported in plain words on every poll until it clears, once per reason, not crash-looped. A configured token still wins and is never minted over. The mint happens on the first call, not at registration: a contributor is synchronous, and a forge not yet answering must not keep the runtime from serving. One source per kept file in a process, or the watcher and the tools would each renew on a 401 and drop the other's token by name.	2026-09-23 23:48:36 +02:00
jschoubben	6e8c18afff	Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation	2026-09-05 12:49:16 +02:00
jschoubben	259c3721b5	gitea: full nox module — client, tools and events (ADR 0044/0046) ... Git hosting. 15 tools (repos, issues, PRs, labels, api passthrough) moved out of the shared sdk. Emits repo.created (from a light poll, catching repos born of git push or the web UI), issue.opened and pull.merged (from the tools at the moment of the action) — the poll owns repo.created alone so it is never announced twice. Typechecks; manifest parses.	2026-09-04 02:30:40 +02:00