4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	e0bf87c2e3	Give /var/lib/systemd and /var/lib/postgres back to their packages, and keep the modules' files in their own directories (issue 1873) ... The systemd and postgres modules' state directories said place ".", which is /var/lib/systemd and /var/lib/postgres: directories the systemd and postgresql packages own (root 0755; postgres 0700). The node-engine took both before issue 339's rule and gave them to the operator's account, 0700, on every machine; postgres's grants directory, placed by default, lay inside /var/lib/postgres too. What each module keeps moves to a directory of its own, "data", placed "mesh" (/var/lib/mesh/systemd, /var/lib/mesh/postgres): the unlink record, and postgres's own secrets (the same values: the vault keys them by name), consumers.json and grants. The store's data stays /var/lib/mesh-store, untouched. The node-engine keeps no found owner or mode for a directory, and forgets one no longer declared as it stands; it sets the declared owner and mode on a directory it recorded at the same path under the same id. So for this delivery "state" names the package's directory with the package's owner and mode, and the engine gives it back; the next change drops "state". The postgres container is recreated, its secret's volume moving. checks/owned/system-known keeps systemd state and postgres state, declared for this delivery only; postgres's consumers and grants leave the list.	2026-10-22 21:31:58 +02:00
jschoubben	098c6d3ec7	Place pacman's state outside the package manager's own directory, and refuse a module directory in a system package's (issue 1841) ... pacman's state directory said place ".", which resolves to /var/lib/pacman: the package manager's database directory. The node-engine used it as found and reported it unhealthy on every machine, and wrote keeper.json into it. It is now the mesh's directory for the module (place "mesh", /var/lib/mesh/pacman), as docker's is; keeper.json, the keeper's bus secret and the root helper's socket follow through ${dir:state}. checks/owned rule 5 refuses a directory that is, lies in or holds a /var/lib directory a system package owns (checks/owned/system, read from shanks through pacman_owns and tmpfiles.d), and any resource inside one. systemd and postgres collide today and are listed in checks/owned/system-known under issue 1873; that list only shrinks.	2026-10-22 21:19:15 +02:00
mesh-tools	bf8f47ce66	Let ssh-client use the SDK's forgekey, and let the checks accept a module's own .ssh (issues 1480, 1484), part 2 of 17	2026-10-20 20:44:30 +00:00
mesh-tools	652b00b25b	Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422) ... Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.	2026-10-17 16:23:03 +00:00