8 Commits

Include renames

Author	SHA1	Message	Date
jochen	13b7562c47	Keep secrets off command lines the runtime records (hq issue 282) ... mosquitto passed the broker's admin password to mosquitto_ctrl as -P on every docker exec, and the container runtime keeps every exec's command line in its event stream, where docker_events returned it. The admin credentials now reach mosquitto_ctrl as a 0600 options file fed on stdin, client passwords at its own prompt, and an argv carrying a secret is refused before it runs. The admin secret says it is taken at start: the bootstrap re-runs when the mesh replaces it and re-keys the broker online from the value it last applied, so it can be rotated. docker_events redacts what an exec's command line carried, and docker_secrets_in_events names such secrets by name. keycloak's repair hands kcadm its passwords through KC_CLI_PASSWORD; minio gives mc its root alias through MC_HOST_mesh.	2026-10-07 01:37:21 +02:00
jochen	685cb1cb1b	Declare every module's data; the backup holder measures it (hq ADR 0233) ... Backup lines are derived from each module's data section instead of written by hand; the holder measures declared items, reads the array under them, and deletes a retired item only after a last restore point; the Go providers say each held consumer's size so an empty replacement is seen.	2026-10-06 16:47:49 +02:00
jochen	2c15074a0b	Retire only once the same answer has held ten minutes as well as five passes ... Five passes are twenty-five seconds, shorter than a controller restart, a store reconnecting or a file half written; the operator asked for both (hq ADR 0230).	2026-10-06 14:28:21 +02:00
jochen	e68ef88333	Retire a consumer the mesh stops asking for, and delete only on a person's word (hq ADR 0230) ... The hourly release of ADR 0229's brake still ended in the mesh acting alone on a mistake. A consumer now stays active until the same unasked set holds for five passes, waits for a person past three or half of those held, is disabled and marked rather than withdrawn, comes back as it was when asked again, and is deleted only through the provider's delete tool. The backend keeps the mark, so a restart forgets nothing and finds what was withdrawn before.	2026-10-06 13:54:10 +02:00
jochen	4238dd8616	Name the SDK harness the Go loop follows: 0.1.11, with the withdrawal brake	2026-10-06 12:29:21 +02:00
jochen	2c151e7c21	Brake a withdrawal larger than its bound (hq to-be 45 Phase 2, ADR 0227 rule 4) ... Issue 241 withdrew seven consumers in one pass on one misread file; its fix refuses a file it cannot read, and a file read whole that names nobody still withdraws everybody. A pass that would withdraw more than one consumer at once, or more than half of those it holds, now withdraws nothing: each consumer it kept is announced provisioner.failing with the class withdrawal-braked, so the controller raises it as a condition and the operator is told, and one is let go each hour while the mesh goes on not asking for them. A consumer asked for again is kept and said recovered. Postgres and keycloak carry the harness identically.	2026-10-06 12:29:21 +02:00
jochen	48d4188927	keycloak repair: remove the temporary admin even when the bootstrap failed after making it ... The bootstrap once created the temporary admin and then failed on a held port; marked only after it succeeded, the cleanup did not know the admin existed and left it.	2026-10-06 00:17:35 +02:00
jochen	77fb1ecfb2	keycloak: port to Go and repair an admin that refuses the mesh's secret ... Twice the identity provider's admin kept an older password than the one the mesh minted (an adopted, then a moved database), and the provisioner failed every consumer until it was repaired by hand (hq issue 179). The module now checks the admin's login and repairs a refusal itself through the server's bootstrap command, verifies, brakes a failed repair and announces it, and stops asking the server while refused. Ported to Go to change it.	2026-10-06 00:13:42 +02:00