build-agent: the build machine as a node role every machine can hold (hq ADR 0190)

The builder's manifest with one change that matters: it claims node-build-agent, a node seat, so it
is assignable to every machine with a container runtime, and every holder pulls one build at a time
from the role's one work queue. A tier of many images is then built by as many machines as hold the
seat and are online. The builder module stays until this is assigned where it was; then it goes.

modules/build-agent/Dockerfile

@@ -0,0 +1,25 @@
+ARG GO_BASE
+ARG ALPINE_BASE
+# build-agent's image: the build machine itself, compiled into a container (novox/hq ADR 0190).
+#
+# **The source is not vendored here.** builder's actual code — cmd/mesh-builder, internal/builder,
+# internal/catalogue — lives in the mesh-controller repository, the same control plane it is one
+# half of. This module ships the packaging, not a second copy of the source, so the build context
+# is the mesh-controller repository root (declared under build.artifacts[].context), and this
+# Dockerfile compiles ./cmd/mesh-builder from it — the same shape route-proxy already uses for the
+# same reason.
+FROM ${GO_BASE} AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /mesh-builder ./cmd/mesh-builder
+
+# Unlike mesh-controller's own FROM scratch (ADR 0006: nothing to audit but one binary), the build
+# machine's whole job is shelling out to git and docker — it needs a real userland to do that in,
+# not a second copy of either tool vendored into this image. apk installs both from the base's own
+# packages, not fetched on its own at build time.
+FROM ${ALPINE_BASE}
+RUN apk add --no-cache docker-cli git
+COPY --from=build /mesh-builder /usr/local/bin/mesh-builder
+ENTRYPOINT ["/usr/local/bin/mesh-builder"]

modules/build-agent/README.md

@@ -0,0 +1,15 @@
+# build-agent
+
+The mesh's build machine as a role every machine can hold (novox/hq ADR 0190). It holds the node seat
+`node-build-agent`: every holder pulls one build at a time from the role's one work queue when it is
+idle, so a tier of many images is built by as many machines as hold the seat and are online, and a
+machine that is off builds nothing and blocks nothing. The controller asks the role, never a machine;
+the outcome names the machine that built it.
+
+What a holding machine needs is what the builder always needed, said here once: a container runtime
+(the socket is mounted), the artifact store and the package registry as provisions, a workspace, and
+the bus credential. The code is `cmd/mesh-builder` in the mesh-controller repository, compiled from
+that repository's main (`build.artifacts[].context`); this module ships the packaging.
+
+Assign it to every machine with a container runtime. It replaces `builder`, the one-holder form of the
+same thing; retire that once this is assigned where it was.

modules/build-agent/module.json

@@ -0,0 +1,88 @@
+{
+  "module": "build-agent",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "claims": [
+    {
+      "name": "node-build-agent",
+      "scope": "node"
+    }
+  ],
+  "requires": [
+    "artifact-store",
+    "npm-package-registry"
+  ],
+  "binds": {
+    "npm-package-registry": "${dir:mesh-state}/package-registry.json"
+  },
+  "secrets": {
+    "npm-package-registry": "${dir:mesh-state}/package-registry.secret"
+  },
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
+    {
+      "id": "workspace",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "agent-env",
+      "type": "file",
+      "path": "${dir:mesh-state}/build-agent.env",
+      "mode": "0600",
+      "content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=${dir:workspace}\n"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mesh-build-agent",
+      "artifact": "server",
+      "env-file": [
+        "${dir:mesh-state}/build-agent.env"
+      ],
+      "volumes": [
+        "${dir:mesh-state}:/run/mesh:ro",
+        "${dir:workspace}:${dir:workspace}",
+        "/var/run/docker.sock:/var/run/docker.sock"
+      ],
+      "restart-on": [
+        "agent-env"
+      ],
+      "network": "host"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "image",
+        "from": "Dockerfile",
+        "context": {
+          "seat": "git",
+          "repository": "novox/mesh-controller",
+          "ref": "main"
+        }
+      }
+    ],
+    "on": [
+      {
+        "arg": "GO_BASE",
+        "image": "golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c"
+      },
+      {
+        "arg": "ALPINE_BASE",
+        "image": "alpine@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc"
+      }
+    ]
+  }
+}

modules/fail2ban/Dockerfile

@@ -0,0 +1,23 @@
+# fail2ban's runtime: the tool runtime, carrying the intrusion prevention's verbs and the client they
+# speak through.
+#
+# Built from this module's own directory and nothing else (novox/hq ADR 0069). Two bases, named in
+# module.json's `build.on`: the image this is compiled in and the image it runs in.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/fail2ban
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+# The daemon runs on the machine, declared by this module; what runs here is only its client, which
+# speaks to the daemon over the socket the machine shares into this container (novox/hq ADR 0179).
+# The package brings the client and the daemon together; the daemon is never started here.
+RUN apt-get update \
+      && apt-get install -y --no-install-recommends fail2ban \
+      && rm -rf /var/lib/apt/lists/*
+COPY --from=build /app/modules/fail2ban/dist /app/modules/fail2ban/dist
+ENV MESH_TOOL_MODULES=/app/modules/fail2ban/dist/tools/index.js

modules/fail2ban/client.ts

@@ -1,51 +1,204 @@
-// fail2ban's own code, in the module (novox/hq ADR 0039). The jails and the daemon are declared
-// resources — the mesh writes /etc/fail2ban/jail.d/* and keeps fail2ban.service running (see
-// module.json). This code exists only to read and steer the *live* state the daemon owns at
-// runtime: which IPs are banned right now, and the manual ban/unban an operator reaches for. That
-// state (the running bans, /var/lib/fail2ban's sqlite) is fail2ban's, not the mesh's — the mesh
-// reconciles the config, never the ban list.
+// fail2ban's own code, in the module (novox/hq ADR 0039). The jails are composed by the mesh from
+// the modules a machine runs (to-be 31) and written as declared resources; the daemon is kept
+// running by one. This code exists only to read and steer the *live* state the daemon owns: who is
+// banned now and until when, and the ban or release an operator asks for — the node-intrusion-
+// prevention seat's four verbs (ADR 0179). The daemon's state is fail2ban's, not the mesh's: the
+// mesh composes the jails and never writes the ban list.
+//
+// Spoken through fail2ban-client over the daemon's socket, which the machine shares into this
+// runtime; so the client here is the one from the runtime's own package and the daemon is the
+// machine's, and the two meet at /var/run/fail2ban/fail2ban.sock.
 
 import { execFile } from "node:child_process";
+import { isIP } from "node:net";
 import { promisify } from "node:util";
 
-const run = promisify(execFile);
+const execFileP = promisify(execFile);
+
+/** A command runner, so the verbs can be tested without a daemon. */
+export type Runner = (cmd: string, args: string[]) => Promise<string>;
+
+export const execRunner: Runner = async (cmd, args) => {
+  try {
+    const { stdout } = await execFileP(cmd, args, { maxBuffer: 16 * 1024 * 1024 });
+    return stdout;
+  } catch (err) {
+    const e = err as { code?: string | number; stderr?: string; stdout?: string; message?: string };
+    const said = `${e.stdout ?? ""}${e.stderr ?? ""}`.trim();
+    if (e.code === "ENOENT") throw new Error(`${cmd} is not in this runtime`);
+    if (/Failed to access socket path|Is fail2ban running/i.test(said)) {
+      throw new Error("fail2ban is not running on this machine, or its socket is not shared with this runtime");
+    }
+    // fail2ban-client's own last line is the one a person reads ("Sorry but the jail 'x' does not exist").
+    const lines = said.split("\n").map((l) => l.trim()).filter(Boolean);
+    throw new Error(lines.length ? lines[lines.length - 1] : (e.message ?? `${cmd} failed`));
+  }
+};
+
+/** One jail as the daemon reports it. */
+export interface JailStatus {
+  jail: string;
+  /** What the jail is reading: files or journal matches, as fail2ban names them. */
+  watching: string[];
+  /** Addresses with failures counted against them right now, and all failures since the jail started. */
+  failing: { now: number; total: number };
+  /** Addresses held right now, and all bans since the jail started. */
+  banned: { now: number; total: number; addresses: string[] };
+}
+
+/** One ban as the daemon holds it. */
+export interface Ban {
+  ip: string;
+  jail: string;
+  /** When the ban was placed, in the machine's local time as fail2ban prints it. */
+  since: string;
+  /** When the ban ends; "never" for a permanent ban. */
+  until: string;
+}
+
+export interface JailSettings {
+  jail: string;
+  bantime: string;
+  findtime: string;
+  maxretry: number;
+  ignoreip: string[];
+  actions: string[];
+  /** The log files the jail reads, when it reads files. */
+  logpath: string[];
+  /** The journal match the jail reads, when it reads the journal. */
+  journalmatch: string;
+}
 
 export class Fail2banClient {
+  private readonly run: Runner;
+
+  constructor(run: Runner = execRunner) {
+    this.run = run;
+  }
+
   static fromEnv(_env: NodeJS.ProcessEnv = process.env): Fail2banClient {
     return new Fail2banClient();
   }
 
-  /** Overview of every jail, or the detailed status of one — currently-banned IPs and totals. */
-  async status(jail?: string): Promise<string> {
+  private client(...args: string[]): Promise<string> {
+    return this.run("fail2ban-client", args);
+  }
+
+  /** The jails the daemon runs, by name. */
+  async jails(): Promise<string[]> {
+    const out = await this.client("status");
+    const m = out.match(/Jail list:\s*(.*)/);
+    if (!m) return [];
+    return m[1].split(",").map((j) => j.trim()).filter(Boolean);
+  }
+
+  /** Every jail with what it watches and holds, or one jail's detail. */
+  async status(jail?: string): Promise<{ jails: JailStatus[] }> {
+    const names = jail ? [jail] : await this.jails();
+    const jails: JailStatus[] = [];
+    for (const name of names) {
+      jails.push(parseJailStatus(name, await this.client("status", name)));
+    }
+    return { jails };
+  }
+
+  /** Every address banned now, with the jail holding it and when the ban ends. */
+  async banned(jail?: string): Promise<{ banned: Ban[] }> {
+    const names = jail ? [jail] : await this.jails();
+    const banned: Ban[] = [];
+    for (const name of names) {
+      banned.push(...parseBans(name, await this.client("get", name, "banip", "--with-time")));
+    }
+    banned.sort((a, b) => a.until.localeCompare(b.until) || a.ip.localeCompare(b.ip));
+    return { banned };
+  }
+
+  /** Ban one address in one jail now. The daemon's own answer is how many addresses it added. */
+  async ban(ip: string, jail: string): Promise<{ banned: Ban | null; added: number }> {
+    address(ip);
+    name(jail);
+    const out = await this.client("set", jail, "banip", ip);
+    const added = Number.parseInt(out.trim(), 10) || 0;
+    const held = (await this.banned(jail)).banned.find((b) => b.ip === ip) ?? null;
+    return { banned: held, added };
+  }
+
+  /** Let one address go, from one jail or from every jail. The daemon's answer is how many it released. */
+  async unban(ip: string, jail?: string): Promise<{ released: number; ip: string; jail: string | "every jail" }> {
+    address(ip);
+    let out: string;
     if (jail) {
-      const { stdout } = await run("sudo", ["fail2ban-client", "status", jail]);
-      return stdout;
+      name(jail);
+      out = await this.client("set", jail, "unbanip", ip);
+    } else {
+      out = await this.client("unban", ip);
     }
-    const { stdout: overview } = await run("sudo", ["fail2ban-client", "status"]);
-    const match = overview.match(/Jail list:\s*(.+)/);
-    if (!match) return overview;
-
-    const jails = match[1].split(",").map((j) => j.trim()).filter(Boolean);
-    const parts: string[] = [overview.trimEnd(), ""];
-    for (const j of jails) {
-      const { stdout } = await run("sudo", ["fail2ban-client", "status", j]);
-      parts.push(`=== ${j} ===`, stdout.trimEnd(), "");
-    }
-    return parts.join("\n");
+    return { released: Number.parseInt(out.trim(), 10) || 0, ip, jail: jail ?? "every jail" };
   }
 
-  /** Manually ban an IP in a jail. Mutates live state, not a mesh-managed file. */
-  async ban(jail: string, ip: string): Promise<string> {
-    const { stdout } = await run("sudo", ["fail2ban-client", "set", jail, "banip", ip]);
-    return stdout;
-  }
-
-  /** Unban an IP from one jail, or from every jail when no jail is given. */
-  async unban(ip: string, jail?: string): Promise<string> {
-    const args = jail
-      ? ["fail2ban-client", "set", jail, "unbanip", ip]
-      : ["fail2ban-client", "unban", ip];
-    const { stdout } = await run("sudo", args);
-    return stdout;
+  /** One jail's effective settings — the module's own tool, beside the seat's verbs. */
+  async settings(jail: string): Promise<JailSettings> {
+    name(jail);
+    const get = (key: string) => this.client("get", jail, key);
+    const [bantime, findtime, maxretry, ignoreip, actions, logpath, journalmatch] = await Promise.all([
+      get("bantime"), get("findtime"), get("maxretry"), get("ignoreip"), get("actions"), get("logpath"),
+      get("journalmatch"),
+    ]);
+    return {
+      jail,
+      bantime: bantime.trim(),
+      findtime: findtime.trim(),
+      maxretry: Number.parseInt(maxretry.trim(), 10),
+      ignoreip: listed(ignoreip),
+      actions: actions.split("\n").slice(1).map((l) => l.trim()).filter(Boolean),
+      logpath: /No file is currently monitored/.test(logpath) ? [] : listed(logpath),
+      journalmatch: journalmatch.split("\n").slice(1).map((l) => l.trim()).filter(Boolean).join(" "),
+    };
   }
 }
+
+/** fail2ban's tree listings: lines like "|- 127.0.0.0/8" and "`- ::1", after a heading. */
+function listed(out: string): string[] {
+  return out
+    .split("\n")
+    .map((l) => l.replace(/^[\s|`-]+/, "").trim())
+    .filter((l, i) => i > 0 && l.length > 0);
+}
+
+export function parseJailStatus(jail: string, out: string): JailStatus {
+  const field = (label: string) => {
+    const m = out.match(new RegExp(label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + ":\\t?\\s*(.*)"));
+    return m ? m[1].trim() : "";
+  };
+  const num = (label: string) => Number.parseInt(field(label), 10) || 0;
+  const watching = [field("File list"), field("Journal matches")].filter(Boolean);
+  return {
+    jail,
+    watching,
+    failing: { now: num("Currently failed"), total: num("Total failed") },
+    banned: {
+      now: num("Currently banned"),
+      total: num("Total banned"),
+      addresses: field("Banned IP list").split(/\s+/).filter(Boolean),
+    },
+  };
+}
+
+/** `get <jail> banip --with-time` prints one ban per line: "IP \tsince + seconds = until". */
+export function parseBans(jail: string, out: string): Ban[] {
+  const bans: Ban[] = [];
+  for (const line of out.split("\n")) {
+    const m = line.match(/^(\S+)\s+(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) \+ (-?\d+) = (\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}|\S+)/);
+    if (!m) continue;
+    bans.push({ ip: m[1], jail, since: m[2], until: Number(m[3]) < 0 ? "never" : m[4] });
+  }
+  return bans;
+}
+
+function address(ip: string): void {
+  if (!isIP(ip)) throw new Error(`${JSON.stringify(ip)} is not an address`);
+}
+
+function name(jail: string): void {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(jail)) throw new Error(`${JSON.stringify(jail)} is not a jail's name`);
+}

modules/fail2ban/module.json

@@ -7,9 +7,25 @@
   "claims": [
     {
       "name": "node-intrusion-prevention",
-      "scope": "node"
+      "scope": "node",
+      "serves": [
+        "status",
+        "banned",
+        "ban",
+        "unban"
+      ]
     }
   ],
+  "tools": [
+    "fail2ban_settings"
+  ],
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "jailing": {
+    "into": "/etc/fail2ban/jail.d/mesh.conf",
+    "filter-into": "/etc/fail2ban/filter.d"
+  },
   "resources": [
     {
       "id": "package",
@@ -28,19 +44,37 @@
       "path": "/etc/fail2ban/action.d",
       "mode": "0755"
     },
+    {
+      "id": "filter-d",
+      "type": "directory",
+      "path": "/etc/fail2ban/filter.d",
+      "mode": "0755"
+    },
+    {
+      "id": "run-dir",
+      "type": "directory",
+      "path": "/var/run/fail2ban",
+      "mode": "0755"
+    },
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
     {
       "id": "jail-local",
       "type": "file",
       "path": "/etc/fail2ban/jail.local",
       "mode": "0644",
-      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\n# Ban through iptables, not through a firewall front-end the machine may not have. ufw is\n# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out\n# only at ban time: the service reports healthy, the jail counts the attempt, the ban command\n# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a\n# machine the mesh reported as protected.\n#\n# The action below is this module's own, already used by the recidive jail on every machine\n# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is\n# covered too.\nbanaction = iptables-allports-dualchain\nbanaction_allports = iptables-allports-dualchain\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
+      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\n# **A ban list never holds a neighbour.** The mesh's own range is named rather than written\n# (novox/hq ADR 0112), and every private range beside it: a source on one is somebody's own\n# network, not the internet. On a machine behind a router that reflects local traffic, every\n# client in the house arrives as the gateway's address — so one mistyped local request banned\n# 192.168.1.1 on the home server and would have cut the whole house off from it (ADR 0186).\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range} 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10\n\n# Three failures in a day ban for a day (novox/hq ADR 0179). The attackers this mesh sees pace\n# themselves at one try every ten minutes, under any ten-minute window; a day's window counts\n# them, and a day's ban costs a person who mistyped three times once, from one address, while\n# the mesh's own range is never banned at all.\nbantime  = 1d\nfindtime = 1d\nmaxretry = 3\n\n# Ban through iptables, not through a firewall front-end the machine may not have. ufw is\n# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out\n# only at ban time: the service reports healthy, the jail counts the attempt, the ban command\n# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a\n# machine the mesh reported as protected.\n#\n# The action below is this module's own, already used by the recidive jail on every machine\n# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is\n# covered too.\nbanaction = iptables-allports-dualchain\nbanaction_allports = iptables-allports-dualchain\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
     },
     {
       "id": "jail-sshd",
       "type": "file",
       "path": "/etc/fail2ban/jail.d/sshd.conf",
       "mode": "0644",
-      "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 5\n"
+      "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 3\nfindtime = 1d\nbantime  = 1d\n"
     },
     {
       "id": "log",
@@ -55,7 +89,7 @@
       "type": "file",
       "path": "/etc/fail2ban/jail.d/recidive.conf",
       "mode": "0644",
-      "content": "[recidive]\nenabled = true\nlogpath  = /var/log/fail2ban.log\n# Ban in both INPUT (host services like SSH) and DOCKER-USER (container services)\nbanaction = iptables-allports-dualchain\nbantime  = 1w\nfindtime = 1d\n"
+      "content": "[recidive]\nenabled = true\nlogpath  = /var/log/fail2ban.log\n# Ban in both INPUT (host services like SSH) and DOCKER-USER (container services)\nbanaction = iptables-allports-dualchain\n# Banned twice in two weeks, by any jail, is banned for four (novox/hq ADR 0179).\nbantime  = 4w\nfindtime = 2w\nmaxretry = 2\n"
     },
     {
       "id": "action-dualchain",
@@ -81,8 +115,44 @@
         "jail-local",
         "jail-sshd",
         "jail-recidive",
-        "action-dualchain"
+        "action-dualchain",
+        "composed-jails"
       ]
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-fail2ban",
+      "artifact": "runtime",
+      "network": "host",
+      "volumes": [
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "/var/run/fail2ban:/var/run/fail2ban"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker"
+      }
     }
-  ]
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
 }

modules/fail2ban/package.json

@@ -1,14 +1,18 @@
 {
   "name": "@novox/module-fail2ban",
   "version": "0.1.0",
-  "description": "fail2ban — intrusion prevention: the mesh declares the jails and keeps the daemon running; its ban/unban/status tools live here.",
+  "description": "fail2ban \u2014 intrusion prevention: the mesh composes the jails and keeps the daemon running; this module holds the node-intrusion-prevention seat and serves its verbs status, banned, ban and unban (novox/hq to-be 31, ADR 0179).",
   "type": "module",
   "private": true,
   "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
+    "@novox/mesh-sdk": "^0.1.1"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0"
+  },
+  "scripts": {
+    "build": "tsc client.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
+    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
   }
 }

modules/fail2ban/test/client.test.ts

@@ -0,0 +1,106 @@
+// The intrusion prevention's verbs over a fake daemon, with the shapes fail2ban-client 1.1.0 printed
+// on the control node on 2026-10-02 (novox/hq ADR 0179).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { Fail2banClient, parseBans, parseJailStatus, type Runner } from "../client.ts";
+
+const STATUS = "Status\n|- Number of jail:\t2\n`- Jail list:\trecidive, sshd\n";
+const RECIDIVE =
+  "Status for the jail: recidive\n|- Filter\n|  |- Currently failed:\t36\n|  |- Total failed:\t149\n" +
+  "|  `- File list:\t/var/log/fail2ban.log\n`- Actions\n   |- Currently banned:\t9\n   |- Total banned:\t13\n" +
+  "   `- Banned IP list:\t195.178.110.30 45.148.10.240 92.118.39.71\n";
+const SSHD =
+  "Status for the jail: sshd\n|- Filter\n|  |- Currently failed:\t5\n|  |- Total failed:\t11776\n" +
+  "|  `- Journal matches:\t_SYSTEMD_UNIT=sshd.service + _COMM=sshd\n`- Actions\n   |- Currently banned:\t0\n" +
+  "   |- Total banned:\t150\n   `- Banned IP list:\t\n";
+const WITH_TIME =
+  "195.178.110.30 \t2026-09-26 23:18:47 + 604800 = 2026-10-03 23:18:47\n" +
+  "92.118.39.71 \t2026-09-28 10:33:49 + 604800 = 2026-10-05 10:33:49\n";
+
+function fake(answers: Record<string, string>, calls: string[][] = []): Runner {
+  return async (cmd, args) => {
+    calls.push([cmd, ...args]);
+    const key = args.join(" ");
+    if (key in answers) return answers[key];
+    throw new Error(`unexpected ${cmd} ${key}`);
+  };
+}
+
+test("a jail's status is read into numbers, what it watches and who it holds", () => {
+  const s = parseJailStatus("recidive", RECIDIVE);
+  assert.deepEqual(s, {
+    jail: "recidive",
+    watching: ["/var/log/fail2ban.log"],
+    failing: { now: 36, total: 149 },
+    banned: { now: 9, total: 13, addresses: ["195.178.110.30", "45.148.10.240", "92.118.39.71"] },
+  });
+  const j = parseJailStatus("sshd", SSHD);
+  assert.deepEqual(j.watching, ["_SYSTEMD_UNIT=sshd.service + _COMM=sshd"]);
+  assert.deepEqual(j.banned, { now: 0, total: 150, addresses: [] });
+});
+
+test("status covers every jail the daemon lists, or the one named", async () => {
+  const calls: string[][] = [];
+  const f = new Fail2banClient(fake({ status: STATUS, "status recidive": RECIDIVE, "status sshd": SSHD }, calls));
+  const all = await f.status();
+  assert.deepEqual(all.jails.map((j) => j.jail), ["recidive", "sshd"]);
+  const one = await f.status("sshd");
+  assert.equal(one.jails.length, 1);
+  assert.deepEqual(calls[calls.length - 1], ["fail2ban-client", "status", "sshd"]);
+});
+
+test("bans are read with when they were placed and when they end, a permanent one as never", () => {
+  const bans = parseBans("recidive", WITH_TIME + "203.0.113.9 \t2026-10-01 00:00:00 + -1 = never\n");
+  assert.equal(bans.length, 3);
+  assert.deepEqual(bans[0], { ip: "195.178.110.30", jail: "recidive", since: "2026-09-26 23:18:47", until: "2026-10-03 23:18:47" });
+  assert.equal(bans[2].until, "never");
+  assert.deepEqual(parseBans("sshd", "\n"), []);
+});
+
+test("banned gathers every jail's bans, soonest to end first", async () => {
+  const f = new Fail2banClient(fake({
+    status: STATUS,
+    "get recidive banip --with-time": WITH_TIME,
+    "get sshd banip --with-time": "198.51.100.7 \t2026-10-02 15:06:58 + 600 = 2026-10-02 15:16:58\n",
+  }));
+  const { banned } = await f.banned();
+  assert.deepEqual(banned.map((b) => `${b.ip}@${b.jail}`), ["198.51.100.7@sshd", "195.178.110.30@recidive", "92.118.39.71@recidive"]);
+});
+
+test("ban asks the daemon by jail and answers with the ban as held; a non-address is refused before anything runs", async () => {
+  const calls: string[][] = [];
+  const f = new Fail2banClient(fake({
+    "set recidive banip 198.51.100.7": "1\n",
+    "get recidive banip --with-time": WITH_TIME + "198.51.100.7 \t2026-10-02 17:00:00 + 604800 = 2026-10-09 17:00:00\n",
+  }, calls));
+  const r = await f.ban("198.51.100.7", "recidive");
+  assert.equal(r.added, 1);
+  assert.equal(r.banned?.until, "2026-10-09 17:00:00");
+  assert.deepEqual(calls[0], ["fail2ban-client", "set", "recidive", "banip", "198.51.100.7"]);
+  await assert.rejects(() => f.ban("not-an-ip", "recidive"), /is not an address/);
+  await assert.rejects(() => f.ban("198.51.100.7", "a jail; rm"), /is not a jail's name/);
+  assert.equal(calls.length, 2);
+});
+
+test("unban releases from one jail or from every jail", async () => {
+  const calls: string[][] = [];
+  const f = new Fail2banClient(fake({ "set sshd unbanip 198.51.100.7": "1\n", "unban 198.51.100.7": "2\n" }, calls));
+  assert.deepEqual(await f.unban("198.51.100.7", "sshd"), { released: 1, ip: "198.51.100.7", jail: "sshd" });
+  assert.deepEqual(await f.unban("198.51.100.7"), { released: 2, ip: "198.51.100.7", jail: "every jail" });
+  assert.deepEqual(calls[1], ["fail2ban-client", "unban", "198.51.100.7"]);
+});
+
+test("a jail's settings are read from the daemon's listings", async () => {
+  const f = new Fail2banClient(fake({
+    "get sshd bantime": "86400\n", "get sshd findtime": "86400\n", "get sshd maxretry": "3\n",
+    "get sshd ignoreip": "These IP addresses/networks are ignored:\n|- 127.0.0.0/8\n|- 10.10.0.0/24\n`- ::1\n",
+    "get sshd actions": "The jail sshd has the following actions:\niptables-allports-dualchain\n",
+    "get sshd logpath": "No file is currently monitored\n",
+    "get sshd journalmatch": "Current match filter:\n_SYSTEMD_UNIT=sshd.service + _COMM=sshd\n",
+  }));
+  assert.deepEqual(await f.settings("sshd"), {
+    jail: "sshd", bantime: "86400", findtime: "86400", maxretry: 3,
+    ignoreip: ["127.0.0.0/8", "10.10.0.0/24", "::1"], actions: ["iptables-allports-dualchain"],
+    logpath: [], journalmatch: "_SYSTEMD_UNIT=sshd.service + _COMM=sshd",
+  });
+});

modules/fail2ban/tools/index.ts

@@ -1,55 +1,62 @@
-// fail2ban's tools — reading and steering the live ban state. The jails themselves are declared
-// resources (module.json); these three touch what the running daemon holds: what is banned now,
-// and the manual ban/unban an operator reaches for. The daemon's state is fail2ban's own, so this
-// is the only way to see or change it — the mesh reconciles the config, not the bans.
+// The intrusion prevention's tools: the node-intrusion-prevention seat's four verbs — who is banned,
+// the jails' state, ban one, let one go — and the module's own reading of a jail's settings
+// (novox/hq to-be 31, ADR 0179). The jails themselves are composed by the mesh from the modules a
+// machine runs and written as declared resources; these touch only what the running daemon holds.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { Fail2banClient } from "../client.js";
 
-export function getFail2banTools(fail2ban: Fail2banClient): ToolDefinition[] {
+export function getSeatVerbs(fail2ban: Fail2banClient): ToolDefinition[] {
   return [
     {
-      name: "fail2ban_status",
+      name: "status",
       description:
-        "fail2ban status on this node — the jails and their live bans. Omit `jail` for every jail, or name one for its detail.",
-      input: {
-        type: "object",
-        properties: {
-          jail: {
-            type: "string",
-            description: "A specific jail (e.g. sshd, recidive); omit for the overview of all jails.",
-          },
-        },
-      },
-      run: async (args) => ({ status: await fail2ban.status(args.jail as string | undefined) }),
+        "Every jail on this machine with what it watches, how many addresses it is counting failures against and holding now, and the totals since it started; one jail's detail when named.",
+      input: { jail: { type: "string", description: "one jail (optional)" } },
+      run: async (args) => fail2ban.status(args.jail ? String(args.jail) : undefined),
     },
     {
-      name: "fail2ban_ban",
-      description: "Manually ban an IP address in a jail — a live change to the running daemon, not a mesh-managed file.",
-      input: {
-        type: "object",
-        properties: {
-          jail: { type: "string", description: "Jail name (e.g. sshd, recidive)." },
-          ip: { type: "string", description: "IP address to ban." },
-        },
-        required: ["jail", "ip"],
-      },
-      run: async (args) => ({ result: await fail2ban.ban(args.jail as string, args.ip as string) }),
+      name: "banned",
+      description: "Every address banned on this machine right now, with the jail that holds it, when it was banned and when the ban ends.",
+      input: { jail: { type: "string", description: "one jail (optional)" } },
+      run: async (args) => fail2ban.banned(args.jail ? String(args.jail) : undefined),
     },
     {
-      name: "fail2ban_unban",
-      description: "Unban an IP address from one jail, or from every jail when `jail` is omitted.",
+      name: "ban",
+      description:
+        "Ban one address in one jail now, for the jail's ban time — an operator's act on the live ban list, which the mesh never writes itself.",
       input: {
-        type: "object",
-        properties: {
-          ip: { type: "string", description: "IP address to unban." },
-          jail: { type: "string", description: "A specific jail; omit to unban from all jails." },
-        },
-        required: ["ip"],
+        ip: { type: "string", description: "the address" },
+        jail: { type: "string", description: "the jail to hold it (recidive for the long ban)" },
       },
-      run: async (args) => ({ result: await fail2ban.unban(args.ip as string, args.jail as string | undefined) }),
+      run: async (args) => fail2ban.ban(String(args.ip ?? ""), String(args.jail ?? "")),
+    },
+    {
+      name: "unban",
+      description: "Let one address go, from one jail or from every jail when none is named.",
+      input: {
+        ip: { type: "string", description: "the address" },
+        jail: { type: "string", description: "one jail (optional)" },
+      },
+      run: async (args) => fail2ban.unban(String(args.ip ?? ""), args.jail ? String(args.jail) : undefined),
     },
   ];
 }
 
-registerModuleTools("fail2ban", () => getFail2banTools(Fail2banClient.fromEnv()));
+export function getFail2banTools(fail2ban: Fail2banClient): ToolDefinition[] {
+  return [
+    {
+      name: "fail2ban_settings",
+      description:
+        "One jail's effective settings on this machine: ban time, window, tries, the addresses it never bans, its actions and what it reads.",
+      input: { jail: { type: "string", description: "the jail" } },
+      run: async (args) => fail2ban.settings(String(args.jail ?? "")),
+    },
+  ];
+}
+
+const fail2ban = Fail2banClient.fromEnv();
+// The seat's verbs under the seat's name: the runtime serves them on the seat's subjects where this
+// module holds it (ADR 0159, 0160). The module's own under its own.
+registerModuleTools("node-intrusion-prevention", () => getSeatVerbs(fail2ban));
+registerModuleTools("fail2ban", () => getFail2banTools(fail2ban));

modules/gitea/module.json

@@ -145,7 +145,8 @@
       "volumes": [
         "${dir:data}:/data"
       ],
-      "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it"
+      "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it",
+      "logging": "journald"
     },
     {
       "id": "admin-bootstrap",
@@ -237,5 +238,12 @@
         "from": "Dockerfile"
       }
     ]
-  }
+  },
+  "jails": [
+    {
+      "name": "gitea",
+      "failregex": "^.*Failed authentication attempt for .* from <HOST>(?::\\d+)?\\s*$",
+      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=gitea\nport = http,https,222\nmaxretry = 3\nfindtime = 1d\nbantime = 1d"
+    }
+  ]
 }

modules/lab/Dockerfile

@@ -0,0 +1,31 @@
+# lab's runtime: the tool runtime, carrying this module's code, and the toolchain the lab's suite
+# builds the mesh with (novox/hq ADR 0172). It reaches the machine's virtualisation and container
+# runtime through their sockets, so what it raises is what a hand run on this machine raises.
+#
+# Every download is pinned by its checksum: an image that builds the mesh is the last place to take
+# whatever an upstream serves today.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/lab
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc tools/index.ts tools/runs.ts --rootDir . \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends git make ca-certificates curl python3 file iproute2 sudo \
+ && rm -rf /var/lib/apt/lists/*
+RUN curl -fsSL -o /tmp/go.tgz https://go.dev/dl/go1.26.8.linux-amd64.tar.gz \
+ && echo "d0f743b33e8d8945e6b1f432edd15785c70507121d6e2a723b21285eddf8b57b  /tmp/go.tgz" | sha256sum -c - \
+ && tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
+RUN curl -fsSL -o /usr/local/bin/incus https://github.com/lxc/incus/releases/download/v7.5.1/bin.linux.incus.x86_64 \
+ && echo "7bd6223b369f4d693fcde695bd8549a73b5b3d403735329212483702aa22c179  /usr/local/bin/incus" | sha256sum -c - \
+ && chmod 0755 /usr/local/bin/incus
+RUN curl -fsSL -o /tmp/docker.tgz https://download.docker.com/linux/static/stable/x86_64/docker-28.5.2.tgz \
+ && echo "ea90cfd12e1eeb12aa1c971741adb8bd4ed88e2a574eaac13f5029a1dbc6300d  /tmp/docker.tgz" | sha256sum -c - \
+ && tar -C /tmp -xzf /tmp/docker.tgz docker/docker && mv /tmp/docker/docker /usr/local/bin/docker && rm -rf /tmp/docker /tmp/docker.tgz
+ENV PATH=/usr/local/go/bin:$PATH
+COPY --from=build /app/modules/lab/dist /app/modules/lab/dist
+ENV MESH_TOOL_MODULES=/app/modules/lab/dist/tools/index.js

modules/lab/module.json

@@ -0,0 +1,82 @@
+{
+  "module": "lab",
+  "version": "1",
+  "capabilities": [
+    "container-runtime",
+    "virtualisation"
+  ],
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "work",
+      "type": "directory",
+      "path": "/var/lib/mesh-lab-runs",
+      "mode": "0700"
+    },
+    {
+      "id": "runtime-env",
+      "type": "file",
+      "path": "${dir:state}/lab.env",
+      "mode": "0600",
+      "content": "MESH_LAB_FORGE=${setting:forge}\n"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-lab",
+      "network": "host",
+      "env-file": [
+        "${dir:state}/lab.env"
+      ],
+      "volumes": [
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:work}:${dir:work}",
+        "/var/run/docker.sock:/var/run/docker.sock",
+        "/var/lib/incus/unix.socket:/var/lib/incus/unix.socket"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_LAB_WORK": "${dir:work}"
+      },
+      "restart-on": [
+        "runtime-env"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/lab/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@novox/module-lab",
+  "version": "0.1.0",
+  "description": "lab — the lab, as a module: runs beds against the forge's branches when the mesh asks (novox/hq ADR 0172).",
+  "type": "module",
+  "private": true,
+  "dependencies": { "@novox/mesh-sdk": "^0.1.0" },
+  "devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.6.0" }
+}

modules/lab/tools/index.ts

@@ -0,0 +1,86 @@
+// lab's tools — the lab, as the mesh asks for it (novox/hq ADR 0172). They run on the machine the
+// lab is assigned to, and only there: a bed raises virtual machines on that machine's virtualisation.
+
+import { spawnSync } from "node:child_process";
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { listRuns, readStatus, REPOSITORIES, running, start, stop, tail } from "./runs.js";
+
+export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
+  const work = env.MESH_LAB_WORK ?? "/var/lib/mesh-lab-runs";
+  const forge = (env.MESH_LAB_FORGE ?? "").replace(/\/+$/, "");
+  return [
+    {
+      name: "lab_check",
+      description: "Whether this machine can run the lab's beds: the lab's own check, against the forge's main branch.",
+      input: {},
+      run: async () => {
+        if (!forge) return { ok: false, output: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
+        const dir = `${work}/check`;
+        spawnSync("rm", ["-rf", dir]);
+        const clone = spawnSync("git", ["clone", "--quiet", "--depth", "1", `${forge}/novox/mesh-lab.git`, dir], { encoding: "utf8" });
+        if (clone.status !== 0) return { ok: false, output: clone.stderr };
+        spawnSync("npm", ["ci", "--no-audit", "--no-fund", "--loglevel=error"], { cwd: dir, encoding: "utf8" });
+        const check = spawnSync("node", ["--experimental-strip-types", "src/cli.ts", "check"], { cwd: dir, encoding: "utf8" });
+        return { ok: check.status === 0, output: `${check.stdout}${check.stderr}`.trim() };
+      },
+    },
+    {
+      name: "lab_run",
+      description:
+        "Run the lab's beds against branches on the forge: fresh checkouts of every repository the lab builds, " +
+        "side by side, then the suite on the named test files. Answers at once with the run's id; lab_status " +
+        "and lab_log follow it. One run at a time.",
+      input: {
+        tests: { type: "string", description: "the bed test files, comma-separated, relative to mesh-lab (e.g. test/integration/mesh.test.ts)" },
+        refs: {
+          type: "string",
+          description: `a JSON object of repository to branch, for any of ${REPOSITORIES.join(", ")}; the rest run main`,
+        },
+      },
+      run: async (args) => {
+        if (!forge) return { started: false, reason: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
+        const tests = String(args.tests ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+        if (tests.length === 0) return { started: false, reason: "name at least one bed test file" };
+        let refs: Record<string, string> = {};
+        if (args.refs) {
+          try {
+            refs = JSON.parse(String(args.refs)) as Record<string, string>;
+          } catch {
+            return { started: false, reason: "refs is not a JSON object of repository to branch" };
+          }
+        }
+        const stranger = Object.keys(refs).filter((r) => !REPOSITORIES.includes(r));
+        if (stranger.length > 0) return { started: false, reason: `the lab does not build ${stranger.join(", ")}` };
+        const busy = running(work);
+        if (busy) return { started: false, reason: `${busy.id} is still ${busy.state}; one run at a time`, running: busy };
+        return { started: true, run: start(work, forge, tests, refs) };
+      },
+    },
+    {
+      name: "lab_status",
+      description: "A run's state, the commits it tested and how it ended — or every run, newest first, when no id is given.",
+      input: { id: { type: "string", description: "the run's id (optional)" } },
+      run: async (args) => {
+        if (args.id) return readStatus(work, String(args.id)) ?? { found: false, id: String(args.id) };
+        return { runs: listRuns(work).slice(0, 10) };
+      },
+    },
+    {
+      name: "lab_log",
+      description: "The last lines of a run's log.",
+      input: {
+        id: { type: "string", description: "the run's id" },
+        lines: { type: "number", description: "how many lines from the end (default 200)" },
+      },
+      run: async (args) => ({ id: String(args.id), log: tail(work, String(args.id), Number(args.lines ?? 200)) }),
+    },
+    {
+      name: "lab_stop",
+      description: "Stop a run and everything it started.",
+      input: { id: { type: "string", description: "the run's id" } },
+      run: async (args) => stop(work, String(args.id)) ?? { found: false, id: String(args.id) },
+    },
+  ];
+}
+
+registerModuleTools("lab", (env) => getLabTools(env));

modules/lab/tools/runs.ts

@@ -0,0 +1,175 @@
+// A lab run: fresh checkouts of the named branches, side by side, then the lab's suite on the named
+// beds (novox/hq ADR 0172).
+//
+// **A run is a detached script with its own process group**, so it outlives the tool call that started
+// it and `stop` ends everything it started. It writes what it is doing to a status file beside its log,
+// and that file is the whole of what the tools read back: a runtime that restarts mid-run still answers
+// for it, and says it was lost rather than pretending it is still going.
+
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** The repositories a lab run checks out, side by side, as the lab expects its siblings. */
+export const REPOSITORIES = ["mesh-lab", "mesh-controller", "mesh-host", "mesh-catalog", "mesh-tools", "mesh-sdk"];
+
+export interface RunStatus {
+  id: string;
+  state: "checking-out" | "building" | "running" | "passed" | "failed" | "stopped" | "lost";
+  started: string;
+  ended?: string;
+  tests: string[];
+  refs: Record<string, string>;
+  commits?: Record<string, string>;
+  exit?: number;
+  pid?: number;
+}
+
+export function runDir(work: string, id: string): string {
+  return join(work, id);
+}
+
+function statusPath(work: string, id: string): string {
+  return join(runDir(work, id), "status.json");
+}
+
+export function readStatus(work: string, id: string): RunStatus | undefined {
+  try {
+    const s = JSON.parse(readFileSync(statusPath(work, id), "utf8")) as RunStatus;
+    // A run whose process is gone while its status still says it is going was lost — the runtime or
+    // the machine restarted under it. Said, rather than left reading as running for ever.
+    if (!["passed", "failed", "stopped", "lost"].includes(s.state) && s.pid && !alive(s.pid)) {
+      s.state = "lost";
+    }
+    return s;
+  } catch {
+    return undefined;
+  }
+}
+
+function alive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function listRuns(work: string): RunStatus[] {
+  if (!existsSync(work)) return [];
+  return readdirSync(work)
+    .filter((d) => d.startsWith("run-"))
+    .map((id) => readStatus(work, id))
+    .filter((s): s is RunStatus => !!s)
+    .sort((a, b) => b.started.localeCompare(a.started));
+}
+
+/** The run still going, if any: one at a time, because two would contend for the same machine. */
+export function running(work: string): RunStatus | undefined {
+  return listRuns(work).find((s) => !["passed", "failed", "stopped", "lost"].includes(s.state));
+}
+
+const shellQuote = (s: string) => `'${s.replace(/'/g, `'\\''`)}'`;
+
+/**
+ * The script one run executes. Every step writes its state first, so a run that dies says where.
+ *
+ * The environment is the one the lab's README describes for a run against sibling checkouts, pointed
+ * at this run's own tree, so what is built and claimed is exactly what was checked out.
+ */
+export function script(work: string, id: string, forge: string, tests: string[], refs: Record<string, string>): string {
+  const dir = runDir(work, id);
+  const setState = (state: string) =>
+    `node -e ${shellQuote(
+      `const f=${JSON.stringify(join(dir, "status.json"))};const s=JSON.parse(require("fs").readFileSync(f,"utf8"));s.state=${JSON.stringify(state)};require("fs").writeFileSync(f,JSON.stringify(s,null,2))`,
+    )}`;
+  const clones = REPOSITORIES.map((repo) => {
+    const ref = refs[repo] ?? "main";
+    return [
+      `git clone --quiet --depth 50 --branch ${shellQuote(ref)} ${shellQuote(`${forge}/novox/${repo}.git`)} ${shellQuote(join(dir, repo))}`,
+      `echo "${repo} $(git -C ${shellQuote(join(dir, repo))} rev-parse HEAD)" >> ${shellQuote(join(dir, "commits.txt"))}`,
+    ].join("\n");
+  }).join("\n");
+  const bin = join(dir, "bin");
+  return `set -euo pipefail
+cd ${shellQuote(dir)}
+${setState("checking-out")}
+${clones}
+node -e ${shellQuote(
+    `const fs=require("fs");const f=${JSON.stringify(join(dir, "status.json"))};const s=JSON.parse(fs.readFileSync(f,"utf8"));s.commits=Object.fromEntries(fs.readFileSync(${JSON.stringify(join(dir, "commits.txt"))},"utf8").trim().split("\\n").map(l=>l.split(" ")));fs.writeFileSync(f,JSON.stringify(s,null,2))`,
+  )}
+${setState("building")}
+# The @novox scope resolves from the mesh's own package registry on the forge, as the build machine
+# resolves it; nothing else is asked of it.
+printf '%s\n' ${shellQuote(`@novox:registry=${forge}/api/packages/novox/npm/`)} > ${shellQuote(join(dir, ".npmrc"))}
+export NPM_CONFIG_USERCONFIG=${shellQuote(join(dir, ".npmrc"))}
+for repo in mesh-sdk mesh-tools mesh-lab; do (cd ${shellQuote(dir)}/$repo && npm ci --no-audit --no-fund --loglevel=error); done
+(cd ${shellQuote(dir)}/mesh-sdk && npm run build --if-present)
+(cd ${shellQuote(dir)}/mesh-tools && npm run build --if-present)
+mkdir -p ${shellQuote(bin)}
+for p in postgres-provisioner objectstore-provisioner route-proxy; do
+  (cd ${shellQuote(dir)}/mesh-controller && CGO_ENABLED=0 go build -o ${shellQuote(bin)}/$p ./examples/$p)
+done
+export MESH_LAB_HOST_BINARY=${shellQuote(join(dir, "mesh-host", "mesh-host"))}
+export MESH_LAB_BUNDLE=${shellQuote(join(dir, "mesh-host", "examples", "foundation-first-node-nats.lock"))}
+export MESH_LAB_MODULES=${shellQuote(join(dir, "mesh-controller", "examples", "modules"))}
+export MESH_LAB_BUILDER=${shellQuote(join(dir, "mesh-controller", "build", "mesh-builder"))}
+export MESH_LAB_BOOTSTRAP_BINARY=${shellQuote(join(dir, "mesh-host", "mesh-bootstrap"))}
+export MESH_LAB_CATALOG=${shellQuote(join(dir, "mesh-catalog", "modules"))}
+export MESH_LAB_PROVISIONER=${shellQuote(join(bin, "postgres-provisioner"))}
+export MESH_LAB_OBJECTSTORE_PROVISIONER=${shellQuote(join(bin, "objectstore-provisioner"))}
+export MESH_LAB_ROUTE_PROXY=${shellQuote(join(bin, "route-proxy"))}
+${setState("running")}
+cd ${shellQuote(join(dir, "mesh-lab"))}
+node --experimental-strip-types src/cli.ts suite ${tests.map(shellQuote).join(" ")}
+`;
+}
+
+/** start begins a run and returns at once with its status. */
+export function start(work: string, forge: string, tests: string[], refs: Record<string, string>): RunStatus {
+  const id = `run-${new Date().toISOString().replace(/[:.]/g, "-")}`;
+  const dir = runDir(work, id);
+  mkdirSync(dir, { recursive: true });
+  const status: RunStatus = { id, state: "checking-out", started: new Date().toISOString(), tests, refs };
+  writeFileSync(statusPath(work, id), JSON.stringify(status, null, 2));
+  writeFileSync(join(dir, "run.sh"), script(work, id, forge, tests, refs), { mode: 0o700 });
+
+  // The wrapper records how the run ended, then removes the checkouts and keeps the log and status: a
+  // run's tree is its own, and the next run starts from fresh ones (novox/hq ADR 0172).
+  const wrapper = `bash ${shellQuote(join(dir, "run.sh"))} > ${shellQuote(join(dir, "run.log"))} 2>&1; code=$?
+node -e ${shellQuote(
+    `const f=${JSON.stringify(statusPath(work, id))};const s=JSON.parse(require("fs").readFileSync(f,"utf8"));if(s.state!=="stopped"){s.state=process.argv[1]==="0"?"passed":"failed"};s.exit=Number(process.argv[1]);s.ended=new Date().toISOString();require("fs").writeFileSync(f,JSON.stringify(s,null,2))`,
+  )} "$code"
+cd ${shellQuote(dir)} && rm -rf ${REPOSITORIES.map(shellQuote).join(" ")} bin`;
+  const child = spawn("bash", ["-c", wrapper], { detached: true, stdio: "ignore" });
+  child.unref();
+  status.pid = child.pid;
+  writeFileSync(statusPath(work, id), JSON.stringify(status, null, 2));
+  return status;
+}
+
+/** stop ends a run and everything it started, by its process group. */
+export function stop(work: string, id: string): RunStatus | undefined {
+  const s = readStatus(work, id);
+  if (!s || !s.pid) return s;
+  if (["passed", "failed", "stopped", "lost"].includes(s.state)) return s;
+  s.state = "stopped";
+  writeFileSync(statusPath(work, id), JSON.stringify(s, null, 2));
+  try {
+    process.kill(-s.pid, "SIGTERM");
+  } catch {
+    // Already gone between the read and the kill.
+  }
+  return s;
+}
+
+/** tail is the last lines of a run's log. */
+export function tail(work: string, id: string, lines: number): string {
+  try {
+    const all = readFileSync(join(runDir(work, id), "run.log"), "utf8").split("\n");
+    return all.slice(-Math.max(1, lines)).join("\n");
+  } catch {
+    return "";
+  }
+}

modules/lab/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["tools/index.ts", "tools/runs.ts"]
+}

modules/mailu/module.json

@@ -462,7 +462,8 @@
       ],
       "dns": [
         "192.168.203.254"
-      ]
+      ],
+      "logging": "journald"
     },
     {
       "id": "runtime-config",
@@ -561,5 +562,12 @@
   },
   "grants": {
     "smtp": "${dir:grants}"
-  }
+  },
+  "jails": [
+    {
+      "name": "mailu-front",
+      "failregex": "^.*(?:imap|pop3|submission|managesieve)-login: .*\\(auth failed, \\d+ attempts(?: in \\d+ secs)?\\):.*rip=<HOST>(?:,|$)",
+      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=mailu-front\nport = smtp,submission,submissions,imap,imaps,pop3,pop3s\nmaxretry = 3\nfindtime = 1d\nbantime = 1d"
+    }
+  ]
 }

modules/nftables/Dockerfile

@@ -0,0 +1,23 @@
+# nftables' runtime: the tool runtime, carrying the packet filter's tools and the binaries they speak.
+#
+# Built from this module's own directory and nothing else (novox/hq ADR 0069). Two bases, named in
+# module.json's `build.on`: the image this is compiled in and the image it runs in.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/nftables
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+# The filter's own tools: nft for the machine's ruleset and the mesh's table, iptables for the
+# legacy filter and the tables iptables-nft manages — a predecessor's rules live there (ADR 0168).
+# The container runs on the machine's network with NET_ADMIN (ADR 0170), so these act on the
+# machine's packet filter, not on a namespace of their own.
+RUN apt-get update \
+      && apt-get install -y --no-install-recommends nftables iptables \
+      && rm -rf /var/lib/apt/lists/*
+COPY --from=build /app/modules/nftables/dist /app/modules/nftables/dist
+ENV MESH_TOOL_MODULES=/app/modules/nftables/dist/tools/index.js

modules/nftables/client.ts

@@ -1,22 +1,211 @@
-// The firewall's own code, in the module (novox/hq ADR 0039). The mesh computes this node's whole
-// rule set from every module's `listens` and writes it to /etc/nftables.conf (novox/hq ADR 0045);
-// the module loads it through its own mesh-filter unit, reloaded whenever the rules change, whose
-// stop deletes only the mesh's table and never flushes the whole ruleset (novox/hq ADR 0100). This
-// code exists only to read back what is actually enforced — the enforcement itself is declarative.
+// The packet filter's own code, in the module (novox/hq ADR 0039). The mesh computes this node's
+// rule set from every module's `listens` and writes it to the filter file (ADR 0045); the module
+// loads it through its own unit. This code reads the filter back as the machine enforces it, reloads
+// the mesh's own table, and removes one thing the mesh did not write when the operator names it
+// (ADR 0168, ADR 0170) — the seat's three verbs, over the machine's own tools.
 
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
-const run = promisify(execFile);
+const execFileP = promisify(execFile);
+
+/** A command runner, so the acts can be tested without a packet filter. */
+export type Runner = (cmd: string, args: string[]) => Promise<string>;
+
+export const execRunner: Runner = async (cmd, args) => {
+  const { stdout } = await execFileP(cmd, args, { maxBuffer: 16 * 1024 * 1024 });
+  return stdout;
+};
+
+/** The mesh's own tables, which `remove` never touches. */
+const MESH_TABLES = new Set(["inet mesh", "inet mesh_guard"]);
+/** The tables iptables-nft manages, spoken through iptables rather than nft. */
+const IPTABLES_TABLES = new Set(["filter", "nat", "raw", "mangle", "security"]);
+/** The chains the kernel has built in; flushing one is the owner's act, not an operator's removal. */
+const BUILT_IN = new Set(["INPUT", "FORWARD", "OUTPUT", "PREROUTING", "POSTROUTING"]);
+/** The chain the container runtime leaves for an administrator, which is emptied, never deleted. */
+const USER_CHAIN = "DOCKER-USER";
+
+export interface Removal {
+  where: string;
+  did: string[];
+}
 
 export class FirewallClient {
-  static fromEnv(_env: NodeJS.ProcessEnv = process.env): FirewallClient {
-    return new FirewallClient();
+  private readonly run: Runner;
+  private readonly filterFile: string;
+
+  constructor(run: Runner = execRunner, filterFile: string = process.env.MESH_FILTER_FILE ?? "/etc/nftables.conf") {
+    this.run = run;
+    this.filterFile = filterFile;
   }
 
-  /** The mesh's live table — exactly what is dropping and accepting on this node right now. */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): FirewallClient {
+    return new FirewallClient(execRunner, env.MESH_FILTER_FILE ?? "/etc/nftables.conf");
+  }
+
+  /** The mesh's live table — exactly what the mesh's own filter is dropping and accepting. */
   async ruleset(): Promise<string> {
-    const { stdout } = await run("nft", ["list", "table", "inet", "mesh"]);
-    return stdout;
+    return this.run("nft", ["list", "table", "inet", "mesh"]);
+  }
+
+  /** The packet filter as the machine enforces it: nftables whole or narrowed, and the legacy filter's
+   *  listings where the tools exist. */
+  async rules(table?: string, chain?: string): Promise<{ nftables: string; legacy: Record<string, string> }> {
+    let nftables: string;
+    if (table && chain) {
+      const [family, name] = splitTable(table);
+      nftables = await this.run("nft", ["list", "chain", family, name, chain]);
+    } else if (table) {
+      const [family, name] = splitTable(table);
+      nftables = await this.run("nft", ["list", "table", family, name]);
+    } else {
+      nftables = await this.run("nft", ["list", "ruleset"]);
+    }
+    const legacy: Record<string, string> = {};
+    if (!table) {
+      for (const tool of ["iptables-legacy", "ip6tables-legacy"]) {
+        try {
+          const out = await this.run(tool, ["-S"]);
+          if (out.trim()) legacy[tool] = out;
+        } catch {
+          // the tool is not here, or the legacy filter is empty: nothing to list
+        }
+      }
+    }
+    return { nftables, legacy };
+  }
+
+  /** Load the mesh's own filter again from the file the mesh writes, and answer with the table. */
+  async reload(): Promise<{ loaded: string; table: string }> {
+    await this.run("nft", ["-f", this.filterFile]);
+    return { loaded: this.filterFile, table: await this.ruleset() };
+  }
+
+  /** Whether the found front end is in force, whose chains `remove` leaves alone. */
+  private async ufwActive(): Promise<boolean> {
+    try {
+      const out = await this.run("ufw", ["status"]);
+      return /^Status:\s*active/m.test(out);
+    } catch {
+      return false;
+    }
+  }
+
+  /** Remove one rule set the mesh did not write, named as the host reports it (ADR 0168). */
+  async remove(where: string): Promise<Removal> {
+    const did: string[] = [];
+    const legacy = /^chain (\S+) \((iptables-legacy|ip6tables-legacy|iptables|ip6tables)\)$/.exec(where.trim());
+    const nft = /^table (\S+) (\S+), chain (\S+)$/.exec(where.trim());
+    if (legacy) {
+      const [, chain, tool] = legacy;
+      await this.refuseOwned(chain, "ip", "filter");
+      await this.removeChainWith(tool, undefined, chain, did);
+      return { where, did };
+    }
+    if (nft) {
+      const [, family, name, chain] = nft;
+      const table = `${family} ${name}`;
+      if (MESH_TABLES.has(table)) throw new Error(`${where} is the mesh's own table; it is not removed, it is composed`);
+      await this.refuseOwned(chain, family, name);
+      if ((family === "ip" || family === "ip6") && IPTABLES_TABLES.has(name)) {
+        const tool = family === "ip6" ? "ip6tables" : "iptables";
+        await this.removeChainWith(tool, name, chain, did);
+        return { where, did };
+      }
+      // A table of the machine's own: a chain of it goes, and the table with it when nothing is left.
+      const listing = await this.run("nft", ["list", "table", family, name]);
+      const base = new RegExp(`chain ${escape(chain)} \\{[^}]*type \\S+ hook`).test(listing);
+      for (const from of chainsJumpingTo(listing, chain)) {
+        await this.deleteNftRules(family, name, from, chain, did);
+      }
+      if (base) {
+        await this.run("nft", ["flush", "chain", family, name, chain]);
+        did.push(`nft flush chain ${family} ${name} ${chain}`);
+      } else {
+        await this.run("nft", ["delete", "chain", family, name, chain]);
+        did.push(`nft delete chain ${family} ${name} ${chain}`);
+      }
+      return { where, did };
+    }
+    throw new Error(`${JSON.stringify(where)} is not a rule set as the host reports one: ` +
+      "`chain X (iptables-legacy)` or `table <family> <name>, chain X`");
+  }
+
+  private async refuseOwned(chain: string, family: string, table: string): Promise<void> {
+    if (chain !== USER_CHAIN && chain.startsWith("DOCKER")) {
+      throw new Error(`chain ${chain} is the container runtime's own; it is left`);
+    }
+    if (BUILT_IN.has(chain)) {
+      throw new Error(`chain ${chain} is built in; its policy is its owner's and it is not flushed`);
+    }
+    if (chain.startsWith("ufw") && (await this.ufwActive())) {
+      throw new Error(`chain ${chain} belongs to the found firewall, which is in force; converge retires it`);
+    }
+    void family; void table;
+  }
+
+  /** Through an iptables tool: the user chain is emptied back to its one return; another chain loses
+   *  the jumps into it, is flushed and deleted. */
+  private async removeChainWith(tool: string, table: string | undefined, chain: string, did: string[]): Promise<void> {
+    const t = table && table !== "filter" ? ["-t", table] : [];
+    if (chain === USER_CHAIN) {
+      await this.run(tool, [...t, "-F", chain]);
+      await this.run(tool, [...t, "-A", chain, "-j", "RETURN"]);
+      did.push(`${tool} ${[...t, "-F", chain].join(" ")}`, `${tool} ${[...t, "-A", chain, "-j", "RETURN"].join(" ")}`);
+      return;
+    }
+    const listing = await this.run(tool, [...t, "-S"]);
+    for (const line of listing.split("\n")) {
+      const fields = line.trim().split(/\s+/);
+      if (fields[0] !== "-A") continue;
+      const j = fields.indexOf("-j");
+      const g = fields.indexOf("-g");
+      const target = j >= 0 ? fields[j + 1] : g >= 0 ? fields[g + 1] : "";
+      if (target !== chain) continue;
+      const args = [...t, "-D", ...fields.slice(1)];
+      await this.run(tool, args);
+      did.push(`${tool} ${args.join(" ")}`);
+    }
+    await this.run(tool, [...t, "-F", chain]);
+    await this.run(tool, [...t, "-X", chain]);
+    did.push(`${tool} ${[...t, "-F", chain].join(" ")}`, `${tool} ${[...t, "-X", chain].join(" ")}`);
+  }
+
+  private async deleteNftRules(family: string, name: string, from: string, target: string, did: string[]): Promise<void> {
+    const listing = await this.run("nft", ["-a", "list", "chain", family, name, from]);
+    for (const line of listing.split("\n")) {
+      if (!new RegExp(`\\b(jump|goto) ${escape(target)}\\b`).test(line)) continue;
+      const handle = /# handle (\d+)/.exec(line)?.[1];
+      if (!handle) continue;
+      await this.run("nft", ["delete", "rule", family, name, from, "handle", handle]);
+      did.push(`nft delete rule ${family} ${name} ${from} handle ${handle}`);
+    }
   }
 }
+
+function splitTable(table: string): [string, string] {
+  const parts = table.trim().split(/\s+/);
+  if (parts.length !== 2) throw new Error(`a table is \`family name\`, not ${JSON.stringify(table)}`);
+  return [parts[0], parts[1]];
+}
+
+/** Which chains of a listed table jump or go to the named one. */
+export function chainsJumpingTo(listing: string, target: string): string[] {
+  const out: string[] = [];
+  let chain = "";
+  for (const raw of listing.split("\n")) {
+    const line = raw.trim();
+    const head = /^chain (\S+) \{/.exec(line);
+    if (head) { chain = head[1]; continue; }
+    if (line === "}") { chain = ""; continue; }
+    if (chain && chain !== target && new RegExp(`\\b(jump|goto) ${escape(target)}\\b`).test(line) && !out.includes(chain)) {
+      out.push(chain);
+    }
+  }
+  return out;
+}
+
+function escape(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
+}

modules/nftables/module.json

@@ -2,18 +2,30 @@
   "module": "nftables",
   "version": "1",
   "capabilities": [
-    "firewall"
+    "firewall",
+    "container-runtime"
   ],
   "claims": [
     {
       "name": "node-packet-filter",
-      "scope": "node"
+      "scope": "node",
+      "serves": [
+        "rules",
+        "reload",
+        "remove"
+      ]
     }
   ],
   "filtering": {
     "into": "/etc/nftables.conf"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
     {
       "id": "package",
       "type": "package",
@@ -46,6 +58,57 @@
       "reload-on": [
         "filtering"
       ]
+    },
+    {
+      "id": "front-end",
+      "type": "package",
+      "package": "ufw",
+      "absent": true
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-nftables",
+      "network": "host",
+      "capabilities": [
+        "NET_ADMIN"
+      ],
+      "volumes": [
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "/etc/nftables.conf:/etc/nftables.conf:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_FILTER_FILE": "/etc/nftables.conf"
+      },
+      "artifact": "runtime"
     }
-  ]
+  ],
+  "tools": [
+    "firewall_rules"
+  ],
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
 }

modules/nftables/package.json

@@ -1,11 +1,15 @@
 {
-  "name": "@novox/module-firewall",
+  "name": "@novox/module-nftables",
   "version": "0.1.0",
-  "description": "firewall — applies the mesh-computed packet filter (ADR 0045). Its diagnostic tool lives here.
+  "description": "nftables — loads the mesh's packet filter and holds the node-packet-filter seat: its verbs rules, reload and remove (novox/hq ADR 0045, ADR 0170).",
   "type": "module",
   "private": true,
+  "scripts": {
+    "build": "tsc client.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
+    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
+  },
   "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
+    "@novox/mesh-sdk": "^0.1.1"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

modules/nftables/test/remove.test.ts

@@ -0,0 +1,74 @@
+// `remove` acts on one rule set the mesh did not write, named as the host reports it (novox/hq ADR
+// 0168, 0169), over the shapes two machines of the first mesh reported live: a predecessor's chain in
+// the legacy filter, the runtime's user chain in the IPv6 legacy filter, a leftover front-end chain,
+// and the same in an iptables-nft table. It refuses what is not the operator's to remove.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { FirewallClient, chainsJumpingTo, type Runner } from "../client.ts";
+
+const legacy = [
+  "-P INPUT ACCEPT", "-P FORWARD DROP", "-P OUTPUT ACCEPT",
+  "-N DOCKER", "-N DOCKER-USER", "-N HAL-MESH-ONLY",
+  "-A FORWARD -j DOCKER-USER",
+  "-A DOCKER-USER -i enp6s0 -p tcp -m conntrack --ctstate NEW -j HAL-MESH-ONLY",
+  "-A HAL-MESH-ONLY -m conntrack --ctorigdstport 80 -j RETURN",
+  "-A HAL-MESH-ONLY -m comment --comment \"HAL: not public -> mesh only\" -j DROP",
+].join("\n") + "\n";
+
+function fake(ufwActive = false): { run: Runner; asked: string[] } {
+  const asked: string[] = [];
+  const run: Runner = async (cmd, args) => {
+    asked.push([cmd, ...args].join(" "));
+    if (cmd === "ufw") return ufwActive ? "Status: active\n" : "Status: inactive\n";
+    if (args.join(" ") === "-S") return legacy;
+    if (cmd === "nft" && args[0] === "list" && args[1] === "table") {
+      return "table ip6 own {\n\tchain forward {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tjump deny\n\t}\n\tchain deny {\n\t\tdrop\n\t}\n}\n";
+    }
+    if (cmd === "nft" && args[0] === "-a") {
+      return "table ip6 own {\n\tchain forward {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tjump deny # handle 7\n\t}\n}\n";
+    }
+    return "";
+  };
+  return { run, asked };
+}
+
+test("a predecessor's chain in the legacy filter loses its jumps, is flushed and deleted", async () => {
+  const f = fake();
+  const out = await new FirewallClient(f.run).remove("chain HAL-MESH-ONLY (iptables-legacy)");
+  assert.deepEqual(out.did, [
+    "iptables-legacy -D DOCKER-USER -i enp6s0 -p tcp -m conntrack --ctstate NEW -j HAL-MESH-ONLY",
+    "iptables-legacy -F HAL-MESH-ONLY",
+    "iptables-legacy -X HAL-MESH-ONLY",
+  ]);
+});
+
+test("the runtime's user chain is emptied back to its one return, never deleted", async () => {
+  const f = fake();
+  const out = await new FirewallClient(f.run).remove("chain DOCKER-USER (ip6tables-legacy)");
+  assert.deepEqual(out.did, ["ip6tables-legacy -F DOCKER-USER", "ip6tables-legacy -A DOCKER-USER -j RETURN"]);
+  const nft = await new FirewallClient(fake().run).remove("table ip6 filter, chain DOCKER-USER");
+  assert.deepEqual(nft.did, ["ip6tables -F DOCKER-USER", "ip6tables -A DOCKER-USER -j RETURN"]);
+});
+
+test("a chain of the machine's own nftables table goes with the rules that reach it", async () => {
+  const f = fake();
+  const out = await new FirewallClient(f.run).remove("table ip6 own, chain deny");
+  assert.deepEqual(out.did, ["nft delete rule ip6 own forward handle 7", "nft delete chain ip6 own deny"]);
+});
+
+test("what is not the operator's to remove is refused by name", async () => {
+  const c = new FirewallClient(fake(true).run);
+  await assert.rejects(c.remove("table inet mesh, chain forward"), /the mesh's own table/);
+  await assert.rejects(c.remove("chain DOCKER (iptables-legacy)"), /container runtime's own/);
+  await assert.rejects(c.remove("chain FORWARD (iptables-legacy)"), /built in/);
+  await assert.rejects(c.remove("chain ufw6-docker-logging-deny (ip6tables-legacy)"), /found firewall, which is in force/);
+  await assert.rejects(c.remove("something else"), /not a rule set as the host reports one/);
+  // Retired, a front end's leftover is nobody's and goes.
+  const retired = await new FirewallClient(fake(false).run).remove("chain ufw6-docker-logging-deny (ip6tables-legacy)");
+  assert.ok(retired.did.includes("ip6tables-legacy -X ufw6-docker-logging-deny"));
+});
+
+test("which chains jump to a target is read from a listing", () => {
+  const listing = "table ip6 own {\n\tchain a {\n\t\tjump deny\n\t}\n\tchain b {\n\t\tgoto deny\n\t}\n\tchain deny {\n\t\tdrop\n\t}\n}\n";
+  assert.deepEqual(chainsJumpingTo(listing, "deny"), ["a", "b"]);
+});

modules/nftables/tools/index.ts

@@ -1,19 +1,51 @@
-// firewall's tools — one, and the useful one: what is actually enforced. The rules are the mesh's,
-// computed from every module's listens; this reads the live table so a declared scope can be checked
-// against what the packet filter is really doing.
-
+// The packet filter's tools: the node-packet-filter seat's three verbs — what the machine enforces,
+// reload the mesh's own, remove one thing the mesh did not write — and the module's own reading of
+// the mesh's table (novox/hq ADR 0045, ADR 0168, ADR 0170).
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { FirewallClient } from "../client.js";
 
+export function getSeatVerbs(firewall: FirewallClient): ToolDefinition[] {
+  return [
+    {
+      name: "rules",
+      description:
+        "The packet filter as this machine enforces it now: the nftables ruleset and, where the tool exists, the legacy filter's listings. Narrowed to one table or chain when asked.",
+      input: {
+        table: { type: "string", description: "one nftables table, as `family name` (optional)" },
+        chain: { type: "string", description: "one chain of that table (optional)" },
+      },
+      run: async (args) => firewall.rules(args.table ? String(args.table) : undefined, args.chain ? String(args.chain) : undefined),
+    },
+    {
+      name: "reload",
+      description: "Load the mesh's own filter again from the file the mesh writes, and answer with the mesh's table as loaded.",
+      input: {},
+      run: async () => firewall.reload(),
+    },
+    {
+      name: "remove",
+      description:
+        "Remove one rule set the mesh did not write, named exactly as `node show` lists it: `chain X (iptables-legacy)` or `table ip6 filter, chain DOCKER-USER`. " +
+        "Refuses the mesh's tables, the runtime's own chains, a built-in chain and an active found firewall's chains. An operator's act, by name, never a flush.",
+      input: { where: { type: "string", description: "the rule set, as `node show` lists it" } },
+      run: async (args) => firewall.remove(String(args.where ?? "")),
+    },
+  ];
+}
+
 export function getFirewallTools(firewall: FirewallClient): ToolDefinition[] {
   return [
     {
       name: "firewall_rules",
-      description: "The mesh's live nftables rules on this node — what is actually accepting and dropping.",
+      description: "The mesh's live nftables table on this node — what the mesh's own filter is accepting and dropping.",
       input: {},
       run: async () => ({ ruleset: await firewall.ruleset() }),
     },
   ];
 }
 
-registerModuleTools("firewall", () => getFirewallTools(FirewallClient.fromEnv()));
+const firewall = FirewallClient.fromEnv();
+// The seat's verbs under the seat's name: the runtime serves them on the seat's subjects where this
+// module holds it (ADR 0159, 0160). The module's own under its own.
+registerModuleTools("node-packet-filter", () => getSeatVerbs(firewall));
+registerModuleTools("nftables", () => getFirewallTools(firewall));

modules/route-proxy/module.json

@@ -25,6 +25,9 @@
     "acme-ca": "${dir:state}/acme-ca.json",
     "internal-acme-ca": "${dir:state}/internal-acme-ca.json"
   },
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
   "listens": [
     {
       "name": "http",
@@ -48,6 +51,12 @@
       "mode": "0700",
       "place": "."
     },
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
     {
       "id": "routes-dir",
       "type": "directory",
@@ -80,13 +89,6 @@
       "mode": "0600",
       "content": "INTERNAL_ACME_DIRECTORY=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:path}\nINTERNAL_ACME_ROOTS=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}\nINTERNAL_ACME_ROOTS_PATH=${bound:internal-acme-ca:roots}\n"
     },
-    {
-      "id": "internal-sources-env",
-      "type": "file",
-      "path": "${dir:state}/internal-sources.env",
-      "mode": "0600",
-      "content": "INTERNAL_SOURCES=${machine:mesh-range}\n"
-    },
     {
       "id": "trust",
       "type": "container",
@@ -139,13 +141,13 @@
       "network": "host",
       "env-file": [
         "${dir:state}/acme.env",
-        "${dir:state}/internal-acme.env",
-        "${dir:state}/internal-sources.env"
+        "${dir:state}/internal-acme.env"
       ],
       "volumes": [
         "${dir:routes-dir}:/routes:ro",
         "${dir:acme-cache}:/acme",
-        "${dir:ca-dir}:/ca:ro"
+        "${dir:ca-dir}:/ca:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
       ],
       "env": {
         "ROUTES": "/routes/mesh.json",
@@ -153,15 +155,16 @@
         "TLS_LISTEN": ":443",
         "ACME_CACHE": "/acme",
         "ACME_CA_BUNDLE": "/ca/root.crt",
-        "INTERNAL_ACME_CA_BUNDLE": "/ca/internal-root.crt"
+        "INTERNAL_ACME_CA_BUNDLE": "/ca/internal-root.crt",
+        "MESH_BROKER_FILE": "/run/secrets/broker"
       },
       "restart-on": [
         "trust",
         "acme-env",
         "internal-trust",
-        "internal-acme-env",
-        "internal-sources-env"
-      ]
+        "internal-acme-env"
+      ],
+      "logging": "journald"
     }
   ],
   "build": {
@@ -192,5 +195,12 @@
         "image": "alpine@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc"
       }
     ]
-  }
+  },
+  "jails": [
+    {
+      "name": "route-proxy",
+      "failregex": "^.*TLS handshake error from <HOST>:\\d+: (?:no public route for|acme/autocert: missing server name)\n            ^.*refused: no route for .*, asked from <HOST>:\\d+$",
+      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=route-proxy\nport = http,https\nmaxretry = 10\nfindtime = 1d\nbantime = 1d"
+    }
+  ]
 }

modules/unifi/client.ts

@@ -23,6 +23,19 @@ export interface UnifiPortForward {
   site_id?: string;
 }
 
+export interface UnifiNetwork {
+  _id: string;
+  name: string;
+  purpose: string;
+  ip_subnet?: string;
+  dhcpd_enabled?: boolean;
+  dhcpd_dns_enabled?: boolean;
+  dhcpd_dns_1?: string;
+  dhcpd_dns_2?: string;
+  dhcpd_dns_3?: string;
+  dhcpd_dns_4?: string;
+}
+
 export interface UnifiDevice {
   _id: string;
   name: string;
@@ -232,6 +245,17 @@ export class UnifiApiClient {
     await this.request<unknown>("DELETE", `/api/s/${this.site}/rest/portforward/${id}`);
   }
 
+  // --- Networks ---
+
+  async listNetworks(): Promise<UnifiNetwork[]> {
+    return this.request<UnifiNetwork>("GET", `/api/s/${this.site}/rest/networkconf`);
+  }
+
+  async updateNetwork(id: string, fields: Partial<UnifiNetwork>): Promise<UnifiNetwork> {
+    const result = await this.request<UnifiNetwork>("PUT", `/api/s/${this.site}/rest/networkconf/${id}`, fields);
+    return result[0];
+  }
+
   // --- Devices ---
 
   async listDevices(): Promise<UnifiDevice[]> {

modules/unifi/tools/index.ts

@@ -1,10 +1,23 @@
 // unifi's tools — its own code (novox/hq ADR 0039), importing unifi's own client. They return
 // structured data; the mesh serves them through the sdk's tool harness. unifi is tools-only (no
 // events entrypoint): the controller does not push lifecycle events the mesh consumes, so this
-// module reads its resources — port forwards, devices, clients — and exposes them, and stops there.
+// module reads its resources — port forwards, networks, devices, clients — and exposes them, and stops there.
 
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { UnifiApiClient, type UnifiPortForward } from "../client.js";
+import { UnifiApiClient, type UnifiNetwork, type UnifiPortForward } from "../client.js";
+
+function summarizeNetwork(n: UnifiNetwork): Record<string, unknown> {
+  const dns = [n.dhcpd_dns_1, n.dhcpd_dns_2, n.dhcpd_dns_3, n.dhcpd_dns_4].filter((s): s is string => !!s);
+  return {
+    id: n._id,
+    name: n.name,
+    purpose: n.purpose,
+    subnet: n.ip_subnet ?? null,
+    dhcp: n.dhcpd_enabled ?? null,
+    // What DHCP hands out as DNS: the listed servers when set, otherwise the gateway itself.
+    dhcp_dns: n.dhcpd_dns_enabled ? dns : "the gateway",
+  };
+}
 
 function summarizePortForward(r: UnifiPortForward): Record<string, unknown> {
   return {
@@ -88,6 +101,40 @@ export function getUnifiTools(unifi: UnifiApiClient): ToolDefinition[] {
         return { deleted: true, id: String(args.id) };
       },
     },
+    {
+      name: "unifi_list_networks",
+      description: "List the networks the UniFi controller manages, with the DNS servers each one's DHCP hands out.",
+      input: {},
+      run: async () => {
+        const nets = await unifi.listNetworks();
+        return { count: nets.length, networks: nets.map(summarizeNetwork) };
+      },
+    },
+    {
+      name: "unifi_set_network_dns",
+      description:
+        "Set the DNS servers a network's DHCP hands out to its devices (see unifi_list_networks for ids). " +
+        "Up to four addresses, comma-separated; \"gateway\" hands out the gateway itself. Devices pick it up when they renew.",
+      input: {
+        id: { type: "string", description: "the network id" },
+        dns: { type: "string", description: "comma-separated DNS server addresses, or \"gateway\"" },
+      },
+      run: async (args) => {
+        const asked = String(args.dns ?? "").trim();
+        if (!asked) return { updated: false, reason: "say dns: addresses, or \"gateway\"" };
+        const servers = asked === "gateway" ? [] : asked.split(",").map((s) => s.trim()).filter(Boolean);
+        if (servers.length > 4) return { updated: false, reason: "DHCP hands out at most four DNS servers" };
+        const fields: Partial<UnifiNetwork> = {
+          dhcpd_dns_enabled: servers.length > 0,
+          dhcpd_dns_1: servers[0] ?? "",
+          dhcpd_dns_2: servers[1] ?? "",
+          dhcpd_dns_3: servers[2] ?? "",
+          dhcpd_dns_4: servers[3] ?? "",
+        };
+        const net = await unifi.updateNetwork(String(args.id), fields);
+        return { updated: summarizeNetwork(net) };
+      },
+    },
     {
       name: "unifi_list_devices",
       description: "List the network devices (APs, switches, gateways) the UniFi controller manages.",