systemd: the service manager as a module — holds node-service-manager and answers for the units in both scopes

The holder of the seat the controller seeds under novox/hq ADR 0177. Eight verbs under the seat's name — units, status, start, stop, restart, enable, disable, journal — each taking an optional scope, "system" by default or "user" for the operator account's own manager, reached as `systemctl --user --machine=<account>@` when the runtime is not that account. One tool of its own, systemd_failed, for every failed unit in both scopes. A package, a claim and a bundle; no container, no process: served by the node tools runtime (ADR 0175) once it exists. `module check` passes against a controller that carries the seat; the tools type-check against the SDK.
zsh: the shell as a module — package, the mesh's ~/.zshrc block, the login-shell seat and execute
2026-10-02 16:47:48 +02:00 · 2026-10-02 16:40:34 +02:00
37 changed files with 1085 additions and 635 deletions
@@ -1,15 +0,0 @@
-# build-agent
-
-The mesh's build machine as a role every machine can hold (novox/hq ADR 0190). It holds the node seat
-`node-build-agent`: every holder pulls one build at a time from the role's one work queue when it is
-idle, so a tier of many images is built by as many machines as hold the seat and are online, and a
-machine that is off builds nothing and blocks nothing. The controller asks the role, never a machine;
-the outcome names the machine that built it.
-
-What a holding machine needs is what the builder always needed, said here once: a container runtime
-(the socket is mounted), the artifact store and the package registry as provisions, a workspace, and
-the bus credential. The code is `cmd/mesh-builder` in the mesh-controller repository, compiled from
-that repository's main (`build.artifacts[].context`); this module ships the packaging.
-
-Assign it to every machine with a container runtime. It replaces `builder`, the one-holder form of the
-same thing; retire that once this is assigned where it was.
@@ -1,6 +1,6 @@
 ARG GO_BASE
 ARG ALPINE_BASE
-# build-agent's image: the build machine itself, compiled into a container (novox/hq ADR 0190).
+# builder's own image: the build machine itself, compiled into a container.
 #
 # **The source is not vendored here.** builder's actual code — cmd/mesh-builder, internal/builder,
 # internal/catalogue — lives in the mesh-controller repository, the same control plane it is one
@@ -1,14 +1,13 @@
 {
-  "module": "build-agent",
+  "module": "builder",
  "version": "1",
-  "slug": "agent",
  "capabilities": [
    "container-runtime"
  ],
  "claims": [
    {
-      "name": "node-build-agent",
-      "scope": "node"
+      "name": "mesh-build-machine",
+      "scope": "mesh"
    }
  ],
  "requires": [
@@ -37,19 +36,19 @@
      "mode": "0700"
    },
    {
-      "id": "agent-env",
+      "id": "builder-env",
      "type": "file",
-      "path": "${dir:mesh-state}/build-agent.env",
+      "path": "${dir:mesh-state}/builder.env",
      "mode": "0600",
      "content": "MESH_BROKER_FILE=/run/mesh/broker\nMESH_NODE=${machine:name}\nMESH_REGISTRY=${bound:artifact-store:at}:${bound:artifact-store:port}\nMESH_PACKAGE_BINDING=/run/mesh/package-registry.json\nMESH_NPM_TOKEN_FILE=/run/mesh/package-registry.secret\nMESH_WORKSPACE=${dir:workspace}\n"
    },
    {
      "id": "server",
      "type": "container",
-      "name": "mesh-build-agent",
+      "name": "mesh-builder",
      "artifact": "server",
      "env-file": [
-        "${dir:mesh-state}/build-agent.env"
+        "${dir:mesh-state}/builder.env"
      ],
      "volumes": [
        "${dir:mesh-state}:/run/mesh:ro",
@@ -57,7 +56,7 @@
        "/var/run/docker.sock:/var/run/docker.sock"
      ],
      "restart-on": [
-        "agent-env"
+        "builder-env"
      ],
      "network": "host"
    }
@@ -1,23 +0,0 @@
-# fail2ban's runtime: the tool runtime, carrying the intrusion prevention's verbs and the client they
-# speak through.
-#
-# Built from this module's own directory and nothing else (novox/hq ADR 0069). Two bases, named in
-# module.json's `build.on`: the image this is compiled in and the image it runs in.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/fail2ban
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# The daemon runs on the machine, declared by this module; what runs here is only its client, which
-# speaks to the daemon over the socket the machine shares into this container (novox/hq ADR 0179).
-# The package brings the client and the daemon together; the daemon is never started here.
-RUN apt-get update \
-      && apt-get install -y --no-install-recommends fail2ban \
-      && rm -rf /var/lib/apt/lists/*
-COPY --from=build /app/modules/fail2ban/dist /app/modules/fail2ban/dist
-ENV MESH_TOOL_MODULES=/app/modules/fail2ban/dist/tools/index.js
@@ -1,204 +1,51 @@
-// fail2ban's own code, in the module (novox/hq ADR 0039). The jails are composed by the mesh from
-// the modules a machine runs (to-be 31) and written as declared resources; the daemon is kept
-// running by one. This code exists only to read and steer the *live* state the daemon owns: who is
-// banned now and until when, and the ban or release an operator asks for — the node-intrusion-
-// prevention seat's four verbs (ADR 0179). The daemon's state is fail2ban's, not the mesh's: the
-// mesh composes the jails and never writes the ban list.
-//
-// Spoken through fail2ban-client over the daemon's socket, which the machine shares into this
-// runtime; so the client here is the one from the runtime's own package and the daemon is the
-// machine's, and the two meet at /var/run/fail2ban/fail2ban.sock.
+// fail2ban's own code, in the module (novox/hq ADR 0039). The jails and the daemon are declared
+// resources — the mesh writes /etc/fail2ban/jail.d/* and keeps fail2ban.service running (see
+// module.json). This code exists only to read and steer the *live* state the daemon owns at
+// runtime: which IPs are banned right now, and the manual ban/unban an operator reaches for. That
+// state (the running bans, /var/lib/fail2ban's sqlite) is fail2ban's, not the mesh's — the mesh
+// reconciles the config, never the ban list.

 import { execFile } from "node:child_process";
-import { isIP } from "node:net";
 import { promisify } from "node:util";

-const execFileP = promisify(execFile);
-
-/** A command runner, so the verbs can be tested without a daemon. */
-export type Runner = (cmd: string, args: string[]) => Promise<string>;
-
-export const execRunner: Runner = async (cmd, args) => {
-  try {
-    const { stdout } = await execFileP(cmd, args, { maxBuffer: 16 * 1024 * 1024 });
-    return stdout;
-  } catch (err) {
-    const e = err as { code?: string | number; stderr?: string; stdout?: string; message?: string };
-    const said = `${e.stdout ?? ""}${e.stderr ?? ""}`.trim();
-    if (e.code === "ENOENT") throw new Error(`${cmd} is not in this runtime`);
-    if (/Failed to access socket path|Is fail2ban running/i.test(said)) {
-      throw new Error("fail2ban is not running on this machine, or its socket is not shared with this runtime");
-    }
-    // fail2ban-client's own last line is the one a person reads ("Sorry but the jail 'x' does not exist").
-    const lines = said.split("\n").map((l) => l.trim()).filter(Boolean);
-    throw new Error(lines.length ? lines[lines.length - 1] : (e.message ?? `${cmd} failed`));
-  }
-};
-
-/** One jail as the daemon reports it. */
-export interface JailStatus {
-  jail: string;
-  /** What the jail is reading: files or journal matches, as fail2ban names them. */
-  watching: string[];
-  /** Addresses with failures counted against them right now, and all failures since the jail started. */
-  failing: { now: number; total: number };
-  /** Addresses held right now, and all bans since the jail started. */
-  banned: { now: number; total: number; addresses: string[] };
-}
-
-/** One ban as the daemon holds it. */
-export interface Ban {
-  ip: string;
-  jail: string;
-  /** When the ban was placed, in the machine's local time as fail2ban prints it. */
-  since: string;
-  /** When the ban ends; "never" for a permanent ban. */
-  until: string;
-}
-
-export interface JailSettings {
-  jail: string;
-  bantime: string;
-  findtime: string;
-  maxretry: number;
-  ignoreip: string[];
-  actions: string[];
-  /** The log files the jail reads, when it reads files. */
-  logpath: string[];
-  /** The journal match the jail reads, when it reads the journal. */
-  journalmatch: string;
-}
+const run = promisify(execFile);

 export class Fail2banClient {
-  private readonly run: Runner;
-
-  constructor(run: Runner = execRunner) {
-    this.run = run;
-  }
-
  static fromEnv(_env: NodeJS.ProcessEnv = process.env): Fail2banClient {
    return new Fail2banClient();
  }

-  private client(...args: string[]): Promise<string> {
-    return this.run("fail2ban-client", args);
-  }
-
-  /** The jails the daemon runs, by name. */
-  async jails(): Promise<string[]> {
-    const out = await this.client("status");
-    const m = out.match(/Jail list:\s*(.*)/);
-    if (!m) return [];
-    return m[1].split(",").map((j) => j.trim()).filter(Boolean);
-  }
-
-  /** Every jail with what it watches and holds, or one jail's detail. */
-  async status(jail?: string): Promise<{ jails: JailStatus[] }> {
-    const names = jail ? [jail] : await this.jails();
-    const jails: JailStatus[] = [];
-    for (const name of names) {
-      jails.push(parseJailStatus(name, await this.client("status", name)));
-    }
-    return { jails };
-  }
-
-  /** Every address banned now, with the jail holding it and when the ban ends. */
-  async banned(jail?: string): Promise<{ banned: Ban[] }> {
-    const names = jail ? [jail] : await this.jails();
-    const banned: Ban[] = [];
-    for (const name of names) {
-      banned.push(...parseBans(name, await this.client("get", name, "banip", "--with-time")));
-    }
-    banned.sort((a, b) => a.until.localeCompare(b.until) || a.ip.localeCompare(b.ip));
-    return { banned };
-  }
-
-  /** Ban one address in one jail now. The daemon's own answer is how many addresses it added. */
-  async ban(ip: string, jail: string): Promise<{ banned: Ban | null; added: number }> {
-    address(ip);
-    name(jail);
-    const out = await this.client("set", jail, "banip", ip);
-    const added = Number.parseInt(out.trim(), 10) || 0;
-    const held = (await this.banned(jail)).banned.find((b) => b.ip === ip) ?? null;
-    return { banned: held, added };
-  }
-
-  /** Let one address go, from one jail or from every jail. The daemon's answer is how many it released. */
-  async unban(ip: string, jail?: string): Promise<{ released: number; ip: string; jail: string | "every jail" }> {
-    address(ip);
-    let out: string;
+  /** Overview of every jail, or the detailed status of one — currently-banned IPs and totals. */
+  async status(jail?: string): Promise<string> {
    if (jail) {
-      name(jail);
-      out = await this.client("set", jail, "unbanip", ip);
-    } else {
-      out = await this.client("unban", ip);
+      const { stdout } = await run("sudo", ["fail2ban-client", "status", jail]);
+      return stdout;
    }
-    return { released: Number.parseInt(out.trim(), 10) || 0, ip, jail: jail ?? "every jail" };
+    const { stdout: overview } = await run("sudo", ["fail2ban-client", "status"]);
+    const match = overview.match(/Jail list:\s*(.+)/);
+    if (!match) return overview;
+
+    const jails = match[1].split(",").map((j) => j.trim()).filter(Boolean);
+    const parts: string[] = [overview.trimEnd(), ""];
+    for (const j of jails) {
+      const { stdout } = await run("sudo", ["fail2ban-client", "status", j]);
+      parts.push(`=== ${j} ===`, stdout.trimEnd(), "");
+    }
+    return parts.join("\n");
  }

-  /** One jail's effective settings — the module's own tool, beside the seat's verbs. */
-  async settings(jail: string): Promise<JailSettings> {
-    name(jail);
-    const get = (key: string) => this.client("get", jail, key);
-    const [bantime, findtime, maxretry, ignoreip, actions, logpath, journalmatch] = await Promise.all([
-      get("bantime"), get("findtime"), get("maxretry"), get("ignoreip"), get("actions"), get("logpath"),
-      get("journalmatch"),
-    ]);
-    return {
-      jail,
-      bantime: bantime.trim(),
-      findtime: findtime.trim(),
-      maxretry: Number.parseInt(maxretry.trim(), 10),
-      ignoreip: listed(ignoreip),
-      actions: actions.split("\n").slice(1).map((l) => l.trim()).filter(Boolean),
-      logpath: /No file is currently monitored/.test(logpath) ? [] : listed(logpath),
-      journalmatch: journalmatch.split("\n").slice(1).map((l) => l.trim()).filter(Boolean).join(" "),
-    };
+  /** Manually ban an IP in a jail. Mutates live state, not a mesh-managed file. */
+  async ban(jail: string, ip: string): Promise<string> {
+    const { stdout } = await run("sudo", ["fail2ban-client", "set", jail, "banip", ip]);
+    return stdout;
+  }
+
+  /** Unban an IP from one jail, or from every jail when no jail is given. */
+  async unban(ip: string, jail?: string): Promise<string> {
+    const args = jail
+      ? ["fail2ban-client", "set", jail, "unbanip", ip]
+      : ["fail2ban-client", "unban", ip];
+    const { stdout } = await run("sudo", args);
+    return stdout;
  }
 }
-
-/** fail2ban's tree listings: lines like "|- 127.0.0.0/8" and "`- ::1", after a heading. */
-function listed(out: string): string[] {
-  return out
-    .split("\n")
-    .map((l) => l.replace(/^[\s|`-]+/, "").trim())
-    .filter((l, i) => i > 0 && l.length > 0);
-}
-
-export function parseJailStatus(jail: string, out: string): JailStatus {
-  const field = (label: string) => {
-    const m = out.match(new RegExp(label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + ":\\t?\\s*(.*)"));
-    return m ? m[1].trim() : "";
-  };
-  const num = (label: string) => Number.parseInt(field(label), 10) || 0;
-  const watching = [field("File list"), field("Journal matches")].filter(Boolean);
-  return {
-    jail,
-    watching,
-    failing: { now: num("Currently failed"), total: num("Total failed") },
-    banned: {
-      now: num("Currently banned"),
-      total: num("Total banned"),
-      addresses: field("Banned IP list").split(/\s+/).filter(Boolean),
-    },
-  };
-}
-
-/** `get <jail> banip --with-time` prints one ban per line: "IP \tsince + seconds = until". */
-export function parseBans(jail: string, out: string): Ban[] {
-  const bans: Ban[] = [];
-  for (const line of out.split("\n")) {
-    const m = line.match(/^(\S+)\s+(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) \+ (-?\d+) = (\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}|\S+)/);
-    if (!m) continue;
-    bans.push({ ip: m[1], jail, since: m[2], until: Number(m[3]) < 0 ? "never" : m[4] });
-  }
-  return bans;
-}
-
-function address(ip: string): void {
-  if (!isIP(ip)) throw new Error(`${JSON.stringify(ip)} is not an address`);
-}
-
-function name(jail: string): void {
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(jail)) throw new Error(`${JSON.stringify(jail)} is not a jail's name`);
-}
@@ -7,25 +7,9 @@
  "claims": [
    {
      "name": "node-intrusion-prevention",
-      "scope": "node",
-      "serves": [
-        "status",
-        "banned",
-        "ban",
-        "unban"
-      ]
+      "scope": "node"
    }
  ],
-  "tools": [
-    "fail2ban_settings"
-  ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
-  "jailing": {
-    "into": "/etc/fail2ban/jail.d/mesh.conf",
-    "filter-into": "/etc/fail2ban/filter.d"
-  },
  "resources": [
    {
      "id": "package",
@@ -44,37 +28,19 @@
      "path": "/etc/fail2ban/action.d",
      "mode": "0755"
    },
-    {
-      "id": "filter-d",
-      "type": "directory",
-      "path": "/etc/fail2ban/filter.d",
-      "mode": "0755"
-    },
-    {
-      "id": "run-dir",
-      "type": "directory",
-      "path": "/var/run/fail2ban",
-      "mode": "0755"
-    },
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
    {
      "id": "jail-local",
      "type": "file",
      "path": "/etc/fail2ban/jail.local",
      "mode": "0644",
-      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\n# **A ban list never holds a neighbour.** The mesh's own range is named rather than written\n# (novox/hq ADR 0112), and every private range beside it: a source on one is somebody's own\n# network, not the internet. On a machine behind a router that reflects local traffic, every\n# client in the house arrives as the gateway's address — so one mistyped local request banned\n# 192.168.1.1 on the home server and would have cut the whole house off from it (ADR 0186).\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range} 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10\n\n# Three failures in a day ban for a day (novox/hq ADR 0179). The attackers this mesh sees pace\n# themselves at one try every ten minutes, under any ten-minute window; a day's window counts\n# them, and a day's ban costs a person who mistyped three times once, from one address, while\n# the mesh's own range is never banned at all.\nbantime  = 1d\nfindtime = 1d\nmaxretry = 3\n\n# Ban through iptables, not through a firewall front-end the machine may not have. ufw is\n# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out\n# only at ban time: the service reports healthy, the jail counts the attempt, the ban command\n# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a\n# machine the mesh reported as protected.\n#\n# The action below is this module's own, already used by the recidive jail on every machine\n# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is\n# covered too.\nbanaction = iptables-allports-dualchain\nbanaction_allports = iptables-allports-dualchain\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
+      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\n# Ban through iptables, not through a firewall front-end the machine may not have. ufw is\n# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out\n# only at ban time: the service reports healthy, the jail counts the attempt, the ban command\n# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a\n# machine the mesh reported as protected.\n#\n# The action below is this module's own, already used by the recidive jail on every machine\n# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is\n# covered too.\nbanaction = iptables-allports-dualchain\nbanaction_allports = iptables-allports-dualchain\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
    },
    {
      "id": "jail-sshd",
      "type": "file",
      "path": "/etc/fail2ban/jail.d/sshd.conf",
      "mode": "0644",
-      "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 3\nfindtime = 1d\nbantime  = 1d\n"
+      "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 5\n"
    },
    {
      "id": "log",
@@ -89,7 +55,7 @@
      "type": "file",
      "path": "/etc/fail2ban/jail.d/recidive.conf",
      "mode": "0644",
-      "content": "[recidive]\nenabled = true\nlogpath  = /var/log/fail2ban.log\n# Ban in both INPUT (host services like SSH) and DOCKER-USER (container services)\nbanaction = iptables-allports-dualchain\n# Banned twice in two weeks, by any jail, is banned for four (novox/hq ADR 0179).\nbantime  = 4w\nfindtime = 2w\nmaxretry = 2\n"
+      "content": "[recidive]\nenabled = true\nlogpath  = /var/log/fail2ban.log\n# Ban in both INPUT (host services like SSH) and DOCKER-USER (container services)\nbanaction = iptables-allports-dualchain\nbantime  = 1w\nfindtime = 1d\n"
    },
    {
      "id": "action-dualchain",
@@ -115,44 +81,8 @@
        "jail-local",
        "jail-sshd",
        "jail-recidive",
-        "action-dualchain",
-        "composed-jails"
-      ]
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-fail2ban",
-      "artifact": "runtime",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "/var/run/fail2ban:/var/run/fail2ban"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker"
-      }
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
+        "action-dualchain"
      ]
    }
+  ]
 }
@@ -1,18 +1,14 @@
 {
  "name": "@novox/module-fail2ban",
  "version": "0.1.0",
-  "description": "fail2ban \u2014 intrusion prevention: the mesh composes the jails and keeps the daemon running; this module holds the node-intrusion-prevention seat and serves its verbs status, banned, ban and unban (novox/hq to-be 31, ADR 0179).",
+  "description": "fail2ban — intrusion prevention: the mesh declares the jails and keeps the daemon running; its ban/unban/status tools live here.",
  "type": "module",
  "private": true,
  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.1"
+    "@novox/mesh-sdk": "^0.1.0"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
    "typescript": "^5.6.0"
-  },
-  "scripts": {
-    "build": "tsc client.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
  }
 }
@@ -1,106 +0,0 @@
-// The intrusion prevention's verbs over a fake daemon, with the shapes fail2ban-client 1.1.0 printed
-// on the control node on 2026-10-02 (novox/hq ADR 0179).
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { Fail2banClient, parseBans, parseJailStatus, type Runner } from "../client.ts";
-
-const STATUS = "Status\n|- Number of jail:\t2\n`- Jail list:\trecidive, sshd\n";
-const RECIDIVE =
-  "Status for the jail: recidive\n|- Filter\n|  |- Currently failed:\t36\n|  |- Total failed:\t149\n" +
-  "|  `- File list:\t/var/log/fail2ban.log\n`- Actions\n   |- Currently banned:\t9\n   |- Total banned:\t13\n" +
-  "   `- Banned IP list:\t195.178.110.30 45.148.10.240 92.118.39.71\n";
-const SSHD =
-  "Status for the jail: sshd\n|- Filter\n|  |- Currently failed:\t5\n|  |- Total failed:\t11776\n" +
-  "|  `- Journal matches:\t_SYSTEMD_UNIT=sshd.service + _COMM=sshd\n`- Actions\n   |- Currently banned:\t0\n" +
-  "   |- Total banned:\t150\n   `- Banned IP list:\t\n";
-const WITH_TIME =
-  "195.178.110.30 \t2026-09-26 23:18:47 + 604800 = 2026-10-03 23:18:47\n" +
-  "92.118.39.71 \t2026-09-28 10:33:49 + 604800 = 2026-10-05 10:33:49\n";
-
-function fake(answers: Record<string, string>, calls: string[][] = []): Runner {
-  return async (cmd, args) => {
-    calls.push([cmd, ...args]);
-    const key = args.join(" ");
-    if (key in answers) return answers[key];
-    throw new Error(`unexpected ${cmd} ${key}`);
-  };
-}
-
-test("a jail's status is read into numbers, what it watches and who it holds", () => {
-  const s = parseJailStatus("recidive", RECIDIVE);
-  assert.deepEqual(s, {
-    jail: "recidive",
-    watching: ["/var/log/fail2ban.log"],
-    failing: { now: 36, total: 149 },
-    banned: { now: 9, total: 13, addresses: ["195.178.110.30", "45.148.10.240", "92.118.39.71"] },
-  });
-  const j = parseJailStatus("sshd", SSHD);
-  assert.deepEqual(j.watching, ["_SYSTEMD_UNIT=sshd.service + _COMM=sshd"]);
-  assert.deepEqual(j.banned, { now: 0, total: 150, addresses: [] });
-});
-
-test("status covers every jail the daemon lists, or the one named", async () => {
-  const calls: string[][] = [];
-  const f = new Fail2banClient(fake({ status: STATUS, "status recidive": RECIDIVE, "status sshd": SSHD }, calls));
-  const all = await f.status();
-  assert.deepEqual(all.jails.map((j) => j.jail), ["recidive", "sshd"]);
-  const one = await f.status("sshd");
-  assert.equal(one.jails.length, 1);
-  assert.deepEqual(calls[calls.length - 1], ["fail2ban-client", "status", "sshd"]);
-});
-
-test("bans are read with when they were placed and when they end, a permanent one as never", () => {
-  const bans = parseBans("recidive", WITH_TIME + "203.0.113.9 \t2026-10-01 00:00:00 + -1 = never\n");
-  assert.equal(bans.length, 3);
-  assert.deepEqual(bans[0], { ip: "195.178.110.30", jail: "recidive", since: "2026-09-26 23:18:47", until: "2026-10-03 23:18:47" });
-  assert.equal(bans[2].until, "never");
-  assert.deepEqual(parseBans("sshd", "\n"), []);
-});
-
-test("banned gathers every jail's bans, soonest to end first", async () => {
-  const f = new Fail2banClient(fake({
-    status: STATUS,
-    "get recidive banip --with-time": WITH_TIME,
-    "get sshd banip --with-time": "198.51.100.7 \t2026-10-02 15:06:58 + 600 = 2026-10-02 15:16:58\n",
-  }));
-  const { banned } = await f.banned();
-  assert.deepEqual(banned.map((b) => `${b.ip}@${b.jail}`), ["198.51.100.7@sshd", "195.178.110.30@recidive", "92.118.39.71@recidive"]);
-});
-
-test("ban asks the daemon by jail and answers with the ban as held; a non-address is refused before anything runs", async () => {
-  const calls: string[][] = [];
-  const f = new Fail2banClient(fake({
-    "set recidive banip 198.51.100.7": "1\n",
-    "get recidive banip --with-time": WITH_TIME + "198.51.100.7 \t2026-10-02 17:00:00 + 604800 = 2026-10-09 17:00:00\n",
-  }, calls));
-  const r = await f.ban("198.51.100.7", "recidive");
-  assert.equal(r.added, 1);
-  assert.equal(r.banned?.until, "2026-10-09 17:00:00");
-  assert.deepEqual(calls[0], ["fail2ban-client", "set", "recidive", "banip", "198.51.100.7"]);
-  await assert.rejects(() => f.ban("not-an-ip", "recidive"), /is not an address/);
-  await assert.rejects(() => f.ban("198.51.100.7", "a jail; rm"), /is not a jail's name/);
-  assert.equal(calls.length, 2);
-});
-
-test("unban releases from one jail or from every jail", async () => {
-  const calls: string[][] = [];
-  const f = new Fail2banClient(fake({ "set sshd unbanip 198.51.100.7": "1\n", "unban 198.51.100.7": "2\n" }, calls));
-  assert.deepEqual(await f.unban("198.51.100.7", "sshd"), { released: 1, ip: "198.51.100.7", jail: "sshd" });
-  assert.deepEqual(await f.unban("198.51.100.7"), { released: 2, ip: "198.51.100.7", jail: "every jail" });
-  assert.deepEqual(calls[1], ["fail2ban-client", "unban", "198.51.100.7"]);
-});
-
-test("a jail's settings are read from the daemon's listings", async () => {
-  const f = new Fail2banClient(fake({
-    "get sshd bantime": "86400\n", "get sshd findtime": "86400\n", "get sshd maxretry": "3\n",
-    "get sshd ignoreip": "These IP addresses/networks are ignored:\n|- 127.0.0.0/8\n|- 10.10.0.0/24\n`- ::1\n",
-    "get sshd actions": "The jail sshd has the following actions:\niptables-allports-dualchain\n",
-    "get sshd logpath": "No file is currently monitored\n",
-    "get sshd journalmatch": "Current match filter:\n_SYSTEMD_UNIT=sshd.service + _COMM=sshd\n",
-  }));
-  assert.deepEqual(await f.settings("sshd"), {
-    jail: "sshd", bantime: "86400", findtime: "86400", maxretry: 3,
-    ignoreip: ["127.0.0.0/8", "10.10.0.0/24", "::1"], actions: ["iptables-allports-dualchain"],
-    logpath: [], journalmatch: "_SYSTEMD_UNIT=sshd.service + _COMM=sshd",
-  });
-});
@@ -1,62 +1,55 @@
-// The intrusion prevention's tools: the node-intrusion-prevention seat's four verbs — who is banned,
-// the jails' state, ban one, let one go — and the module's own reading of a jail's settings
-// (novox/hq to-be 31, ADR 0179). The jails themselves are composed by the mesh from the modules a
-// machine runs and written as declared resources; these touch only what the running daemon holds.
+// fail2ban's tools — reading and steering the live ban state. The jails themselves are declared
+// resources (module.json); these three touch what the running daemon holds: what is banned now,
+// and the manual ban/unban an operator reaches for. The daemon's state is fail2ban's own, so this
+// is the only way to see or change it — the mesh reconciles the config, not the bans.

 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { Fail2banClient } from "../client.js";

-export function getSeatVerbs(fail2ban: Fail2banClient): ToolDefinition[] {
-  return [
-    {
-      name: "status",
-      description:
-        "Every jail on this machine with what it watches, how many addresses it is counting failures against and holding now, and the totals since it started; one jail's detail when named.",
-      input: { jail: { type: "string", description: "one jail (optional)" } },
-      run: async (args) => fail2ban.status(args.jail ? String(args.jail) : undefined),
-    },
-    {
-      name: "banned",
-      description: "Every address banned on this machine right now, with the jail that holds it, when it was banned and when the ban ends.",
-      input: { jail: { type: "string", description: "one jail (optional)" } },
-      run: async (args) => fail2ban.banned(args.jail ? String(args.jail) : undefined),
-    },
-    {
-      name: "ban",
-      description:
-        "Ban one address in one jail now, for the jail's ban time — an operator's act on the live ban list, which the mesh never writes itself.",
-      input: {
-        ip: { type: "string", description: "the address" },
-        jail: { type: "string", description: "the jail to hold it (recidive for the long ban)" },
-      },
-      run: async (args) => fail2ban.ban(String(args.ip ?? ""), String(args.jail ?? "")),
-    },
-    {
-      name: "unban",
-      description: "Let one address go, from one jail or from every jail when none is named.",
-      input: {
-        ip: { type: "string", description: "the address" },
-        jail: { type: "string", description: "one jail (optional)" },
-      },
-      run: async (args) => fail2ban.unban(String(args.ip ?? ""), args.jail ? String(args.jail) : undefined),
-    },
-  ];
-}
-
 export function getFail2banTools(fail2ban: Fail2banClient): ToolDefinition[] {
  return [
    {
-      name: "fail2ban_settings",
+      name: "fail2ban_status",
      description:
-        "One jail's effective settings on this machine: ban time, window, tries, the addresses it never bans, its actions and what it reads.",
-      input: { jail: { type: "string", description: "the jail" } },
-      run: async (args) => fail2ban.settings(String(args.jail ?? "")),
+        "fail2ban status on this node — the jails and their live bans. Omit `jail` for every jail, or name one for its detail.",
+      input: {
+        type: "object",
+        properties: {
+          jail: {
+            type: "string",
+            description: "A specific jail (e.g. sshd, recidive); omit for the overview of all jails.",
+          },
+        },
+      },
+      run: async (args) => ({ status: await fail2ban.status(args.jail as string | undefined) }),
+    },
+    {
+      name: "fail2ban_ban",
+      description: "Manually ban an IP address in a jail — a live change to the running daemon, not a mesh-managed file.",
+      input: {
+        type: "object",
+        properties: {
+          jail: { type: "string", description: "Jail name (e.g. sshd, recidive)." },
+          ip: { type: "string", description: "IP address to ban." },
+        },
+        required: ["jail", "ip"],
+      },
+      run: async (args) => ({ result: await fail2ban.ban(args.jail as string, args.ip as string) }),
+    },
+    {
+      name: "fail2ban_unban",
+      description: "Unban an IP address from one jail, or from every jail when `jail` is omitted.",
+      input: {
+        type: "object",
+        properties: {
+          ip: { type: "string", description: "IP address to unban." },
+          jail: { type: "string", description: "A specific jail; omit to unban from all jails." },
+        },
+        required: ["ip"],
+      },
+      run: async (args) => ({ result: await fail2ban.unban(args.ip as string, args.jail as string | undefined) }),
    },
  ];
 }

-const fail2ban = Fail2banClient.fromEnv();
-// The seat's verbs under the seat's name: the runtime serves them on the seat's subjects where this
-// module holds it (ADR 0159, 0160). The module's own under its own.
-registerModuleTools("node-intrusion-prevention", () => getSeatVerbs(fail2ban));
-registerModuleTools("fail2ban", () => getFail2banTools(fail2ban));
+registerModuleTools("fail2ban", () => getFail2banTools(Fail2banClient.fromEnv()));
@@ -145,8 +145,7 @@
      "volumes": [
        "${dir:data}:/data"
      ],
-      "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it",
-      "logging": "journald"
+      "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it"
    },
    {
      "id": "admin-bootstrap",
@@ -238,12 +237,5 @@
        "from": "Dockerfile"
      }
    ]
-  },
-  "jails": [
-    {
-      "name": "gitea",
-      "failregex": "^.*Failed authentication attempt for .* from <HOST>(?::\\d+)?\\s*$\n            ^.*Invalid user .* from <HOST> port \\d+\\s*$\n            ^.*User \\S+ from <HOST> not allowed because .*$",
-      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=gitea\nport = http,https,222\nmaxretry = 3\nfindtime = 1d\nbantime = 1d"
  }
-  ]
 }
@@ -462,8 +462,7 @@
      ],
      "dns": [
        "192.168.203.254"
-      ],
-      "logging": "journald"
+      ]
    },
    {
      "id": "runtime-config",
@@ -562,12 +561,5 @@
  },
  "grants": {
    "smtp": "${dir:grants}"
-  },
-  "jails": [
-    {
-      "name": "mailu-front",
-      "failregex": "^.*(?:imap|pop3|submission|managesieve)-login: .*\\(auth failed, \\d+ attempts(?: in \\d+ secs)?\\):.*rip=<HOST>(?:,|$)",
-      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=mailu-front\nport = smtp,submission,submissions,imap,imaps,pop3,pop3s\nmaxretry = 3\nfindtime = 1d\nbantime = 1d"
  }
-  ]
 }
@@ -0,0 +1,13 @@
+# The console (novox/hq ADR 0152, design 34): the mesh's tools for whoever is on a machine, served
+# over MCP on that machine's loopback.
+#
+# **Nothing is compiled here.** The console is the tool runtime's own client — `mesh serve` — which
+# the runtime image already carries beside the runtime it runs modules with. This recipe changes the
+# program the image starts and nothing else, so the console is exactly the client a person can run by
+# hand, started by the mesh instead, on the credential the mesh sealed to the machine.
+#
+# One base, named rather than pinned: the mesh answers with the copy it holds (novox/hq issue 044).
+ARG RUNTIME_BASE
+
+FROM ${RUNTIME_BASE}
+ENTRYPOINT ["node", "dist/mesh.js"]
@@ -0,0 +1,38 @@
+# mesh-console
+
+The mesh's tools, on the machine a person sits at, served by a module the mesh assigned there
+(novox/hq [ADR 0152](https://git.novox.be/novox/hq), design 34).
+
+Assign it to a machine and an agent on that machine has the mesh's tools at
+`http://127.0.0.1:<port>/mcp` — MCP over HTTP, `initialize`, `tools/list`, `tools/call`. A person at
+a terminal reaches the same endpoint with `mesh tools --console http://127.0.0.1:<port>` and
+`mesh call <module>.<tool> --console …`, with no credential of their own: the console holds it.
+
+## What it is
+
+The tool runtime's own client, `mesh serve`, started by the mesh on the credential it sealed to the
+machine for `<node>.mesh-console`. The manifest says three things nothing else in the catalogue says
+together:
+
+- `invokes: ["*"]` — it calls every tool on the mesh, and the bus grants exactly that publish side;
+- a listener `from: machine` — loopback only, and the filter opens nothing for it;
+- no `emits`, no `consumes`, no `tools` — nothing on the bus can address it.
+
+**Loopback is the authority boundary.** Whoever can connect is on the machine, and whoever is on the
+machine is the account that owns the mesh there (ADR 0034, ADR 0144). There is no token and no login,
+and `mesh serve` refuses to bind anything but a loopback address.
+
+## What it lists
+
+What the running modules answer: every tool runtime serves a `tools` verb for its module, and the
+console asks the catalogue which modules the mesh holds and each module what it serves. A module that
+did not answer — not assigned, not up, or built before the runtime answered `tools` — is named in the
+list's `_meta.notAnswering` and can still be called by `<module>.<tool>`.
+
+The mesh's own verbs (`status`, `push`, `assign`) are the `mesh-controller` seat's tools under
+ADR 0132 and are not served on the bus yet; they appear here when they are.
+
+## Port
+
+The manifest declares port 4270 and the mesh assigns the machine port as it does for any listener;
+the console binds `127.0.0.1:${port:4270}`. `node show <machine>` says which port a machine was given.
@@ -0,0 +1,64 @@
+{
+  "module": "mesh-console",
+  "version": "1",
+  "slug": "console",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "invokes": [
+    "*"
+  ],
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "listens": [
+    {
+      "name": "mcp",
+      "port": 4270,
+      "protocol": "tcp",
+      "from": "machine",
+      "why": "the mesh's tools for whoever is on this machine, over MCP on loopback; the machine's login is the authority (novox/hq ADR 0152)"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mesh-console",
+      "network": "host",
+      "args": [
+        "serve"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_CONSOLE_LISTEN": "127.0.0.1:${port:4270}"
+      },
+      "volumes": [
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}
@@ -0,0 +1,23 @@
+# nftables' runtime: the tool runtime, carrying the packet filter's tools and the binaries they speak.
+#
+# Built from this module's own directory and nothing else (novox/hq ADR 0069). Two bases, named in
+# module.json's `build.on`: the image this is compiled in and the image it runs in.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+WORKDIR /app/modules/nftables
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+# The filter's own tools: nft for the machine's ruleset and the mesh's table, iptables for the
+# legacy filter and the tables iptables-nft manages — a predecessor's rules live there (ADR 0168).
+# The container runs on the machine's network with NET_ADMIN (ADR 0170), so these act on the
+# machine's packet filter, not on a namespace of their own.
+RUN apt-get update \
+      && apt-get install -y --no-install-recommends nftables iptables \
+      && rm -rf /var/lib/apt/lists/*
+COPY --from=build /app/modules/nftables/dist /app/modules/nftables/dist
+ENV MESH_TOOL_MODULES=/app/modules/nftables/dist/tools/index.js
@@ -2,13 +2,9 @@
 // rule set from every module's `listens` and writes it to the filter file (ADR 0045); the module
 // loads it through its own unit. This code reads the filter back as the machine enforces it, reloads
 // the mesh's own table, and removes one thing the mesh did not write when the operator names it
-// (ADR 0168, ADR 0170) — the seat's three verbs, over the machine's own tools. Root is the module's
-// concern (ADR 0175 §4): the runtime loading this bundle runs as the operator's account (to-be 38
-// WP4), so the commands go through sudo without a prompt where the account is not root.
+// (ADR 0168, ADR 0170) — the seat's three verbs, over the machine's own tools.

 import { execFile } from "node:child_process";
-import { accessSync, constants } from "node:fs";
-import { delimiter, join } from "node:path";
 import { promisify } from "node:util";

 const execFileP = promisify(execFile);
@@ -16,54 +12,9 @@ const execFileP = promisify(execFile);
 /** A command runner, so the acts can be tested without a packet filter. */
 export type Runner = (cmd: string, args: string[]) => Promise<string>;

-/** Where the mesh writes this node's filter: the path the manifest's `filtering.into` names. A
- *  bundle has no environment of its own (to-be 38 WP4), so the path is said here once, and a test
- *  holds it to the manifest's. */
-export const FILTER_FILE = "/etc/nftables.conf";
-
-/** The command as it is run: as given when this process is root, else through sudo without a
- *  prompt. The packet filter answers only to root, listing included. */
-export function escalated(cmd: string, args: string[], uid: number | undefined = process.getuid?.()): [string, string[]] {
-  if (uid === 0) return [cmd, args];
-  return ["sudo", ["-n", cmd, ...args]];
-}
-
-/** Whether a tool is on this machine: an executable of that name on the path, or where the
- *  system keeps its administration. Asked before a tool is run, so "not here" and "refused" are
- *  never confused — the former is a fact to work around, the latter an error to say. */
-export function installed(tool: string, path: string = process.env.PATH ?? ""): boolean {
-  const dirs = [...path.split(delimiter), "/usr/sbin", "/sbin", "/usr/bin"].filter((d) => d !== "");
-  return dirs.some((dir) => {
-    try {
-      accessSync(join(dir, tool), constants.X_OK);
-      return true;
-    } catch {
-      return false;
-    }
-  });
-}
-
 export const execRunner: Runner = async (cmd, args) => {
-  const [program, argv] = escalated(cmd, args);
-  try {
-    const { stdout } = await execFileP(program, argv, { maxBuffer: 16 * 1024 * 1024 });
+  const { stdout } = await execFileP(cmd, args, { maxBuffer: 16 * 1024 * 1024 });
  return stdout;
-  } catch (err) {
-    // What failed is named by how it failed, not by prose: sudo missing is a spawn error; sudo
-    // refusing speaks on its own stderr line; anything else is the command's own failure.
-    const e = err as { code?: string | number; stderr?: string };
-    if (program === "sudo") {
-      if (e.code === "ENOENT") {
-        throw new Error(`${cmd} needs root, and sudo is not installed here for the runtime's account to escalate with`);
-      }
-      const stderr = String(e.stderr ?? "").trim();
-      if (/^sudo: .*command not found/m.test(stderr)) throw new Error(`${cmd} is not installed here`);
-      if (/^sudo:/m.test(stderr)) {
-        throw new Error(`${cmd} needs root and the runtime's account may not run it without a prompt: ${stderr}`);
-      }
-    }
-    throw err;
-  }
 };

 /** The mesh's own tables, which `remove` never touches. */
@@ -83,17 +34,14 @@ export interface Removal {
 export class FirewallClient {
  private readonly run: Runner;
  private readonly filterFile: string;
-  private readonly have: (tool: string) => boolean;

-  constructor(run: Runner = execRunner, filterFile: string = FILTER_FILE, have: (tool: string) => boolean = installed) {
+  constructor(run: Runner = execRunner, filterFile: string = process.env.MESH_FILTER_FILE ?? "/etc/nftables.conf") {
    this.run = run;
    this.filterFile = filterFile;
-    this.have = have;
  }

-  /** The filter as this machine has it: its own tools, the mesh's file. */
-  static onThisMachine(): FirewallClient {
-    return new FirewallClient();
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): FirewallClient {
+    return new FirewallClient(execRunner, env.MESH_FILTER_FILE ?? "/etc/nftables.conf");
  }

  /** The mesh's live table — exactly what the mesh's own filter is dropping and accepting. */
@@ -117,14 +65,11 @@ export class FirewallClient {
    const legacy: Record<string, string> = {};
    if (!table) {
      for (const tool of ["iptables-legacy", "ip6tables-legacy"]) {
-        if (!this.have(tool)) continue; // no legacy tool, nothing to list
        try {
          const out = await this.run(tool, ["-S"]);
          if (out.trim()) legacy[tool] = out;
-        } catch (err) {
-          // The tool is here and would not answer: said, not swallowed — a listing that silently
-          // leaves out a predecessor's rules reads as "none".
-          legacy[tool] = `error: ${err instanceof Error ? err.message : String(err)}`;
+        } catch {
+          // the tool is not here, or the legacy filter is empty: nothing to list
        }
      }
    }
@@ -137,17 +82,14 @@ export class FirewallClient {
    return { loaded: this.filterFile, table: await this.ruleset() };
  }

-  /** Whether the found front end is in force, whose chains `remove` leaves alone. Absent, it is
-   *  not; present and not answering, nothing is removed on a guess. */
+  /** Whether the found front end is in force, whose chains `remove` leaves alone. */
  private async ufwActive(): Promise<boolean> {
-    if (!this.have("ufw")) return false;
-    let out: string;
    try {
-      out = await this.run("ufw", ["status"]);
-    } catch (err) {
-      throw new Error(`cannot tell whether the found firewall is in force, so nothing of its is removed: ${err instanceof Error ? err.message : String(err)}`);
-    }
+      const out = await this.run("ufw", ["status"]);
      return /^Status:\s*active/m.test(out);
+    } catch {
+      return false;
+    }
  }

  /** Remove one rule set the mesh did not write, named as the host reports it (ADR 0168). */
@@ -2,7 +2,8 @@
  "module": "nftables",
  "version": "1",
  "capabilities": [
-    "firewall"
+    "firewall",
+    "container-runtime"
  ],
  "claims": [
    {
@@ -19,16 +20,17 @@
    "into": "/etc/nftables.conf"
  },
  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
    {
      "id": "package",
      "type": "package",
      "package": "nftables"
    },
-    {
-      "id": "legacy-tools",
-      "type": "package",
-      "package": "iptables"
-    },
    {
      "id": "unit",
      "type": "file",
@@ -40,7 +42,7 @@
      "id": "stock-unit-stop",
      "type": "file",
      "path": "/etc/systemd/system/nftables.service.d/mesh.conf",
-      "content": "# The mesh: stopping the stock unit deletes only the mesh's table, never the whole ruleset\n# (novox/hq ADR 0100) — a flush would take the container runtime's rules and any firewall with it.\n[Service]\nExecStop=\nExecStop=nft delete table inet mesh\n",
+      "content": "# The mesh: stopping the stock unit deletes only the mesh's table, never the whole ruleset\n# (novox/hq ADR 0100) \u2014 a flush would take the container runtime's rules and any firewall with it.\n[Service]\nExecStop=\nExecStop=nft delete table inet mesh\n",
      "mode": "0644"
    },
    {
@@ -58,24 +60,48 @@
      ]
    },
    {
-      "id": "front-end",
-      "type": "package",
-      "package": "ufw",
-      "absent": true
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-nftables",
+      "network": "host",
+      "capabilities": [
+        "NET_ADMIN"
+      ],
+      "volumes": [
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "/etc/nftables.conf:/etc/nftables.conf:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_FILTER_FILE": "/etc/nftables.conf"
+      },
+      "artifact": "runtime"
    }
  ],
  "tools": [
    "firewall_rules"
  ],
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
    "artifacts": [
      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js"
-        ]
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
      }
    ]
  }
@@ -5,7 +5,7 @@
  "type": "module",
  "private": true,
  "scripts": {
-    "build": "tsc client.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --rootDir . --outDir dist",
+    "build": "tsc client.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
  },
  "dependencies": {
@@ -4,8 +4,7 @@
 // and the same in an iptables-nft table. It refuses what is not the operator's to remove.
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { FILTER_FILE, FirewallClient, chainsJumpingTo, escalated, installed, type Runner } from "../client.ts";
+import { FirewallClient, chainsJumpingTo, type Runner } from "../client.ts";

 const legacy = [
  "-P INPUT ACCEPT", "-P FORWARD DROP", "-P OUTPUT ACCEPT",
@@ -35,7 +34,7 @@ function fake(ufwActive = false): { run: Runner; asked: string[] } {

 test("a predecessor's chain in the legacy filter loses its jumps, is flushed and deleted", async () => {
  const f = fake();
-  const out = await new FirewallClient(f.run, undefined, () => true).remove("chain HAL-MESH-ONLY (iptables-legacy)");
+  const out = await new FirewallClient(f.run).remove("chain HAL-MESH-ONLY (iptables-legacy)");
  assert.deepEqual(out.did, [
    "iptables-legacy -D DOCKER-USER -i enp6s0 -p tcp -m conntrack --ctstate NEW -j HAL-MESH-ONLY",
    "iptables-legacy -F HAL-MESH-ONLY",
@@ -45,27 +44,27 @@ test("a predecessor's chain in the legacy filter loses its jumps, is flushed and

 test("the runtime's user chain is emptied back to its one return, never deleted", async () => {
  const f = fake();
-  const out = await new FirewallClient(f.run, undefined, () => true).remove("chain DOCKER-USER (ip6tables-legacy)");
+  const out = await new FirewallClient(f.run).remove("chain DOCKER-USER (ip6tables-legacy)");
  assert.deepEqual(out.did, ["ip6tables-legacy -F DOCKER-USER", "ip6tables-legacy -A DOCKER-USER -j RETURN"]);
-  const nft = await new FirewallClient(fake().run, undefined, () => true).remove("table ip6 filter, chain DOCKER-USER");
+  const nft = await new FirewallClient(fake().run).remove("table ip6 filter, chain DOCKER-USER");
  assert.deepEqual(nft.did, ["ip6tables -F DOCKER-USER", "ip6tables -A DOCKER-USER -j RETURN"]);
 });

 test("a chain of the machine's own nftables table goes with the rules that reach it", async () => {
  const f = fake();
-  const out = await new FirewallClient(f.run, undefined, () => true).remove("table ip6 own, chain deny");
+  const out = await new FirewallClient(f.run).remove("table ip6 own, chain deny");
  assert.deepEqual(out.did, ["nft delete rule ip6 own forward handle 7", "nft delete chain ip6 own deny"]);
 });

 test("what is not the operator's to remove is refused by name", async () => {
-  const c = new FirewallClient(fake(true).run, undefined, () => true);
+  const c = new FirewallClient(fake(true).run);
  await assert.rejects(c.remove("table inet mesh, chain forward"), /the mesh's own table/);
  await assert.rejects(c.remove("chain DOCKER (iptables-legacy)"), /container runtime's own/);
  await assert.rejects(c.remove("chain FORWARD (iptables-legacy)"), /built in/);
  await assert.rejects(c.remove("chain ufw6-docker-logging-deny (ip6tables-legacy)"), /found firewall, which is in force/);
  await assert.rejects(c.remove("something else"), /not a rule set as the host reports one/);
  // Retired, a front end's leftover is nobody's and goes.
-  const retired = await new FirewallClient(fake(false).run, undefined, () => true).remove("chain ufw6-docker-logging-deny (ip6tables-legacy)");
+  const retired = await new FirewallClient(fake(false).run).remove("chain ufw6-docker-logging-deny (ip6tables-legacy)");
  assert.ok(retired.did.includes("ip6tables-legacy -X ufw6-docker-logging-deny"));
 });

@@ -73,36 +72,3 @@ test("which chains jump to a target is read from a listing", () => {
  const listing = "table ip6 own {\n\tchain a {\n\t\tjump deny\n\t}\n\tchain b {\n\t\tgoto deny\n\t}\n\tchain deny {\n\t\tdrop\n\t}\n}\n";
  assert.deepEqual(chainsJumpingTo(listing, "deny"), ["a", "b"]);
 });
-
-test("the filter's commands run as given by root and through sudo without a prompt by anyone else", () => {
-  assert.deepEqual(escalated("nft", ["list", "ruleset"], 0), ["nft", ["list", "ruleset"]]);
-  assert.deepEqual(escalated("nft", ["-f", "/etc/nftables.conf"], 1000), ["sudo", ["-n", "nft", "-f", "/etc/nftables.conf"]]);
-  assert.deepEqual(escalated("iptables-legacy", ["-S"], undefined), ["sudo", ["-n", "iptables-legacy", "-S"]]);
-});
-
-test("the filter file is the one the manifest's filtering names", () => {
-  const manifest = JSON.parse(readFileSync(new URL("../module.json", import.meta.url), "utf8")) as { filtering: { into: string } };
-  assert.equal(FILTER_FILE, manifest.filtering.into);
-});
-
-test("a tool is installed when an executable of its name is on the path, and not otherwise", () => {
-  assert.equal(installed("sh"), true);
-  assert.equal(installed("no-such-tool-of-the-mesh"), false);
-});
-
-test("a found firewall that is absent guards nothing; one that will not answer stops the removal", async () => {
-  // Absent: its leftover chain is nobody's and goes, without asking it.
-  const absent = fake(true);
-  const out = await new FirewallClient(absent.run, undefined, () => false).remove("chain ufw6-docker-logging-deny (ip6tables-legacy)");
-  assert.ok(out.did.includes("ip6tables-legacy -X ufw6-docker-logging-deny"));
-  assert.ok(!absent.asked.some((a) => a.startsWith("ufw ")));
-  // Present and failing — refused by sudo, say — nothing is removed on a guess.
-  const refusing: Runner = async (cmd, args) => {
-    if (cmd === "ufw") throw new Error("ufw needs root and the runtime's account may not run it without a prompt");
-    return fake().run(cmd, args);
-  };
-  await assert.rejects(
-    new FirewallClient(refusing, undefined, () => true).remove("chain ufw6-docker-logging-deny (ip6tables-legacy)"),
-    /cannot tell whether the found firewall is in force/,
-  );
-});
@@ -44,7 +44,7 @@ export function getFirewallTools(firewall: FirewallClient): ToolDefinition[] {
  ];
 }

-const firewall = FirewallClient.onThisMachine();
+const firewall = FirewallClient.fromEnv();
 // The seat's verbs under the seat's name: the runtime serves them on the seat's subjects where this
 // module holds it (ADR 0159, 0160). The module's own under its own.
 registerModuleTools("node-packet-filter", () => getSeatVerbs(firewall));
@@ -0,0 +1,30 @@
+# portainer's runtime: the tool runtime, carrying this module's compiled code.
+#
+# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
+# the base images, published like any other artifact — which is what makes this buildable by the
+# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
+# happens to have the siblings.
+#
+# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
+# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
+# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
+# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
+# resolved away.
+WORKDIR /app/modules/portainer
+COPY . .
+RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/portainer/dist /app/modules/portainer/dist
+# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
+# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
+# the convention novox/hq issues 060/061 settled. A container that instead ran only its
+# provisioner (`run`) served no tools and emitted no events; a container that named no command
+# ran no provisioner at all.
+ENV MESH_TOOL_MODULES=/app/modules/portainer/dist/tools/index.js
@@ -0,0 +1,107 @@
+// The Portainer API client — portainer's own code, living in the module (novox/hq ADR 0039).
+// portainer is tools-only: its "events" would really be the underlying containers' lifecycle,
+// which the host owns and emits — so this module reads Portainer's own resources (endpoints,
+// stacks, containers) and exposes them, and stops there.
+
+import { readFileSync } from "node:fs";
+
+export interface PortainerEndpoint {
+  id: number;
+  name: string;
+  type: number;
+  url: string;
+  status: number;
+}
+
+export interface PortainerStack {
+  id: number;
+  name: string;
+  type: number;
+  endpointId: number;
+  status: number;
+}
+
+export interface PortainerContainer {
+  id: string;
+  names: string[];
+  image: string;
+  state: string;
+  status: string;
+}
+
+/** The settings-merged config the mesh delivers (novox/hq ADR 0046): { url, apiKey, token, password, user, ... }. */
+function meshConfig(file?: string): Record<string, string> {
+  if (!file) return {};
+  try { return JSON.parse(readFileSync(file, "utf8")) as Record<string, string>; }
+  catch { return {}; }
+}
+
+export class PortainerClient {
+  readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly token: string,
+  ) {
+    this.baseUrl = url.replace(/\/+$/, "");
+  }
+
+  /**
+   * Build from the module's resolved environment. The URL is MESH_PORTAINER_URL (or the local
+   * dashboard port) and the API token is MESH_PORTAINER_TOKEN — an access token minted in
+   * Portainer, sent as X-API-Key. Throws when no token is configured, so a misconfigured module
+   * exposes nothing rather than calling Portainer unauthenticated.
+   */
+  static fromEnv(env: NodeJS.ProcessEnv = process.env): PortainerClient {
+    const cfg = meshConfig(env.MESH_PORTAINER_CONFIG_FILE);
+    const url = cfg.url ?? env.MESH_PORTAINER_URL ?? `https://127.0.0.1:${env.PORTAINER_PORT ?? "9443"}`;
+    const token = cfg.token ?? env.MESH_PORTAINER_TOKEN;
+    if (!token) throw new Error("no Portainer token — set MESH_PORTAINER_TOKEN");
+    return new PortainerClient(url, token);
+  }
+
+  private async get<T>(path: string): Promise<T> {
+    const res = await fetch(`${this.baseUrl}${path}`, { headers: { "X-API-Key": this.token } });
+    if (!res.ok) throw new Error(`Portainer ${path}: ${res.status} ${await res.text()}`);
+    return res.json() as Promise<T>;
+  }
+
+  /** The environments (endpoints) Portainer manages — each a Docker host or cluster it talks to. */
+  async listEndpoints(): Promise<PortainerEndpoint[]> {
+    const raw = await this.get<any[]>("/api/endpoints");
+    return (raw ?? []).map((e) => ({
+      id: e.Id,
+      name: e.Name,
+      type: e.Type,
+      url: e.URL,
+      status: e.Status,
+    }));
+  }
+
+  /** The stacks (compose/swarm deployments) Portainer knows about. */
+  async listStacks(): Promise<PortainerStack[]> {
+    const raw = await this.get<any[]>("/api/stacks");
+    return (raw ?? []).map((s) => ({
+      id: s.Id,
+      name: s.Name,
+      type: s.Type,
+      endpointId: s.EndpointId,
+      status: s.Status,
+    }));
+  }
+
+  /**
+   * The containers on one endpoint, read through Portainer's Docker API proxy. Includes stopped
+   * containers, so the caller sees the whole picture rather than only what is running.
+   */
+  async listContainers(endpointId: number): Promise<PortainerContainer[]> {
+    const raw = await this.get<any[]>(`/api/endpoints/${endpointId}/docker/containers/json?all=1`);
+    return (raw ?? []).map((c) => ({
+      id: c.Id,
+      names: c.Names ?? [],
+      image: c.Image,
+      state: c.State,
+      status: c.Status,
+    }));
+  }
+}
@@ -0,0 +1,114 @@
+{
+  "module": "portainer",
+  "version": "1",
+  "slug": "portain",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 9000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the dashboard over http; its public name is a route grant and the proxy reaches it here"
+    },
+    {
+      "name": "web-tls",
+      "port": 9443,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the same dashboard over its own tls; the runtime sidecar talks to it here"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "portainer",
+      "image": "portainer/portainer-ce@sha256:4d616db18cfeb5dd41a69c0958bc825c84483ea9cde1106eb82a5d26f3bd8b0e",
+      "ports": [
+        "9000",
+        "9443"
+      ],
+      "volumes": [
+        "${dir:data}:/data",
+        "/var/run/docker.sock:/var/run/docker.sock"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "content": "{}\n",
+      "merge": "json"
+    },
+    {
+      "id": "runtime",
+      "type": "container",
+      "name": "mesh-portainer",
+      "network": "host",
+      "volumes": [
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker",
+        "MESH_PORTAINER_URL": "https://127.0.0.1:9443",
+        "MESH_PORTAINER_CONFIG_FILE": "/run/config/config.json"
+      },
+      "restart-on": [
+        "runtime-config"
+      ],
+      "artifact": "runtime"
+    }
+  ],
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "portainer",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:mesh-state}/route.json"
+  }
+}
@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-portainer",
+  "version": "0.1.0",
+  "description": "portainer — container management UI. Its API client and tools live here (novox/hq ADR 0039).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}
@@ -0,0 +1,50 @@
+// portainer's tools — its own code (novox/hq ADR 0039), importing portainer's own client. They
+// return structured data; the mesh serves them through the sdk's tool harness. portainer is
+// tools-only (no events entrypoint): a container starting or stopping is the host's signal to emit,
+// not Portainer's to re-announce.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { PortainerClient } from "../client.js";
+
+export function getPortainerTools(portainer: PortainerClient): ToolDefinition[] {
+  return [
+    {
+      name: "portainer_endpoints",
+      description: "List the environments (endpoints) Portainer manages — each a Docker host or cluster.",
+      input: {},
+      run: async () => {
+        const endpoints = await portainer.listEndpoints();
+        return { count: endpoints.length, endpoints };
+      },
+    },
+    {
+      name: "portainer_stacks",
+      description: "List the stacks (compose/swarm deployments) Portainer knows about.",
+      input: {},
+      run: async () => {
+        const stacks = await portainer.listStacks();
+        return { count: stacks.length, stacks };
+      },
+    },
+    {
+      name: "portainer_containers",
+      description: "List the containers on one Portainer endpoint, including stopped ones.",
+      input: { endpoint: { type: "number", description: "the endpoint id (see portainer_endpoints)" } },
+      run: async (args) => {
+        const endpointId = Number(args.endpoint);
+        const containers = await portainer.listContainers(endpointId);
+        return { endpointId, count: containers.length, containers };
+      },
+    },
+  ];
+}
+
+// The tools exist only when a token is configured; without one, portainer contributes none rather
+// than failing the whole runtime.
+registerModuleTools("portainer", (env) => {
+  try {
+    return getPortainerTools(PortainerClient.fromEnv(env));
+  } catch {
+    return [];
+  }
+});
@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["client.ts", "tools/index.ts"]
+}
@@ -163,8 +163,7 @@
        "acme-env",
        "internal-trust",
        "internal-acme-env"
-      ],
-      "logging": "journald"
+      ]
    }
  ],
  "build": {
@@ -195,12 +194,5 @@
        "image": "alpine@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc"
      }
    ]
-  },
-  "jails": [
-    {
-      "name": "route-proxy",
-      "failregex": "^.*TLS handshake error from <HOST>:\\d+: (?:no public route for|acme/autocert: missing server name)\n            ^.*refused: no route for .*, asked from <HOST>:\\d+$",
-      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=route-proxy\nport = http,https\nmaxretry = 10\nfindtime = 1d\nbantime = 1d"
  }
-  ]
 }
@@ -5,12 +5,20 @@
    "container-runtime"
  ],
  "provides": [
+    {
+      "name": "acme-ca",
+      "scope": "mesh"
+    },
    {
      "name": "internal-acme-ca",
      "scope": "mesh"
    }
  ],
  "serves": {
+    "acme-ca": {
+      "path": "/acme/acme/directory",
+      "roots": "/roots.pem"
+    },
    "internal-acme-ca": {
      "path": "/acme/acme/directory",
      "roots": "/roots.pem"
@@ -0,0 +1,93 @@
+// systemctl and journalctl, asked in one scope or the other (novox/hq ADR 0177).
+//
+// The system manager is the machine's. The user manager is the operator account's own: reached as
+// `systemctl --user --machine=<account>@` when this process is not that account (the node tools
+// runtime runs as the node's account, root when the host started it), and as plain `--user` when
+// it is. It answers only while the account's manager runs — a login, or lingering enabled.
+
+import { execFile } from "node:child_process";
+import { userInfo } from "node:os";
+
+export type Scope = "system" | "user";
+
+export interface Unit {
+  unit: string;
+  load: string;
+  active: string;
+  sub: string;
+  description: string;
+}
+
+function run(cmd: string, args: string[]): Promise<{ stdout: string; stderr: string; status: number }> {
+  return new Promise((resolve) => {
+    execFile(cmd, args, { maxBuffer: 8 * 1024 * 1024 }, (err, stdout, stderr) => {
+      const status = err && typeof (err as { code?: unknown }).code === "number" ? ((err as { code: number }).code) : err ? 1 : 0;
+      resolve({ stdout: String(stdout ?? ""), stderr: String(stderr ?? "") + (err && !(err as { code?: unknown }).code ? err.message : ""), status });
+    });
+  });
+}
+
+export class ServiceManager {
+  constructor(private readonly account: string) {}
+
+  static fromEnv(env: NodeJS.ProcessEnv): ServiceManager {
+    return new ServiceManager(env.MESH_OPERATOR_ACCOUNT?.trim() || userInfo().username);
+  }
+
+  /** The leading arguments that pick a manager. */
+  scopeArgs(scope: Scope): string[] {
+    if (scope !== "user") return [];
+    return userInfo().username === this.account ? ["--user"] : ["--user", `--machine=${this.account}@`];
+  }
+
+  async systemctl(scope: Scope, ...args: string[]): Promise<{ stdout: string; stderr: string; status: number }> {
+    return run("systemctl", [...this.scopeArgs(scope), ...args]);
+  }
+
+  async units(scope: Scope, pattern?: string): Promise<Unit[]> {
+    const args = ["list-units", "--all", "--no-legend", "--plain", "--no-pager"];
+    if (pattern) args.push(pattern);
+    const { stdout } = await this.systemctl(scope, ...args);
+    return stdout
+      .split("\n")
+      .map((l) => l.trim())
+      .filter(Boolean)
+      .map((l) => {
+        const [unit, load, active, sub, ...rest] = l.split(/\s+/);
+        return { unit, load, active, sub, description: rest.join(" ") };
+      });
+  }
+
+  async status(scope: Scope, unit: string): Promise<Record<string, string>> {
+    const props = ["LoadState", "ActiveState", "SubState", "UnitFileState", "MainPID", "ExecMainStatus", "Description", "FragmentPath"];
+    const { stdout } = await this.systemctl(scope, "show", unit, ...props.map((p) => `--property=${p}`));
+    const out: Record<string, string> = { unit, scope };
+    for (const line of stdout.split("\n")) {
+      const i = line.indexOf("=");
+      if (i > 0) out[line.slice(0, i)] = line.slice(i + 1);
+    }
+    return out;
+  }
+
+  async act(scope: Scope, verb: "start" | "stop" | "restart" | "enable" | "disable", unit: string): Promise<Record<string, unknown>> {
+    const { stderr, status } = await this.systemctl(scope, verb, unit);
+    const after = await this.status(scope, unit);
+    return { unit, scope, verb, ok: status === 0, stderr: stderr.trim(), active: after.ActiveState, boot: after.UnitFileState,
+      note: "a unit the mesh declares is restored to its declared state at the host's next apply" };
+  }
+
+  async journal(scope: Scope, unit: string, lines: number): Promise<{ unit: string; scope: Scope; lines: string[] }> {
+    const args = ["--no-pager", "-n", String(lines), "-u", unit, "-o", "short-iso"];
+    if (scope === "user") {
+      args.unshift(userInfo().username === this.account ? "--user" : `--machine=${this.account}@`, ...(userInfo().username === this.account ? [] : ["--user"]));
+    }
+    const { stdout } = await run("journalctl", args);
+    return { unit, scope, lines: stdout.split("\n").filter(Boolean) };
+  }
+
+  async failed(): Promise<{ system: Unit[]; user: Unit[] }> {
+    const system = (await this.units("system")).filter((u) => u.active === "failed");
+    const user = (await this.units("user").catch(() => [] as Unit[])).filter((u) => u.active === "failed");
+    return { system, user };
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "module": "systemd",
+  "version": "1",
+  "capabilities": [
+    "service-manager",
+    "package-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-service-manager",
+      "scope": "node",
+      "serves": [
+        "units",
+        "status",
+        "start",
+        "stop",
+        "restart",
+        "enable",
+        "disable",
+        "journal"
+      ]
+    }
+  ],
+  "tools": [
+    "systemd_failed"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "systemd"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ]
+      }
+    ]
+  }
+}
@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-systemd",
+  "version": "0.1.0",
+  "description": "systemd \u2014 the machine's service manager as a module: holds node-service-manager and answers for the units in both scopes (novox/hq ADR 0177). The host applies units; this answers about them.",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}
@@ -0,0 +1,71 @@
+// systemd's tools: the node-service-manager seat's eight verbs — the units on this machine in
+// both scopes, read and acted on by name — and the module's own reading of what has failed
+// (novox/hq ADR 0177). Served by the node tools runtime (ADR 0175); the host applies units, this
+// answers about them.
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { ServiceManager, type Scope } from "../client.js";
+
+const scope = { type: "string", description: "\"system\" (the default) or \"user\": the operator account's own manager" };
+const unit = { type: "string", description: "the unit's name, as the service manager knows it" };
+
+function scopeOf(args: Readonly<Record<string, unknown>>): Scope {
+  const s = String(args.scope ?? "system");
+  if (s !== "system" && s !== "user") throw new Error(`scope ${JSON.stringify(s)}: "system" or "user"`);
+  return s;
+}
+function unitOf(args: Readonly<Record<string, unknown>>): string {
+  const u = String(args.unit ?? "").trim();
+  if (!u) throw new Error("a unit is required");
+  return u;
+}
+
+export function getSeatVerbs(manager: ServiceManager): ToolDefinition[] {
+  const act = (verb: "start" | "stop" | "restart" | "enable" | "disable", description: string): ToolDefinition => ({
+    name: verb,
+    description,
+    input: { type: "object", properties: { scope, unit }, required: ["unit"] },
+    run: async (args) => manager.act(scopeOf(args), verb, unitOf(args)),
+  });
+  return [
+    {
+      name: "units",
+      description: "The units the service manager knows in a scope, each with its load, active and sub state; narrowed to a pattern when asked.",
+      input: { type: "object", properties: { scope, pattern: { type: "string", description: "a glob the unit's name must match (optional)" } } },
+      run: async (args) => ({ scope: scopeOf(args), units: await manager.units(scopeOf(args), args.pattern ? String(args.pattern) : undefined) }),
+    },
+    {
+      name: "status",
+      description: "One unit as the service manager sees it now: its states, whether it starts at boot, its main process, and whether the mesh declares it.",
+      input: { type: "object", properties: { scope, unit }, required: ["unit"] },
+      run: async (args) => manager.status(scopeOf(args), unitOf(args)),
+    },
+    act("start", "Start one unit. For a unit the mesh declares, the answer says the host will restore what its declaration says at the next apply."),
+    act("stop", "Stop one unit; for a mesh-declared unit the answer says the host will restore its declared state."),
+    act("restart", "Restart one unit."),
+    act("enable", "Make one unit start at boot (or at the account's login, in user scope)."),
+    act("disable", "Stop one unit starting at boot (or at login, in user scope)."),
+    {
+      name: "journal",
+      description: "The last lines of one unit's journal.",
+      input: { type: "object", properties: { scope, unit, lines: { type: "number", description: "how many lines from the end (default 100)" } }, required: ["unit"] },
+      run: async (args) => {
+        const n = Number(args.lines ?? 100);
+        return manager.journal(scopeOf(args), unitOf(args), Number.isFinite(n) && n > 0 ? Math.min(n, 5000) : 100);
+      },
+    },
+  ];
+}
+
+export function getOwnTools(manager: ServiceManager): ToolDefinition[] {
+  return [
+    {
+      name: "systemd_failed",
+      description: "Every failed unit on this machine, in the system manager and in the operator account's.",
+      input: { type: "object", properties: {} },
+      run: async () => manager.failed(),
+    },
+  ];
+}
+
+registerModuleTools("node-service-manager", (env) => getSeatVerbs(ServiceManager.fromEnv(env)));
+registerModuleTools("systemd", (env) => getOwnTools(ServiceManager.fromEnv(env)));
@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": [
+    "tools/index.ts",
+    "client.ts"
+  ]
+}
@@ -0,0 +1,81 @@
+{
+  "module": "zsh",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "seats": [
+    {
+      "name": "login-shell",
+      "scope": "node",
+      "serves": [
+        {
+          "name": "execute",
+          "description": "Run one command on this machine as the operator account, in a login shell; answers with what it printed and how it exited (novox/hq ADR 0176).",
+          "input": {
+            "type": "object",
+            "properties": {
+              "command": {
+                "type": "string",
+                "description": "the command line, as you would type it"
+              },
+              "timeout_seconds": {
+                "type": "number",
+                "description": "give up after this long (default 60)"
+              }
+            },
+            "required": [
+              "command"
+            ]
+          }
+        }
+      ]
+    }
+  ],
+  "claims": [
+    {
+      "name": "login-shell",
+      "scope": "node",
+      "serves": [
+        "execute"
+      ]
+    }
+  ],
+  "tools": [
+    "zsh_config"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "zsh"
+    },
+    {
+      "id": "rc",
+      "type": "file",
+      "path": "${machine:account-home}/.zshrc",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "into": "block",
+      "content": "# The mesh's default zsh configuration (module zsh). Everything OUTSIDE this block is yours and\n# survives every push; everything inside it is replaced on the next one (novox/hq ADR 0174).\n# Machine-specific lines go in ~/.zshrc.local, which this sources last.\n\nexport EDITOR=vim\nexport VISUAL=vim\nexport XDG_CONFIG_HOME=\"$HOME/.config\"\nexport PATH=\"$HOME/.local/bin:$HOME/scripts:$HOME/scripts/bin:$PATH\"\n\n# Terminal title: host, directory, git branch\nfunction set_terminal_title() {\n  local git_branch=\"\"\n  if git rev-parse --is-inside-work-tree &>/dev/null; then\n    git_branch=\" ($(git branch --show-current 2>/dev/null))\"\n  fi\n  print -Pn \"\\e]2;%m: %~${git_branch}\\a\"\n}\nprecmd_functions+=(set_terminal_title)\n\n# A prompt theme and plugins, when a module placed them (the prompt module owns ~/.p10k.zsh and\n# ~/.zsh/themes; this only loads what is there).\n[[ ! -f ~/.zsh/themes/powerlevel10k/powerlevel10k.zsh-theme ]] || source ~/.zsh/themes/powerlevel10k/powerlevel10k.zsh-theme\n[[ ! -f ~/.p10k.zsh ]] || source ~/.p10k.zsh\n[[ ! -f ~/.zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh ]] || source ~/.zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh\n[[ ! -f ~/.zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]] || source ~/.zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh\n\n# Keybindings: Home, End, Ctrl-A, Ctrl-E, Del\nbindkey \"^[[H\"  beginning-of-line\nbindkey \"^[OH\"  beginning-of-line\nbindkey \"^A\"    beginning-of-line\nbindkey \"^[[F\"  end-of-line\nbindkey \"^[OF\"  end-of-line\nbindkey \"^E\"    end-of-line\nbindkey \"^[[3~\" delete-char\n\n# Colour and the usual ls aliases\nif [ -x /usr/bin/dircolors ]; then\n  test -r \"$HOME/.dircolors\" && eval \"$(dircolors -b \"$HOME/.dircolors\")\" || eval \"$(dircolors -b)\"\n  alias ls='ls --color=auto'\n  alias grep='grep --color=auto'\nfi\nalias ll='ls -alhF'\nalias la='ls -Ah'\nalias l='ls -CFh'\nalias drun='docker run -it --rm'\ndisksize() { du -h --max-depth=1 \"${1:-.}\" | sort -h; }\n\n# Machine-specific configuration, kept by you\n[[ ! -f ~/.zshrc.local ]] || source ~/.zshrc.local\n"
+    },
+    {
+      "id": "login",
+      "type": "user",
+      "name": "${machine:account}",
+      "shell": "/usr/bin/zsh"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ]
+      }
+    ]
+  }
+}
@@ -0,0 +1,14 @@
+{
+  "name": "@novox/module-zsh",
+  "version": "0.1.0",
+  "description": "zsh \u2014 the shell as a module: the package, the mesh's default ~/.zshrc as a block the operator's own lines survive around, the login-shell seat and its execute verb (novox/hq ADR 0176).",
+  "type": "module",
+  "private": true,
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}
@@ -0,0 +1,98 @@
+// zsh's tools — the module's own, and its implementation of the login-shell seat's one verb
+// (novox/hq ADR 0176). Served by the node tools runtime (ADR 0175); nothing here runs a process.
+//
+// `execute` runs as the operator account. The runtime runs as the node's account — root when the
+// host started it — so the command is handed to the account through `runuser` when we are not
+// already that account. Root is the module's concern (ADR 0175 §4): a command that needs it uses
+// sudo inside the shell like a person would.
+
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { homedir, userInfo } from "node:os";
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+
+/** The operator account on this machine, as the mesh told the runtime; the current user otherwise. */
+function account(env: NodeJS.ProcessEnv): string {
+  return env.MESH_OPERATOR_ACCOUNT?.trim() || userInfo().username;
+}
+
+interface Executed {
+  command: string;
+  account: string;
+  status: number | null;
+  signal: string | null;
+  stdout: string;
+  stderr: string;
+  timed_out: boolean;
+}
+
+/** Run one command line in a zsh login shell as the account, capturing everything. */
+export async function execute(command: string, who: string, timeoutSeconds: number): Promise<Executed> {
+  const self = userInfo().username;
+  const argv = who === self
+    ? ["zsh", "-lc", command]
+    : ["runuser", "-u", who, "--", "zsh", "-lc", command];
+  return new Promise((resolve) => {
+    const child = spawn(argv[0], argv.slice(1), { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    child.stdout.on("data", (d: Buffer) => { stdout += d.toString(); });
+    child.stderr.on("data", (d: Buffer) => { stderr += d.toString(); });
+    const timer = setTimeout(() => { timedOut = true; child.kill("SIGKILL"); }, timeoutSeconds * 1000);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      resolve({ command, account: who, status: null, signal: null, stdout, stderr: stderr + err.message, timed_out: false });
+    });
+    child.on("close", (status, signal) => {
+      clearTimeout(timer);
+      resolve({ command, account: who, status, signal, stdout, stderr, timed_out: timedOut });
+    });
+  });
+}
+
+function seatVerbs(env: NodeJS.ProcessEnv): ToolDefinition[] {
+  return [
+    {
+      name: "execute",
+      description: "Run one command on this machine as the operator account, in a login shell; answers with what it printed and how it exited.",
+      input: {
+        type: "object",
+        properties: {
+          command: { type: "string", description: "the command line, as you would type it" },
+          timeout_seconds: { type: "number", description: "give up after this long (default 60)" },
+        },
+        required: ["command"],
+      },
+      run: async (args) => {
+        const command = String(args.command ?? "").trim();
+        if (!command) throw new Error("execute: a command is required");
+        const timeout = Number(args.timeout_seconds ?? 60);
+        return execute(command, account(env), Number.isFinite(timeout) && timeout > 0 ? timeout : 60);
+      },
+    },
+  ];
+}
+
+function ownTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
+  return [
+    {
+      name: "zsh_config",
+      description: "The operator account's ~/.zshrc on this machine as it is now: the mesh's block and the lines around it.",
+      input: { type: "object", properties: {} },
+      run: async () => {
+        const who = account(env);
+        const home = env.MESH_OPERATOR_HOME?.trim() || (who === userInfo().username ? homedir() : `/home/${who}`);
+        const path = `${home}/.zshrc`;
+        const text = await readFile(path, "utf8").catch(() => "");
+        const inBlock = /# BEGIN mesh [^\n]*\n([\s\S]*?)# END mesh/.exec(text);
+        return { account: who, path, lines: text.split("\n").length, mesh_block_lines: inBlock ? inBlock[1].split("\n").length - 1 : 0, content: text };
+      },
+    },
+  ];
+}
+
+// The seat's verb is registered under the seat's name (what the runtime serves on the seat's
+// subject when this module holds it) and the module's own tools under the module's.
+registerModuleTools("login-shell", seatVerbs);
+registerModuleTools("zsh", ownTools);
@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": [
+    "tools/index.ts"
+  ]
+}