anthropic-consumer: its usage runs in the node's runtime, and its apply is a scheduled process (hq ADR 0198)

Both containers go with the Dockerfile, build bases, bus credential and state directory. apply needs no bus and runs every five minutes as a process on the machine at the host paths the container mounted. usage emitted by spawning the runtime image's own emit command with the module's credential, which exists nowhere now, so it is loaded by the node's runtime instead: it emits through the SDK as this module and reads on the cadence the schedule gave it, once at start and every five minutes. That is the one code change.

modules/anthropic-consumer/Dockerfile

@@ -1,22 +0,0 @@
-# anthropic-consumer's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/anthropic-consumer
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc apply/index.ts usage/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/anthropic-consumer/dist /app/modules/anthropic-consumer/dist
-# No serve-time entrypoints: every container of this module names its command (`run` on a
-# schedule), so nothing here serves — deliberately no MESH_TOOL_MODULES.

modules/anthropic-consumer/module.json

@@ -14,19 +14,10 @@
   "secrets": {
     "model-access": "${dir:state}/access-token"
   },
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "emits": [
     "usage.session"
   ],
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -46,66 +37,39 @@
     },
     {
       "id": "apply",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-anthropic-consumer-apply",
+      "name": "anthropic-consumer-apply",
-      "network": "host",
+      "artifact": "code",
+      "run": [
+        "node",
+        "apply/index.js"
+      ],
       "schedule": "*/5 * * * *",
-      "args": [
-        "run",
-        "/app/modules/anthropic-consumer/dist/apply/index.js"
-      ],
-      "volumes": [
-        "${dir:state}:/run/state"
-      ],
       "env": {
-        "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/access-token",
+        "MESH_MODEL_ACCESS_SECRET_FILE": "${dir:state}/access-token",
-        "MESH_MODEL_ACCESS_BIND_FILE": "/run/state/model.json",
+        "MESH_MODEL_ACCESS_BIND_FILE": "${dir:state}/model.json",
-        "MESH_CLAUDE_CREDENTIALS_FILE": "/run/state/claude/.credentials.json",
+        "MESH_CLAUDE_CREDENTIALS_FILE": "${dir:state}/claude/.credentials.json",
-        "MESH_CLAUDE_IDENTITY_FILE": "/run/state/claude/.claude.json"
+        "MESH_CLAUDE_IDENTITY_FILE": "${dir:state}/claude/.claude.json"
-      },
+      }
-      "artifact": "runtime"
-    },
-    {
-      "id": "usage",
-      "type": "container",
-      "name": "mesh-anthropic-consumer-usage",
-      "network": "host",
-      "schedule": "*/5 * * * *",
-      "args": [
-        "run",
-        "/app/modules/anthropic-consumer/dist/usage/index.js"
-      ],
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:state}:/run/state"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_CLAUDE_PROJECTS_DIR": "/run/state/claude/projects",
-        "MESH_ANTHROPIC_USAGE_OUT": "/run/state/out/session-usage.json",
-        "MESH_TOOLS_MAIN": "/app/dist/main.js"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "apply/index.js",
+          "usage/index.js"
+        ],
+        "loads": [
+          "usage/index.js"
+        ],
+        "env": {
+          "MESH_CLAUDE_PROJECTS_DIR": "${dir:state}/claude/projects",
+          "MESH_ANTHROPIC_USAGE_OUT": "${dir:state}/out/session-usage.json"
+        }
       }
     ]
   }

modules/anthropic-consumer/usage/index.ts

@@ -3,12 +3,15 @@
 // per session. The consumer IS the (node,module) session's fixed binding, so no per-message account
 // attribution is done — just the totals (port map "don't-map" #3).
 //
-// Runs as `mesh-tools run` (no broker), so events are emitted best-effort via the sibling mesh-tools
+// Runs in the node's runtime (novox/hq ADR 0198), every five minutes, so events are emitted through
-// `emit` primitive; the totals are also written to a file so the reading is observable without one.
+// the runtime as this module; the totals are also written to a file so the reading is observable
+// without one.
 
 import { readdirSync, statSync, readFileSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 
+import { emit } from "@novox/mesh-sdk/events";
+
 import { readSessionFile, type SessionUsage } from "../transcript.js";
 
 /** The vendor-neutral usage row ADR 0054 fixes — the shape the model-usage store upserts. Kept local
@@ -116,22 +119,20 @@ function atomicWrite(path: string, content: string): void {
   renameSync(tmp, path);
 }
 
-/** Emit best-effort via the sibling mesh-tools `emit`, which wires a broker a run step has none. */
+/** Emit best-effort through the runtime: a reading that could not be announced is still in the file. */
 async function emitUsage(body: Record<string, unknown>): Promise<void> {
-  const main = process.env.MESH_TOOLS_MAIN ?? "/app/dist/main.js";
+  try {
-  const { spawn } = await import("node:child_process");
+    await emit("usage.session", body);
-  await new Promise<void>((resolve) => {
+  } catch (err) {
-    const child = spawn(
-      process.execPath,
-      [main, "emit", "usage.session", JSON.stringify(body)],
-      { stdio: "inherit" },
-    );
-    child.on("exit", () => resolve());
-    child.on("error", (err) => {
     console.error(`[anthropic-consumer] could not emit usage: ${err}`);
-      resolve();
+  }
-    });
-  });
 }
 
-await main();
+// The cadence the scheduled container had: once at start, then every five minutes. Not awaited, so the
+// runtime's handshake is answered while a long first reading is still under way.
+const EVERY_MS = 5 * 60 * 1000;
+const tick = (): void => {
+  void main().catch((err) => console.error(`[anthropic-consumer] usage reading failed: ${err}`));
+};
+tick();
+setInterval(tick, EVERY_MS);

modules/audit-logger/Dockerfile

@@ -1,33 +0,0 @@
-# audit-logger's runtime: the shared runtime image, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The toolkit is in the base image, so
-# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
-# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
-# the siblings laid out beside it.
-
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
-# They are different images on purpose — the first carries a compiler and the second must not, or
-# every running container would carry one it never invokes. The mesh answers both with the copies it
-# holds, because a fingerprint written here would name one particular copy and no other mesh has it
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
-# nobody told stops here and says which module to build first.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the toolkit it will run against.
-WORKDIR /app/modules/audit-logger
-COPY . .
-# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
-# symlinks to a launcher that requires its library relatively — resolved away when the base image
-# was assembled.
-RUN node /app/node_modules/typescript/bin/tsc audit.ts index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/audit-logger/dist /app/modules/audit-logger/dist
-# **Served, not run.** This subscribes on import, and the serve mode binds the broker before it
-# imports anything — `run` exists for a step that works offline and exits, and would leave this
-# with nothing to subscribe to.
-ENV MESH_TOOL_MODULES=/app/modules/audit-logger/dist/index.js

modules/audit-logger/module.json

@@ -5,27 +5,21 @@
   "consumes": [
     "**"
   ],
-  "own-secrets": {
-    "broker": "${dir:state}/broker"
-  },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js"
+        ],
+        "loads": [
+          "index.js"
+        ],
+        "env": {
+          "AUDIT_LOG": "${dir:trail}/audit.log"
+        }
       }
     ]
   },
@@ -40,21 +34,6 @@
       "id": "trail",
       "type": "directory",
       "mode": "0700"
-    },
-    {
-      "id": "run",
-      "type": "container",
-      "name": "mesh-audit-logger",
-      "network": "host",
-      "volumes": [
-        "${dir:state}/broker:/run/secrets/broker:ro",
-        "${dir:trail}:/trail"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "AUDIT_LOG": "/trail/audit.log"
-      },
-      "artifact": "runtime"
     }
   ],
   "capabilities": [

modules/cloudflare-dns/Dockerfile

@@ -1,24 +0,0 @@
-# cloudflare-dns's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/cloudflare-dns
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/cloudflare-dns/dist /app/modules/cloudflare-dns/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/cloudflare-dns/dist/tools/index.js,/app/modules/cloudflare-dns/dist/provisioner/index.js

modules/cloudflare-dns/module.json

@@ -18,20 +18,13 @@
     "public-dns": "${dir:grants}/mesh.json"
   },
   "own-secrets": {
-    "token": "${dir:state}/token",
+    "token": "${dir:state}/token"
-    "broker": "${dir:mesh-state}/broker"
   },
   "emits": [
     "record.created",
     "record.removed"
   ],
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -50,48 +43,30 @@
       "merge": "json",
       "content": "{}",
       "mode": "0600"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-cloudflare-dns",
-      "network": "host",
-      "volumes": [
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:grants}:/grants",
-        "${dir:state}/token:/run/secrets/token:ro",
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
-      ],
-      "env": {
-        "MESH_CLOUDFLARE_TOKEN_FILE": "/run/secrets/token",
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_CLOUDFLARE_CONFIG_FILE": "/run/config/config.json",
-        "MESH_RECEIVES": "/var/lib/cloudflare-dns/grants/mesh.json"
-      },
-      "artifact": "runtime"
     }
   ],
   "capabilities": [
     "container-runtime"
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_CLOUDFLARE_TOKEN_FILE": "${dir:state}/token",
+          "MESH_CLOUDFLARE_CONFIG_FILE": "${dir:state}/config.json",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       }
     ]
   }

modules/gitea/Dockerfile

@@ -1,37 +0,0 @@
-# gitea's runtime: the tool runtime, carrying this module's compiled provisioner, tools and event
-# consumer.
-#
-# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
-# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
-# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
-# the siblings.
-#
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
-# They are different images on purpose — the first carries a compiler and the second must not, or
-# every running container would carry one it never invokes. The mesh answers both with the copies it
-# holds, because a fingerprint written here would name one particular copy and no other mesh has it
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
-# nobody told stops here and says which module to build first.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against.
-WORKDIR /app/modules/gitea
-COPY . .
-# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
-# symlinks to a launcher that requires its library relatively — resolved away when the base image
-# was assembled.
-RUN node /app/node_modules/typescript/bin/tsc client.ts token.ts index.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# **No apt packages.** gitea's provisioner talks to the forge over HTTP (the gitea REST API), not
-# through a CLI the way postgres drives psql — so the runtime base holds everything this needs.
-COPY --from=build /app/modules/gitea/dist /app/modules/gitea/dist
-# What a tool host should load from this module: its event consumer and its tools, which are
-# separate entrypoints because they are loaded by different things. The provisioner is the third,
-# and is not listed here — the declaration names it in the container's `args`, because it is what
-# this module's own container runs. One image, because they are one module and share a client.
-ENV MESH_TOOL_MODULES=/app/modules/gitea/dist/index.js,/app/modules/gitea/dist/tools/index.js,/app/modules/gitea/dist/provisioner/index.js

modules/gitea/module.json

@@ -85,9 +85,6 @@
       "scope": "mesh"
     }
   ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "resources": [
     {
       "id": "mesh-state",
@@ -180,32 +177,6 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-gitea",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:runtime-state}:/run/state"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
-        "MESH_GITEA_CONFIG_FILE": "/run/config/config.json",
-        "MESH_GITEA_ADMIN_USER": "mesh-admin",
-        "MESH_GITEA_ADMIN_PASSWORD_FILE": "/run/secrets/admin",
-        "MESH_GITEA_STATE_DIR": "/run/state",
-        "MESH_RECEIVES": "${dir:grants}/npm.json"
-      },
-      "artifact": "runtime",
-      "restart-on": [
-        "runtime-config"
-      ]
     }
   ],
   "provides": [
@@ -219,23 +190,29 @@
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GITEA_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_GITEA_ADMIN_USER": "mesh-admin",
+          "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_GITEA_STATE_DIR": "${dir:runtime-state}",
+          "MESH_RECEIVES": "${dir:grants}/npm.json"
+        }
       }
     ]
   },

modules/grafana/Dockerfile

@@ -1,24 +0,0 @@
-# grafana's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/grafana
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/grafana/dist /app/modules/grafana/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/grafana/dist/index.js,/app/modules/grafana/dist/tools/index.js

modules/grafana/module.json

@@ -5,8 +5,7 @@
     "alert.firing"
   ],
   "own-secrets": {
-    "admin": "${dir:mesh-state}/admin",
+    "admin": "${dir:mesh-state}/admin"
-    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -112,25 +111,6 @@
       "mode": "0600",
       "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-grafana",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
-        "MESH_GRAFANA_CONFIG_FILE": "/run/config/config.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "requires": [
@@ -162,23 +142,23 @@
     "influxdb-api": "${dir:mesh-state}/influxdb-api"
   },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GRAFANA_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
       }
     ]
   }

modules/home-assistant/Dockerfile

@@ -1,27 +0,0 @@
-# home-assistant's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/home-assistant
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisions/hass.ts provisions/probe.ts provisions/connections.ts provisions/mesh.ts provisions/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/home-assistant/dist /app/modules/home-assistant/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/home-assistant/dist/index.js,/app/modules/home-assistant/dist/tools/index.js
-# NOT dist/provisions/index.js: that is a step the host runs to completion, named by the
-# `provisions` container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run
-# inside the serving sidecar too, and exit it.

modules/home-assistant/module.json

@@ -9,7 +9,6 @@
     "state.changed"
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker",
     "token": "${dir:mesh-state}/token"
   },
   "listens": [
@@ -80,55 +79,27 @@
       "merge": "json"
     },
     {
-      "id": "runtime",
+      "id": "provisions-env",
-      "type": "container",
+      "type": "file",
-      "name": "mesh-home-assistant",
+      "path": "${dir:state}/provisions.env",
-      "network": "host",
+      "mode": "0600",
-      "volumes": [
+      "content": "MESH_HOMEASSISTANT_URL=http://127.0.0.1:${port:8123}\nMESH_HOMEASSISTANT_TOKEN_FILE=${dir:mesh-state}/token\nMESH_PROVISIONS_DIR=${dir:state}\nMESH_WRITTEN_DIR=${dir:written}\n"
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/token:/run/secrets/token:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
-        "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
-        "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     },
     {
       "id": "provisions",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-home-assistant-provisions",
+      "name": "home-assistant-provisions",
-      "network": "host",
+      "artifact": "code",
-      "run-once": true,
+      "run": [
-      "volumes": [
+        "node",
-        "${dir:mesh-state}/token:/run/secrets/token:ro",
+        "provisions/index.js"
-        "${dir:written}:/var/lib/home-assistant-provisions",
-        "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
-        "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",
-        "${dir:state}/sonarr-api.json:/run/provisions/sonarr-api.json:ro",
-        "${dir:state}/sonarr-api.secret:/run/provisions/sonarr-api.secret:ro",
-        "${dir:state}/radarr-api.json:/run/provisions/radarr-api.json:ro",
-        "${dir:state}/radarr-api.secret:/run/provisions/radarr-api.secret:ro",
-        "${dir:state}/lidarr-api.json:/run/provisions/lidarr-api.json:ro",
-        "${dir:state}/lidarr-api.secret:/run/provisions/lidarr-api.secret:ro"
       ],
-      "env": {
+      "run-once": true,
-        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
+      "env-file": [
-        "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
+        "${dir:state}/provisions.env"
-        "MESH_PROVISIONS_DIR": "/run/provisions",
-        "MESH_WRITTEN_DIR": "/var/lib/home-assistant-provisions"
-      },
-      "args": [
-        "run",
-        "/app/modules/home-assistant/dist/provisions/index.js"
       ],
       "restart-on": [
+        "provisions-env",
         "bound-mqtt-topic",
         "secret-mqtt-topic",
         "bound-sonarr-api",
@@ -137,8 +108,7 @@
         "secret-radarr-api",
         "bound-lidarr-api",
         "secret-lidarr-api"
-      ],
+      ]
-      "artifact": "runtime"
     }
   ],
   "requires": [
@@ -173,23 +143,25 @@
     "lidarr-api": "${dir:state}/lidarr-api.secret"
   },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisions/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
+          "MESH_HOMEASSISTANT_TOKEN_FILE": "${dir:mesh-state}/token",
+          "MESH_HOMEASSISTANT_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
       }
     ]
   }

modules/icecast/Dockerfile

@@ -1,24 +0,0 @@
-# icecast's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/icecast
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/icecast/dist /app/modules/icecast/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/icecast/dist/index.js,/app/modules/icecast/dist/tools/index.js

modules/icecast/module.json

@@ -28,9 +28,6 @@
     "stream.started",
     "stream.stopped"
   ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "listens": [
     {
       "name": "stream",
@@ -95,45 +92,26 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-icecast",
-      "network": "icecast",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_ICECAST_URL": "http://icecast:8000",
-        "MESH_ICECAST_CONFIG_FILE": "/run/config/config.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_ICECAST_URL": "http://127.0.0.1:${port:8000}",
+          "MESH_ICECAST_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
       }
     ]
   }

modules/influxdb/Dockerfile

@@ -1,24 +0,0 @@
-# influxdb's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/influxdb
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts grants.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/influxdb/dist /app/modules/influxdb/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/influxdb/dist/tools/index.js,/app/modules/influxdb/dist/provisioner/index.js

modules/influxdb/module.json

@@ -11,7 +11,6 @@
     "container-runtime"
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker",
     "admin": "${dir:state}/admin.secret",
     "admin-token": "${dir:state}/admin-token.secret"
   },
@@ -100,29 +99,6 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-influxdb",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro",
-        "${dir:grants}:${dir:grants}:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
-        "MESH_INFLUXDB_CONFIG_FILE": "/run/config/config.json",
-        "MESH_INFLUXDB_TOKEN_FILE": "/run/secrets/admin-token",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "requires": [
@@ -135,23 +111,25 @@
     }
   },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
+          "MESH_INFLUXDB_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_INFLUXDB_TOKEN_FILE": "${dir:state}/admin-token.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       }
     ]
   }

modules/keycloak/Dockerfile

@@ -1,30 +0,0 @@
-# keycloak's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/keycloak
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts oidc.ts index.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/keycloak/dist /app/modules/keycloak/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/keycloak/dist/index.js,/app/modules/keycloak/dist/tools/index.js,/app/modules/keycloak/dist/provisioner/index.js

modules/keycloak/module.json

@@ -62,8 +62,7 @@
     "oidc-client": "${dir:grants}"
   },
   "own-secrets": {
-    "admin": "${dir:state}/admin.secret",
+    "admin": "${dir:state}/admin.secret"
-    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
@@ -144,49 +143,30 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-keycloak",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:grants}:${dir:grants}:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
-        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json",
-        "MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
+          "MESH_KEYCLOAK_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_KEYCLOAK_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       }
     ]
   }

modules/lab/Dockerfile

@@ -1,31 +0,0 @@
-# lab's runtime: the tool runtime, carrying this module's code, and the toolchain the lab's suite
-# builds the mesh with (novox/hq ADR 0172). It reaches the machine's virtualisation and container
-# runtime through their sockets, so what it raises is what a hand run on this machine raises.
-#
-# Every download is pinned by its checksum: an image that builds the mesh is the last place to take
-# whatever an upstream serves today.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/lab
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc tools/index.ts tools/runs.ts --rootDir . \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-RUN apt-get update \
- && apt-get install -y --no-install-recommends git make ca-certificates curl python3 file iproute2 sudo \
- && rm -rf /var/lib/apt/lists/*
-RUN curl -fsSL -o /tmp/go.tgz https://go.dev/dl/go1.26.8.linux-amd64.tar.gz \
- && echo "d0f743b33e8d8945e6b1f432edd15785c70507121d6e2a723b21285eddf8b57b  /tmp/go.tgz" | sha256sum -c - \
- && tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
-RUN curl -fsSL -o /usr/local/bin/incus https://github.com/lxc/incus/releases/download/v7.5.1/bin.linux.incus.x86_64 \
- && echo "7bd6223b369f4d693fcde695bd8549a73b5b3d403735329212483702aa22c179  /usr/local/bin/incus" | sha256sum -c - \
- && chmod 0755 /usr/local/bin/incus
-RUN curl -fsSL -o /tmp/docker.tgz https://download.docker.com/linux/static/stable/x86_64/docker-28.5.2.tgz \
- && echo "ea90cfd12e1eeb12aa1c971741adb8bd4ed88e2a574eaac13f5029a1dbc6300d  /tmp/docker.tgz" | sha256sum -c - \
- && tar -C /tmp -xzf /tmp/docker.tgz docker/docker && mv /tmp/docker/docker /usr/local/bin/docker && rm -rf /tmp/docker /tmp/docker.tgz
-ENV PATH=/usr/local/go/bin:$PATH
-COPY --from=build /app/modules/lab/dist /app/modules/lab/dist
-ENV MESH_TOOL_MODULES=/app/modules/lab/dist/tools/index.js

modules/lab/module.json

@@ -5,16 +5,7 @@
     "container-runtime",
     "virtualisation"
   ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -35,47 +26,67 @@
       "content": "MESH_LAB_FORGE=${setting:forge}\n"
     },
     {
-      "id": "runtime",
+      "id": "git",
-      "type": "container",
+      "type": "package",
-      "name": "mesh-lab",
+      "package": "git"
-      "network": "host",
-      "env-file": [
-        "${dir:state}/lab.env"
-      ],
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:work}:${dir:work}",
-        "/var/run/docker.sock:/var/run/docker.sock",
-        "/var/lib/incus/unix.socket:/var/lib/incus/unix.socket"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_LAB_WORK": "${dir:work}"
     },
-      "restart-on": [
+    {
-        "runtime-env"
+      "id": "make",
-      ],
+      "type": "package",
-      "artifact": "runtime"
+      "package": "make"
+    },
+    {
+      "id": "python",
+      "type": "package",
+      "package": "python"
+    },
+    {
+      "id": "file",
+      "type": "package",
+      "package": "file"
+    },
+    {
+      "id": "iproute2",
+      "type": "package",
+      "package": "iproute2"
+    },
+    {
+      "id": "sudo",
+      "type": "package",
+      "package": "sudo"
+    },
+    {
+      "id": "npm",
+      "type": "package",
+      "package": "npm"
+    },
+    {
+      "id": "go",
+      "type": "package",
+      "package": "go"
+    },
+    {
+      "id": "incus",
+      "type": "package",
+      "package": "incus"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_LAB_WORK": "${dir:work}",
+          "MESH_LAB_ENV_FILE": "${dir:state}/lab.env"
+        }
       }
     ]
   }

modules/lab/tools/index.ts

@@ -2,18 +2,23 @@
 // lab is assigned to, and only there: a bed raises virtual machines on that machine's virtualisation.
 
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { listRuns, readStatus, REPOSITORIES, running, start, stop, tail } from "./runs.js";
 
 export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
   const work = env.MESH_LAB_WORK ?? "/var/lib/mesh-lab-runs";
-  const forge = (env.MESH_LAB_FORGE ?? "").replace(/\/+$/, "");
+  // The forge is an operator's setting, which reaches a file and never a bundle's words (novox/hq
+  // ADR 0192): read from the env-file the mesh fills, at each call, so a changed setting is used
+  // without restarting the runtime. MESH_LAB_FORGE itself still wins, for a hand-run instance.
+  const forgeOf = (): string => (env.MESH_LAB_FORGE ?? wordIn(env.MESH_LAB_ENV_FILE, "MESH_LAB_FORGE")).replace(/\/+$/, "");
   return [
     {
       name: "lab_check",
       description: "Whether this machine can run the lab's beds: the lab's own check, against the forge's main branch.",
       input: {},
       run: async () => {
+        const forge = forgeOf();
         if (!forge) return { ok: false, output: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
         const dir = `${work}/check`;
         spawnSync("rm", ["-rf", dir]);
@@ -38,6 +43,7 @@ export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
         },
       },
       run: async (args) => {
+        const forge = forgeOf();
         if (!forge) return { started: false, reason: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
         const tests = String(args.tests ?? "").split(",").map((s) => s.trim()).filter(Boolean);
         if (tests.length === 0) return { started: false, reason: "name at least one bed test file" };
@@ -83,4 +89,20 @@ export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
   ];
 }
 
+/** One word from an env-file (`KEY=value` lines), or "" when the file or the word is absent. */
+export function wordIn(file: string | undefined, word: string): string {
+  if (!file) return "";
+  let text: string;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch {
+    return "";
+  }
+  for (const line of text.split("\n")) {
+    const at = line.indexOf("=");
+    if (at > 0 && line.slice(0, at).trim() === word) return line.slice(at + 1).trim();
+  }
+  return "";
+}
+
 registerModuleTools("lab", (env) => getLabTools(env));

modules/mailu/Dockerfile

@@ -1,30 +0,0 @@
-# mailu's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/mailu
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/mailu/dist /app/modules/mailu/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/mailu/dist/index.js,/app/modules/mailu/dist/tools/index.js,/app/modules/mailu/dist/provisioner/index.js

modules/mailu/module.json

@@ -135,11 +135,15 @@
       "protocol": "tcp",
       "from": "mesh",
       "why": "automx: mail client autoconfiguration; the autoconfig, autodiscover and automx names are route grants reaching it here"
+    },
+    {
+      "name": "admin-api",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "machine",
+      "why": "the admin API, which this module's own code reaches on loopback from the node's runtime now that it runs outside the mailu network"
     }
   ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "resources": [
     {
       "id": "mesh-state",
@@ -305,6 +309,9 @@
       "name": "mailu-admin",
       "image": "ghcr.io/mailu/admin@sha256:6dbfdadc4a9590dcb7652357b505200115b689b74008653bbf369e4599a3be5a",
       "network": "mailu",
+      "ports": [
+        "8080"
+      ],
       "env-file": [
         "${dir:state}/mailu.env",
         "${dir:state}/secret.env",
@@ -473,31 +480,6 @@
       "content": "{}\n",
       "merge": "json"
     },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-mailu",
-      "network": "mailu",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:state}/api-token.secret:/run/secrets/api-token:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_MAILU_URL": "http://mailu-admin:8080/api/v1",
-        "MESH_MAILU_API_KEY_FILE": "/run/secrets/api-token",
-        "MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
-        "MESH_MAILU_CONFIG_FILE": "/run/config/config.json",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
-    },
     {
       "id": "automx",
       "type": "container",
@@ -517,16 +499,6 @@
   ],
   "build": {
     "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      },
       {
         "arg": "PYTHON_BASE",
         "image": "python@sha256:25f3cfeaceca14921366af4d1240b56457ef46273bdb508c7b0e8f469f6fd228"
@@ -534,9 +506,26 @@
     ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_MAILU_URL": "http://127.0.0.1:${port:8080}/api/v1",
+          "MESH_MAILU_API_KEY_FILE": "${dir:state}/api-token.secret",
+          "MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
+          "MESH_MAILU_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       },
       {
         "name": "automx",

modules/mesh-vault/Dockerfile

@@ -1,22 +0,0 @@
-# mesh-vault's runtime: the tool runtime, carrying this module's compiled provisioner, tools and event
-# consumer. The same shape as postgres's, minus the client the database needs: mesh-vault reaches no
-# server, because what it provides is a value the mesh already delivered to its node.
-#
-# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
-# nothing is copied out of a neighbouring checkout (novox/hq ADR 0069). Two bases, named rather than
-# pinned — the image this is COMPILED in and the image it RUNS in — answered by the mesh from
-# `build.on` in module.json (novox/hq issue 044).
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/vault
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/vault/dist /app/modules/vault/dist
-# The entrypoints a tool host loads from this module: its event consumer, its tools and its
-# provisioner — one image, one process, one broker account (novox/hq ADR 0052).
-ENV MESH_TOOL_MODULES=/app/modules/vault/dist/index.js,/app/modules/vault/dist/tools/index.js,/app/modules/vault/dist/provisioner/index.js

modules/mesh-vault/module.json

@@ -27,16 +27,7 @@
     "secret": "${dir:grants}"
   },
   "keeps": "/var/lib/mesh-vault/root",
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -57,45 +48,29 @@
       "id": "root",
       "type": "directory",
       "mode": "0700"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-vault",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:ledger}:${dir:ledger}",
-        "${dir:root}:${dir:root}:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json",
-        "MESH_VAULT_LEDGER": "${dir:ledger}",
-        "MESH_VAULT_ROOT": "${dir:root}"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_VAULT_LEDGER": "${dir:ledger}",
+          "MESH_VAULT_ROOT": "${dir:root}"
+        }
       }
     ]
   },

modules/minio/Dockerfile

@@ -1,40 +0,0 @@
-# minio's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-ARG MC_CLI
-
-# Named so the final stage's COPY --from can reference a stage, not an ARG — the legacy builder
-# this host still runs doesn't expand ARGs inside COPY --from, only inside FROM.
-FROM ${MC_CLI} AS mccli
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/minio
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/minio/dist /app/modules/minio/dist
-# The provisioner shells out to mc to actually create buckets and service accounts on the running
-# minio server — mc itself was never in this runtime image, only in minio's own. Silently retried
-# "spawn mc ENOENT" forever: a requirement was granted at the control-plane level without ever
-# materializing the credential on minio. /usr/bin/mc there is a symlink to the real binary, mcli —
-# both copied so the symlink resolves.
-COPY --from=mccli /usr/bin/mcli /usr/bin/mcli
-COPY --from=mccli /usr/bin/mc /usr/bin/mc
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/minio/dist/tools/index.js,/app/modules/minio/dist/provisioner/index.js

modules/minio/module.json

@@ -59,16 +59,9 @@
     "s3-bucket": "${dir:grants}"
   },
   "own-secrets": {
-    "root": "${dir:state}/root.secret",
+    "root": "${dir:state}/root.secret"
-    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -127,48 +120,34 @@
       }
     },
     {
-      "id": "runtime",
+      "id": "client",
-      "type": "container",
+      "type": "package",
-      "name": "mesh-minio",
+      "package": "minio-client"
-      "network": "minio-net",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:state}/root.secret:/run/secrets/root:ro"
-      ],
-      "env": {
-        "MESH_MINIO_ENDPOINT": "http://minio:9000",
-        "MESH_MINIO_ROOT_USER": "meshroot",
-        "MESH_MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
-        "MESH_MINIO_REGION": "eu-west",
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      },
-      {
-        "arg": "MC_CLI",
-        "image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_MINIO_ENDPOINT": "http://127.0.0.1:${port:9000}",
+          "MESH_MINIO_ROOT_USER": "meshroot",
+          "MESH_MINIO_ROOT_PASSWORD_FILE": "${dir:state}/root.secret",
+          "MESH_MINIO_REGION": "eu-west",
+          "MESH_MINIO_MC_BIN": "mcli",
+          "MESH_MINIO_MC_CONFIG": "${dir:state}/mc",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       }
     ]
   }

modules/mosquitto/Dockerfile

@@ -1,28 +0,0 @@
-# mosquitto's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/mosquitto
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc topics.ts client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# mosquitto's client and bootstrap drive `mosquitto_ctrl`; the apt package carries it with its
-# shared libraries — the musl binary from the eclipse image would not load on this glibc base.
-RUN apt-get update && apt-get install -y --no-install-recommends mosquitto \
- && rm -rf /var/lib/apt/lists/*
-COPY --from=build /app/modules/mosquitto/dist /app/modules/mosquitto/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/mosquitto/dist/index.js,/app/modules/mosquitto/dist/tools/index.js,/app/modules/mosquitto/dist/provisioner/index.js

modules/mosquitto/module.json

@@ -32,8 +32,7 @@
     "mqtt-topic": "${dir:grants}"
   },
   "own-secrets": {
-    "admin": "${dir:mesh-state}/admin",
+    "admin": "${dir:mesh-state}/admin"
-    "broker": "${dir:mesh-state}/broker"
   },
   "listens": [
     {
@@ -89,25 +88,28 @@
       "name": "mosquitto"
     },
     {
-      "id": "bootstrap",
+      "id": "bootstrap-env",
-      "type": "container",
+      "type": "file",
-      "name": "mosquitto-bootstrap",
+      "path": "${dir:state}/bootstrap.env",
-      "run-once": true,
+      "mode": "0600",
-      "volumes": [
+      "content": "MESH_PROVISION_MQTT=127.0.0.1:${port:1883}\nMESH_PROVISION_ADMIN_USER=mesh-admin\nMESH_PROVISION_PASSWORD_FILE=${dir:mesh-state}/admin\nMESH_DYNSEC_FILE=${dir:data}/dynamic-security.json\n"
-        "${dir:data}:/mosquitto/data",
-        "${dir:mesh-state}/admin:/run/secrets/admin:ro"
-      ],
-      "env": {
-        "MESH_PROVISION_MQTT": "mosquitto:1883",
-        "MESH_PROVISION_ADMIN_USER": "mesh-admin",
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin",
-        "MESH_DYNSEC_FILE": "/mosquitto/data/dynamic-security.json"
     },
-      "args": [
+    {
-        "run",
+      "id": "bootstrap",
-        "/app/modules/mosquitto/dist/bootstrap/index.js"
+      "type": "process",
+      "name": "mosquitto-bootstrap",
+      "artifact": "code",
+      "run": [
+        "node",
+        "bootstrap/index.js"
       ],
-      "artifact": "runtime"
+      "run-once": true,
+      "env-file": [
+        "${dir:state}/bootstrap.env"
+      ],
+      "restart-on": [
+        "bootstrap-env"
+      ]
     },
     {
       "id": "server",
@@ -125,43 +127,34 @@
       ]
     },
     {
-      "id": "runtime",
+      "id": "client",
-      "type": "container",
+      "type": "package",
-      "name": "mesh-mosquitto",
+      "package": "mosquitto"
-      "network": "mosquitto",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:mesh-state}/admin:/run/secrets/admin:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json",
-        "MESH_PROVISION_MQTT": "mosquitto:1883",
-        "MESH_PROVISION_ADMIN_USER": "mesh-admin",
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js",
+          "bootstrap/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_PROVISION_MQTT": "127.0.0.1:${port:1883}",
+          "MESH_PROVISION_ADMIN_USER": "mesh-admin",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:mesh-state}/admin"
+        }
       }
     ]
   }

modules/netcheck/cmd/netcheck/checks.go

@@ -0,0 +1,173 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"net"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Bounds on what a caller may ask: a check is a probe, never a wait anyone can make long.
+const (
+	DefaultTimeout = 3 * time.Second
+	MostTimeout    = 30 * time.Second
+)
+
+// TCPResult is what netcheck_tcp answers.
+type TCPResult struct {
+	Host      string `json:"host"`
+	Port      int    `json:"port"`
+	Address   string `json:"address,omitempty"`
+	Reachable bool   `json:"reachable"`
+	ElapsedMS int64  `json:"elapsed_ms"`
+	Error     string `json:"error,omitempty"`
+}
+
+// CheckTCP opens one TCP connection and closes it, sending nothing. A port that refuses or a host
+// that does not answer is a result, not a failure of the tool; only a malformed question is.
+func CheckTCP(host string, port int, timeout time.Duration) (TCPResult, error) {
+	if port < 1 || port > 65535 {
+		return TCPResult{}, fmt.Errorf("port %d is not a TCP port (1-65535)", port)
+	}
+	out := TCPResult{Host: host, Port: port}
+	start := time.Now()
+	conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, strconv.Itoa(port)), timeout)
+	out.ElapsedMS = time.Since(start).Milliseconds()
+	if err != nil {
+		out.Error = err.Error()
+		return out, nil
+	}
+	out.Address = conn.RemoteAddr().String()
+	out.Reachable = true
+	_ = conn.Close()
+	return out, nil
+}
+
+// DNSResult is what netcheck_dns answers.
+type DNSResult struct {
+	Name      string   `json:"name"`
+	Type      string   `json:"type"`
+	Answers   []string `json:"answers"`
+	ElapsedMS int64    `json:"elapsed_ms"`
+	Error     string   `json:"error,omitempty"`
+}
+
+// DNSTypes are the record types netcheck_dns looks up.
+var DNSTypes = []string{"A", "AAAA", "CNAME", "TXT", "MX"}
+
+// CheckDNS looks a name up with the machine's resolver. Built without cgo, Go's own resolver reads
+// the machine's /etc/resolv.conf and /etc/hosts, which is the resolver this machine's programs use.
+// A name that does not resolve is a result with its error; an unknown type is refused.
+func CheckDNS(name, kind string, timeout time.Duration) (DNSResult, error) {
+	kind = strings.ToUpper(strings.TrimSpace(kind))
+	if kind == "" {
+		kind = "A"
+	}
+	known := false
+	for _, t := range DNSTypes {
+		known = known || t == kind
+	}
+	if !known {
+		return DNSResult{}, fmt.Errorf("type %q is not one netcheck_dns looks up (%s)", kind, strings.Join(DNSTypes, ", "))
+	}
+	out := DNSResult{Name: name, Type: kind, Answers: []string{}}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	r := net.DefaultResolver
+	start := time.Now()
+	var err error
+	switch kind {
+	case "A", "AAAA":
+		network := "ip4"
+		if kind == "AAAA" {
+			network = "ip6"
+		}
+		var ips []net.IP
+		if ips, err = r.LookupIP(ctx, network, name); err == nil {
+			for _, ip := range ips {
+				out.Answers = append(out.Answers, ip.String())
+			}
+		}
+	case "CNAME":
+		var cname string
+		if cname, err = r.LookupCNAME(ctx, name); err == nil {
+			out.Answers = append(out.Answers, cname)
+		}
+	case "TXT":
+		var txts []string
+		if txts, err = r.LookupTXT(ctx, name); err == nil {
+			out.Answers = append(out.Answers, txts...)
+		}
+	case "MX":
+		var mxs []*net.MX
+		if mxs, err = r.LookupMX(ctx, name); err == nil {
+			for _, mx := range mxs {
+				out.Answers = append(out.Answers, fmt.Sprintf("%d %s", mx.Pref, mx.Host))
+			}
+		}
+	}
+	out.ElapsedMS = time.Since(start).Milliseconds()
+	if err != nil {
+		out.Error = err.Error()
+	}
+	if kind != "MX" {
+		sort.Strings(out.Answers)
+	}
+	return out, nil
+}
+
+// text is a required string argument.
+func text(args map[string]any, key string) (string, error) {
+	s, _ := args[key].(string)
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	return s, nil
+}
+
+// whole is an integer argument, given as a JSON number or a numeric string; fallback when absent.
+func whole(args map[string]any, key string, fallback int) (int, error) {
+	v, given := args[key]
+	if !given || v == nil {
+		if fallback == 0 {
+			return 0, fmt.Errorf("%s is required", key)
+		}
+		return fallback, nil
+	}
+	switch n := v.(type) {
+	case float64:
+		if n != math.Trunc(n) {
+			return 0, fmt.Errorf("%s must be a whole number, not %v", key, n)
+		}
+		return int(n), nil
+	case string:
+		i, err := strconv.Atoi(strings.TrimSpace(n))
+		if err != nil {
+			return 0, fmt.Errorf("%s must be a whole number, not %q", key, n)
+		}
+		return i, nil
+	}
+	return 0, errors.New(key + " must be a whole number")
+}
+
+// timeoutOf is timeout_ms, defaulted and bounded.
+func timeoutOf(args map[string]any) (time.Duration, error) {
+	ms, err := whole(args, "timeout_ms", int(DefaultTimeout/time.Millisecond))
+	if err != nil {
+		return 0, err
+	}
+	if ms < 1 {
+		return 0, fmt.Errorf("timeout_ms must be at least 1, not %d", ms)
+	}
+	d := time.Duration(ms) * time.Millisecond
+	if d > MostTimeout {
+		d = MostTimeout
+	}
+	return d, nil
+}

modules/netcheck/cmd/netcheck/checks_test.go

@@ -0,0 +1,68 @@
+package main
+
+import (
+	"net"
+	"testing"
+	"time"
+)
+
+func TestATCPPortThatListensIsReachableAndOneThatDoesNotIsNot(t *testing.T) {
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	port := l.Addr().(*net.TCPAddr).Port
+	got, err := CheckTCP("127.0.0.1", port, time.Second)
+	if err != nil || !got.Reachable || got.Error != "" {
+		t.Fatalf("a listening port: %+v, %v", got, err)
+	}
+	l.Close()
+	got, err = CheckTCP("127.0.0.1", port, time.Second)
+	if err != nil || got.Reachable || got.Error == "" {
+		t.Fatalf("a closed port is reported as a result with its error, not a failure: %+v, %v", got, err)
+	}
+}
+
+func TestAPortOutsideTheRangeIsRefused(t *testing.T) {
+	for _, p := range []int{0, -1, 65536} {
+		if _, err := CheckTCP("127.0.0.1", p, time.Second); err == nil {
+			t.Errorf("port %d was accepted", p)
+		}
+	}
+}
+
+func TestDNSAnswersFromTheMachinesResolverAndRefusesAnUnknownType(t *testing.T) {
+	got, err := CheckDNS("localhost", "a", time.Second)
+	if err != nil || got.Type != "A" || len(got.Answers) == 0 {
+		t.Fatalf("localhost A: %+v, %v", got, err)
+	}
+	if _, err := CheckDNS("localhost", "SRV", time.Second); err == nil {
+		t.Fatal("an unknown record type was accepted")
+	}
+	got, err = CheckDNS("no-such-name.invalid", "A", time.Second)
+	if err != nil || got.Error == "" || len(got.Answers) != 0 {
+		t.Fatalf("a name that does not resolve is a result with its error: %+v, %v", got, err)
+	}
+}
+
+func TestTimeoutIsDefaultedAndBounded(t *testing.T) {
+	if d, _ := timeoutOf(map[string]any{}); d != DefaultTimeout {
+		t.Errorf("default: %v", d)
+	}
+	if d, _ := timeoutOf(map[string]any{"timeout_ms": float64(10 * 60 * 1000)}); d != MostTimeout {
+		t.Errorf("bounded: %v", d)
+	}
+	if _, err := timeoutOf(map[string]any{"timeout_ms": float64(0)}); err == nil {
+		t.Error("a zero timeout was accepted")
+	}
+}
+
+func TestBothToolsAreListedUnprefixed(t *testing.T) {
+	names := map[string]bool{}
+	for _, tool := range tools() {
+		names[tool.Name] = true
+	}
+	if !names["netcheck_tcp"] || !names["netcheck_dns"] || len(names) != 2 {
+		t.Fatalf("tools: %v", names)
+	}
+}

modules/netcheck/cmd/netcheck/main.go

@@ -0,0 +1,72 @@
+// netcheck's Go tools bundle (novox/hq ADR 0188, ADR 0193): a process the node's runtime launches
+// and speaks MCP over stdio to, through the Go SDK. It serves the two checks that are the machine's
+// own sockets and resolver — a TCP connect and a DNS lookup — and nothing that changes anything.
+// The module's HTTP check is its TypeScript bundle; the runtime serves both under one module.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+func main() {
+	// An empty name serves as the module the runtime names (MESH_SERVED_MODULE): netcheck.
+	if err := stdio.Serve("", tools()); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func tools() []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "netcheck_tcp",
+			Description: "Check whether a TCP port is reachable from this machine: opens one connection " +
+				"and closes it at once, sending nothing. Answers reachable, elapsed_ms and the error when not.",
+			Input: map[string]any{
+				"host":       map[string]any{"type": "string", "description": "host name or IP address"},
+				"port":       map[string]any{"type": "integer", "description": "TCP port, 1-65535"},
+				"timeout_ms": map[string]any{"type": "integer", "description": "give up after this long (default 3000, at most 30000)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				host, err := text(args, "host")
+				if err != nil {
+					return nil, err
+				}
+				port, err := whole(args, "port", 0)
+				if err != nil {
+					return nil, err
+				}
+				timeout, err := timeoutOf(args)
+				if err != nil {
+					return nil, err
+				}
+				return CheckTCP(host, port, timeout)
+			},
+		},
+		{
+			Name: "netcheck_dns",
+			Description: "Look a name up with this machine's resolver (its /etc/resolv.conf and /etc/hosts). " +
+				"type is A, AAAA, CNAME, TXT or MX; answers the records found, or the error.",
+			Input: map[string]any{
+				"name":       map[string]any{"type": "string", "description": "the name to look up"},
+				"type":       map[string]any{"type": "string", "enum": []string{"A", "AAAA", "CNAME", "TXT", "MX"}, "description": "record type (default A)"},
+				"timeout_ms": map[string]any{"type": "integer", "description": "give up after this long (default 3000, at most 30000)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				name, err := text(args, "name")
+				if err != nil {
+					return nil, err
+				}
+				kind, _ := args["type"].(string)
+				timeout, err := timeoutOf(args)
+				if err != nil {
+					return nil, err
+				}
+				return CheckDNS(name, kind, timeout)
+			},
+		},
+	}
+}

modules/netcheck/go.mod

@@ -0,0 +1,5 @@
+module netcheck
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.6

modules/netcheck/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
+git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/netcheck/http.ts

@@ -0,0 +1,84 @@
+// netcheck's HTTP check — the module's own code, in TypeScript (novox/hq ADR 0039, ADR 0188). One
+// request, HEAD or GET, never a body sent and never a body read: the status, how long it took and
+// a few headers that say what answered. Redirects are reported, not followed, so a check reaches
+// exactly the address it was given.
+
+export const METHODS = ["HEAD", "GET"] as const;
+export type Method = (typeof METHODS)[number];
+
+/** The headers worth reporting: what answered and what it says it is, nothing it set for a client. */
+export const REPORTED_HEADERS = [
+  "content-type", "content-length", "server", "location", "date",
+  "cache-control", "last-modified", "etag",
+] as const;
+
+export const DEFAULT_TIMEOUT_MS = 5000;
+export const MOST_TIMEOUT_MS = 30000;
+
+export interface HttpResult {
+  url: string;
+  method: Method;
+  status?: number;
+  statusText?: string;
+  elapsed_ms: number;
+  headers: Record<string, string>;
+  error?: string;
+}
+
+/** Only http and https are checked; anything else — file:, data:, ftp: — is refused by name. */
+export function checkedUrl(raw: unknown): URL {
+  const text = typeof raw === "string" ? raw.trim() : "";
+  if (!text) throw new Error("url is required");
+  let url: URL;
+  try {
+    url = new URL(text);
+  } catch {
+    throw new Error(`${JSON.stringify(text)} is not a URL`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(`netcheck_http checks http and https URLs only, not ${url.protocol}`);
+  }
+  return url;
+}
+
+export function checkedMethod(raw: unknown): Method {
+  const m = (typeof raw === "string" && raw.trim() ? raw.trim() : "HEAD").toUpperCase();
+  if (!(METHODS as readonly string[]).includes(m)) {
+    throw new Error(`method ${m} is not one netcheck_http uses (${METHODS.join(", ")}): a check never changes anything`);
+  }
+  return m as Method;
+}
+
+export function checkedTimeout(raw: unknown): number {
+  if (raw === undefined || raw === null || raw === "") return DEFAULT_TIMEOUT_MS;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1) throw new Error(`timeout_ms must be a whole number of at least 1, not ${String(raw)}`);
+  return Math.min(n, MOST_TIMEOUT_MS);
+}
+
+/** Make one request and report how it went. A refused connection or a timeout is a result with its
+ *  error; only a malformed question throws. */
+export async function checkHttp(args: Readonly<Record<string, unknown>>, fetcher: typeof fetch = fetch): Promise<HttpResult> {
+  const url = checkedUrl(args.url);
+  const method = checkedMethod(args.method);
+  const timeout = checkedTimeout(args.timeout_ms);
+  const started = performance.now();
+  const out: HttpResult = { url: url.toString(), method, elapsed_ms: 0, headers: {} };
+  try {
+    const res = await fetcher(url, { method, redirect: "manual", signal: AbortSignal.timeout(timeout) });
+    out.elapsed_ms = Math.round(performance.now() - started);
+    out.status = res.status;
+    out.statusText = res.statusText;
+    for (const h of REPORTED_HEADERS) {
+      const v = res.headers.get(h);
+      if (v !== null) out.headers[h] = v;
+    }
+    // The body is not read: a check asks whether something answers, not what it says.
+    await res.body?.cancel().catch(() => {});
+  } catch (err) {
+    out.elapsed_ms = Math.round(performance.now() - started);
+    const e = err as Error & { cause?: { message?: string; code?: string } };
+    out.error = e.name === "TimeoutError" ? `no answer within ${timeout} ms` : (e.cause?.code ?? e.cause?.message ?? e.message);
+  }
+  return out;
+}

modules/netcheck/module.json

@@ -0,0 +1,35 @@
+{
+  "module": "netcheck",
+  "version": "1",
+  "tools": [
+    "netcheck_tcp",
+    "netcheck_dns",
+    "netcheck_http"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/netcheck",
+        "binary": "netcheck",
+        "loads": [
+          "netcheck"
+        ]
+      },
+      {
+        "name": "tools-typescript",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ]
+      }
+    ]
+  }
+}

modules/netcheck/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@novox/module-netcheck",
+  "version": "0.1.0",
+  "description": "netcheck — read-only network checks from a machine, as one module carrying a Go tools bundle (TCP, DNS) and a TypeScript one (HTTP) (novox/hq ADR 0188, ADR 0193).",
+  "type": "module",
+  "private": true,
+  "scripts": {
+    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
+  },
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.6"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/netcheck/test/http.test.ts

@@ -0,0 +1,52 @@
+// The HTTP check refuses what is not http(s) and what would change something, and reports a status,
+// a refusal and a timeout as results (novox/hq ADR 0188: a tools bundle is read-only and harmless).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import { checkHttp, checkedMethod, checkedUrl } from "../http.ts";
+
+test("only http and https URLs are checked", () => {
+  for (const bad of ["file:///etc/passwd", "ftp://example.org/", "data:text/plain,hi", "javascript:1", "", "not a url"]) {
+    assert.throws(() => checkedUrl(bad), `${bad} was accepted`);
+  }
+  assert.equal(checkedUrl("https://example.org/x").protocol, "https:");
+});
+
+test("only HEAD and GET are used", () => {
+  assert.equal(checkedMethod(undefined), "HEAD");
+  assert.equal(checkedMethod("get"), "GET");
+  for (const bad of ["POST", "PUT", "DELETE", "PATCH"]) assert.throws(() => checkedMethod(bad));
+});
+
+test("a status, its headers and a redirect not followed", async () => {
+  const server = createServer((req, res) => {
+    if (req.url === "/moved") { res.writeHead(302, { location: "/elsewhere" }); res.end(); return; }
+    res.writeHead(200, { "content-type": "text/plain", "x-secret": "not reported" });
+    res.end(req.method === "GET" ? "body" : undefined);
+  });
+  await new Promise<void>((ok) => server.listen(0, "127.0.0.1", ok));
+  const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+  try {
+    const head = await checkHttp({ url: base + "/" });
+    assert.equal(head.status, 200);
+    assert.equal(head.method, "HEAD");
+    assert.equal(head.headers["content-type"], "text/plain");
+    assert.equal(head.headers["x-secret"], undefined);
+    const moved = await checkHttp({ url: base + "/moved", method: "GET" });
+    assert.equal(moved.status, 302);
+    assert.equal(moved.headers.location, "/elsewhere");
+  } finally {
+    server.close();
+  }
+});
+
+test("a refused connection is a result with its error", async () => {
+  const server = createServer();
+  await new Promise<void>((ok) => server.listen(0, "127.0.0.1", ok));
+  const port = (server.address() as AddressInfo).port;
+  await new Promise<void>((ok) => server.close(() => ok()));
+  const got = await checkHttp({ url: `http://127.0.0.1:${port}/`, timeout_ms: 2000 });
+  assert.equal(got.status, undefined);
+  assert.ok(got.error, "no error reported");
+});

modules/netcheck/tools/index.ts

@@ -0,0 +1,28 @@
+// netcheck's TypeScript tools bundle (novox/hq ADR 0188, ADR 0193): what the builder's launcher
+// imports and serves over MCP on stdio. Its Go bundle serves the TCP and DNS checks; this one the
+// HTTP check — one module, two languages, one runtime that knows neither.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { checkHttp, DEFAULT_TIMEOUT_MS, METHODS, MOST_TIMEOUT_MS } from "../http.js";
+
+export function getNetcheckHttpTools(): ToolDefinition[] {
+  return [
+    {
+      name: "netcheck_http",
+      description:
+        "Check whether an http(s) URL answers from this machine: one HEAD or GET, no body sent or read, " +
+        "redirects reported and not followed. Answers status, elapsed_ms and a few headers.",
+      input: {
+        url: { type: "string", description: "an http:// or https:// URL" },
+        method: { type: "string", enum: [...METHODS], description: "HEAD (default) or GET" },
+        timeout_ms: {
+          type: "integer",
+          description: `give up after this long (default ${DEFAULT_TIMEOUT_MS}, at most ${MOST_TIMEOUT_MS})`,
+        },
+      },
+      run: async (args) => checkHttp(args),
+    },
+  ];
+}
+
+registerModuleTools("netcheck", () => getNetcheckHttpTools());

modules/netcheck/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["http.ts", "tools/index.ts"]
+}

modules/nextcloud/Dockerfile

@@ -1,40 +0,0 @@
-# nextcloud's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-ARG DOCKER_CLI
-
-# Named so the final stage's COPY --from can reference a stage, not an ARG — the legacy builder
-# this host still runs doesn't expand ARGs inside COPY --from, only inside FROM.
-FROM ${DOCKER_CLI} AS dockercli
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/nextcloud
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/nextcloud/dist /app/modules/nextcloud/dist
-# occ runs inside nextcloud's own container, reached over the mounted docker socket — which needs
-# the docker CLI itself present here, not only the socket. Copied from Docker's own official client
-# image rather than apt-installed, so this stays the one binary and nothing else (no daemon, no
-# systemd unit, no package manager tree pulled in for it).
-COPY --from=dockercli /usr/local/bin/docker /usr/local/bin/docker
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/nextcloud/dist/index.js,/app/modules/nextcloud/dist/tools/index.js

modules/nextcloud/module.json

@@ -30,8 +30,7 @@
     "share.created"
   ],
   "own-secrets": {
-    "admin": "${dir:state}/admin.secret",
+    "admin": "${dir:state}/admin.secret"
-    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -94,53 +93,28 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-nextcloud",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NEXTCLOUD_URL": "http://127.0.0.1:${port:80}",
-        "MESH_NEXTCLOUD_CONFIG_FILE": "/run/config/config.json",
-        "MESH_NEXTCLOUD_ADMIN_USER": "mesh-admin",
-        "MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE": "/run/secrets/admin"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      },
-      {
-        "arg": "DOCKER_CLI",
-        "image": "docker@sha256:018edbc908e08fcc9dbf029c812c34251e9b4719e6f71ca0e5eae2a987d014ca"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_NEXTCLOUD_URL": "http://127.0.0.1:${port:80}",
+          "MESH_NEXTCLOUD_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_NEXTCLOUD_ADMIN_USER": "mesh-admin",
+          "MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret"
+        }
       }
     ]
   }

modules/nodered/Dockerfile

@@ -1,27 +0,0 @@
-# nodered's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/nodered
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts mqtt/probe.ts mqtt/connection.ts mqtt/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/nodered/dist /app/modules/nodered/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/nodered/dist/tools/index.js
-# NOT dist/mqtt/index.js: that is a step the host runs to completion, named by the `mqtt`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.

modules/nodered/module.json

@@ -12,8 +12,7 @@
     "api-token": {
       "path": "${dir:mesh-state}/api-token",
       "taken": "at-start"
-    },
+    }
-    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -101,53 +100,31 @@
       "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
     },
     {
-      "id": "runtime",
+      "id": "mqtt-env",
-      "type": "container",
+      "type": "file",
-      "name": "mesh-nodered",
+      "path": "${dir:state}/mqtt.env",
-      "network": "host",
+      "mode": "0600",
-      "volumes": [
+      "content": "MESH_NODERED_URL=http://127.0.0.1:${port:1880}\nMESH_NODERED_CONFIG_FILE=${dir:mesh-state}/config.json\nMESH_PROVISIONS_DIR=${dir:state}\nMESH_WRITTEN_DIR=${dir:written}\n"
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
-        "MESH_NODERED_CONFIG_FILE": "/run/config/config.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     },
     {
       "id": "mqtt",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-nodered-mqtt",
+      "name": "nodered-mqtt",
-      "network": "host",
+      "artifact": "code",
-      "run-once": true,
+      "run": [
-      "volumes": [
+        "node",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
+        "mqtt/index.js"
-        "${dir:written}:/var/lib/nodered-provisions",
-        "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
-        "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",
-        "${dir:state}/settings.json:/run/provisions/settings.json:ro"
       ],
-      "env": {
+      "run-once": true,
-        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
+      "env-file": [
-        "MESH_NODERED_CONFIG_FILE": "/run/config/config.json",
+        "${dir:state}/mqtt.env"
-        "MESH_PROVISIONS_DIR": "/run/provisions",
-        "MESH_WRITTEN_DIR": "/var/lib/nodered-provisions"
-      },
-      "args": [
-        "run",
-        "/app/modules/nodered/dist/mqtt/index.js"
       ],
       "restart-on": [
+        "mqtt-env",
         "bound-mqtt-topic",
         "secret-mqtt-topic",
         "settings"
-      ],
+      ]
-      "artifact": "runtime"
     }
   ],
   "requires": [
@@ -173,23 +150,22 @@
     "mqtt-topic": "${dir:state}/mqtt-topic.secret"
   },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "mqtt/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
+          "MESH_NODERED_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
       }
     ]
   }

modules/openai-consumer/Dockerfile

@@ -1,22 +0,0 @@
-# openai-consumer's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/openai-consumer
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc apply/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/openai-consumer/dist /app/modules/openai-consumer/dist
-# No serve-time entrypoints: every container of this module names its command (`run` on a
-# schedule), so nothing here serves — deliberately no MESH_TOOL_MODULES.

modules/openai-consumer/module.json

@@ -28,44 +28,31 @@
     },
     {
       "id": "apply",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-openai-consumer-apply",
+      "name": "openai-consumer-apply",
-      "network": "host",
+      "artifact": "code",
+      "run": [
+        "node",
+        "apply/index.js"
+      ],
       "schedule": "*/5 * * * *",
-      "args": [
-        "run",
-        "/app/modules/openai-consumer/dist/apply/index.js"
-      ],
-      "volumes": [
-        "${dir:state}:/run/state"
-      ],
       "env": {
-        "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/api-key",
+        "MESH_MODEL_ACCESS_SECRET_FILE": "${dir:state}/api-key",
-        "MESH_MODEL_ACCESS_BIND_FILE": "/run/state/model.json",
+        "MESH_MODEL_ACCESS_BIND_FILE": "${dir:state}/model.json",
-        "MESH_OPENAI_ENV_FILE": "/run/state/config/openai.env",
+        "MESH_OPENAI_ENV_FILE": "${dir:state}/config/openai.env",
-        "MESH_OPENAI_CREDENTIALS_FILE": "/run/state/config/auth.json"
+        "MESH_OPENAI_CREDENTIALS_FILE": "${dir:state}/config/auth.json"
-      },
+      }
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "apply/index.js"
+        ]
       }
     ]
   }

modules/postgres/Dockerfile

@@ -1,41 +0,0 @@
-# postgres's runtime: the tool runtime, carrying this module's compiled provisioner, tools and
-# event consumer.
-#
-# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
-# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
-# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
-# the siblings.
-#
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
-# They are different images on purpose — the first carries a compiler and the second must not, or
-# every running container would carry one it never invokes. The mesh answers both with the copies it
-# holds, because a fingerprint written here would name one particular copy and no other mesh has it
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
-# nobody told stops here and says which module to build first.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against.
-WORKDIR /app/modules/postgres
-COPY . .
-# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
-# symlinks to a launcher that requires its library relatively — resolved away when the base image
-# was assembled.
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# **This module talks to its database through psql, so psql has to be here.** The client is how
-# postgres's provisioner runs DDL — it does not carry a driver — and the runtime base holds only
-# what every module needs.
-RUN apt-get update \
-      && apt-get install -y --no-install-recommends postgresql-client \
-      && rm -rf /var/lib/apt/lists/*
-COPY --from=build /app/modules/postgres/dist /app/modules/postgres/dist
-# What a tool host should load from this module: its event consumer and its tools, which are
-# separate entrypoints because they are loaded by different things. The provisioner is the third,
-# and is not listed here — the declaration names it in the container's `args`, because it is what
-# this module's own container runs. One image, because they are one module and share a client.
-ENV MESH_TOOL_MODULES=/app/modules/postgres/dist/index.js,/app/modules/postgres/dist/tools/index.js,/app/modules/postgres/dist/provisioner/index.js

modules/postgres/module.json

@@ -53,16 +53,9 @@
   },
   "own-secrets": {
     "superuser": "${dir:state}/superuser.secret",
-    "broker": "${dir:mesh-state}/broker",
     "reader": "${dir:state}/reader.secret"
   },
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -99,45 +92,33 @@
       ]
     },
     {
-      "id": "runtime",
+      "id": "client",
-      "type": "container",
+      "type": "package",
-      "name": "mesh-postgres",
+      "package": "postgresql-libs"
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:state}/superuser.secret:/run/secrets/superuser:ro",
-        "${dir:state}/reader.secret:/run/secrets/reader:ro"
-      ],
-      "env": {
-        "MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:${port:5432}/postgres?sslmode=disable",
-        "MESH_PROVISION_POSTGRES_PORT": "${seat:mesh-store:5432}",
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/superuser",
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json",
-        "MESH_POSTGRES_READER_PASSWORD_FILE": "/run/secrets/reader"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:${port:5432}/postgres?sslmode=disable",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:state}/superuser.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_POSTGRES_READER_PASSWORD_FILE": "${dir:state}/reader.secret"
+        }
       }
     ]
   }

modules/records/Dockerfile

@@ -1,26 +0,0 @@
-# records' runtime: the tool runtime, carrying this module's compiled reader and its tools.
-#
-# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
-# nothing is copied out of a neighbouring checkout (novox/hq ADR 0069).
-#
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/records
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc records.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# **A module may need something the base image does not carry.** The reader keeps a checkout of the
-# repository it reads (novox/hq ADR 0153) — a git working copy, kept current, not a derived copy — and
-# the base image has no git. Certificates too, because the origin may be reached over TLS.
-RUN apt-get update \
-      && apt-get install -y --no-install-recommends git ca-certificates \
-      && rm -rf /var/lib/apt/lists/*
-COPY --from=build /app/modules/records/dist /app/modules/records/dist
-# Both entrypoints, loaded in serve mode: the consumer that pulls on a merge, and the tools.
-ENV MESH_TOOL_MODULES=/app/modules/records/dist/index.js,/app/modules/records/dist/tools/index.js

modules/records/module.json

@@ -11,9 +11,6 @@
   "binds": {
     "git": "${dir:mesh-state}/git.json"
   },
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "consumes": [
     "gitea.pull.merged"
   ],
@@ -53,47 +50,30 @@
       "content": "${bound:git:scheme}://${bound:git:at}:${bound:git:port}\n"
     },
     {
-      "id": "runtime",
+      "id": "git",
-      "type": "container",
+      "type": "package",
-      "name": "records",
+      "package": "git"
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:mesh-state}/origin:/run/config/origin:ro",
-        "${dir:checkout}:${dir:checkout}"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECORDS_CONFIG_FILE": "/run/config/config.json",
-        "MESH_RECORDS_ORIGIN_FILE": "/run/config/origin",
-        "MESH_RECORDS_DIR": "${dir:checkout}"
-      },
-      "artifact": "runtime",
-      "restart-on": [
-        "config",
-        "origin"
-      ]
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_RECORDS_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_RECORDS_ORIGIN_FILE": "${dir:mesh-state}/origin",
+          "MESH_RECORDS_DIR": "${dir:checkout}"
+        }
       }
     ]
   }

modules/redis/Dockerfile

@@ -1,30 +0,0 @@
-# redis's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/redis
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/redis/dist /app/modules/redis/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/redis/dist/index.js,/app/modules/redis/dist/tools/index.js,/app/modules/redis/dist/provisioner/index.js

modules/redis/module.json

@@ -35,9 +35,6 @@
   "secrets": {
     "secret": "${dir:state}/default.secret"
   },
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "listens": [
     {
       "name": "cache",
@@ -48,12 +45,6 @@
     }
   ],
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -103,44 +94,29 @@
       "restart-on": [
         "server-conf"
       ]
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-redis",
-      "network": "redis",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:/var/lib/redis-module/grants:ro",
-        "${dir:state}/default.secret:/run/secrets/default:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "/var/lib/redis-module/grants/mesh.json",
-        "MESH_PROVISION_REDIS": "redis:6379",
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/default"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_PROVISION_REDIS": "127.0.0.1:${port:6379}",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:state}/default.secret"
+        }
       }
     ]
   }

modules/route-adapter/Dockerfile

@@ -1,24 +0,0 @@
-# route-adapter's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/route-adapter
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc adapter.ts index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/route-adapter/dist /app/modules/route-adapter/dist
-# **No MESH_TOOL_MODULES, deliberately.** This module serves no tool and consumes no event: it is a
-# step the host runs to completion, named by the container's `args` as `mesh-tools run …`. Setting a
-# serve-time entrypoint here would give the image a second way to be started — one that connects to
-# the broker and never exits.

modules/route-adapter/module.json

@@ -47,23 +47,18 @@
     },
     {
       "id": "adapt",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-route-adapter",
+      "name": "route-adapter",
-      "artifact": "runtime",
+      "artifact": "code",
-      "run-once": true,
+      "run": [
-      "volumes": [
+        "node",
-        "${dir:routes-dir}/mesh.json:${dir:routes-dir}/mesh.json:ro",
+        "index.js"
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${access:dynamic}:/services/traefik/dynamic"
       ],
+      "run-once": true,
       "env": {
         "MESH_RECEIVES": "${dir:routes-dir}/mesh.json",
-        "MESH_ROUTE_ADAPTER_CONFIG": "/run/config/config.json"
+        "MESH_ROUTE_ADAPTER_CONFIG": "${dir:state}/config.json"
       },
-      "args": [
-        "run",
-        "/app/modules/route-adapter/dist/index.js"
-      ],
       "restart-on": [
         "received-route",
         "config"
@@ -71,23 +66,14 @@
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js"
+        ]
       }
     ]
   }

modules/umami/Dockerfile

@@ -1,30 +0,0 @@
-# umami's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/umami
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/umami/dist /app/modules/umami/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/umami/dist/tools/index.js,/app/modules/umami/dist/provisioner/index.js

modules/umami/module.json

@@ -44,9 +44,6 @@
   "grants": {
     "analytics": "${dir:grants}"
   },
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "listens": [
     {
       "name": "web",
@@ -57,12 +54,6 @@
     }
   ],
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -81,13 +72,6 @@
       "mode": "0600",
       "content": "DATABASE_URL=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nDATABASE_TYPE=postgresql\nAPP_SECRET=${secret:app-secret}\n"
     },
-    {
-      "id": "provisioner-env",
-      "type": "file",
-      "path": "${dir:state}/provisioner.env",
-      "mode": "0600",
-      "content": "MESH_PROVISION_UMAMI_URL=http://umami:3000\nGRANTS=${dir:grants}\n"
-    },
     {
       "id": "net",
       "type": "network",
@@ -106,46 +90,27 @@
         "3000"
       ],
       "secrets-in-environment": "a Next.js/Prisma application: DATABASE_URL and APP_SECRET are read from the environment only; not convertible"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-umami",
-      "network": "umami",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json",
-        "MESH_UMAMI_ADMIN_PASSWORD_FILE": "/run/secrets/admin"
-      },
-      "env-file": [
-        "${dir:state}/provisioner.env"
-      ],
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_UMAMI_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_PROVISION_UMAMI_URL": "http://127.0.0.1:${port:3000}"
+        }
       }
     ]
   }