anthropic-consumer: its usage runs in the node's runtime, and its apply is a scheduled process (hq ADR 0198)

Both containers go with the Dockerfile, build bases, bus credential and state directory. apply needs no bus and runs every five minutes as a process on the machine at the host paths the container mounted. usage emitted by spawning the runtime image's own emit command with the module's credential, which exists nowhere now, so it is loaded by the node's runtime instead: it emits through the SDK as this module and reads on the cadence the schedule gave it, once at start and every five minutes. That is the one code change.

modules/anthropic-consumer/Dockerfile

@@ -1,22 +0,0 @@
-# anthropic-consumer's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/anthropic-consumer
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc apply/index.ts usage/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/anthropic-consumer/dist /app/modules/anthropic-consumer/dist
-# No serve-time entrypoints: every container of this module names its command (`run` on a
-# schedule), so nothing here serves — deliberately no MESH_TOOL_MODULES.

modules/anthropic-consumer/module.json

@@ -14,19 +14,10 @@
   "secrets": {
     "model-access": "${dir:state}/access-token"
   },
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "emits": [
     "usage.session"
   ],
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -46,66 +37,39 @@
     },
     {
       "id": "apply",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-anthropic-consumer-apply",
+      "name": "anthropic-consumer-apply",
-      "network": "host",
+      "artifact": "code",
+      "run": [
+        "node",
+        "apply/index.js"
+      ],
       "schedule": "*/5 * * * *",
-      "args": [
-        "run",
-        "/app/modules/anthropic-consumer/dist/apply/index.js"
-      ],
-      "volumes": [
-        "${dir:state}:/run/state"
-      ],
       "env": {
-        "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/access-token",
+        "MESH_MODEL_ACCESS_SECRET_FILE": "${dir:state}/access-token",
-        "MESH_MODEL_ACCESS_BIND_FILE": "/run/state/model.json",
+        "MESH_MODEL_ACCESS_BIND_FILE": "${dir:state}/model.json",
-        "MESH_CLAUDE_CREDENTIALS_FILE": "/run/state/claude/.credentials.json",
+        "MESH_CLAUDE_CREDENTIALS_FILE": "${dir:state}/claude/.credentials.json",
-        "MESH_CLAUDE_IDENTITY_FILE": "/run/state/claude/.claude.json"
+        "MESH_CLAUDE_IDENTITY_FILE": "${dir:state}/claude/.claude.json"
-      },
+      }
-      "artifact": "runtime"
-    },
-    {
-      "id": "usage",
-      "type": "container",
-      "name": "mesh-anthropic-consumer-usage",
-      "network": "host",
-      "schedule": "*/5 * * * *",
-      "args": [
-        "run",
-        "/app/modules/anthropic-consumer/dist/usage/index.js"
-      ],
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:state}:/run/state"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_CLAUDE_PROJECTS_DIR": "/run/state/claude/projects",
-        "MESH_ANTHROPIC_USAGE_OUT": "/run/state/out/session-usage.json",
-        "MESH_TOOLS_MAIN": "/app/dist/main.js"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "apply/index.js",
+          "usage/index.js"
+        ],
+        "loads": [
+          "usage/index.js"
+        ],
+        "env": {
+          "MESH_CLAUDE_PROJECTS_DIR": "${dir:state}/claude/projects",
+          "MESH_ANTHROPIC_USAGE_OUT": "${dir:state}/out/session-usage.json"
+        }
       }
     ]
   }

modules/anthropic-consumer/usage/index.ts

@@ -3,12 +3,15 @@
 // per session. The consumer IS the (node,module) session's fixed binding, so no per-message account
 // attribution is done — just the totals (port map "don't-map" #3).
 //
-// Runs as `mesh-tools run` (no broker), so events are emitted best-effort via the sibling mesh-tools
+// Runs in the node's runtime (novox/hq ADR 0198), every five minutes, so events are emitted through
-// `emit` primitive; the totals are also written to a file so the reading is observable without one.
+// the runtime as this module; the totals are also written to a file so the reading is observable
+// without one.
 
 import { readdirSync, statSync, readFileSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 
+import { emit } from "@novox/mesh-sdk/events";
+
 import { readSessionFile, type SessionUsage } from "../transcript.js";
 
 /** The vendor-neutral usage row ADR 0054 fixes — the shape the model-usage store upserts. Kept local
@@ -116,22 +119,20 @@ function atomicWrite(path: string, content: string): void {
   renameSync(tmp, path);
 }
 
-/** Emit best-effort via the sibling mesh-tools `emit`, which wires a broker a run step has none. */
+/** Emit best-effort through the runtime: a reading that could not be announced is still in the file. */
 async function emitUsage(body: Record<string, unknown>): Promise<void> {
-  const main = process.env.MESH_TOOLS_MAIN ?? "/app/dist/main.js";
+  try {
-  const { spawn } = await import("node:child_process");
+    await emit("usage.session", body);
-  await new Promise<void>((resolve) => {
+  } catch (err) {
-    const child = spawn(
+    console.error(`[anthropic-consumer] could not emit usage: ${err}`);
-      process.execPath,
+  }
-      [main, "emit", "usage.session", JSON.stringify(body)],
-      { stdio: "inherit" },
-    );
-    child.on("exit", () => resolve());
-    child.on("error", (err) => {
-      console.error(`[anthropic-consumer] could not emit usage: ${err}`);
-      resolve();
-    });
-  });
 }
 
-await main();
+// The cadence the scheduled container had: once at start, then every five minutes. Not awaited, so the
+// runtime's handshake is answered while a long first reading is still under way.
+const EVERY_MS = 5 * 60 * 1000;
+const tick = (): void => {
+  void main().catch((err) => console.error(`[anthropic-consumer] usage reading failed: ${err}`));
+};
+tick();
+setInterval(tick, EVERY_MS);

modules/audit-logger/Dockerfile

@@ -1,33 +0,0 @@
-# audit-logger's runtime: the shared runtime image, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The toolkit is in the base image, so
-# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
-# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
-# the siblings laid out beside it.
-
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
-# They are different images on purpose — the first carries a compiler and the second must not, or
-# every running container would carry one it never invokes. The mesh answers both with the copies it
-# holds, because a fingerprint written here would name one particular copy and no other mesh has it
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
-# nobody told stops here and says which module to build first.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the toolkit it will run against.
-WORKDIR /app/modules/audit-logger
-COPY . .
-# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
-# symlinks to a launcher that requires its library relatively — resolved away when the base image
-# was assembled.
-RUN node /app/node_modules/typescript/bin/tsc audit.ts index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/audit-logger/dist /app/modules/audit-logger/dist
-# **Served, not run.** This subscribes on import, and the serve mode binds the broker before it
-# imports anything — `run` exists for a step that works offline and exits, and would leave this
-# with nothing to subscribe to.
-ENV MESH_TOOL_MODULES=/app/modules/audit-logger/dist/index.js

modules/audit-logger/module.json

@@ -5,27 +5,21 @@
   "consumes": [
     "**"
   ],
-  "own-secrets": {
-    "broker": "${dir:state}/broker"
-  },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js"
+        ],
+        "loads": [
+          "index.js"
+        ],
+        "env": {
+          "AUDIT_LOG": "${dir:trail}/audit.log"
+        }
       }
     ]
   },
@@ -40,21 +34,6 @@
       "id": "trail",
       "type": "directory",
       "mode": "0700"
-    },
-    {
-      "id": "run",
-      "type": "container",
-      "name": "mesh-audit-logger",
-      "network": "host",
-      "volumes": [
-        "${dir:state}/broker:/run/secrets/broker:ro",
-        "${dir:trail}:/trail"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "AUDIT_LOG": "/trail/audit.log"
-      },
-      "artifact": "runtime"
     }
   ],
   "capabilities": [

modules/cloudflare-dns/Dockerfile

@@ -1,24 +0,0 @@
-# cloudflare-dns's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/cloudflare-dns
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/cloudflare-dns/dist /app/modules/cloudflare-dns/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/cloudflare-dns/dist/tools/index.js,/app/modules/cloudflare-dns/dist/provisioner/index.js

modules/cloudflare-dns/module.json

@@ -18,20 +18,13 @@
     "public-dns": "${dir:grants}/mesh.json"
   },
   "own-secrets": {
-    "token": "${dir:state}/token",
+    "token": "${dir:state}/token"
-    "broker": "${dir:mesh-state}/broker"
   },
   "emits": [
     "record.created",
     "record.removed"
   ],
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -50,48 +43,30 @@
       "merge": "json",
       "content": "{}",
       "mode": "0600"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-cloudflare-dns",
-      "network": "host",
-      "volumes": [
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${dir:grants}:/grants",
-        "${dir:state}/token:/run/secrets/token:ro",
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
-      ],
-      "env": {
-        "MESH_CLOUDFLARE_TOKEN_FILE": "/run/secrets/token",
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_CLOUDFLARE_CONFIG_FILE": "/run/config/config.json",
-        "MESH_RECEIVES": "/var/lib/cloudflare-dns/grants/mesh.json"
-      },
-      "artifact": "runtime"
     }
   ],
   "capabilities": [
     "container-runtime"
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_CLOUDFLARE_TOKEN_FILE": "${dir:state}/token",
+          "MESH_CLOUDFLARE_CONFIG_FILE": "${dir:state}/config.json",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       }
     ]
   }

modules/gitea/Dockerfile

@@ -1,37 +0,0 @@
-# gitea's runtime: the tool runtime, carrying this module's compiled provisioner, tools and event
-# consumer.
-#
-# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
-# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
-# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
-# the siblings.
-#
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
-# They are different images on purpose — the first carries a compiler and the second must not, or
-# every running container would carry one it never invokes. The mesh answers both with the copies it
-# holds, because a fingerprint written here would name one particular copy and no other mesh has it
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
-# nobody told stops here and says which module to build first.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against.
-WORKDIR /app/modules/gitea
-COPY . .
-# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
-# symlinks to a launcher that requires its library relatively — resolved away when the base image
-# was assembled.
-RUN node /app/node_modules/typescript/bin/tsc client.ts token.ts index.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# **No apt packages.** gitea's provisioner talks to the forge over HTTP (the gitea REST API), not
-# through a CLI the way postgres drives psql — so the runtime base holds everything this needs.
-COPY --from=build /app/modules/gitea/dist /app/modules/gitea/dist
-# What a tool host should load from this module: its event consumer and its tools, which are
-# separate entrypoints because they are loaded by different things. The provisioner is the third,
-# and is not listed here — the declaration names it in the container's `args`, because it is what
-# this module's own container runs. One image, because they are one module and share a client.
-ENV MESH_TOOL_MODULES=/app/modules/gitea/dist/index.js,/app/modules/gitea/dist/tools/index.js,/app/modules/gitea/dist/provisioner/index.js

modules/gitea/module.json

@@ -85,9 +85,6 @@
       "scope": "mesh"
     }
   ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "resources": [
     {
       "id": "mesh-state",
@@ -180,32 +177,6 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-gitea",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:runtime-state}:/run/state"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
-        "MESH_GITEA_CONFIG_FILE": "/run/config/config.json",
-        "MESH_GITEA_ADMIN_USER": "mesh-admin",
-        "MESH_GITEA_ADMIN_PASSWORD_FILE": "/run/secrets/admin",
-        "MESH_GITEA_STATE_DIR": "/run/state",
-        "MESH_RECEIVES": "${dir:grants}/npm.json"
-      },
-      "artifact": "runtime",
-      "restart-on": [
-        "runtime-config"
-      ]
     }
   ],
   "provides": [
@@ -219,23 +190,29 @@
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GITEA_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_GITEA_ADMIN_USER": "mesh-admin",
+          "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_GITEA_STATE_DIR": "${dir:runtime-state}",
+          "MESH_RECEIVES": "${dir:grants}/npm.json"
+        }
       }
     ]
   },

modules/grafana/Dockerfile

@@ -1,24 +0,0 @@
-# grafana's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/grafana
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/grafana/dist /app/modules/grafana/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/grafana/dist/index.js,/app/modules/grafana/dist/tools/index.js

modules/grafana/module.json

@@ -5,8 +5,7 @@
     "alert.firing"
   ],
   "own-secrets": {
-    "admin": "${dir:mesh-state}/admin",
+    "admin": "${dir:mesh-state}/admin"
-    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -112,25 +111,6 @@
       "mode": "0600",
       "content": "{\n  \"user\": \"admin\",\n  \"password\": \"${secret:admin}\"\n}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-grafana",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
-        "MESH_GRAFANA_CONFIG_FILE": "/run/config/config.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "requires": [
@@ -162,23 +142,23 @@
     "influxdb-api": "${dir:mesh-state}/influxdb-api"
   },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GRAFANA_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
       }
     ]
   }

modules/home-assistant/Dockerfile

@@ -1,27 +0,0 @@
-# home-assistant's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/home-assistant
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisions/hass.ts provisions/probe.ts provisions/connections.ts provisions/mesh.ts provisions/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/home-assistant/dist /app/modules/home-assistant/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/home-assistant/dist/index.js,/app/modules/home-assistant/dist/tools/index.js
-# NOT dist/provisions/index.js: that is a step the host runs to completion, named by the
-# `provisions` container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run
-# inside the serving sidecar too, and exit it.

modules/home-assistant/module.json

@@ -9,7 +9,6 @@
     "state.changed"
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker",
     "token": "${dir:mesh-state}/token"
   },
   "listens": [
@@ -80,55 +79,27 @@
       "merge": "json"
     },
     {
-      "id": "runtime",
+      "id": "provisions-env",
-      "type": "container",
+      "type": "file",
-      "name": "mesh-home-assistant",
+      "path": "${dir:state}/provisions.env",
-      "network": "host",
+      "mode": "0600",
-      "volumes": [
+      "content": "MESH_HOMEASSISTANT_URL=http://127.0.0.1:${port:8123}\nMESH_HOMEASSISTANT_TOKEN_FILE=${dir:mesh-state}/token\nMESH_PROVISIONS_DIR=${dir:state}\nMESH_WRITTEN_DIR=${dir:written}\n"
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/token:/run/secrets/token:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
-        "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
-        "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     },
     {
       "id": "provisions",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-home-assistant-provisions",
+      "name": "home-assistant-provisions",
-      "network": "host",
+      "artifact": "code",
-      "run-once": true,
+      "run": [
-      "volumes": [
+        "node",
-        "${dir:mesh-state}/token:/run/secrets/token:ro",
+        "provisions/index.js"
-        "${dir:written}:/var/lib/home-assistant-provisions",
-        "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
-        "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",
-        "${dir:state}/sonarr-api.json:/run/provisions/sonarr-api.json:ro",
-        "${dir:state}/sonarr-api.secret:/run/provisions/sonarr-api.secret:ro",
-        "${dir:state}/radarr-api.json:/run/provisions/radarr-api.json:ro",
-        "${dir:state}/radarr-api.secret:/run/provisions/radarr-api.secret:ro",
-        "${dir:state}/lidarr-api.json:/run/provisions/lidarr-api.json:ro",
-        "${dir:state}/lidarr-api.secret:/run/provisions/lidarr-api.secret:ro"
       ],
-      "env": {
+      "run-once": true,
-        "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
+      "env-file": [
-        "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
+        "${dir:state}/provisions.env"
-        "MESH_PROVISIONS_DIR": "/run/provisions",
-        "MESH_WRITTEN_DIR": "/var/lib/home-assistant-provisions"
-      },
-      "args": [
-        "run",
-        "/app/modules/home-assistant/dist/provisions/index.js"
       ],
       "restart-on": [
+        "provisions-env",
         "bound-mqtt-topic",
         "secret-mqtt-topic",
         "bound-sonarr-api",
@@ -137,8 +108,7 @@
         "secret-radarr-api",
         "bound-lidarr-api",
         "secret-lidarr-api"
-      ],
+      ]
-      "artifact": "runtime"
     }
   ],
   "requires": [
@@ -173,23 +143,25 @@
     "lidarr-api": "${dir:state}/lidarr-api.secret"
   },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisions/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
+          "MESH_HOMEASSISTANT_TOKEN_FILE": "${dir:mesh-state}/token",
+          "MESH_HOMEASSISTANT_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
       }
     ]
   }

modules/hosts/client.ts

@@ -1,178 +0,0 @@
-// The hosts file's own code (novox/hq ADR 0199): read /etc/hosts as the machine has it, and change the
-// operator's lines — every line outside a `# BEGIN … / # END …` block — leaving every block, the mesh's
-// and any other tool's, byte for byte. The mesh writes this module's block; these verbs never touch it.
-// Root is the module's concern (ADR 0175 §4): the runtime runs as the operator's account, so the file
-// is written through sudo without a prompt where the account is not root, as the packet filter's is.
-
-import { execFile } from "node:child_process";
-import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { isIP } from "node:net";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { promisify } from "node:util";
-
-const execFileP = promisify(execFile);
-
-/** Where the file is. The manifest's resource names the same path; a test holds the two together. */
-export const HOSTS_FILE = "/etc/hosts";
-
-/** A command runner, so the writes can be tested without a machine. */
-export type Runner = (cmd: string, args: string[]) => Promise<string>;
-
-export function escalated(cmd: string, args: string[], uid: number | undefined = process.getuid?.()): [string, string[]] {
-  if (uid === 0) return [cmd, args];
-  return ["sudo", ["-n", cmd, ...args]];
-}
-
-const run: Runner = async (cmd, args) => {
-  const [program, argv] = escalated(cmd, args);
-  const { stdout } = await execFileP(program, argv);
-  return stdout;
-};
-
-/** One line of the file, as a reader sees it. */
-export interface Line {
-  /** The line exactly as it is in the file. */
-  text: string;
-  /** Whose it is: the block's id (`mesh hosts.own`, or another tool's) or "operator". */
-  owner: string;
-  /** For an entry: its address and names. Absent for a comment or blank line. */
-  address?: string;
-  names?: string[];
-}
-
-const BEGIN = /^#\s*BEGIN\s+(.+?)\s*$/;
-const END = /^#\s*END\s+(.+?)\s*$/;
-
-/** Every line of a hosts file, each marked whose it is. */
-export function parse(text: string): Line[] {
-  const out: Line[] = [];
-  let block: string | null = null;
-  for (const raw of text.split("\n")) {
-    const begin = raw.match(BEGIN);
-    if (!block && begin) {
-      block = begin[1];
-      out.push({ text: raw, owner: block });
-      continue;
-    }
-    const owner = block ?? "operator";
-    const entry = raw.replace(/#.*/, "").trim().split(/\s+/).filter(Boolean);
-    const line: Line = { text: raw, owner };
-    if (entry.length >= 2 && isIP(entry[0])) {
-      line.address = entry[0];
-      line.names = entry.slice(1);
-    }
-    out.push(line);
-    const end = raw.match(END);
-    if (block && end && end[1] === block) block = null;
-  }
-  // A trailing newline splits into one empty last element; it is the file's ending, not a line.
-  if (out.length > 0 && out[out.length - 1].text === "" && text.endsWith("\n")) out.pop();
-  return out;
-}
-
-const NAME = /^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*\.?$/;
-
-/** Refused input says why, so a caller is one edit from right. */
-function checkAddress(address: string): void {
-  if (!isIP(address)) throw new Error(`${JSON.stringify(address)} is not an IPv4 or IPv6 address`);
-}
-function checkName(name: string): void {
-  if (!NAME.test(name)) throw new Error(`${JSON.stringify(name)} is not a host name`);
-}
-
-/** The file with one address and its names added to the operator's lines; unchanged when already there. */
-export function withAdded(text: string, address: string, names: string[]): string {
-  checkAddress(address);
-  if (names.length === 0) throw new Error("add names at least one name for the address");
-  names.forEach(checkName);
-  const lines = parse(text);
-  const have = new Set(
-    lines.filter((l) => l.owner === "operator" && l.address === address).flatMap((l) => l.names ?? []),
-  );
-  const missing = names.filter((n) => !have.has(n));
-  if (missing.length === 0) return text;
-  const body = text.endsWith("\n") || text === "" ? text : text + "\n";
-  return body + `${address}\t${missing.join(" ")}\n`;
-}
-
-/** The file with one name, or every line of one address, taken out of the operator's lines. Blocks are
- *  never touched: a name only the mesh or another tool writes is refused, naming whose it is. */
-export function withRemoved(text: string, what: string): { text: string; removed: number } {
-  const byAddress = isIP(what) !== 0;
-  if (!byAddress) checkName(what);
-  const lines = parse(text);
-  let removed = 0;
-  const kept: string[] = [];
-  for (const l of lines) {
-    if (l.owner !== "operator" || !l.address) {
-      kept.push(l.text);
-      continue;
-    }
-    if (byAddress && l.address === what) {
-      removed++;
-      continue;
-    }
-    if (!byAddress && l.names?.includes(what)) {
-      removed++;
-      const rest = l.names.filter((n) => n !== what);
-      if (rest.length > 0) kept.push(`${l.address}\t${rest.join(" ")}`);
-      continue;
-    }
-    kept.push(l.text);
-  }
-  if (removed === 0) {
-    const elsewhere = lines.find((l) => l.owner !== "operator" && (byAddress ? l.address === what : l.names?.includes(what)));
-    if (elsewhere) throw new Error(`${what} is written by ${elsewhere.owner}, not the operator; it is not this verb's to remove`);
-  }
-  return { text: kept.join("\n") + "\n", removed };
-}
-
-export class HostsFile {
-  private readonly path: string;
-  private readonly runner: Runner;
-
-  constructor(path: string = HOSTS_FILE, runner: Runner = run) {
-    this.path = path;
-    this.runner = runner;
-  }
-
-  static onThisMachine(): HostsFile {
-    return new HostsFile();
-  }
-
-  async read(): Promise<string> {
-    return readFile(this.path, "utf8");
-  }
-
-  async entries(): Promise<{ path: string; lines: Line[] }> {
-    return { path: this.path, lines: parse(await this.read()) };
-  }
-
-  async add(address: string, names: string[]): Promise<{ added: boolean; line?: string }> {
-    const before = await this.read();
-    const after = withAdded(before, address, names);
-    if (after === before) return { added: false };
-    await this.write(after);
-    return { added: true, line: after.slice(before.length).trim() };
-  }
-
-  async remove(what: string): Promise<{ removed: number }> {
-    const before = await this.read();
-    const { text, removed } = withRemoved(before, what);
-    if (removed > 0) await this.write(text);
-    return { removed };
-  }
-
-  /** Written whole through a copy beside it, so a reader never sees half a file. */
-  private async write(content: string): Promise<void> {
-    const dir = await mkdtemp(join(tmpdir(), "hosts-"));
-    const staged = join(dir, "hosts");
-    try {
-      await writeFile(staged, content, { mode: 0o644 });
-      await this.runner("install", ["-m", "0644", staged, this.path]);
-    } finally {
-      await rm(dir, { recursive: true, force: true });
-    }
-  }
-}

modules/hosts/module.json

@@ -1,41 +0,0 @@
-{
-  "module": "hosts",
-  "version": "1",
-  "claims": [
-    {
-      "name": "node-hosts-file",
-      "scope": "node",
-      "serves": [
-        "entries",
-        "add",
-        "remove"
-      ]
-    }
-  ],
-  "resources": [
-    {
-      "id": "own",
-      "type": "file",
-      "path": "/etc/hosts",
-      "mode": "0644",
-      "into": "block",
-      "at": "start",
-      "content": "# The machine's own names (module hosts, novox/hq ADR 0199). Every line outside this block is the\n# operator's: kept across every push, changed through the node-hosts-file verbs add and remove, and\n# given back when this module goes. The mesh's names are not here: the mesh's resolver answers them.\n127.0.0.1\tlocalhost\n::1\tlocalhost\n"
-    }
-  ],
-  "build": {
-    "artifacts": [
-      {
-        "name": "tools",
-        "kind": "bundle",
-        "language": "typescript",
-        "entrypoints": [
-          "tools/index.js"
-        ],
-        "loads": [
-          "tools/index.js"
-        ]
-      }
-    ]
-  }
-}

modules/hosts/package.json

@@ -1,18 +0,0 @@
-{
-  "name": "@novox/module-hosts",
-  "version": "0.1.0",
-  "description": "hosts — holds the node-hosts-file seat: writes the machine's own lines into /etc/hosts and serves the verbs entries, add and remove over the operator's lines (novox/hq ADR 0199).",
-  "type": "module",
-  "private": true,
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.1"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  },
-  "scripts": {
-    "build": "tsc client.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --rootDir . --outDir dist",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
-  }
-}

modules/hosts/test/client.test.ts

@@ -1,69 +0,0 @@
-// The hosts file's verbs over files shaped like the workstation's on 2026-10-03 (novox/hq ADR 0199):
-// distribution lines, an operator's development names, the mesh's block and another tool's.
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { HOSTS_FILE, escalated, parse, withAdded, withRemoved } from "../client.ts";
-
-const FILE =
-  "# Static table lookup for hostnames.\n" +
-  "127.0.0.1\tlocaldev.example.com\n" +
-  "127.0.0.1 a.example.com b.example.com\n" +
-  "# BEGIN mesh hosts.own\n" +
-  "127.0.0.1\tlocalhost\n" +
-  "::1\tlocalhost\n" +
-  "# END mesh hosts.own\n" +
-  "# BEGIN other-tool\n" +
-  "192.0.2.7\tproject.test\n" +
-  "# END other-tool\n";
-
-const blocks = (text: string) => parse(text).filter((l) => l.owner !== "operator").map((l) => l.text);
-
-test("every line says whose it is", () => {
-  const lines = parse(FILE);
-  assert.equal(lines.length, 10);
-  assert.deepEqual(lines[1], { text: "127.0.0.1\tlocaldev.example.com", owner: "operator", address: "127.0.0.1", names: ["localdev.example.com"] });
-  assert.equal(lines[4].owner, "mesh hosts.own");
-  assert.equal(lines[8].owner, "other-tool");
-  assert.deepEqual(lines[8].names, ["project.test"]);
-});
-
-test("add appends an operator line, and is a no-op when the names are there", () => {
-  const after = withAdded(FILE, "192.0.2.9", ["lab.test", "www.lab.test"]);
-  assert.ok(after.endsWith("192.0.2.9\tlab.test www.lab.test\n"));
-  assert.deepEqual(blocks(after), blocks(FILE));
-  assert.equal(withAdded(FILE, "127.0.0.1", ["a.example.com"]), FILE);
-  assert.ok(withAdded(FILE, "127.0.0.1", ["a.example.com", "c.example.com"]).endsWith("127.0.0.1\tc.example.com\n"));
-});
-
-test("add refuses what is not an address or a host name", () => {
-  assert.throws(() => withAdded(FILE, "not-an-ip", ["x.test"]), /not an IPv4 or IPv6 address/);
-  assert.throws(() => withAdded(FILE, "192.0.2.9", ["bad name\n10.0.0.1 evil"]), /not a host name/);
-  assert.throws(() => withAdded(FILE, "192.0.2.9", []), /at least one name/);
-});
-
-test("remove takes one name or one address from the operator's lines, and blocks stay byte for byte", () => {
-  const one = withRemoved(FILE, "a.example.com");
-  assert.equal(one.removed, 1);
-  assert.ok(one.text.includes("127.0.0.1\tb.example.com\n"));
-  assert.ok(!one.text.includes("a.example.com"));
-  assert.deepEqual(blocks(one.text), blocks(FILE));
-  const all = withRemoved(FILE, "127.0.0.1");
-  assert.equal(all.removed, 2);
-  assert.ok(all.text.includes("# BEGIN mesh hosts.own\n127.0.0.1\tlocalhost\n"), "the mesh's own localhost is not the operator's to remove");
-});
-
-test("remove refuses a name only a block writes, naming whose", () => {
-  assert.throws(() => withRemoved(FILE, "project.test"), /written by other-tool/);
-  assert.equal(withRemoved(FILE, "nowhere.test").removed, 0);
-});
-
-test("the file is written as root through sudo where the account is not root", () => {
-  assert.deepEqual(escalated("install", ["x"], 1000), ["sudo", ["-n", "install", "x"]]);
-  assert.deepEqual(escalated("install", ["x"], 0), ["install", ["x"]]);
-});
-
-test("the path the code writes is the path the manifest's resource declares", () => {
-  const manifest = JSON.parse(readFileSync(new URL("../module.json", import.meta.url), "utf8"));
-  assert.equal(manifest.resources.find((r: { id: string }) => r.id === "own").path, HOSTS_FILE);
-});

modules/hosts/tools/index.ts

@@ -1,40 +0,0 @@
-// The hosts file's tools: the node-hosts-file seat's three verbs (novox/hq ADR 0199) — the file's lines
-// with whose each is, add an operator's line, remove one. They change the machine's file and nothing
-// else; the controller holds none of it.
-
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { HostsFile } from "../client.js";
-
-export function getSeatVerbs(hosts: HostsFile): ToolDefinition[] {
-  return [
-    {
-      name: "entries",
-      description:
-        "Every line of this machine's /etc/hosts, each marked whose it is: the operator's, or the block of the module or tool that writes it.",
-      input: {},
-      run: async () => hosts.entries(),
-    },
-    {
-      name: "add",
-      description:
-        "Add one address and its names to the operator's lines of this machine's /etc/hosts — a name for this machine's own programs, not the mesh's. Nothing changes when they are already there.",
-      input: {
-        address: { type: "string", description: "the IPv4 or IPv6 address" },
-        names: { type: "string", description: "the names for it, separated by spaces" },
-      },
-      run: async (args) =>
-        hosts.add(String(args.address ?? ""), String(args.names ?? "").split(/[\s,]+/).filter(Boolean)),
-    },
-    {
-      name: "remove",
-      description:
-        "Remove one name, or every line of one address, from the operator's lines of this machine's /etc/hosts. A line a module writes is refused, naming the module.",
-      input: { name: { type: "string", description: "a host name, or an address to remove every line of" } },
-      run: async (args) => hosts.remove(String(args.name ?? "")),
-    },
-  ];
-}
-
-const hosts = HostsFile.onThisMachine();
-// The seat's verbs under the seat's name: the runtime serves them as <node>/node-hosts-file.<verb>.
-registerModuleTools("node-hosts-file", () => getSeatVerbs(hosts));

modules/icecast/Dockerfile

@@ -1,24 +0,0 @@
-# icecast's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/icecast
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/icecast/dist /app/modules/icecast/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/icecast/dist/index.js,/app/modules/icecast/dist/tools/index.js

modules/icecast/module.json

@@ -28,9 +28,6 @@
     "stream.started",
     "stream.stopped"
   ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "listens": [
     {
       "name": "stream",
@@ -95,45 +92,26 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-icecast",
-      "network": "icecast",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_ICECAST_URL": "http://icecast:8000",
-        "MESH_ICECAST_CONFIG_FILE": "/run/config/config.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_ICECAST_URL": "http://127.0.0.1:${port:8000}",
+          "MESH_ICECAST_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
       }
     ]
   }

modules/influxdb/Dockerfile

@@ -1,24 +0,0 @@
-# influxdb's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/influxdb
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts grants.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/influxdb/dist /app/modules/influxdb/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/influxdb/dist/tools/index.js,/app/modules/influxdb/dist/provisioner/index.js

modules/influxdb/module.json

@@ -11,7 +11,6 @@
     "container-runtime"
   ],
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker",
     "admin": "${dir:state}/admin.secret",
     "admin-token": "${dir:state}/admin-token.secret"
   },
@@ -100,29 +99,6 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-influxdb",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro",
-        "${dir:grants}:${dir:grants}:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
-        "MESH_INFLUXDB_CONFIG_FILE": "/run/config/config.json",
-        "MESH_INFLUXDB_TOKEN_FILE": "/run/secrets/admin-token",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "requires": [
@@ -135,23 +111,25 @@
     }
   },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
+          "MESH_INFLUXDB_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_INFLUXDB_TOKEN_FILE": "${dir:state}/admin-token.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       }
     ]
   }

modules/keycloak/Dockerfile

@@ -1,30 +0,0 @@
-# keycloak's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/keycloak
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts oidc.ts index.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/keycloak/dist /app/modules/keycloak/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/keycloak/dist/index.js,/app/modules/keycloak/dist/tools/index.js,/app/modules/keycloak/dist/provisioner/index.js

modules/keycloak/module.json

@@ -62,8 +62,7 @@
     "oidc-client": "${dir:grants}"
   },
   "own-secrets": {
-    "admin": "${dir:state}/admin.secret",
+    "admin": "${dir:state}/admin.secret"
-    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
     {
@@ -144,49 +143,30 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-keycloak",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "${dir:grants}:${dir:grants}:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
-        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json",
-        "MESH_KEYCLOAK_PASSWORD_FILE": "/run/secrets/admin",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
+          "MESH_KEYCLOAK_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_KEYCLOAK_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       }
     ]
   }

modules/lab/Dockerfile

@@ -1,31 +0,0 @@
-# lab's runtime: the tool runtime, carrying this module's code, and the toolchain the lab's suite
-# builds the mesh with (novox/hq ADR 0172). It reaches the machine's virtualisation and container
-# runtime through their sockets, so what it raises is what a hand run on this machine raises.
-#
-# Every download is pinned by its checksum: an image that builds the mesh is the last place to take
-# whatever an upstream serves today.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/lab
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc tools/index.ts tools/runs.ts --rootDir . \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-RUN apt-get update \
- && apt-get install -y --no-install-recommends git make ca-certificates curl python3 file iproute2 sudo \
- && rm -rf /var/lib/apt/lists/*
-RUN curl -fsSL -o /tmp/go.tgz https://go.dev/dl/go1.26.8.linux-amd64.tar.gz \
- && echo "d0f743b33e8d8945e6b1f432edd15785c70507121d6e2a723b21285eddf8b57b  /tmp/go.tgz" | sha256sum -c - \
- && tar -C /usr/local -xzf /tmp/go.tgz && rm /tmp/go.tgz
-RUN curl -fsSL -o /usr/local/bin/incus https://github.com/lxc/incus/releases/download/v7.5.1/bin.linux.incus.x86_64 \
- && echo "7bd6223b369f4d693fcde695bd8549a73b5b3d403735329212483702aa22c179  /usr/local/bin/incus" | sha256sum -c - \
- && chmod 0755 /usr/local/bin/incus
-RUN curl -fsSL -o /tmp/docker.tgz https://download.docker.com/linux/static/stable/x86_64/docker-28.5.2.tgz \
- && echo "ea90cfd12e1eeb12aa1c971741adb8bd4ed88e2a574eaac13f5029a1dbc6300d  /tmp/docker.tgz" | sha256sum -c - \
- && tar -C /tmp -xzf /tmp/docker.tgz docker/docker && mv /tmp/docker/docker /usr/local/bin/docker && rm -rf /tmp/docker /tmp/docker.tgz
-ENV PATH=/usr/local/go/bin:$PATH
-COPY --from=build /app/modules/lab/dist /app/modules/lab/dist
-ENV MESH_TOOL_MODULES=/app/modules/lab/dist/tools/index.js

modules/lab/module.json

@@ -5,16 +5,7 @@
     "container-runtime",
     "virtualisation"
   ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -35,47 +26,67 @@
       "content": "MESH_LAB_FORGE=${setting:forge}\n"
     },
     {
-      "id": "runtime",
+      "id": "git",
-      "type": "container",
+      "type": "package",
-      "name": "mesh-lab",
+      "package": "git"
-      "network": "host",
+    },
-      "env-file": [
+    {
-        "${dir:state}/lab.env"
+      "id": "make",
-      ],
+      "type": "package",
-      "volumes": [
+      "package": "make"
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+    },
-        "${dir:work}:${dir:work}",
+    {
-        "/var/run/docker.sock:/var/run/docker.sock",
+      "id": "python",
-        "/var/lib/incus/unix.socket:/var/lib/incus/unix.socket"
+      "type": "package",
-      ],
+      "package": "python"
-      "env": {
+    },
-        "MESH_BROKER_FILE": "/run/secrets/broker",
+    {
-        "MESH_LAB_WORK": "${dir:work}"
+      "id": "file",
-      },
+      "type": "package",
-      "restart-on": [
+      "package": "file"
-        "runtime-env"
+    },
-      ],
+    {
-      "artifact": "runtime"
+      "id": "iproute2",
+      "type": "package",
+      "package": "iproute2"
+    },
+    {
+      "id": "sudo",
+      "type": "package",
+      "package": "sudo"
+    },
+    {
+      "id": "npm",
+      "type": "package",
+      "package": "npm"
+    },
+    {
+      "id": "go",
+      "type": "package",
+      "package": "go"
+    },
+    {
+      "id": "incus",
+      "type": "package",
+      "package": "incus"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_LAB_WORK": "${dir:work}",
+          "MESH_LAB_ENV_FILE": "${dir:state}/lab.env"
+        }
       }
     ]
   }

modules/lab/tools/index.ts

@@ -2,18 +2,23 @@
 // lab is assigned to, and only there: a bed raises virtual machines on that machine's virtualisation.
 
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
 import { listRuns, readStatus, REPOSITORIES, running, start, stop, tail } from "./runs.js";
 
 export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
   const work = env.MESH_LAB_WORK ?? "/var/lib/mesh-lab-runs";
-  const forge = (env.MESH_LAB_FORGE ?? "").replace(/\/+$/, "");
+  // The forge is an operator's setting, which reaches a file and never a bundle's words (novox/hq
+  // ADR 0192): read from the env-file the mesh fills, at each call, so a changed setting is used
+  // without restarting the runtime. MESH_LAB_FORGE itself still wins, for a hand-run instance.
+  const forgeOf = (): string => (env.MESH_LAB_FORGE ?? wordIn(env.MESH_LAB_ENV_FILE, "MESH_LAB_FORGE")).replace(/\/+$/, "");
   return [
     {
       name: "lab_check",
       description: "Whether this machine can run the lab's beds: the lab's own check, against the forge's main branch.",
       input: {},
       run: async () => {
+        const forge = forgeOf();
         if (!forge) return { ok: false, output: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
         const dir = `${work}/check`;
         spawnSync("rm", ["-rf", dir]);
@@ -38,6 +43,7 @@ export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
         },
       },
       run: async (args) => {
+        const forge = forgeOf();
         if (!forge) return { started: false, reason: "the lab's forge is not set: settings for lab, {\"forge\": \"<url>\"}" };
         const tests = String(args.tests ?? "").split(",").map((s) => s.trim()).filter(Boolean);
         if (tests.length === 0) return { started: false, reason: "name at least one bed test file" };
@@ -83,4 +89,20 @@ export function getLabTools(env: NodeJS.ProcessEnv): ToolDefinition[] {
   ];
 }
 
+/** One word from an env-file (`KEY=value` lines), or "" when the file or the word is absent. */
+export function wordIn(file: string | undefined, word: string): string {
+  if (!file) return "";
+  let text: string;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch {
+    return "";
+  }
+  for (const line of text.split("\n")) {
+    const at = line.indexOf("=");
+    if (at > 0 && line.slice(0, at).trim() === word) return line.slice(at + 1).trim();
+  }
+  return "";
+}
+
 registerModuleTools("lab", (env) => getLabTools(env));

modules/mailu/Dockerfile

@@ -1,30 +0,0 @@
-# mailu's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/mailu
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/mailu/dist /app/modules/mailu/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/mailu/dist/index.js,/app/modules/mailu/dist/tools/index.js,/app/modules/mailu/dist/provisioner/index.js

modules/mailu/module.json

@@ -135,11 +135,15 @@
       "protocol": "tcp",
       "from": "mesh",
       "why": "automx: mail client autoconfiguration; the autoconfig, autodiscover and automx names are route grants reaching it here"
+    },
+    {
+      "name": "admin-api",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "machine",
+      "why": "the admin API, which this module's own code reaches on loopback from the node's runtime now that it runs outside the mailu network"
     }
   ],
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "resources": [
     {
       "id": "mesh-state",
@@ -305,6 +309,9 @@
       "name": "mailu-admin",
       "image": "ghcr.io/mailu/admin@sha256:6dbfdadc4a9590dcb7652357b505200115b689b74008653bbf369e4599a3be5a",
       "network": "mailu",
+      "ports": [
+        "8080"
+      ],
       "env-file": [
         "${dir:state}/mailu.env",
         "${dir:state}/secret.env",
@@ -473,31 +480,6 @@
       "content": "{}\n",
       "merge": "json"
     },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-mailu",
-      "network": "mailu",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:state}/api-token.secret:/run/secrets/api-token:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_MAILU_URL": "http://mailu-admin:8080/api/v1",
-        "MESH_MAILU_API_KEY_FILE": "/run/secrets/api-token",
-        "MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
-        "MESH_MAILU_CONFIG_FILE": "/run/config/config.json",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
-    },
     {
       "id": "automx",
       "type": "container",
@@ -517,16 +499,6 @@
   ],
   "build": {
     "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      },
       {
         "arg": "PYTHON_BASE",
         "image": "python@sha256:25f3cfeaceca14921366af4d1240b56457ef46273bdb508c7b0e8f469f6fd228"
@@ -534,9 +506,26 @@
     ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_MAILU_URL": "http://127.0.0.1:${port:8080}/api/v1",
+          "MESH_MAILU_API_KEY_FILE": "${dir:state}/api-token.secret",
+          "MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
+          "MESH_MAILU_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       },
       {
         "name": "automx",

modules/mesh-vault/Dockerfile

@@ -1,22 +0,0 @@
-# mesh-vault's runtime: the tool runtime, carrying this module's compiled provisioner, tools and event
-# consumer. The same shape as postgres's, minus the client the database needs: mesh-vault reaches no
-# server, because what it provides is a value the mesh already delivered to its node.
-#
-# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
-# nothing is copied out of a neighbouring checkout (novox/hq ADR 0069). Two bases, named rather than
-# pinned — the image this is COMPILED in and the image it RUNS in — answered by the mesh from
-# `build.on` in module.json (novox/hq issue 044).
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/vault
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/vault/dist /app/modules/vault/dist
-# The entrypoints a tool host loads from this module: its event consumer, its tools and its
-# provisioner — one image, one process, one broker account (novox/hq ADR 0052).
-ENV MESH_TOOL_MODULES=/app/modules/vault/dist/index.js,/app/modules/vault/dist/tools/index.js,/app/modules/vault/dist/provisioner/index.js

modules/mesh-vault/module.json

@@ -27,16 +27,7 @@
     "secret": "${dir:grants}"
   },
   "keeps": "/var/lib/mesh-vault/root",
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -57,45 +48,29 @@
       "id": "root",
       "type": "directory",
       "mode": "0700"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-vault",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:ledger}:${dir:ledger}",
-        "${dir:root}:${dir:root}:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json",
-        "MESH_VAULT_LEDGER": "${dir:ledger}",
-        "MESH_VAULT_ROOT": "${dir:root}"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_VAULT_LEDGER": "${dir:ledger}",
+          "MESH_VAULT_ROOT": "${dir:root}"
+        }
       }
     ]
   },

modules/minio/Dockerfile

@@ -1,40 +0,0 @@
-# minio's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-ARG MC_CLI
-
-# Named so the final stage's COPY --from can reference a stage, not an ARG — the legacy builder
-# this host still runs doesn't expand ARGs inside COPY --from, only inside FROM.
-FROM ${MC_CLI} AS mccli
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/minio
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/minio/dist /app/modules/minio/dist
-# The provisioner shells out to mc to actually create buckets and service accounts on the running
-# minio server — mc itself was never in this runtime image, only in minio's own. Silently retried
-# "spawn mc ENOENT" forever: a requirement was granted at the control-plane level without ever
-# materializing the credential on minio. /usr/bin/mc there is a symlink to the real binary, mcli —
-# both copied so the symlink resolves.
-COPY --from=mccli /usr/bin/mcli /usr/bin/mcli
-COPY --from=mccli /usr/bin/mc /usr/bin/mc
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/minio/dist/tools/index.js,/app/modules/minio/dist/provisioner/index.js

modules/minio/module.json

@@ -59,16 +59,9 @@
     "s3-bucket": "${dir:grants}"
   },
   "own-secrets": {
-    "root": "${dir:state}/root.secret",
+    "root": "${dir:state}/root.secret"
-    "broker": "${dir:mesh-state}/broker"
   },
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -127,48 +120,34 @@
       }
     },
     {
-      "id": "runtime",
+      "id": "client",
-      "type": "container",
+      "type": "package",
-      "name": "mesh-minio",
+      "package": "minio-client"
-      "network": "minio-net",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:state}/root.secret:/run/secrets/root:ro"
-      ],
-      "env": {
-        "MESH_MINIO_ENDPOINT": "http://minio:9000",
-        "MESH_MINIO_ROOT_USER": "meshroot",
-        "MESH_MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
-        "MESH_MINIO_REGION": "eu-west",
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      },
-      {
-        "arg": "MC_CLI",
-        "image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_MINIO_ENDPOINT": "http://127.0.0.1:${port:9000}",
+          "MESH_MINIO_ROOT_USER": "meshroot",
+          "MESH_MINIO_ROOT_PASSWORD_FILE": "${dir:state}/root.secret",
+          "MESH_MINIO_REGION": "eu-west",
+          "MESH_MINIO_MC_BIN": "mcli",
+          "MESH_MINIO_MC_CONFIG": "${dir:state}/mc",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
       }
     ]
   }

modules/mosquitto/Dockerfile

@@ -1,28 +0,0 @@
-# mosquitto's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/mosquitto
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc topics.ts client.ts index.ts tools/index.ts provisioner/index.ts bootstrap/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# mosquitto's client and bootstrap drive `mosquitto_ctrl`; the apt package carries it with its
-# shared libraries — the musl binary from the eclipse image would not load on this glibc base.
-RUN apt-get update && apt-get install -y --no-install-recommends mosquitto \
- && rm -rf /var/lib/apt/lists/*
-COPY --from=build /app/modules/mosquitto/dist /app/modules/mosquitto/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/mosquitto/dist/index.js,/app/modules/mosquitto/dist/tools/index.js,/app/modules/mosquitto/dist/provisioner/index.js

modules/mosquitto/module.json

@@ -32,8 +32,7 @@
     "mqtt-topic": "${dir:grants}"
   },
   "own-secrets": {
-    "admin": "${dir:mesh-state}/admin",
+    "admin": "${dir:mesh-state}/admin"
-    "broker": "${dir:mesh-state}/broker"
   },
   "listens": [
     {
@@ -88,26 +87,29 @@
       "type": "network",
       "name": "mosquitto"
     },
+    {
+      "id": "bootstrap-env",
+      "type": "file",
+      "path": "${dir:state}/bootstrap.env",
+      "mode": "0600",
+      "content": "MESH_PROVISION_MQTT=127.0.0.1:${port:1883}\nMESH_PROVISION_ADMIN_USER=mesh-admin\nMESH_PROVISION_PASSWORD_FILE=${dir:mesh-state}/admin\nMESH_DYNSEC_FILE=${dir:data}/dynamic-security.json\n"
+    },
     {
       "id": "bootstrap",
-      "type": "container",
+      "type": "process",
       "name": "mosquitto-bootstrap",
+      "artifact": "code",
+      "run": [
+        "node",
+        "bootstrap/index.js"
+      ],
       "run-once": true,
-      "volumes": [
+      "env-file": [
-        "${dir:data}:/mosquitto/data",
+        "${dir:state}/bootstrap.env"
-        "${dir:mesh-state}/admin:/run/secrets/admin:ro"
       ],
-      "env": {
+      "restart-on": [
-        "MESH_PROVISION_MQTT": "mosquitto:1883",
+        "bootstrap-env"
-        "MESH_PROVISION_ADMIN_USER": "mesh-admin",
+      ]
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin",
-        "MESH_DYNSEC_FILE": "/mosquitto/data/dynamic-security.json"
-      },
-      "args": [
-        "run",
-        "/app/modules/mosquitto/dist/bootstrap/index.js"
-      ],
-      "artifact": "runtime"
     },
     {
       "id": "server",
@@ -125,43 +127,34 @@
       ]
     },
     {
-      "id": "runtime",
+      "id": "client",
-      "type": "container",
+      "type": "package",
-      "name": "mesh-mosquitto",
+      "package": "mosquitto"
-      "network": "mosquitto",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:mesh-state}/admin:/run/secrets/admin:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json",
-        "MESH_PROVISION_MQTT": "mosquitto:1883",
-        "MESH_PROVISION_ADMIN_USER": "mesh-admin",
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js",
+          "bootstrap/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_PROVISION_MQTT": "127.0.0.1:${port:1883}",
+          "MESH_PROVISION_ADMIN_USER": "mesh-admin",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:mesh-state}/admin"
+        }
       }
     ]
   }

modules/netcheck/cmd/netcheck/checks.go

@@ -0,0 +1,173 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"net"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Bounds on what a caller may ask: a check is a probe, never a wait anyone can make long.
+const (
+	DefaultTimeout = 3 * time.Second
+	MostTimeout    = 30 * time.Second
+)
+
+// TCPResult is what netcheck_tcp answers.
+type TCPResult struct {
+	Host      string `json:"host"`
+	Port      int    `json:"port"`
+	Address   string `json:"address,omitempty"`
+	Reachable bool   `json:"reachable"`
+	ElapsedMS int64  `json:"elapsed_ms"`
+	Error     string `json:"error,omitempty"`
+}
+
+// CheckTCP opens one TCP connection and closes it, sending nothing. A port that refuses or a host
+// that does not answer is a result, not a failure of the tool; only a malformed question is.
+func CheckTCP(host string, port int, timeout time.Duration) (TCPResult, error) {
+	if port < 1 || port > 65535 {
+		return TCPResult{}, fmt.Errorf("port %d is not a TCP port (1-65535)", port)
+	}
+	out := TCPResult{Host: host, Port: port}
+	start := time.Now()
+	conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, strconv.Itoa(port)), timeout)
+	out.ElapsedMS = time.Since(start).Milliseconds()
+	if err != nil {
+		out.Error = err.Error()
+		return out, nil
+	}
+	out.Address = conn.RemoteAddr().String()
+	out.Reachable = true
+	_ = conn.Close()
+	return out, nil
+}
+
+// DNSResult is what netcheck_dns answers.
+type DNSResult struct {
+	Name      string   `json:"name"`
+	Type      string   `json:"type"`
+	Answers   []string `json:"answers"`
+	ElapsedMS int64    `json:"elapsed_ms"`
+	Error     string   `json:"error,omitempty"`
+}
+
+// DNSTypes are the record types netcheck_dns looks up.
+var DNSTypes = []string{"A", "AAAA", "CNAME", "TXT", "MX"}
+
+// CheckDNS looks a name up with the machine's resolver. Built without cgo, Go's own resolver reads
+// the machine's /etc/resolv.conf and /etc/hosts, which is the resolver this machine's programs use.
+// A name that does not resolve is a result with its error; an unknown type is refused.
+func CheckDNS(name, kind string, timeout time.Duration) (DNSResult, error) {
+	kind = strings.ToUpper(strings.TrimSpace(kind))
+	if kind == "" {
+		kind = "A"
+	}
+	known := false
+	for _, t := range DNSTypes {
+		known = known || t == kind
+	}
+	if !known {
+		return DNSResult{}, fmt.Errorf("type %q is not one netcheck_dns looks up (%s)", kind, strings.Join(DNSTypes, ", "))
+	}
+	out := DNSResult{Name: name, Type: kind, Answers: []string{}}
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	r := net.DefaultResolver
+	start := time.Now()
+	var err error
+	switch kind {
+	case "A", "AAAA":
+		network := "ip4"
+		if kind == "AAAA" {
+			network = "ip6"
+		}
+		var ips []net.IP
+		if ips, err = r.LookupIP(ctx, network, name); err == nil {
+			for _, ip := range ips {
+				out.Answers = append(out.Answers, ip.String())
+			}
+		}
+	case "CNAME":
+		var cname string
+		if cname, err = r.LookupCNAME(ctx, name); err == nil {
+			out.Answers = append(out.Answers, cname)
+		}
+	case "TXT":
+		var txts []string
+		if txts, err = r.LookupTXT(ctx, name); err == nil {
+			out.Answers = append(out.Answers, txts...)
+		}
+	case "MX":
+		var mxs []*net.MX
+		if mxs, err = r.LookupMX(ctx, name); err == nil {
+			for _, mx := range mxs {
+				out.Answers = append(out.Answers, fmt.Sprintf("%d %s", mx.Pref, mx.Host))
+			}
+		}
+	}
+	out.ElapsedMS = time.Since(start).Milliseconds()
+	if err != nil {
+		out.Error = err.Error()
+	}
+	if kind != "MX" {
+		sort.Strings(out.Answers)
+	}
+	return out, nil
+}
+
+// text is a required string argument.
+func text(args map[string]any, key string) (string, error) {
+	s, _ := args[key].(string)
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return "", fmt.Errorf("%s is required", key)
+	}
+	return s, nil
+}
+
+// whole is an integer argument, given as a JSON number or a numeric string; fallback when absent.
+func whole(args map[string]any, key string, fallback int) (int, error) {
+	v, given := args[key]
+	if !given || v == nil {
+		if fallback == 0 {
+			return 0, fmt.Errorf("%s is required", key)
+		}
+		return fallback, nil
+	}
+	switch n := v.(type) {
+	case float64:
+		if n != math.Trunc(n) {
+			return 0, fmt.Errorf("%s must be a whole number, not %v", key, n)
+		}
+		return int(n), nil
+	case string:
+		i, err := strconv.Atoi(strings.TrimSpace(n))
+		if err != nil {
+			return 0, fmt.Errorf("%s must be a whole number, not %q", key, n)
+		}
+		return i, nil
+	}
+	return 0, errors.New(key + " must be a whole number")
+}
+
+// timeoutOf is timeout_ms, defaulted and bounded.
+func timeoutOf(args map[string]any) (time.Duration, error) {
+	ms, err := whole(args, "timeout_ms", int(DefaultTimeout/time.Millisecond))
+	if err != nil {
+		return 0, err
+	}
+	if ms < 1 {
+		return 0, fmt.Errorf("timeout_ms must be at least 1, not %d", ms)
+	}
+	d := time.Duration(ms) * time.Millisecond
+	if d > MostTimeout {
+		d = MostTimeout
+	}
+	return d, nil
+}

modules/netcheck/cmd/netcheck/checks_test.go

@@ -0,0 +1,68 @@
+package main
+
+import (
+	"net"
+	"testing"
+	"time"
+)
+
+func TestATCPPortThatListensIsReachableAndOneThatDoesNotIsNot(t *testing.T) {
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	port := l.Addr().(*net.TCPAddr).Port
+	got, err := CheckTCP("127.0.0.1", port, time.Second)
+	if err != nil || !got.Reachable || got.Error != "" {
+		t.Fatalf("a listening port: %+v, %v", got, err)
+	}
+	l.Close()
+	got, err = CheckTCP("127.0.0.1", port, time.Second)
+	if err != nil || got.Reachable || got.Error == "" {
+		t.Fatalf("a closed port is reported as a result with its error, not a failure: %+v, %v", got, err)
+	}
+}
+
+func TestAPortOutsideTheRangeIsRefused(t *testing.T) {
+	for _, p := range []int{0, -1, 65536} {
+		if _, err := CheckTCP("127.0.0.1", p, time.Second); err == nil {
+			t.Errorf("port %d was accepted", p)
+		}
+	}
+}
+
+func TestDNSAnswersFromTheMachinesResolverAndRefusesAnUnknownType(t *testing.T) {
+	got, err := CheckDNS("localhost", "a", time.Second)
+	if err != nil || got.Type != "A" || len(got.Answers) == 0 {
+		t.Fatalf("localhost A: %+v, %v", got, err)
+	}
+	if _, err := CheckDNS("localhost", "SRV", time.Second); err == nil {
+		t.Fatal("an unknown record type was accepted")
+	}
+	got, err = CheckDNS("no-such-name.invalid", "A", time.Second)
+	if err != nil || got.Error == "" || len(got.Answers) != 0 {
+		t.Fatalf("a name that does not resolve is a result with its error: %+v, %v", got, err)
+	}
+}
+
+func TestTimeoutIsDefaultedAndBounded(t *testing.T) {
+	if d, _ := timeoutOf(map[string]any{}); d != DefaultTimeout {
+		t.Errorf("default: %v", d)
+	}
+	if d, _ := timeoutOf(map[string]any{"timeout_ms": float64(10 * 60 * 1000)}); d != MostTimeout {
+		t.Errorf("bounded: %v", d)
+	}
+	if _, err := timeoutOf(map[string]any{"timeout_ms": float64(0)}); err == nil {
+		t.Error("a zero timeout was accepted")
+	}
+}
+
+func TestBothToolsAreListedUnprefixed(t *testing.T) {
+	names := map[string]bool{}
+	for _, tool := range tools() {
+		names[tool.Name] = true
+	}
+	if !names["netcheck_tcp"] || !names["netcheck_dns"] || len(names) != 2 {
+		t.Fatalf("tools: %v", names)
+	}
+}

modules/netcheck/cmd/netcheck/main.go

@@ -0,0 +1,72 @@
+// netcheck's Go tools bundle (novox/hq ADR 0188, ADR 0193): a process the node's runtime launches
+// and speaks MCP over stdio to, through the Go SDK. It serves the two checks that are the machine's
+// own sockets and resolver — a TCP connect and a DNS lookup — and nothing that changes anything.
+// The module's HTTP check is its TypeScript bundle; the runtime serves both under one module.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+)
+
+func main() {
+	// An empty name serves as the module the runtime names (MESH_SERVED_MODULE): netcheck.
+	if err := stdio.Serve("", tools()); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func tools() []stdio.Tool {
+	return []stdio.Tool{
+		{
+			Name: "netcheck_tcp",
+			Description: "Check whether a TCP port is reachable from this machine: opens one connection " +
+				"and closes it at once, sending nothing. Answers reachable, elapsed_ms and the error when not.",
+			Input: map[string]any{
+				"host":       map[string]any{"type": "string", "description": "host name or IP address"},
+				"port":       map[string]any{"type": "integer", "description": "TCP port, 1-65535"},
+				"timeout_ms": map[string]any{"type": "integer", "description": "give up after this long (default 3000, at most 30000)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				host, err := text(args, "host")
+				if err != nil {
+					return nil, err
+				}
+				port, err := whole(args, "port", 0)
+				if err != nil {
+					return nil, err
+				}
+				timeout, err := timeoutOf(args)
+				if err != nil {
+					return nil, err
+				}
+				return CheckTCP(host, port, timeout)
+			},
+		},
+		{
+			Name: "netcheck_dns",
+			Description: "Look a name up with this machine's resolver (its /etc/resolv.conf and /etc/hosts). " +
+				"type is A, AAAA, CNAME, TXT or MX; answers the records found, or the error.",
+			Input: map[string]any{
+				"name":       map[string]any{"type": "string", "description": "the name to look up"},
+				"type":       map[string]any{"type": "string", "enum": []string{"A", "AAAA", "CNAME", "TXT", "MX"}, "description": "record type (default A)"},
+				"timeout_ms": map[string]any{"type": "integer", "description": "give up after this long (default 3000, at most 30000)"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				name, err := text(args, "name")
+				if err != nil {
+					return nil, err
+				}
+				kind, _ := args["type"].(string)
+				timeout, err := timeoutOf(args)
+				if err != nil {
+					return nil, err
+				}
+				return CheckDNS(name, kind, timeout)
+			},
+		},
+	}
+}

modules/netcheck/go.mod

@@ -0,0 +1,5 @@
+module netcheck
+
+go 1.22
+
+require git.novox.be/novox/mesh-sdk/go v0.1.6

modules/netcheck/go.sum

@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.6 h1:9qzdYONYbJdWcu6sxQcq9v1LI0JxcfkiKYkMUzJSkVQ=
+git.novox.be/novox/mesh-sdk/go v0.1.6/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=

modules/netcheck/http.ts

@@ -0,0 +1,84 @@
+// netcheck's HTTP check — the module's own code, in TypeScript (novox/hq ADR 0039, ADR 0188). One
+// request, HEAD or GET, never a body sent and never a body read: the status, how long it took and
+// a few headers that say what answered. Redirects are reported, not followed, so a check reaches
+// exactly the address it was given.
+
+export const METHODS = ["HEAD", "GET"] as const;
+export type Method = (typeof METHODS)[number];
+
+/** The headers worth reporting: what answered and what it says it is, nothing it set for a client. */
+export const REPORTED_HEADERS = [
+  "content-type", "content-length", "server", "location", "date",
+  "cache-control", "last-modified", "etag",
+] as const;
+
+export const DEFAULT_TIMEOUT_MS = 5000;
+export const MOST_TIMEOUT_MS = 30000;
+
+export interface HttpResult {
+  url: string;
+  method: Method;
+  status?: number;
+  statusText?: string;
+  elapsed_ms: number;
+  headers: Record<string, string>;
+  error?: string;
+}
+
+/** Only http and https are checked; anything else — file:, data:, ftp: — is refused by name. */
+export function checkedUrl(raw: unknown): URL {
+  const text = typeof raw === "string" ? raw.trim() : "";
+  if (!text) throw new Error("url is required");
+  let url: URL;
+  try {
+    url = new URL(text);
+  } catch {
+    throw new Error(`${JSON.stringify(text)} is not a URL`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(`netcheck_http checks http and https URLs only, not ${url.protocol}`);
+  }
+  return url;
+}
+
+export function checkedMethod(raw: unknown): Method {
+  const m = (typeof raw === "string" && raw.trim() ? raw.trim() : "HEAD").toUpperCase();
+  if (!(METHODS as readonly string[]).includes(m)) {
+    throw new Error(`method ${m} is not one netcheck_http uses (${METHODS.join(", ")}): a check never changes anything`);
+  }
+  return m as Method;
+}
+
+export function checkedTimeout(raw: unknown): number {
+  if (raw === undefined || raw === null || raw === "") return DEFAULT_TIMEOUT_MS;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1) throw new Error(`timeout_ms must be a whole number of at least 1, not ${String(raw)}`);
+  return Math.min(n, MOST_TIMEOUT_MS);
+}
+
+/** Make one request and report how it went. A refused connection or a timeout is a result with its
+ *  error; only a malformed question throws. */
+export async function checkHttp(args: Readonly<Record<string, unknown>>, fetcher: typeof fetch = fetch): Promise<HttpResult> {
+  const url = checkedUrl(args.url);
+  const method = checkedMethod(args.method);
+  const timeout = checkedTimeout(args.timeout_ms);
+  const started = performance.now();
+  const out: HttpResult = { url: url.toString(), method, elapsed_ms: 0, headers: {} };
+  try {
+    const res = await fetcher(url, { method, redirect: "manual", signal: AbortSignal.timeout(timeout) });
+    out.elapsed_ms = Math.round(performance.now() - started);
+    out.status = res.status;
+    out.statusText = res.statusText;
+    for (const h of REPORTED_HEADERS) {
+      const v = res.headers.get(h);
+      if (v !== null) out.headers[h] = v;
+    }
+    // The body is not read: a check asks whether something answers, not what it says.
+    await res.body?.cancel().catch(() => {});
+  } catch (err) {
+    out.elapsed_ms = Math.round(performance.now() - started);
+    const e = err as Error & { cause?: { message?: string; code?: string } };
+    out.error = e.name === "TimeoutError" ? `no answer within ${timeout} ms` : (e.cause?.code ?? e.cause?.message ?? e.message);
+  }
+  return out;
+}

modules/netcheck/module.json

@@ -0,0 +1,35 @@
+{
+  "module": "netcheck",
+  "version": "1",
+  "tools": [
+    "netcheck_tcp",
+    "netcheck_dns",
+    "netcheck_http"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/netcheck",
+        "binary": "netcheck",
+        "loads": [
+          "netcheck"
+        ]
+      },
+      {
+        "name": "tools-typescript",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ]
+      }
+    ]
+  }
+}

modules/netcheck/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@novox/module-netcheck",
+  "version": "0.1.0",
+  "description": "netcheck — read-only network checks from a machine, as one module carrying a Go tools bundle (TCP, DNS) and a TypeScript one (HTTP) (novox/hq ADR 0188, ADR 0193).",
+  "type": "module",
+  "private": true,
+  "scripts": {
+    "test": "node --test --experimental-strip-types 'test/*.test.ts'"
+  },
+  "dependencies": {
+    "@novox/mesh-sdk": "^0.1.6"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  }
+}

modules/netcheck/test/http.test.ts

@@ -0,0 +1,52 @@
+// The HTTP check refuses what is not http(s) and what would change something, and reports a status,
+// a refusal and a timeout as results (novox/hq ADR 0188: a tools bundle is read-only and harmless).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import { checkHttp, checkedMethod, checkedUrl } from "../http.ts";
+
+test("only http and https URLs are checked", () => {
+  for (const bad of ["file:///etc/passwd", "ftp://example.org/", "data:text/plain,hi", "javascript:1", "", "not a url"]) {
+    assert.throws(() => checkedUrl(bad), `${bad} was accepted`);
+  }
+  assert.equal(checkedUrl("https://example.org/x").protocol, "https:");
+});
+
+test("only HEAD and GET are used", () => {
+  assert.equal(checkedMethod(undefined), "HEAD");
+  assert.equal(checkedMethod("get"), "GET");
+  for (const bad of ["POST", "PUT", "DELETE", "PATCH"]) assert.throws(() => checkedMethod(bad));
+});
+
+test("a status, its headers and a redirect not followed", async () => {
+  const server = createServer((req, res) => {
+    if (req.url === "/moved") { res.writeHead(302, { location: "/elsewhere" }); res.end(); return; }
+    res.writeHead(200, { "content-type": "text/plain", "x-secret": "not reported" });
+    res.end(req.method === "GET" ? "body" : undefined);
+  });
+  await new Promise<void>((ok) => server.listen(0, "127.0.0.1", ok));
+  const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+  try {
+    const head = await checkHttp({ url: base + "/" });
+    assert.equal(head.status, 200);
+    assert.equal(head.method, "HEAD");
+    assert.equal(head.headers["content-type"], "text/plain");
+    assert.equal(head.headers["x-secret"], undefined);
+    const moved = await checkHttp({ url: base + "/moved", method: "GET" });
+    assert.equal(moved.status, 302);
+    assert.equal(moved.headers.location, "/elsewhere");
+  } finally {
+    server.close();
+  }
+});
+
+test("a refused connection is a result with its error", async () => {
+  const server = createServer();
+  await new Promise<void>((ok) => server.listen(0, "127.0.0.1", ok));
+  const port = (server.address() as AddressInfo).port;
+  await new Promise<void>((ok) => server.close(() => ok()));
+  const got = await checkHttp({ url: `http://127.0.0.1:${port}/`, timeout_ms: 2000 });
+  assert.equal(got.status, undefined);
+  assert.ok(got.error, "no error reported");
+});

modules/netcheck/tools/index.ts

@@ -0,0 +1,28 @@
+// netcheck's TypeScript tools bundle (novox/hq ADR 0188, ADR 0193): what the builder's launcher
+// imports and serves over MCP on stdio. Its Go bundle serves the TCP and DNS checks; this one the
+// HTTP check — one module, two languages, one runtime that knows neither.
+
+import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
+import { checkHttp, DEFAULT_TIMEOUT_MS, METHODS, MOST_TIMEOUT_MS } from "../http.js";
+
+export function getNetcheckHttpTools(): ToolDefinition[] {
+  return [
+    {
+      name: "netcheck_http",
+      description:
+        "Check whether an http(s) URL answers from this machine: one HEAD or GET, no body sent or read, " +
+        "redirects reported and not followed. Answers status, elapsed_ms and a few headers.",
+      input: {
+        url: { type: "string", description: "an http:// or https:// URL" },
+        method: { type: "string", enum: [...METHODS], description: "HEAD (default) or GET" },
+        timeout_ms: {
+          type: "integer",
+          description: `give up after this long (default ${DEFAULT_TIMEOUT_MS}, at most ${MOST_TIMEOUT_MS})`,
+        },
+      },
+      run: async (args) => checkHttp(args),
+    },
+  ];
+}
+
+registerModuleTools("netcheck", () => getNetcheckHttpTools());

modules/netcheck/tsconfig.json

@@ -8,8 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": [
+  "include": ["http.ts", "tools/index.ts"]
-    "client.ts",
-    "tools/index.ts"
-  ]
 }

modules/nextcloud/Dockerfile

@@ -1,40 +0,0 @@
-# nextcloud's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-ARG DOCKER_CLI
-
-# Named so the final stage's COPY --from can reference a stage, not an ARG — the legacy builder
-# this host still runs doesn't expand ARGs inside COPY --from, only inside FROM.
-FROM ${DOCKER_CLI} AS dockercli
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/nextcloud
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/nextcloud/dist /app/modules/nextcloud/dist
-# occ runs inside nextcloud's own container, reached over the mounted docker socket — which needs
-# the docker CLI itself present here, not only the socket. Copied from Docker's own official client
-# image rather than apt-installed, so this stays the one binary and nothing else (no daemon, no
-# systemd unit, no package manager tree pulled in for it).
-COPY --from=dockercli /usr/local/bin/docker /usr/local/bin/docker
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/nextcloud/dist/index.js,/app/modules/nextcloud/dist/tools/index.js

modules/nextcloud/module.json

@@ -30,8 +30,7 @@
     "share.created"
   ],
   "own-secrets": {
-    "admin": "${dir:state}/admin.secret",
+    "admin": "${dir:state}/admin.secret"
-    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -94,53 +93,28 @@
       "mode": "0600",
       "content": "{}\n",
       "merge": "json"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-nextcloud",
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro",
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NEXTCLOUD_URL": "http://127.0.0.1:${port:80}",
-        "MESH_NEXTCLOUD_CONFIG_FILE": "/run/config/config.json",
-        "MESH_NEXTCLOUD_ADMIN_USER": "mesh-admin",
-        "MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE": "/run/secrets/admin"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      },
-      {
-        "arg": "DOCKER_CLI",
-        "image": "docker@sha256:018edbc908e08fcc9dbf029c812c34251e9b4719e6f71ca0e5eae2a987d014ca"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_NEXTCLOUD_URL": "http://127.0.0.1:${port:80}",
+          "MESH_NEXTCLOUD_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_NEXTCLOUD_ADMIN_USER": "mesh-admin",
+          "MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret"
+        }
       }
     ]
   }

modules/nodered/Dockerfile

@@ -1,27 +0,0 @@
-# nodered's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/nodered
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts mqtt/probe.ts mqtt/connection.ts mqtt/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/nodered/dist /app/modules/nodered/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled.
-ENV MESH_TOOL_MODULES=/app/modules/nodered/dist/tools/index.js
-# NOT dist/mqtt/index.js: that is a step the host runs to completion, named by the `mqtt`
-# container's args as `mesh-tools run …` (novox/hq ADR 0052). Listed here it would run inside the
-# serving sidecar too, and exit it.

modules/nodered/module.json

@@ -12,8 +12,7 @@
     "api-token": {
       "path": "${dir:mesh-state}/api-token",
       "taken": "at-start"
-    },
+    }
-    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -101,53 +100,31 @@
       "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
     },
     {
-      "id": "runtime",
+      "id": "mqtt-env",
-      "type": "container",
+      "type": "file",
-      "name": "mesh-nodered",
+      "path": "${dir:state}/mqtt.env",
-      "network": "host",
+      "mode": "0600",
-      "volumes": [
+      "content": "MESH_NODERED_URL=http://127.0.0.1:${port:1880}\nMESH_NODERED_CONFIG_FILE=${dir:mesh-state}/config.json\nMESH_PROVISIONS_DIR=${dir:state}\nMESH_WRITTEN_DIR=${dir:written}\n"
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
-        "MESH_NODERED_CONFIG_FILE": "/run/config/config.json"
-      },
-      "restart-on": [
-        "runtime-config"
-      ],
-      "artifact": "runtime"
     },
     {
       "id": "mqtt",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-nodered-mqtt",
+      "name": "nodered-mqtt",
-      "network": "host",
+      "artifact": "code",
-      "run-once": true,
+      "run": [
-      "volumes": [
+        "node",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
+        "mqtt/index.js"
-        "${dir:written}:/var/lib/nodered-provisions",
-        "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
-        "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",
-        "${dir:state}/settings.json:/run/provisions/settings.json:ro"
       ],
-      "env": {
+      "run-once": true,
-        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
+      "env-file": [
-        "MESH_NODERED_CONFIG_FILE": "/run/config/config.json",
+        "${dir:state}/mqtt.env"
-        "MESH_PROVISIONS_DIR": "/run/provisions",
-        "MESH_WRITTEN_DIR": "/var/lib/nodered-provisions"
-      },
-      "args": [
-        "run",
-        "/app/modules/nodered/dist/mqtt/index.js"
       ],
       "restart-on": [
+        "mqtt-env",
         "bound-mqtt-topic",
         "secret-mqtt-topic",
         "settings"
-      ],
+      ]
-      "artifact": "runtime"
     }
   ],
   "requires": [
@@ -173,23 +150,22 @@
     "mqtt-topic": "${dir:state}/mqtt-topic.secret"
   },
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "mqtt/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
+          "MESH_NODERED_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
       }
     ]
   }

modules/openai-consumer/Dockerfile

@@ -1,22 +0,0 @@
-# openai-consumer's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/openai-consumer
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc apply/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/openai-consumer/dist /app/modules/openai-consumer/dist
-# No serve-time entrypoints: every container of this module names its command (`run` on a
-# schedule), so nothing here serves — deliberately no MESH_TOOL_MODULES.

modules/openai-consumer/module.json

@@ -28,44 +28,31 @@
     },
     {
       "id": "apply",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-openai-consumer-apply",
+      "name": "openai-consumer-apply",
-      "network": "host",
+      "artifact": "code",
+      "run": [
+        "node",
+        "apply/index.js"
+      ],
       "schedule": "*/5 * * * *",
-      "args": [
-        "run",
-        "/app/modules/openai-consumer/dist/apply/index.js"
-      ],
-      "volumes": [
-        "${dir:state}:/run/state"
-      ],
       "env": {
-        "MESH_MODEL_ACCESS_SECRET_FILE": "/run/state/api-key",
+        "MESH_MODEL_ACCESS_SECRET_FILE": "${dir:state}/api-key",
-        "MESH_MODEL_ACCESS_BIND_FILE": "/run/state/model.json",
+        "MESH_MODEL_ACCESS_BIND_FILE": "${dir:state}/model.json",
-        "MESH_OPENAI_ENV_FILE": "/run/state/config/openai.env",
+        "MESH_OPENAI_ENV_FILE": "${dir:state}/config/openai.env",
-        "MESH_OPENAI_CREDENTIALS_FILE": "/run/state/config/auth.json"
+        "MESH_OPENAI_CREDENTIALS_FILE": "${dir:state}/config/auth.json"
-      },
+      }
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "apply/index.js"
+        ]
       }
     ]
   }

modules/postgres/Dockerfile

@@ -1,41 +0,0 @@
-# postgres's runtime: the tool runtime, carrying this module's compiled provisioner, tools and
-# event consumer.
-#
-# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
-# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
-# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
-# the siblings.
-#
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
-# They are different images on purpose — the first carries a compiler and the second must not, or
-# every running container would carry one it never invokes. The mesh answers both with the copies it
-# holds, because a fingerprint written here would name one particular copy and no other mesh has it
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
-# nobody told stops here and says which module to build first.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against.
-WORKDIR /app/modules/postgres
-COPY . .
-# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
-# symlinks to a launcher that requires its library relatively — resolved away when the base image
-# was assembled.
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# **This module talks to its database through psql, so psql has to be here.** The client is how
-# postgres's provisioner runs DDL — it does not carry a driver — and the runtime base holds only
-# what every module needs.
-RUN apt-get update \
-      && apt-get install -y --no-install-recommends postgresql-client \
-      && rm -rf /var/lib/apt/lists/*
-COPY --from=build /app/modules/postgres/dist /app/modules/postgres/dist
-# What a tool host should load from this module: its event consumer and its tools, which are
-# separate entrypoints because they are loaded by different things. The provisioner is the third,
-# and is not listed here — the declaration names it in the container's `args`, because it is what
-# this module's own container runs. One image, because they are one module and share a client.
-ENV MESH_TOOL_MODULES=/app/modules/postgres/dist/index.js,/app/modules/postgres/dist/tools/index.js,/app/modules/postgres/dist/provisioner/index.js

modules/postgres/module.json

@@ -53,16 +53,9 @@
   },
   "own-secrets": {
     "superuser": "${dir:state}/superuser.secret",
-    "broker": "${dir:mesh-state}/broker",
     "reader": "${dir:state}/reader.secret"
   },
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -99,45 +92,33 @@
       ]
     },
     {
-      "id": "runtime",
+      "id": "client",
-      "type": "container",
+      "type": "package",
-      "name": "mesh-postgres",
+      "package": "postgresql-libs"
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}:ro",
-        "${dir:state}/superuser.secret:/run/secrets/superuser:ro",
-        "${dir:state}/reader.secret:/run/secrets/reader:ro"
-      ],
-      "env": {
-        "MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:${port:5432}/postgres?sslmode=disable",
-        "MESH_PROVISION_POSTGRES_PORT": "${seat:mesh-store:5432}",
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/superuser",
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json",
-        "MESH_POSTGRES_READER_PASSWORD_FILE": "/run/secrets/reader"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:${port:5432}/postgres?sslmode=disable",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:state}/superuser.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_POSTGRES_READER_PASSWORD_FILE": "${dir:state}/reader.secret"
+        }
       }
     ]
   }

modules/records/Dockerfile

@@ -1,26 +0,0 @@
-# records' runtime: the tool runtime, carrying this module's compiled reader and its tools.
-#
-# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
-# nothing is copied out of a neighbouring checkout (novox/hq ADR 0069).
-#
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/records
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc records.ts index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-# **A module may need something the base image does not carry.** The reader keeps a checkout of the
-# repository it reads (novox/hq ADR 0153) — a git working copy, kept current, not a derived copy — and
-# the base image has no git. Certificates too, because the origin may be reached over TLS.
-RUN apt-get update \
-      && apt-get install -y --no-install-recommends git ca-certificates \
-      && rm -rf /var/lib/apt/lists/*
-COPY --from=build /app/modules/records/dist /app/modules/records/dist
-# Both entrypoints, loaded in serve mode: the consumer that pulls on a merge, and the tools.
-ENV MESH_TOOL_MODULES=/app/modules/records/dist/index.js,/app/modules/records/dist/tools/index.js

modules/records/module.json

@@ -11,9 +11,6 @@
   "binds": {
     "git": "${dir:mesh-state}/git.json"
   },
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "consumes": [
     "gitea.pull.merged"
   ],
@@ -53,47 +50,30 @@
       "content": "${bound:git:scheme}://${bound:git:at}:${bound:git:port}\n"
     },
     {
-      "id": "runtime",
+      "id": "git",
-      "type": "container",
+      "type": "package",
-      "name": "records",
+      "package": "git"
-      "network": "host",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
-        "${dir:mesh-state}/origin:/run/config/origin:ro",
-        "${dir:checkout}:${dir:checkout}"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECORDS_CONFIG_FILE": "/run/config/config.json",
-        "MESH_RECORDS_ORIGIN_FILE": "/run/config/origin",
-        "MESH_RECORDS_DIR": "${dir:checkout}"
-      },
-      "artifact": "runtime",
-      "restart-on": [
-        "config",
-        "origin"
-      ]
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_RECORDS_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_RECORDS_ORIGIN_FILE": "${dir:mesh-state}/origin",
+          "MESH_RECORDS_DIR": "${dir:checkout}"
+        }
       }
     ]
   }

modules/redis/Dockerfile

@@ -1,30 +0,0 @@
-# redis's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/redis
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/redis/dist /app/modules/redis/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/redis/dist/index.js,/app/modules/redis/dist/tools/index.js,/app/modules/redis/dist/provisioner/index.js

modules/redis/module.json

@@ -35,9 +35,6 @@
   "secrets": {
     "secret": "${dir:state}/default.secret"
   },
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "listens": [
     {
       "name": "cache",
@@ -48,12 +45,6 @@
     }
   ],
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -103,44 +94,29 @@
       "restart-on": [
         "server-conf"
       ]
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-redis",
-      "network": "redis",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:/var/lib/redis-module/grants:ro",
-        "${dir:state}/default.secret:/run/secrets/default:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "/var/lib/redis-module/grants/mesh.json",
-        "MESH_PROVISION_REDIS": "redis:6379",
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/default"
-      },
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_PROVISION_REDIS": "127.0.0.1:${port:6379}",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:state}/default.secret"
+        }
       }
     ]
   }

modules/resolv-conf/module.json

@@ -17,24 +17,7 @@
       "type": "file",
       "path": "/etc/resolv.conf",
       "mode": "0644",
-      "content": "# Managed by the mesh.\n#\n# For a machine where nothing else owns this file. On one where systemd-resolved\n# or NetworkManager does, assign that module instead — this one and those claim\n# the same thing, so the mesh refuses the pair rather than letting them take\n# turns overwriting each other, which is the failure this claim exists to stop.\n#\n# The mesh's one resolver first (novox/hq ADR 0194, 0196), by address — a machine\n# cannot resolve the name of the thing it resolves names with. It answers the\n# mesh's names itself and forwards every other name. A public resolver second,\n# asked only when the first does not answer at all — its machine or the tunnel\n# down, a captive portal holding the tunnel back — so public names keep\n# resolving then. An answer from the first, \"no such name\" included, is final,\n# so a mesh name is never asked of the public one while the mesh's answers. One\n# second and one attempt, so the wait before the fallback is short. Containers\n# copy these two lines from their machine.\nnameserver ${bound:wildcard-resolution:address}\nnameserver 1.1.1.1\noptions timeout:1 attempts:1 edns0\n"
+      "content": "# Managed by the mesh.\n#\n# For a machine where nothing else owns this file. On one where systemd-resolved\n# or NetworkManager does, assign that module instead \u2014 this one and those claim\n# the same thing, so the mesh refuses the pair rather than letting them take\n# turns overwriting each other, which is the failure this claim exists to stop.\n#\n# The mesh's resolver, and only it \u2014 the one line the predecessor wrote on every\n# machine it set up. It answers the mesh's names itself and forwards everything\n# else to upstreams named in its own configuration, never read from this file.\n# This file used to carry a second nameserver as a placeholder for \"whatever\n# this machine used before\"; that was never a fallback for names the mesh does\n# not know \u2014 a resolver's second line is asked only when the first does not\n# answer at all \u2014 and now that the first answers everything it would be a line\n# nothing ever reached.\nnameserver 127.0.0.1\noptions edns0\n"
-    },
-    {
-      "id": "runtime-config",
-      "type": "file",
-      "path": "/etc/docker/daemon.json",
-      "mode": "0644",
-      "into": "json",
-      "content": "{\"live-restore\": true}\n"
-    },
-    {
-      "id": "runtime",
-      "type": "service",
-      "unit": "docker.service",
-      "state": "running",
-      "reload-on": [
-        "runtime-config"
-      ]
     }
   ]
 }

modules/resolved-split-dns/module.json

@@ -23,7 +23,7 @@
       "type": "file",
       "path": "/etc/systemd/resolved.conf.d/mesh.conf",
       "mode": "0644",
-      "content": "# Managed by the mesh.\n#\n# **Only the mesh's names.** The tilde makes this a routing domain rather than a\n# search domain: queries under it go to the resolver below, and everything else\n# keeps going wherever this machine already sent it. A resolver that took over\n# all of DNS would be this module claiming the machine's whole network, which\n# is not what it says it claims. The mesh's resolver can forward the rest too;\n# this module is for a machine that wants systemd-resolved to stay in charge of\n# that, and only lends it the mesh's suffix.\n#\n# The mesh's one resolver (novox/hq ADR 0194), by its private address — a\n# machine cannot resolve the name of the thing it resolves names with.\n[Resolve]\nDNS=${bound:wildcard-resolution:address}\nDomains=~internal\n"
+      "content": "# Managed by the mesh.\n#\n# **Only the mesh's names.** The tilde makes this a routing domain rather than a\n# search domain: queries under it go to the resolver below, and everything else\n# keeps going wherever this machine already sent it. A resolver that took over\n# all of DNS would be this module claiming the machine's whole network, which\n# is not what it says it claims. The mesh's resolver can forward the rest too;\n# this module is for a machine that wants systemd-resolved to stay in charge of\n# that, and only lends it the mesh's suffix.\n#\n# 127.0.0.1 is where the mesh's resolver answers on every machine \u2014 a fixed\n# address, so this file needs to know nothing about this particular machine.\n# systemd-resolved holds .53 and .54 itself, which is why the resolver is on\n# neither, and why the two coexist here.\n[Resolve]\nDNS=127.0.0.1\nDomains=~internal\n"
     },
     {
       "id": "resolved",

modules/route-adapter/Dockerfile

@@ -1,24 +0,0 @@
-# route-adapter's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-WORKDIR /app/modules/route-adapter
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc adapter.ts index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/route-adapter/dist /app/modules/route-adapter/dist
-# **No MESH_TOOL_MODULES, deliberately.** This module serves no tool and consumes no event: it is a
-# step the host runs to completion, named by the container's `args` as `mesh-tools run …`. Setting a
-# serve-time entrypoint here would give the image a second way to be started — one that connects to
-# the broker and never exits.

modules/route-adapter/module.json

@@ -47,23 +47,18 @@
     },
     {
       "id": "adapt",
-      "type": "container",
+      "type": "process",
-      "name": "mesh-route-adapter",
+      "name": "route-adapter",
-      "artifact": "runtime",
+      "artifact": "code",
-      "run-once": true,
+      "run": [
-      "volumes": [
+        "node",
-        "${dir:routes-dir}/mesh.json:${dir:routes-dir}/mesh.json:ro",
+        "index.js"
-        "${dir:state}/config.json:/run/config/config.json:ro",
-        "${access:dynamic}:/services/traefik/dynamic"
       ],
+      "run-once": true,
       "env": {
         "MESH_RECEIVES": "${dir:routes-dir}/mesh.json",
-        "MESH_ROUTE_ADAPTER_CONFIG": "/run/config/config.json"
+        "MESH_ROUTE_ADAPTER_CONFIG": "${dir:state}/config.json"
       },
-      "args": [
-        "run",
-        "/app/modules/route-adapter/dist/index.js"
-      ],
       "restart-on": [
         "received-route",
         "config"
@@ -71,23 +66,14 @@
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "index.js"
+        ]
       }
     ]
   }

modules/umami/Dockerfile

@@ -1,30 +0,0 @@
-# umami's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are in
-# the base images, published like any other artifact — which is what makes this buildable by the
-# mesh from a repository and a path (novox/hq ADR 0069) rather than only on a workstation that
-# happens to have the siblings.
-#
-# Two bases, named rather than pinned (novox/hq issue 044): the image this is COMPILED in and the
-# image it RUNS in — the second must not carry a compiler. Declared in module.json's `build.on`.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against. The compiler
-# is invoked by its real path: node_modules/.bin entries are launcher symlinks the base image
-# resolved away.
-WORKDIR /app/modules/umami
-COPY . .
-RUN node /app/node_modules/typescript/bin/tsc client.ts tools/index.ts provisioner/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/umami/dist /app/modules/umami/dist
-# Every serve-time entrypoint, loaded by the runtime in serve mode: tools and events serve, and a
-# provider's provisioner runs its reconcile loop in the same process, with the broker connected —
-# the convention novox/hq issues 060/061 settled. A container that instead ran only its
-# provisioner (`run`) served no tools and emitted no events; a container that named no command
-# ran no provisioner at all.
-ENV MESH_TOOL_MODULES=/app/modules/umami/dist/tools/index.js,/app/modules/umami/dist/provisioner/index.js

modules/umami/module.json

@@ -44,9 +44,6 @@
   "grants": {
     "analytics": "${dir:grants}"
   },
-  "own-secrets": {
-    "broker": "${dir:mesh-state}/broker"
-  },
   "listens": [
     {
       "name": "web",
@@ -57,12 +54,6 @@
     }
   ],
   "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "mesh"
-    },
     {
       "id": "state",
       "type": "directory",
@@ -81,13 +72,6 @@
       "mode": "0600",
       "content": "DATABASE_URL=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}\nDATABASE_TYPE=postgresql\nAPP_SECRET=${secret:app-secret}\n"
     },
-    {
-      "id": "provisioner-env",
-      "type": "file",
-      "path": "${dir:state}/provisioner.env",
-      "mode": "0600",
-      "content": "MESH_PROVISION_UMAMI_URL=http://umami:3000\nGRANTS=${dir:grants}\n"
-    },
     {
       "id": "net",
       "type": "network",
@@ -106,46 +90,27 @@
         "3000"
       ],
       "secrets-in-environment": "a Next.js/Prisma application: DATABASE_URL and APP_SECRET are read from the environment only; not convertible"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-umami",
-      "network": "umami",
-      "volumes": [
-        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
-        "${dir:grants}:${dir:grants}",
-        "${dir:state}/admin.secret:/run/secrets/admin:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "${dir:grants}/mesh.json",
-        "MESH_UMAMI_ADMIN_PASSWORD_FILE": "/run/secrets/admin"
-      },
-      "env-file": [
-        "${dir:state}/provisioner.env"
-      ],
-      "artifact": "runtime"
     }
   ],
   "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
     "artifacts": [
       {
-        "name": "runtime",
+        "name": "code",
-        "kind": "image",
+        "kind": "bundle",
-        "from": "Dockerfile"
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_UMAMI_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_PROVISION_UMAMI_URL": "http://127.0.0.1:${port:3000}"
+        }
       }
     ]
   }