Refs name the registry; lavinmq's runtime runs its provisioner (042/048/061) #26

2026-09-17T22:25:41Z

jschoubben commented

2026-09-17 22:25:41 +00:00

Two fixes proven together by the built-store-cross-node bed:

The builder names the registry by the binding again (ADR 0082) — published references carry the registry's internal name and port (MESH_REGISTRY), so a joined node pulls from the store by the name the overlay resolves, not a loopback that only works on the machine hosting it (hq issues 042/048).
lavinmq's runtime container runs its provisioner — the runtime container named no command, so it ran the image default (the tool host) and the provisioner entrypoint compiled beside it never ran anywhere: no consumer was ever granted its vhost, while grants sat applied in the mounted directory (hq issue 061, bed run 9). It now names its provisioner in args, mirroring postgres.

Validated: built-store-cross-node green fresh (run 12: mesh-controller 98aea8b, mesh-catalog 1891b09, mesh-lab cb353f9).

Two fixes proven together by the built-store-cross-node bed: - **The builder names the registry by the binding again (ADR 0082)** — published references carry the registry's internal name and port (`MESH_REGISTRY`), so a joined node pulls from the store by the name the overlay resolves, not a loopback that only works on the machine hosting it (hq issues 042/048). - **lavinmq's runtime container runs its provisioner** — the runtime container named no command, so it ran the image default (the tool host) and the provisioner entrypoint compiled beside it never ran anywhere: no consumer was ever granted its vhost, while grants sat applied in the mounted directory (hq issue 061, bed run 9). It now names its provisioner in `args`, mirroring postgres. Validated: built-store-cross-node green fresh (run 12: mesh-controller 98aea8b, mesh-catalog 1891b09, mesh-lab cb353f9).

jschoubben added 2 commits 2026-09-17 22:25:41 +00:00

The builder names the registry by the binding again (ADR 0082) 2dab3069d2

The one-line change e0c9219 parked "until there is a certificate" returns — with the
overlay recorded as the registry's transport security and every node's runtime told the
store speaks plain HTTP, a reference under the provider's internal name is one every
machine can pull. References minted at genesis stay loopback and are valid where they
matter, on the machine that made them.

https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

lavinmq's runtime container runs its provisioner 1891b09c65

The runtime container named no command, so it ran the image default —
the tool host — and the provisioner entrypoint compiled beside it never
ran anywhere: no vhost was ever minted, while the grants sat applied in
its mounted directory. postgres already names its provisioner in args;
lavinmq now does the same. Surfaced by the built-store-cross-node bed,
run 9 — the first bed to reach the vhost assertion honestly.

jschoubben merged commit 83a78b4fb3 into main

2026-09-17 23:00:43 +00:00

jschoubben referenced this issue from a commit

2026-09-25 21:49:19 +00:00

mailu: every container asks the module's own resolver, pinned where they can find it

jschoubben referenced this pull request

2026-09-25 21:49:26 +00:00

mailu: every container asks the module's own resolver, pinned where they can find it #78

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#26