# lab

The `lab` module of the mesh catalogue: installs the package `git`; installs the package `openssh`; installs the package `make`; installs the package `python`; installs the package `file`; installs the package `iproute2`; installs the package `incus`; requires `go-toolchain` and `node-toolchain`, so the `go` module and the `nodejs` module are assigned to a machine running it (novox/hq ADR 0477 clause 4).

## How its runs clone

A run clones the mesh's repositories, private ones too (mesh-tools-go), as the build modules do: the lab requires
`forge-account`, the forge's provider registers the account's key (`~/.ssh/mesh_ed25519`) for it, and the mesh writes
`forge.gitconfig`, `forge.ssh` and `forge.known_hosts` into the lab's state from that binding. Every clone reads
`forge.gitconfig` (`git -c include.path=...`), which sends the forge's address, as the lab's `forge` setting or the
forge itself names it, over ssh to the forge with that key and only the forge's host key. No password is bound,
sealed or written for a run. npm reads from `npm-package-registry` are anonymous (novox/hq ADR 0346): the lab
contributes nothing to it and holds no secret of it; its binding gives the registry's public root only.

## Files it does not know

Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).

- `${dir:state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
- `/var/lib/mesh-lab-runs`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).