jschoubben
e40ace34a6
npm-package-registry is form none, so the registry pair the lab's clones of mesh-tools-go used is no longer minted. The lab requires forge-account as the build modules do; its clones go over ssh through a git and ssh configuration the mesh writes from that binding. The secret, contributes and MESH_LAB_FORGE_SECRET go. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
lab
The lab module of the mesh catalogue: installs the package git; installs the package openssh; installs the package make; installs the package python; installs the package file; installs the package iproute2; installs the package incus; requires go-toolchain and node-toolchain, so the go module and the nodejs module are assigned to a machine running it (novox/hq ADR 0477 clause 4).
How its runs clone
A run clones the mesh's repositories, private ones too (mesh-tools-go), as the build modules do: the lab requires
forge-account, the forge's provider registers the account's key (~/.ssh/mesh_ed25519) for it, and the mesh writes
forge.gitconfig, forge.ssh and forge.known_hosts into the lab's state from that binding. Every clone reads
forge.gitconfig (git -c include.path=...), which sends the forge's address, as the lab's forge setting or the
forge itself names it, over ssh to the forge with that key and only the forge's host key. No password is bound,
sealed or written for a run. npm reads from npm-package-registry are anonymous (novox/hq ADR 0346): the lab
contributes nothing to it and holds no secret of it; its binding gives the registry's public root only.
Files it does not know
Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
${dir:state}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2)./var/lib/mesh-lab-runs: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).