jschoubben 1c55e5d44d Vault: take and hash a process's own bus account (broker-<process id>) as a covered account, so take-over is not held by every process user ...

The controller hands each process account of a core or moved module with origin issued (ADR 0436 §2); the vault took
only broker and provisioner-broker, refused these and never hashed them. Owed hashes are now said once per pass, and
account_hash says who asked when it refuses too (review round 1).

Issue: 1945

2026-10-26 02:35:57 +01:00

..

adwaita

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

artifact-store-tools

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

asus-zephyrus-g14

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

audit-logger

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

avahi

avahi: the discovery daemon declared, and why it hears nothing reported

2026-10-04 12:50:20 +02:00

baserow

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

blueman

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

bluetooth

Add nextcloud-client and blueman: the two tray apps get an owner and tools, each with one start

2026-10-05 11:47:38 +02:00

brother

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

buildah

Add the buildah module and the check that only it provides rootless-image-build (issues 1702, 1704)

2026-10-22 10:27:01 +02:00

ca-trust

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

claude-code

Take the build agent and the toolchain images out of the catalogue's prose, and refuse the word where it comes back outside the one module still naming it (issue 1295, E6)

2026-10-23 15:34:11 +02:00

claude-licence-manager

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

clipmenu

Wait until the older clipmenud holds the lock before the launcher starts (issue 1814, S1)

2026-10-22 19:03:03 +02:00

confluence

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

cups

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

dbus

dbus: hold node-message-bus, and never restart the bus live (hq ADR 0215)

2026-10-05 11:50:52 +02:00

desk-channel

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

dev-tools

Take the build agent and the toolchain images out of the catalogue's prose, and refuse the word where it comes back outside the one module still naming it (issue 1295, E6)

2026-10-23 15:34:11 +02:00

disk-load

disk_folders: answer said as a list (issue 1804)

2026-10-22 01:13:35 +02:00

distribution

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

dmenu

dmenu: the package, which makes the notifier's menu work, and a menu tool (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

dnsmasq

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

docker

Count volumes a half-done batch already removed as removed, and test the batching (issue 1796)

2026-10-22 00:23:21 +02:00

docker-compose

docker-compose: the package, and its projects as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

dunst

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

fail2ban

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

feh

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

flatpak

flatpak: the package, Flathub with it, and the installations as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

fonts

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

forticlient

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

gitea

mesh-delivery-gate and gitea: a setting check-gates-merge; false asks a reviewed pull request's Approve and merges it without waiting for mesh/check

2026-10-25 23:07:50 +01:00

gitlab

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

gnome-keyring

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

go

Say in the go and nodejs READMEs that they are now the only declarers (issue 1573)

2026-10-21 09:51:22 +00:00

grafana

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

hello-web

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

home-assistant

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

hostname

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

i3

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

i3status-rust

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

icecast

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

influxdb

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

invoicing

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

jira

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

kernel

issue 1841/S15: put the booted kernel first when GRUB's menu is generated again, so the fallback kernel, sorted first by version, never becomes the default entry (ADR 0508 §9)

2026-10-22 17:49:21 +02:00

keycloak

Pin gitea, keycloak, mesh-provisioner-client, postgres and route-adapter to a commit of mesh-sdk main, since the pinned one is on a feature branch only (issue 1663)

2026-10-21 14:07:01 +02:00

lab

Take the build agent and the toolchain images out of the catalogue's prose, and refuse the word where it comes back outside the one module still naming it (issue 1295, E6)

2026-10-23 15:34:11 +02:00

lemurs

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

letta

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

local-model-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

localization

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

logrotate

logrotate: dry-run the base against logs of its own, so the shut-off unit level does not stat the machine's /var/log (issue 1891)

2026-10-23 09:10:09 +02:00

mailu

Check an image's Dockerfile place instead of refusing the image kind (ADR 0487 clause 13)

2026-10-22 11:44:45 +02:00

marrytts

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

matrix

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

memory-pressure

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mesh-build-go

Read the newest steps first: sort the node's keys by id (start order) before the cut, and say older steps were not read

2026-10-26 00:43:53 +01:00

mesh-build-image

Read the newest steps first: sort the node's keys by id (start order) before the cut, and say older steps were not read

2026-10-26 00:43:53 +01:00

mesh-build-node

Read the newest steps first: sort the node's keys by id (start order) before the cut, and say older steps were not read

2026-10-26 00:43:53 +01:00

mesh-catalog

Stop hearing the retired build seats' events in gitea and the catalogue module, so no manifest consumes a seat nothing claims once node-build-agent goes (issue 1887 E2 with A9)

2026-10-23 15:37:17 +02:00

mesh-cli

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mesh-config

mesh-config: read the pull request's commit from head_sha (issue 1826)

2026-10-22 11:09:48 +02:00

mesh-delivery-gate

mesh-delivery-gate and gitea: a setting check-gates-merge; false asks a reviewed pull request's Approve and merges it without waiting for mesh/check

2026-10-25 23:07:50 +01:00

mesh-files

Bound an upload and a download to 25 s, so a tool call is never cut while the transfer goes on (issue 1597)

2026-10-21 15:21:56 +02:00

mesh-issues

Merge main into feat/r6: keep R6's gate, which already carries #474's catch-up at start, and drop the seat and walk adoption R6 removed

2026-10-24 23:03:42 +02:00

mesh-knowledge

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

mesh-mail

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

mesh-mail-notifier

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

mesh-mail-reader

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

mesh-mail-web

Review round 1: an unset mail-reading verb answers unavailable not unknown, cache the index instead of leaking a pool per call, a gone mail leaves the queue without going unhealthy, sort the judge's own cause by its words, drive RunBatches itself for its pacing test, and prove no tell while unhealthy against a genuinely untold mail (issues 1430, 1523, 1517, 1518, 1520, 1519, 1524)

2026-10-21 01:48:23 +02:00

mesh-provisioner

Pin mesh-provisioner, mesh-vault and rofi to a commit of mesh-sdk main, since the pinned one is on no branch and no fetch can resolve it (issue 1659)

2026-10-21 13:14:57 +02:00

mesh-provisioner-client

Provisioner client: drop a module's held vault secrets when it leaves or is placed again, so it asks afresh (issue 1945)

2026-10-26 00:03:43 +01:00

mesh-reads

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mesh-vault

Vault: take and hash a process's own bus account (broker-<process id>) as a covered account, so take-over is not held by every process user

2026-10-26 02:35:57 +01:00

mesh-watcher

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

messenger

The messenger holds and tells what the delivery view says is in motion, not the controller's plans (issue 1946)

2026-10-24 18:25:38 +02:00

minio

mesh-build-go: a catalogue module's non-Go files enter its packages' digests; markers where tests read other modules (issue 1935)

2026-10-24 03:59:08 +02:00

model-usage

Commit the lock files of mssql, mongodb, model-usage and mesh-catalog, and refuse a Node module without one (issue 1868, ADR 0469 §5)

2026-10-22 18:12:32 +02:00

mongodb

Commit the lock files of mssql, mongodb, model-usage and mesh-catalog, and refuse a Node module without one (issue 1868, ADR 0469 §5)

2026-10-22 18:12:32 +02:00

mosquitto

gitea, minio, mosquitto: tests run as the Node build module runs them, tsc -p . then npm test (issue 1891)

2026-10-23 10:18:57 +02:00

mounts

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mssql

Commit the lock files of mssql, mongodb, model-usage and mesh-catalog, and refuse a Node module without one (issue 1868, ADR 0469 §5)

2026-10-22 18:12:32 +02:00

n8n

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nats

Keep nats on main's mesh-sdk pin: only its test subjects change in R4g, so the bus does not move (R4g)

2026-10-23 16:27:06 +02:00

netcheck

Refuse a host in a short or legacy numeric form (127.1, 2130706433, 0x7f.0.0.1) in netcheck_request before any lookup, so the refusal does not depend on the resolver

2026-10-21 13:07:08 +02:00

networkmanager

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

nextcloud

nextcloud: repair the account only on a 401, never reset the throttle (issue 1253, review 2)

2026-10-25 16:57:46 +01:00

nextcloud-client

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

nfs-server

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nftables

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

nm-applet

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

node-env

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nodejs

Say in the go and nodejs READMEs that they are now the only declarers (issue 1573)

2026-10-21 09:51:22 +00:00

nodered

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

ollama

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

only-office

only-office: stop declaring the old lib directory, emptied on the operator's word (issue 1854)

2026-10-22 17:49:08 +02:00

openai-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

openrazer

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

pacman

Say what pacman-tools reads outside: the root predefined.json (issue 1935)

2026-10-24 13:48:18 +02:00

photos-eef

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

photos-filip

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

picom

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

polychromatic

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

postgres

mesh-build-go: a catalogue module's non-Go files enter its packages' digests; markers where tests read other modules (issue 1935)

2026-10-24 03:59:08 +02:00

power

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

powerlevel10k

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

records

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

redis

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

restic

Remove a binary built by mistake

2026-10-24 16:58:33 +02:00

rofi

Pin mesh-provisioner, mesh-vault and rofi to a commit of mesh-sdk main, since the pinned one is on no branch and no fetch can resolve it (issue 1659)

2026-10-21 13:14:57 +02:00

route-adapter

Pin gitea, keycloak, mesh-provisioner-client, postgres and route-adapter to a commit of mesh-sdk main, since the pinned one is on a feature branch only (issue 1663)

2026-10-21 14:07:01 +02:00

screen-lock

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

searxng

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

sensors

sensors: take a SAS drive's standby, whose mode holds spaces

2026-10-08 15:04:02 +02:00

showcase

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

slack

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

snapd

snapd: tools for the snaps, the package blocked on the mesh's AUR repository (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

ssh-client

pacman, ssh-client: tests read nothing of the machine, so the unit level passes shut off and on a desk (issue 1891)

2026-10-23 09:38:40 +02:00

sshd

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

step-ca

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

sudo

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

supabase

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

systemd

Give /var/lib/systemd and /var/lib/postgres back to their packages, and keep the modules' files in their own directories (issue 1873)

2026-10-22 21:31:58 +02:00

systemd-networkd

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

systemd-resolved

systemd-resolved: say when a route's domains do cross the bus

2026-10-07 21:35:49 +02:00

telegram

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

time-sync

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

triggerhappy

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

umami

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

unifi

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

website

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

xclip

xclip: the package, and the operator's clipboard from the mesh (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

xdg

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

xorg

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

xterm

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:49 +02:00

zfs

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

zsh

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

zsh-autosuggestions

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

zsh-syntax-highlighting

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00