jochen 5eab586116 Put no caller's text in a forge path unjudged: every segment checked, every sent path checked again ...

The confirmation review of 2026-10-09 found the dedicated tools building paths
from caller text: a branch named .. became DELETE /repos/o/r/ (the repository),
a file path ../../../../version reached /api/v1/version, and a sha with
?sudo= set a status as any user. Each caller-supplied segment now goes through
one helper refusing empty, . and .. and / ? # %; a sha must be a commit; and
the client judges every path once more as it sends it: no dot or empty
segment, encoded or not, and only the allow-listed query keys.

2026-10-09 13:35:15 +02:00

..

adwaita

adwaita: the theme as a module, dark by default, for GTK, Qt, the portal and the cursor (hq ADR 0208)

2026-10-04 13:21:47 +02:00

artifact-store-tools

Count a platform manifest as its index's, and list the unrecorded copies of upstream images

2026-10-08 14:11:02 +02:00

asus-zephyrus-g14

Say the laptop's scripts unparsed where the build seat has no bash

2026-10-08 16:20:45 +02:00

audit-logger

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

avahi

avahi: the discovery daemon declared, and why it hears nothing reported

2026-10-04 12:50:20 +02:00

baserow

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

betterbird

betterbird: know a composer by its instance alone, and bound a restart's worst case (review of #155)

2026-10-09 12:34:06 +02:00

blueman

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

bluetooth

Add nextcloud-client and blueman: the two tray apps get an owner and tools, each with one start

2026-10-05 11:47:38 +02:00

build-agent

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

ca-trust

ca-trust: a machine trusts the mesh's authority because a module put its root there

2026-09-29 15:07:40 +02:00

claude-code

claude-code: remove from or restore to only an agent account's own home

2026-10-09 09:51:18 +02:00

claude-licence-manager

Apply a binding that differs, and never repeat a generation a node passed

2026-10-05 09:59:19 +02:00

clipmenu

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

confluence

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

cups

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

dbus

dbus: hold node-message-bus, and never restart the bus live (hq ADR 0215)

2026-10-05 11:50:52 +02:00

de-spiegel

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

disk-load

Add disk-load: no tool said a machine's iowait, disk load or who does the I/O (hq issue 312)

2026-10-08 10:47:41 +02:00

distribution

Move the artifact store's tools into a module beside it, as the controller requires

2026-10-08 12:04:33 +02:00

dmenu

dmenu: the package, which makes the notifier's menu work, and a menu tool (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

dnsmasq

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

docker

docker: remove images no container or declaration uses, keeping the previous of each line (hq ADR 0251)

2026-10-08 11:56:43 +02:00

docker-compose

docker-compose: the package, and its projects as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

dunst

Say that nothing trusts dunst's and xdg's settings, so a verb may still change them

2026-10-09 01:42:23 +02:00

fail2ban

fail2ban: its tools in Go

2026-10-05 12:01:25 +02:00

feh

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

flatpak

flatpak: the package, Flathub with it, and the installations as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

fonts

fonts: the five decided faces as packages, and what the generic families mean (hq to-be 42 phase 2.1)

2026-10-04 13:02:23 +02:00

forticlient

forticlient: hand the client's resolver file to the machine's own resolver (hq ADR 0247)

2026-10-07 21:35:50 +02:00

gitea

Put no caller's text in a forge path unjudged: every segment checked, every sent path checked again

2026-10-09 13:35:15 +02:00

gitlab

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

gnome-keyring

gnome-keyring: the secret service as a module, claiming node-secret-service (hq ADR 0208, ADR 0102)

2026-10-04 13:15:39 +02:00

grafana

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

hello-web

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

home-assistant

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

hostname

Rename hosts to hostname, which also writes /etc/hostname (hq ADR 0223)

2026-10-05 23:43:14 +02:00

i3

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

i3status-rust

Keep the value a watch hands over at once, watch a dead watch again, and let the path lists grow only in the open (hq ADR 0260)

2026-10-08 16:12:37 +02:00

icecast

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

influxdb

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

invoicing

minio declares the bucket it derives; its consumers stop transcribing it (hq ADR 0188)

2026-10-04 02:34:06 +02:00

jira

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

keycloak

Keep secrets off command lines the runtime records (hq issue 282)

2026-10-07 01:37:21 +02:00

lab

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

lemurs

lemurs, clipmenu: X keeps its resources, and an image in the clipboard is never read as text

2026-10-04 16:34:02 +02:00

letta

Mark the OpenAI keys letta and supabase hold as issued outside the mesh

2026-10-06 12:13:57 +02:00

local-model-consumer

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

localization

localization: locale, time zone and console keymap as one module

2026-10-04 12:50:20 +02:00

logrotate

logrotate: rotation on every machine, its base configuration owned

2026-10-04 12:50:20 +02:00

mailu

Name the hq issue by its number: 294 was taken on an open branch, this is 295

2026-10-07 19:28:54 +02:00

marrytts

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

matrix

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

memory-pressure

Phase 3: asus-zephyrus-g14 and memory-pressure, with Go tools and long-running code

2026-10-04 15:42:56 +02:00

mesh-catalog

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

mesh-delivery

Cover a held merge only when the forge says a later delivered merge contains it (review of #150)

2026-10-09 02:57:18 +02:00

mesh-vault

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

mesh-watcher

messenger: never say history as news — read the open conditions first, coalesce bursts

2026-10-06 12:03:19 +02:00

messenger

Load the records the live build kept, remind every quiet warning, silence only its own condition

2026-10-08 14:53:11 +02:00

minio

The derived-value record is ADR 0202 (was 0201)

2026-10-08 01:42:16 +02:00

model-usage

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

mongodb

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

mosquitto

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

mounts

Say that the modules' own checks are the only line before root, since sudo grants the account everything

2026-10-08 20:21:28 +02:00

mssql

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

n8n

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

nats

Read the tested nats release from the server itself

2026-10-08 18:07:29 +02:00

netcheck

netcheck: one module, a Go tools bundle and a TypeScript one (hq ADR 0188, 0193)

2026-10-04 00:34:31 +02:00

networkmanager

Serve the uplink seat's verbs from both of its holders (hq ADR 0241)

2026-10-07 19:19:52 +02:00

nextcloud

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

nextcloud-client

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

nfs-server

Let nfs-server's tests see their folders as the library owner's, so the root refusal is tested and not tripped when the build seat runs them as root

2026-10-08 21:05:52 +02:00

nftables

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

nm-applet

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

node-env

node-env: the account's environment as one module's two files

2026-10-04 03:59:50 +02:00

nodered

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

ollama

Bound the holder's measuring; dump the database platform (hq ADR 0233)

2026-10-06 17:00:23 +02:00

only-office

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

openai-consumer

openai-consumer: its apply is a scheduled process (hq ADR 0198)

2026-10-04 00:52:31 +02:00

openrazer

Declare the operator's account in the openrazer group (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

pacman

pacman: the package manager's configuration, mirrors and cache as a module

2026-10-04 12:50:20 +02:00

photos-eef

The photo clients publish the endpoint they declare (hq issue 227)

2026-10-04 12:25:28 +02:00

photos-filip

The photo clients publish the endpoint they declare (hq issue 227)

2026-10-04 12:25:28 +02:00

picom

picom: keep the configuration trusted, so only the terminal sets the backend (review of #157)

2026-10-09 12:33:41 +02:00

polychromatic

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

postgres

Report as revoked only what the read-back shows gone, and take back what the reader passed on (review of hq issue 337)

2026-10-08 22:11:06 +02:00

power

Follow bar values so a dead watch speaks, date them by their reading, and widen the path check (hq ADR 0260)

2026-10-08 16:12:37 +02:00

powerlevel10k

powerlevel10k: the prompt as a pinned archive of the module's own, loaded from a slot

2026-10-04 04:04:10 +02:00

records

records: list the decision records by topic when asked, since hq stores no list (hq ADR 0248)

2026-10-07 23:38:13 +02:00

redis

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

restic

Bound the holder's measuring; dump the database platform (hq ADR 0233)

2026-10-06 17:00:23 +02:00

rofi

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

route-adapter

Fold public-acme into route-proxy; drop dhcpcd and cloudflare-dns (hq ADR 0226)

2026-10-06 14:59:43 +02:00

route-proxy

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

screen-lock

screen-lock: recognise the colour build by its version scheme; its version line never says color

2026-10-04 17:07:40 +02:00

searxng

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

sensors

sensors: take a SAS drive's standby, whose mode holds spaces

2026-10-08 15:04:02 +02:00

showcase

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

slack

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

snapd

snapd: tools for the snaps, the package blocked on the mesh's AUR repository (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

ssh-client

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

sshd

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

step-ca

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

sudo

sudo: declare the operator account's passwordless escalation as a module

2026-10-04 12:50:20 +02:00

supabase

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

systemd

Record a removal's outcome, publish it, and read one directory once

2026-10-08 17:55:56 +02:00

systemd-networkd

Serve the uplink seat's verbs from both of its holders (hq ADR 0241)

2026-10-07 19:19:52 +02:00

systemd-resolved

systemd-resolved: say when a route's domains do cross the bus

2026-10-07 21:35:49 +02:00

time-sync

time-sync: one time daemon, timesyncd, with its servers declared

2026-10-04 12:50:20 +02:00

triggerhappy

triggerhappy: the machine's hotkeys as a module holding node-hotkeys (hq ADR 0212)

2026-10-04 16:50:57 +02:00

umami

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

unifi

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

website

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

xclip

xclip: the package, and the operator's clipboard from the mesh (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

xdg

xdg: keep the folders file trusted, so only the terminal sets the folders (hq issue 346)

2026-10-09 12:40:04 +02:00

xorg

xorg: refuse a window that is not on the screen, and keep an inline screenshot within the bus (review of #154)

2026-10-09 12:23:51 +02:00

xterm

xterm: the terminal holds node-terminal-emulator; its resources through xorg's slot (hq ADR 0208)

2026-10-04 13:21:47 +02:00

zfs

Keep the scheduled run's served slot in a folder of root's alone, written never through a link

2026-10-09 01:55:54 +02:00

zsh

zsh: let a machine withhold node-login-shell's execute

2026-10-09 00:10:28 +02:00

zsh-autosuggestions

zsh-autosuggestions, zsh-syntax-highlighting: the plugins as packages and one line each

2026-10-04 04:04:35 +02:00

zsh-syntax-highlighting

zsh-autosuggestions, zsh-syntax-highlighting: the plugins as packages and one line each

2026-10-04 04:04:35 +02:00