jschoubben 81a80c675c The builder declares what it announces ...

Its account is scoped from what it emits and consumes, and it declared neither —
which is why asking for a generic module account produced one that authenticated
and could do nothing, with the refusal surfacing a layer away as a permissions
error against a queue.

Declaring the announcement is not documentation here. It is what the permission
is derived from.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

2026-09-13 00:57:41 +02:00

..

amqp-email-forwarder

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

amqp-ping

amqp-ping says what it is made of, and can be built from its own directory

2026-09-13 00:52:57 +02:00

anthropic-consumer

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

anthropic-manager

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

audit-logger

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

baserow

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

bazarr

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

bookshelf

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

builder

The builder declares what it announces

2026-09-13 00:57:41 +02:00

cloudflare-dns

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

confluence

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

de-spiegel

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

dnsmasq

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

fail2ban

fail2ban: require the firewall capability, not the non-existent intrusion-prevention

2026-09-08 18:27:34 +02:00

firewall

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

gitea

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

gitlab

Convert gitlab into a tools-only mesh catalog module

2026-09-06 01:33:43 +02:00

grafana

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

hello-web

Declare what hello-web is made of, to prove a build from a path

2026-09-12 16:57:18 +02:00

home-assistant

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

icecast

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

influxdb

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

invoicing

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

jackett

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

jira

Convert confluence and jira into nox catalog modules

2026-09-06 01:49:22 +02:00

keycloak

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

lavinmq

Add lavinmq amqp provider and amqp-ping consumer

2026-09-06 15:50:19 +02:00

letta

fix: postgres consumers connect to the db the mesh named (the login), not a hardcoded app name

2026-09-06 13:47:16 +02:00

lidarr

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

local-model-consumer

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

mailu

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

marrytts

Convert four more hal modules: bookshelf, unifi, fail2ban, marrytts

2026-09-05 12:04:14 +02:00

mesh-catalog

The catalogue, as a module that owns the module graph

2026-09-12 23:16:05 +02:00

mesh-control

mesh-control: the enrolment endpoint is the substrate's, not the overlay's

2026-09-11 11:48:51 +02:00

minio

minio: pin the manifest these machines can actually run

2026-09-11 02:51:34 +02:00

model-usage

model-usage: the vendor-neutral usage store (ADR 0054)

2026-09-07 04:07:26 +02:00

mongodb

fix: db/cache/store providers must serve their port; drop baserow's empty redis contribution

2026-09-06 02:38:22 +02:00

mosquitto

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

mssql

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

n8n

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

nextcloud

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

nodered

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

novox.be

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

nzbget

modules: wire tool-runtime app credentials as own-secrets

2026-09-08 18:40:23 +02:00

ollama

local model: an ollama provider + a local-model consumer (ADR 0055)

2026-09-07 05:25:21 +02:00

ombi

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

only-office

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

openai-consumer

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

photos

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

photos-eef

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

photos-filip

Pin the operator's own images by digest, as every other image already is

2026-09-11 01:06:14 +02:00

plex

modules: wire tool-runtime app credentials as own-secrets

2026-09-08 18:40:23 +02:00

portainer

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

postgres

fix: db/cache/store providers must serve their port; drop baserow's empty redis contribution

2026-09-06 02:38:22 +02:00

public-acme

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

qbittorrent

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

radarr

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

redis

fix: db/cache/store providers must serve their port; drop baserow's empty redis contribution

2026-09-06 02:38:22 +02:00

registry

The artifact store requires nothing, because at genesis there is nothing

2026-09-11 00:06:23 +02:00

resolv-conf

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

resolved-split-dns

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

route-proxy

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00

searxng

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

sonarr

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

step-ca

step-ca: mount the directory, not each secret file

2026-09-11 08:49:55 +02:00

tautulli

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

umami

ADR 0056: selectable ACME issuer, step-ca init from operator root, route labels

2026-09-10 00:21:42 +02:00

unifi

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:49:16 +02:00

verdaccio

Give every module that would overflow its login a short slug

2026-09-10 20:57:45 +02:00