jochen be53f5167a mesh-mail: bound a fetch by bytes, show mail_accounts only to its grantees, say why grants are unread, judge a secret without reading it (hq issue 733) ...

The review of #300 found a batch of 25 whole messages could hold a gigabyte,
mail_accounts told ungranted callers folder names, counts and server errors,
an unreadable grants setting was refused without its reason, and the watch
read the password only to learn it was there.

2026-10-14 22:24:11 +02:00

..

adwaita

adwaita: the theme as a module, dark by default, for GTK, Qt, the portal and the cursor (hq ADR 0208)

2026-10-04 13:21:47 +02:00

artifact-store-tools

artifact-store-tools: say an image a definition pins is named by a definition, under any name the store has had (issue 323)

2026-10-12 14:47:06 +02:00

asus-zephyrus-g14

Say the laptop's scripts unparsed where the build seat has no bash

2026-10-08 16:20:45 +02:00

audit-logger

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

avahi

avahi: the discovery daemon declared, and why it hears nothing reported

2026-10-04 12:50:20 +02:00

baserow

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

betterbird

Revert the showmissed lock of #277: the operator wants no special handling in betterbird's config (hq issue 640)

2026-10-13 16:54:51 +02:00

blueman

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

bluetooth

Add nextcloud-client and blueman: the two tray apps get an owner and tools, each with one start

2026-10-05 11:47:38 +02:00

build-agent

Give the build agent a judge cache of its own, and prove a release branch's move puts its verdicts out of date

2026-10-14 13:48:30 +00:00

ca-trust

ca-trust: a machine trusts the mesh's authority because a module put its root there

2026-09-29 15:07:40 +02:00

claude-code

A withheld change line in the note keeps its key's name; SDK at 5933eb7 (the review of mesh-controller #304)

2026-10-13 20:32:50 +02:00

claude-licence-manager

licence manager: a login's adoption is said beside the bindings it made, not first (issue 625)

2026-10-13 11:49:30 +00:00

clipmenu

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

confluence

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

cups

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

dbus

dbus: hold node-message-bus, and never restart the bus live (hq ADR 0215)

2026-10-05 11:50:52 +02:00

de-spiegel

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

desk-channel

A withheld change line in the note keeps its key's name; SDK at 5933eb7 (the review of mesh-controller #304)

2026-10-13 20:32:50 +02:00

dev-tools

dev-tools: give every node the toolchains to build and test the mesh's code (issue 626)

2026-10-13 11:42:12 +00:00

disk-load

Add disk-load: no tool said a machine's iowait, disk load or who does the I/O (hq issue 312)

2026-10-08 10:47:41 +02:00

distribution

Move the artifact store's tools into a module beside it, as the controller requires

2026-10-08 12:04:33 +02:00

dmenu

dmenu: the package, which makes the notifier's menu work, and a menu tool (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

dnsmasq

Answer the review of hq issue 348's catalogue change

2026-10-09 15:25:45 +02:00

docker

docker: keep the module's state in the mesh's directory, never Docker's own

2026-10-11 18:01:24 +02:00

docker-compose

docker-compose: the package, and its projects as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

dunst

dunst: the menu takes no typed text, so a typed line never becomes a choice

2026-10-10 00:11:45 +02:00

fail2ban

fail2ban: know the own-addresses list in the form fail2ban prints it (hq issue 238)

2026-10-13 11:14:24 +02:00

feh

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

flatpak

flatpak: the package, Flathub with it, and the installations as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

fonts

fonts: the five decided faces as packages, and what the generic families mean (hq to-be 42 phase 2.1)

2026-10-04 13:02:23 +02:00

forticlient

forticlient: hand the client's resolver file to the machine's own resolver (hq ADR 0247)

2026-10-07 21:35:50 +02:00

gitea

Name the keys gitea's mergeable config takes: none (ADR 0326)

2026-10-14 21:50:05 +02:00

gitlab

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

gnome-keyring

gnome-keyring: the secret service as a module, claiming node-secret-service (hq ADR 0208, ADR 0102)

2026-10-04 13:15:39 +02:00

grafana

Make grafana prefer the vault's password, and let the secrets list only shrink (hq issue 342)

2026-10-13 07:43:08 +02:00

hello-web

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

home-assistant

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

hostname

Rename hosts to hostname, which also writes /etc/hostname (hq ADR 0223)

2026-10-05 23:43:14 +02:00

i3

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

i3status-rust

Keep the value a watch hands over at once, watch a dead watch again, and let the path lists grow only in the open (hq ADR 0260)

2026-10-08 16:12:37 +02:00

icecast

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

influxdb

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

invoicing

minio declares the bucket it derives; its consumers stop transcribing it (hq ADR 0188)

2026-10-04 02:34:06 +02:00

jira

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

keycloak

Name the setting keys searxng, keycloak and betterbird files take (hq issue 168, ADR 0326)

2026-10-12 17:47:27 +02:00

lab

Merge pull request 'lab: name the base image's age, refuse a stale one, and rebuild it (issue 698)' (#288) from fix/698-the-lab-names-its-base-age into main

2026-10-14 05:12:37 +00:00

lemurs

lemurs, clipmenu: X keeps its resources, and an image in the clipboard is never read as text

2026-10-04 16:34:02 +02:00

letta

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

local-model-consumer

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

localization

localization: locale, time zone and console keymap as one module

2026-10-04 12:50:20 +02:00

logrotate

logrotate: rotation on every machine, its base configuration owned

2026-10-04 12:50:20 +02:00

mailu

Merge pull request 'mailu: declare its unhealthy urgent (hq ADR 0355 §5, issue 691)' (#296) from adr-355-mailu-urgent into main

2026-10-14 17:01:22 +00:00

marrytts

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

matrix

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

memory-pressure

Phase 3: asus-zephyrus-g14 and memory-pressure, with Go tools and long-running code

2026-10-04 15:42:56 +02:00

mesh-catalog

mesh-catalog: pass over a build off its repository's trunk, as the controller does (ADR 0238)

2026-10-14 20:09:39 +02:00

mesh-cli

mesh-cli: build on the SDK that reads the engine's refusal after a failed write, so a caller hears busy, not broken pipe (novox/hq issue 444)

2026-10-11 02:56:55 +02:00

mesh-delivery

Merge a pull request marked ready at its head once its checks pass (issue 722)

2026-10-14 21:23:26 +02:00

mesh-issues

Read the mesh's comment verdicts as approvals, and warn on no fix timed from the log (issue 403, review 69)

2026-10-12 16:16:04 +02:00

mesh-knowledge

Say which provision five consumers' checks exercise, so a database down is one condition (hq issue 145)

2026-10-14 03:21:53 +02:00

mesh-mail

mesh-mail: bound a fetch by bytes, show mail_accounts only to its grantees, say why grants are unread, judge a secret without reading it (hq issue 733)

2026-10-14 22:24:11 +02:00

mesh-reads

mesh-reads: read a node's files and accounts as an account that holds no secret (hq ADR 0310, issue 418)

2026-10-12 14:32:22 +02:00

mesh-vault

Refuse a daemon's line in what a module shows: the operator types nox (hq ADR 0272, issue 356)

2026-10-09 18:33:49 +02:00

mesh-watcher

messenger: never say history as news — read the open conditions first, coalesce bursts

2026-10-06 12:03:19 +02:00

messenger

An answered ask keeps its question whole, its answer below it (issue 714)

2026-10-14 20:06:24 +02:00

minio

The derived-value record is ADR 0202 (was 0201)

2026-10-08 01:42:16 +02:00

model-usage

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

mongodb

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

mosquitto

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

mounts

mounts: list says an armed automount waits, not mounted, as the look already judges it (issue 437)

2026-10-11 02:17:47 +02:00

mssql

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

n8n

Say which provision five consumers' checks exercise, so a database down is one condition (hq issue 145)

2026-10-14 03:21:53 +02:00

nats

nats: say whether a user's grant is in force on the running server, not only written (hq issue 353)

2026-10-12 12:13:03 +02:00

netcheck

Read the tunnel through sudo where the tool runner is not root (hq issue 522)

2026-10-12 00:05:04 +02:00

networkmanager

Serve the uplink seat's verbs from both of its holders (hq ADR 0241)

2026-10-07 19:19:52 +02:00

nextcloud

Say which provision five consumers' checks exercise, so a database down is one condition (hq issue 145)

2026-10-14 03:21:53 +02:00

nextcloud-client

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

nfs-server

nfs-server: one test per guard (each stray guard, the failed-reload retry, the empty data list, the walk's stop, a stopping pass); say that a start drops hand-made exports and that unknown backup paths are a deliberate warning (review of #142)

2026-10-09 14:45:03 +02:00

nftables

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

nm-applet

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

node-env

node-env: the account's environment as one module's two files

2026-10-04 03:59:50 +02:00

nodered

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

ollama

Bound the holder's measuring; dump the database platform (hq ADR 0233)

2026-10-06 17:00:23 +02:00

only-office

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

openai-consumer

openai-consumer: its apply is a scheduled process (hq ADR 0198)

2026-10-04 00:52:31 +02:00

openrazer

Declare the operator's account in the openrazer group (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

pacman

pacman: the package manager's configuration, mirrors and cache as a module

2026-10-04 12:50:20 +02:00

photos-eef

The photo clients publish the endpoint they declare (hq issue 227)

2026-10-04 12:25:28 +02:00

photos-filip

The photo clients publish the endpoint they declare (hq issue 227)

2026-10-04 12:25:28 +02:00

picom

picom: keep the configuration trusted, so only the terminal sets the backend (review of #157)

2026-10-09 12:33:41 +02:00

polychromatic

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

postgres

Report as revoked only what the read-back shows gone, and take back what the reader passed on (review of hq issue 337)

2026-10-08 22:11:06 +02:00

power

Follow bar values so a dead watch speaks, date them by their reading, and widen the path check (hq ADR 0260)

2026-10-08 16:12:37 +02:00

powerlevel10k

powerlevel10k: the prompt as a pinned archive of the module's own, loaded from a slot

2026-10-04 04:04:10 +02:00

records

Nothing reads decision records from hq: records_decisions retired, reserve asks the knowledge base, an empty import refuses (hq issue 488)

2026-10-11 12:25:58 +02:00

redis

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

restic

restic: judge no night overdue where nothing is declared, and a count's age by the time the machine was awake

2026-10-11 21:10:11 +02:00

rofi

rofi: the desk's secret prompt names who asked (hq ADR 0277)

2026-10-10 15:17:57 +02:00

route-adapter

mesh-cli: the operator's command on every node, nox in zsh (hq ADR 0272)

2026-10-09 12:11:21 +02:00

route-proxy

Say how the build agent and the route proxy are ready (novox/hq issue 544)

2026-10-12 21:33:13 +02:00

screen-lock

screen-lock: recognise the colour build by its version scheme; its version line never says color

2026-10-04 17:07:40 +02:00

searxng

Name the setting keys searxng, keycloak and betterbird files take (hq issue 168, ADR 0326)

2026-10-12 17:47:27 +02:00

sensors

sensors: take a SAS drive's standby, whose mode holds spaces

2026-10-08 15:04:02 +02:00

showcase

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

slack

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

snapd

snapd: tools for the snaps, the package blocked on the mesh's AUR repository (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

ssh-client

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

sshd

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

step-ca

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

sudo

Merge remote-tracking branch 'origin/main' into feat/the-agent-account-is-declared

2026-10-09 23:37:04 +02:00

supabase

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

systemd

Record a removal's outcome, publish it, and read one directory once

2026-10-08 17:55:56 +02:00

systemd-networkd

Serve the uplink seat's verbs from both of its holders (hq ADR 0241)

2026-10-07 19:19:52 +02:00

systemd-resolved

systemd-resolved: say when a route's domains do cross the bus

2026-10-07 21:35:49 +02:00

telegram

An answered ask keeps its question whole, its answer below it (issue 714)

2026-10-14 20:06:24 +02:00

time-sync

time-sync: one time daemon, timesyncd, with its servers declared

2026-10-04 12:50:20 +02:00

triggerhappy

triggerhappy: the machine's hotkeys as a module holding node-hotkeys (hq ADR 0212)

2026-10-04 16:50:57 +02:00

umami

Hold umami's check to the share route's own 404, so an unknown route cannot pass it (hq issue 145, review 262)

2026-10-14 07:07:11 +02:00

unifi

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

website

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

xclip

xclip: the package, and the operator's clipboard from the mesh (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

xdg

xdg: keep the folders file trusted, so only the terminal sets the folders (hq issue 346)

2026-10-09 12:40:04 +02:00

xorg

xorg: refuse a window that is not on the screen, and keep an inline screenshot within the bus (review of #154)

2026-10-09 12:23:51 +02:00

xterm

xterm: the terminal holds node-terminal-emulator; its resources through xorg's slot (hq ADR 0208)

2026-10-04 13:21:47 +02:00

zfs

Keep the scheduled run's served slot in a folder of root's alone, written never through a link

2026-10-09 01:55:54 +02:00

zsh

zsh: let a machine withhold node-login-shell's execute

2026-10-09 00:10:28 +02:00

zsh-autosuggestions

zsh-autosuggestions, zsh-syntax-highlighting: the plugins as packages and one line each

2026-10-04 04:04:35 +02:00

zsh-syntax-highlighting

zsh-autosuggestions, zsh-syntax-highlighting: the plugins as packages and one line each

2026-10-04 04:04:35 +02:00