jochen dd39d4ace7 lab: name the bound credential in the tools bundle's env, and skip the locked-tree test as root (hq issue 624, reviews 198, 199) ...

The lab's tools read their bound npm-package-registry credential, root's at 0600 on the machine. The
controller gives the runtime's account exactly the files a tools bundle names in its env (ADR 0192), as
gitea and umami are given theirs, so the bundle now names the credential and its binding there, and no
other credential changes hands.

The merge check runs as root, where no directory mode stops a removal: the test that makes an
unremovable tree now skips there before it makes anything, and a second test clears leftovers whoever
runs it.

2026-10-13 14:51:18 +02:00

..

adwaita

adwaita: the theme as a module, dark by default, for GTK, Qt, the portal and the cursor (hq ADR 0208)

2026-10-04 13:21:47 +02:00

artifact-store-tools

artifact-store-tools: say an image a definition pins is named by a definition, under any name the store has had (issue 323)

2026-10-12 14:47:06 +02:00

asus-zephyrus-g14

Say the laptop's scripts unparsed where the build seat has no bash

2026-10-08 16:20:45 +02:00

audit-logger

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

avahi

avahi: the discovery daemon declared, and why it hears nothing reported

2026-10-04 12:50:20 +02:00

baserow

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

betterbird

betterbird: write the account lists only while the profile is closed, and never propose over an unreadable layer (hq issue 586, review 121)

2026-10-13 02:12:06 +02:00

blueman

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

bluetooth

Add nextcloud-client and blueman: the two tray apps get an owner and tools, each with one start

2026-10-05 11:47:38 +02:00

build-agent

Let genesis assign the build agent before the package registry exists (hq issue 121, ADR 0336)

2026-10-13 02:50:39 +02:00

ca-trust

ca-trust: a machine trusts the mesh's authority because a module put its root there

2026-09-29 15:07:40 +02:00

claude-code

licence manager: say what moved a binding, why, and who asked (issue 625)

2026-10-13 11:45:52 +00:00

claude-licence-manager

licence manager: a login's adoption is said beside the bindings it made, not first (issue 625)

2026-10-13 11:49:30 +00:00

clipmenu

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

confluence

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

cups

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

dbus

dbus: hold node-message-bus, and never restart the bus live (hq ADR 0215)

2026-10-05 11:50:52 +02:00

de-spiegel

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

desk-channel

Review: keep the desk's notification ids so lost answers are said again in place (issue 384)

2026-10-10 16:13:57 +02:00

dev-tools

dev-tools: give every node the toolchains to build and test the mesh's code (issue 626)

2026-10-13 11:42:12 +00:00

disk-load

Add disk-load: no tool said a machine's iowait, disk load or who does the I/O (hq issue 312)

2026-10-08 10:47:41 +02:00

distribution

Move the artifact store's tools into a module beside it, as the controller requires

2026-10-08 12:04:33 +02:00

dmenu

dmenu: the package, which makes the notifier's menu work, and a menu tool (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

dnsmasq

Answer the review of hq issue 348's catalogue change

2026-10-09 15:25:45 +02:00

docker

docker: keep the module's state in the mesh's directory, never Docker's own

2026-10-11 18:01:24 +02:00

docker-compose

docker-compose: the package, and its projects as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

dunst

dunst: the menu takes no typed text, so a typed line never becomes a choice

2026-10-10 00:11:45 +02:00

fail2ban

fail2ban: know the own-addresses list in the form fail2ban prints it (hq issue 238)

2026-10-13 11:14:24 +02:00

feh

i3: other modules' lines are contributions to node-display-session (hq ADR 0212)

2026-10-05 10:11:27 +02:00

flatpak

flatpak: the package, Flathub with it, and the installations as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

fonts

fonts: the five decided faces as packages, and what the generic families mean (hq to-be 42 phase 2.1)

2026-10-04 13:02:23 +02:00

forticlient

forticlient: hand the client's resolver file to the machine's own resolver (hq ADR 0247)

2026-10-07 21:35:50 +02:00

gitea

lab: a read-only forge account of its own, and no credential left on disk after a stop (hq issue 624, review 196)

2026-10-13 14:00:59 +02:00

gitlab

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

gnome-keyring

gnome-keyring: the secret service as a module, claiming node-secret-service (hq ADR 0208, ADR 0102)

2026-10-04 13:15:39 +02:00

grafana

Make grafana prefer the vault's password, and let the secrets list only shrink (hq issue 342)

2026-10-13 07:43:08 +02:00

hello-web

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

home-assistant

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

hostname

Rename hosts to hostname, which also writes /etc/hostname (hq ADR 0223)

2026-10-05 23:43:14 +02:00

i3

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

i3status-rust

Keep the value a watch hands over at once, watch a dead watch again, and let the path lists grow only in the open (hq ADR 0260)

2026-10-08 16:12:37 +02:00

icecast

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

influxdb

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

invoicing

minio declares the bucket it derives; its consumers stop transcribing it (hq ADR 0188)

2026-10-04 02:34:06 +02:00

jira

The seven say what the runtime loads from their tools bundle (hq ADR 0192)

2026-10-03 15:58:19 +02:00

keycloak

Name the setting keys searxng, keycloak and betterbird files take (hq issue 168, ADR 0326)

2026-10-12 17:47:27 +02:00

lab

lab: name the bound credential in the tools bundle's env, and skip the locked-tree test as root (hq issue 624, reviews 198, 199)

2026-10-13 14:51:18 +02:00

lemurs

lemurs, clipmenu: X keeps its resources, and an image in the clipboard is never read as text

2026-10-04 16:34:02 +02:00

letta

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

local-model-consumer

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

localization

localization: locale, time zone and console keymap as one module

2026-10-04 12:50:20 +02:00

logrotate

logrotate: rotation on every machine, its base configuration owned

2026-10-04 12:50:20 +02:00

mailu

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

marrytts

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

matrix

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

memory-pressure

Phase 3: asus-zephyrus-g14 and memory-pressure, with Go tools and long-running code

2026-10-04 15:42:56 +02:00

mesh-catalog

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

mesh-cli

mesh-cli: build on the SDK that reads the engine's refusal after a failed write, so a caller hears busy, not broken pipe (novox/hq issue 444)

2026-10-11 02:56:55 +02:00

mesh-delivery

Deliver a merge whose walk said its modules matched what runs, instead of stopping it as stranded (hq issue 611)

2026-10-13 08:18:25 +02:00

mesh-issues

Read the mesh's comment verdicts as approvals, and warn on no fix timed from the log (issue 403, review 69)

2026-10-12 16:16:04 +02:00

mesh-knowledge

mesh-knowledge: let a record change a drafted clause, and never redraft a record whose clauses others link by number

2026-10-12 14:05:37 +02:00

mesh-reads

mesh-reads: read a node's files and accounts as an account that holds no secret (hq ADR 0310, issue 418)

2026-10-12 14:32:22 +02:00

mesh-vault

Refuse a daemon's line in what a module shows: the operator types nox (hq ADR 0272, issue 356)

2026-10-09 18:33:49 +02:00

mesh-watcher

messenger: never say history as news — read the open conditions first, coalesce bursts

2026-10-06 12:03:19 +02:00

messenger

messenger: end a replaced ask's own message, and drop what a cleared record owed (issue 548)

2026-10-12 13:44:08 +02:00

minio

The derived-value record is ADR 0202 (was 0201)

2026-10-08 01:42:16 +02:00

model-usage

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

mongodb

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

mosquitto

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

mounts

mounts: list says an armed automount waits, not mounted, as the look already judges it (issue 437)

2026-10-11 02:17:47 +02:00

mssql

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

n8n

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

nats

nats: say whether a user's grant is in force on the running server, not only written (hq issue 353)

2026-10-12 12:13:03 +02:00

netcheck

Read the tunnel through sudo where the tool runner is not root (hq issue 522)

2026-10-12 00:05:04 +02:00

networkmanager

Serve the uplink seat's verbs from both of its holders (hq ADR 0241)

2026-10-07 19:19:52 +02:00

nextcloud

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

nextcloud-client

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

nfs-server

nfs-server: one test per guard (each stray guard, the failed-reload retry, the empty data list, the walk's stop, a stopping pass); say that a start drops hand-made exports and that unknown backup paths are a deliberate warning (review of #142)

2026-10-09 14:45:03 +02:00

nftables

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

nm-applet

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

node-env

node-env: the account's environment as one module's two files

2026-10-04 03:59:50 +02:00

nodered

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

ollama

Bound the holder's measuring; dump the database platform (hq ADR 0233)

2026-10-06 17:00:23 +02:00

only-office

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

openai-consumer

openai-consumer: its apply is a scheduled process (hq ADR 0198)

2026-10-04 00:52:31 +02:00

openrazer

Declare the operator's account in the openrazer group (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

pacman

pacman: the package manager's configuration, mirrors and cache as a module

2026-10-04 12:50:20 +02:00

photos-eef

The photo clients publish the endpoint they declare (hq issue 227)

2026-10-04 12:25:28 +02:00

photos-filip

The photo clients publish the endpoint they declare (hq issue 227)

2026-10-04 12:25:28 +02:00

picom

picom: keep the configuration trusted, so only the terminal sets the backend (review of #157)

2026-10-09 12:33:41 +02:00

polychromatic

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

postgres

Report as revoked only what the read-back shows gone, and take back what the reader passed on (review of hq issue 337)

2026-10-08 22:11:06 +02:00

power

Follow bar values so a dead watch speaks, date them by their reading, and widen the path check (hq ADR 0260)

2026-10-08 16:12:37 +02:00

powerlevel10k

powerlevel10k: the prompt as a pinned archive of the module's own, loaded from a slot

2026-10-04 04:04:10 +02:00

records

Nothing reads decision records from hq: records_decisions retired, reserve asks the knowledge base, an empty import refuses (hq issue 488)

2026-10-11 12:25:58 +02:00

redis

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

restic

restic: judge no night overdue where nothing is declared, and a count's age by the time the machine was awake

2026-10-11 21:10:11 +02:00

rofi

rofi: the desk's secret prompt names who asked (hq ADR 0277)

2026-10-10 15:17:57 +02:00

route-adapter

mesh-cli: the operator's command on every node, nox in zsh (hq ADR 0272)

2026-10-09 12:11:21 +02:00

route-proxy

Say how the build agent and the route proxy are ready (novox/hq issue 544)

2026-10-12 21:33:13 +02:00

screen-lock

screen-lock: recognise the colour build by its version scheme; its version line never says color

2026-10-04 17:07:40 +02:00

searxng

Name the setting keys searxng, keycloak and betterbird files take (hq issue 168, ADR 0326)

2026-10-12 17:47:27 +02:00

sensors

sensors: take a SAS drive's standby, whose mode holds spaces

2026-10-08 15:04:02 +02:00

showcase

audit-logger, model-usage: retry a failed write and never lose the event (hq issue 276)

2026-10-06 18:36:16 +02:00

slack

Hold what the tools say to the glossary's retired words (hq ADR 0244)

2026-10-07 20:02:09 +02:00

snapd

snapd: tools for the snaps, the package blocked on the mesh's AUR repository (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

ssh-client

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

sshd

Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

2026-10-06 18:39:13 +02:00

step-ca

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

sudo

Merge remote-tracking branch 'origin/main' into feat/the-agent-account-is-declared

2026-10-09 23:37:04 +02:00

supabase

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

systemd

Record a removal's outcome, publish it, and read one directory once

2026-10-08 17:55:56 +02:00

systemd-networkd

Serve the uplink seat's verbs from both of its holders (hq ADR 0241)

2026-10-07 19:19:52 +02:00

systemd-resolved

systemd-resolved: say when a route's domains do cross the bus

2026-10-07 21:35:49 +02:00

telegram

Review: a blip swallows no escalation or waiting reminder; replace safely (issue 373)

2026-10-10 14:22:53 +02:00

time-sync

time-sync: one time daemon, timesyncd, with its servers declared

2026-10-04 12:50:20 +02:00

triggerhappy

triggerhappy: the machine's hotkeys as a module holding node-hotkeys (hq ADR 0212)

2026-10-04 16:50:57 +02:00

umami

Declare every module's data; the backup holder measures it (hq ADR 0233)

2026-10-06 16:47:49 +02:00

unifi

Keep every password, token and API key the vault's, never a setting (hq issue 342)

2026-10-13 07:32:19 +02:00

website

Say how the first twenty-three long-running resources are ready (hq ADR 0240, to-be 48 Phase E)

2026-10-07 18:47:58 +02:00

xclip

xclip: the package, and the operator's clipboard from the mesh (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

xdg

xdg: keep the folders file trusted, so only the terminal sets the folders (hq issue 346)

2026-10-09 12:40:04 +02:00

xorg

xorg: refuse a window that is not on the screen, and keep an inline screenshot within the bus (review of #154)

2026-10-09 12:23:51 +02:00

xterm

xterm: the terminal holds node-terminal-emulator; its resources through xorg's slot (hq ADR 0208)

2026-10-04 13:21:47 +02:00

zfs

Keep the scheduled run's served slot in a folder of root's alone, written never through a link

2026-10-09 01:55:54 +02:00

zsh

zsh: let a machine withhold node-login-shell's execute

2026-10-09 00:10:28 +02:00

zsh-autosuggestions

zsh-autosuggestions, zsh-syntax-highlighting: the plugins as packages and one line each

2026-10-04 04:04:35 +02:00

zsh-syntax-highlighting

zsh-autosuggestions, zsh-syntax-highlighting: the plugins as packages and one line each

2026-10-04 04:04:35 +02:00