jschoubben f83e6e4713 Make each sensitive vault verb judge its own caller ...

The controller judged the operator's account for approving or deleting a
retirement, rotating a secret and exporting sealed copies; it is not
placed, and these verbs are reached through the mesh MCP server on each
machine. Each now answers the operator's account (person.<name>), or a
caller naming its own recorded hand act for that verb and subject, and
nothing else (ADR 0590 §8, issue 1126).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

2026-11-02 12:29:56 +01:00

..

adwaita

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

artifact-store-tools

Drop artifact-store-tools' controller client; the provisioner client reads placement

2026-11-02 12:29:56 +01:00

asus-zephyrus-g14

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

audit-logger

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

avahi

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

baserow

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

blueman

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

bluetooth

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

brother

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

buildah

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

ca-trust

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

claude-code

Let claude-code read its tools and machines from the bus, not the controller

2026-11-02 12:29:56 +01:00

claude-licence-manager

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

clipmenu

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

confluence

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

cups

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

dbus

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

desk-channel

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

dev-tools

Take the build agent and the toolchain images out of the catalogue's prose, and refuse the word where it comes back outside the one module still naming it (issue 1295, E6)

2026-10-23 15:34:11 +02:00

disk-load

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

distribution

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

dmenu

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

dnsmasq

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

docker

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

docker-compose

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

dunst

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

fail2ban

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

feh

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

flatpak

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

fonts

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

forticlient

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

gitea

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

gitlab

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

gnome-keyring

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

go

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

grafana

Say grafana's refused admin password once with its cause, and ask again hourly, not every 30 s (issue 774)

2026-10-30 18:18:16 +01:00

hello-web

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

home-assistant

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

hostname

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

i3

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

i3status-rust

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

icecast

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

influxdb

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

invoicing

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

jira

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

kernel

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

keycloak

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

lab

Take the build agent and the toolchain images out of the catalogue's prose, and refuse the word where it comes back outside the one module still naming it (issue 1295, E6)

2026-10-23 15:34:11 +02:00

lemurs

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

letta

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

local-model-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

localization

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

logrotate

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mailu

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

marrytts

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

matrix

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

memory-pressure

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-build-go

Read a go download failure as a pin on a pull request head only when go does not know the revision, so a network failure is retaken and says its own cause

2026-11-02 12:29:56 +01:00

mesh-build-image

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-build-node

Pin the Go and TypeScript build modules to mesh-sdk 67354f8: a check ask for another toolchain is declined too (ADR 0584, issue 1578)

2026-11-01 15:38:27 +01:00

mesh-catalog

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

mesh-cli

nox cleanup delete confirms with the holder's name, as the vault asks

2026-11-02 10:47:56 +01:00

mesh-conditions

mesh-config and mesh-conditions without the controller's lease

2026-11-02 10:43:52 +01:00

mesh-config

mesh-config and mesh-conditions without the controller's lease

2026-11-02 10:43:52 +01:00

mesh-delivery-gate

Say a failed check first in the merge ask's headline, since a merge is not gated on the check and the headline is the phone's only warning (issue 1166)

2026-11-01 18:06:27 +01:00

mesh-files

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-hand-acts

Make the controller checks strict: nothing names the placed-nowhere controller

2026-11-02 12:29:56 +01:00

mesh-healers

mesh-healers act and artifact-store-tools sweeps without the controller's lease

2026-11-02 10:38:58 +01:00

mesh-issues

Point messenger, mesh-watcher, restic and mesh-issues away from the controller

2026-11-02 12:29:56 +01:00

mesh-knowledge

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-mail

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-mail-notifier

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-mail-reader

Give mesh-mail-reader's two acceptance tests a due date a week from now, so they do not expire

2026-11-02 12:29:56 +01:00

mesh-mail-web

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-provisioner

Pin pacman and mesh-provisioner to the group's mesh-sdk head b2a27ed5 (issues 1953, 1876, 1954)

2026-11-01 16:24:04 +01:00

mesh-provisioner-client

Drop artifact-store-tools' controller client; the provisioner client reads placement

2026-11-02 12:29:56 +01:00

mesh-reads

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mesh-self-check

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

mesh-vault

Make each sensitive vault verb judge its own caller

2026-11-02 12:29:56 +01:00

mesh-watcher

Point messenger, mesh-watcher, restic and mesh-issues away from the controller

2026-11-02 12:29:56 +01:00

messenger

Point messenger, mesh-watcher, restic and mesh-issues away from the controller

2026-11-02 12:29:56 +01:00

minio

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

model-usage

Commit the lock files of mssql, mongodb, model-usage and mesh-catalog, and refuse a Node module without one (issue 1868, ADR 0469 §5)

2026-10-22 18:12:32 +02:00

mongodb

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

mosquitto

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

mounts

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

mssql

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

n8n

Keep n8n on its own Dockerfile: since ADR 0487 a module may ship one, and the move to the upstream image only added a config value and a uuid mount (the operator, 2026-10-22)

2026-10-22 11:47:44 +02:00

nats

Let the bus tools remove the controller's leftovers by one word

2026-11-02 12:29:56 +01:00

netcheck

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

networkmanager

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

nextcloud

nextcloud: repair the account only on a 401, never reset the throttle (issue 1253, review 2)

2026-10-25 16:57:46 +01:00

nextcloud-client

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

nfs-server

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

nftables

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

nm-applet

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

node-env

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nodejs

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

nodered

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

ollama

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

only-office

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

openai-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

openrazer

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

pacman

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

photos-eef

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

photos-filip

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

picom

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

polychromatic

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

postgres

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

power

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

powerlevel10k

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

records

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

redis

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

restic

Point messenger, mesh-watcher, restic and mesh-issues away from the controller

2026-11-02 12:29:56 +01:00

rofi

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

route-adapter

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

screen-lock

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

searxng

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

sensors

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

showcase

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

slack

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

snapd

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

ssh-client

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

sshd

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

step-ca

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

sudo

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

supabase

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

systemd

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

systemd-networkd

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

systemd-resolved

Make tests that wait for concurrent work wait on the event or a condition with a long deadline (issue 1814)

2026-11-01 17:24:19 +01:00

telegram

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

time-sync

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

triggerhappy

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

umami

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

unifi

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

website

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

xclip

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

xdg

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

xorg

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

xterm

Pin every module to the group's mesh-sdk head after the gofmt fix

2026-11-01 03:30:59 +01:00

zfs

Keep three timeout tests' upper bounds well under the production timeouts, so a timeout that falls back to production still fails (issue 1814, review round 3)

2026-11-01 17:26:58 +01:00

zsh

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

zsh-autosuggestions

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

zsh-syntax-highlighting

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00