2026-03-28 - 2026-09-28
Overview
105 Pull requests merged by 2 users
Merged
#111 The controller follows the subject it decodes
Merged
#110 A merge on the forge builds what it moved, bases first
Merged
#109 rollout hand: a machine's membership, minted afresh and handed to an operator once
Merged
#108 A store row keeps its seat's protocol, and a holder may take work from its queue
Merged
#107 The build machine takes work on the bus its credential names, and the work queue has a taker
Merged
#106 A principal may hear what its consumer delivers
Merged
#105 The bus account has JetStream, and the control plane's client has its own inbox
Merged
#104 The control plane pins the bus's certificate, and keeps its password out of errors
Merged
#103 The control plane serves and pushes on the bus it is told to
Merged
#102 A machine may bind its consumer
Merged
#101 The mint leaves the control plane's old-bus secret alone
Merged
#100 The control plane mounts the bus secret it reads
Merged
#99 The network map resolves each machine with the seat holders on record
Merged
#98 The control plane speaks the new bus
Merged
#97 The mint names the bus by bare host, and can mint again
Merged
#96 The mint finds the bus on the hub
Merged
#95 The move mints every credential and tells each machine its membership
Merged
#93 The first handover records the standing holder without re-judging it
Merged
#92 AMQP is not a provision: the bus seat delivers the bus, and the word is refused
Merged
#91 A seat is handed over as one act, and the holder is on record
Merged
#90 The move ends with the old broker going, not staying
Merged
#89 The store owns the seat set, so only the control plane may judge a claim
Merged
#88 The Go base has to be 1.26: the NATS client requires it
Merged
#87 The bus on NATS: both transports behind seams, and the rollout switch
Merged
#86 The mesh owns the operator's ~/.ssh: account fact + home-scoped resources (to-be 29)
Merged
#85 A module declares its fail2ban jail; mesh composes per node (to-be 31 mechanism)
Merged
#84 A module can name the mesh's range: ${machine:mesh-range}
Merged
#83 Seats keep their former names — a rename is one DB op (ADR 0122, phase 2)
Merged
#82 Seats are data the controller owns, loaded from its store (ADR 0122, phase 1)
Merged
#81 Name system seats by scope; let a module define its own (ADR 0121)
Merged
#80 Facts carry the format as a template, so the control plane holds none (ADR 0120)
Merged
#79 The uplink seat (ADR 0117), and the mesh's names written into the hosts file, not over it (hq 128)
Merged
#78 The controller marks a deliberately-empty declaration owns_nothing (hq 127)
Merged
#77 An empty declaration is sent, so a node drops what it last held (hq 127)
Merged
#76 The mesh's interface takes over the found tunnel's MTU
Merged
#75 A taken tunnel brings its ListenPort, even on a node the hub cannot dial
Merged
#74 The broker opening is only on the broker's host, not every node
Merged
#73 A carried peer is nameable, and the mesh answers for it (hq 112)
Merged
#72 A repeat assignment says nothing changed (ADR 0115)
Merged
#71 A collision is two places, not two spellings
Merged
#70 The assignment's own root is a place, and the manifest's maps are placed
Merged
#69 A directory the mesh places: ${dir:<id>} and the pathless directory resource
Merged
#68 A route may say the largest body it carries
Merged
#54 mount the broker TLS directory bind, not the old named volume
Merged
#63 Seats are a closed set, a seat's holder answers for what it delivers, and a build source may live on the git seat
Merged
#67 route-proxy: a policy refusal is also not-my-token
Merged
#66 route-proxy: the challenge path falls through for real
Merged
#64 route-proxy: a second authority for internal names, and https targets
Merged
#65 builder: a clone may offer the forge's credential, through git's own store
Merged
#62 An image artifact may name its own build context, apart from the module's repository
Merged
#61 route-proxy serves a route's internal-name alias, never certifies it
Merged
#60 A route composes its internal-network alias too, not only its public name
Merged
#59 gitea's ssh port test matched a manifest mistake; resolver test used Names, not Machines
Merged
#58 route-proxy: a route carries the policy applied to a request
Merged
#57 contributes: a module's grant carries no value where it contributed several times
Merged
#56 plan: show what a module would open and why
Merged
#55 contributes: a module may answer one requirement several times
Merged
#53 Tell the resolver the machines, not the names the mesh merely serves
Merged
#52 Give the resolver the mesh's suffix as a local domain and a module its machine's address
Merged
#49 Adopt the predecessor's tunnel in place: its range, its address, its peers (hq ADR 0105)
Merged
#50 An address is read from the node's settings where it is used, never recorded with a port (hq issue 102)
Merged
#51 The artifact store's seat is one per mesh, and the test says so from the catalogue
Merged
#47 A node may move a port a module publishes as a mapping's machine side
Merged
#46 A container's environment follows a moved port, as a file already does (hq issue 088)
Merged
#45 Hold the forge to being an ordinary provider, in tests (hq issue 085)
Merged
#44 Adoption mode: a node in use is adopted before it is converged (hq ADR 0100–0103)
Merged
#43 Nothing the control queue carries is lost while the store restarts (issue 083)
Merged
#42 A report that arrives while the store restarts is kept, not lost (issue 082)
Merged
#41 Every machine was named twice over; only a machine on the private network is named (issue 079)
Merged
#40 Multiple fixes: a run-once step may name what it reads (ADR 0099); secret accept refuses an undeclared name (078)
Merged
#39 The control plane's recipe declares its base, and an undeclared FROM is refused (ADR 0097 live)
Merged
#38 Multiple fixes: several secrets per module (069), ask a module's tool (049), copy an upstream image (046), declare a vendor image (064)
Merged
#37 Multiple fixes: a stuck machine is said to be one (065), an undeclared mount is refused (026), an operator delivers a pair credential (070)
Merged
#36 The link knows a superseded report (issue 031)
Merged
#35 A secret reaches a process as a file (ADR 0086, closes issue 041)
Merged
#34 Secrets vault: operator key, a second seal on every secret, recovery and export
Merged
#33 The catalogue moves out, to novox/mesh-catalog
Merged
#32 The consistency cascade sends tolerantly and stops loudly (057 review)
Merged
#31 One push leaves the mesh consistent; the foundation's ports are forwarded (057, 063)
Merged
#30 The broker credential resolves the seat, not the hub (issue 059)
Merged
#29 The network carries the registry trust (ADR 0082, issues 042/048/062)
Merged
#28 The controller's seat is mesh-controller; second-node assignment refused
Merged
#27 A cross-node module reaches the broker by the hub's overlay name
Merged
#26 Self-upgrade installer: SDK-by-version, mesh-controller rename, foundation adopted
Merged
#25 Only a thing built and never run is unassignable
Merged
#24 ssh is never left without a rule
Merged
#23 The firewall governs what is forwarded, and never closes ssh
Merged
#22 A module that puts nothing on a machine cannot be assigned to one
Merged
#21 An artifact may name which stage of its recipe to stop at
Merged
#20 A module is a repository and a path, the builder announces what it made, and the mesh acts on it
Merged
#19 resolve: one un-hostable assignment no longer takes down a whole node's push
Merged
#18 catalogue: deliver a keyless same-node provider's served facts
Merged
#17 adapters: openai is a static-key vendor
Merged
#16 catalogue: give host-network containers the mesh's names too
Merged
#15 model-access: refreshable-grant — manager holds the refresh token, control plane never reads it
Merged
#14 model-access B: the refreshable-grant machinery (ADR 0050 carve-out)
Merged
#13 model-access A: provider→vendor + adapter dispatch + static-key (ADR 0050 foundation)
Merged
#12 fix: a require-only consumer of a parameterless provision still asks (mint gap)
Merged
#11 schedule: parse + validate a cron on a container, refuse run-once+schedule (ADR 0053)
Merged
#10 fix: a ${secret:} placeholder must fill from the file-owner's credential (provider-seal-key gate)
Merged
#9 run-once: a container the host runs to completion (ADR 0052)
Merged
#8 A module accesses operator-owned data, it does not own it (ADR 0051)
Merged
#7 A bare alive moves last_seen and nothing else (convergence race fix)
Merged
#6 Resync hq ADR references (0044-0054 -> 0039-0049)
Merged
#5 broker: a module account scopes its tool serve queues + mesh.rpc (ADR 0052)
1 Pull request proposed by 1 user
Proposed
#94 The two seat commands appear in the usage text