Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

Tests that read ../../../mesh-catalog or ../../../mesh-host gave a verdict that depended on what sat beside the checkout: a stale or dirty sibling failed them on a desktop, and a missing one skipped them unseen. They now read the clone the build seat puts in MESH_CHECK_BESIDE, failing when it is absent there, and elsewhere a copy captured at a named commit. The skip had hidden that the builder test read a module retired by ADR 0190. The systemd reading test no longer counts the machine's own environment.d.
2026-10-11 02:55:04 +02:00
parent 5bddb16514
commit eb72075104
146 changed files with 13749 additions and 102 deletions
@@ -0,0 +1,45 @@
+{
+  "module": "sshd",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the operator's way into the machine when the mesh cannot reach it: a build that breaks it is found only when that way is needed, which no gate sees (hq ADR 0236)"
+  },
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "listens": [
+    {
+      "name": "ssh",
+      "port": 22,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "the operator's own door. From anywhere because the machines that need it are exactly the ones not on the mesh yet \u2014 and locking the operator out is the one failure a firewall must never arrange"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "openssh"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/ssh/sshd_config.d/10-mesh.conf",
+      "mode": "0644",
+      "content": "# Managed by the mesh (module sshd). Replaced on every push; edit the catalogue instead.\nPort 22\nPermitRootLogin no\nPasswordAuthentication no\nPubkeyAuthentication yes\nKbdInteractiveAuthentication no\nUsePAM yes\nX11Forwarding no\nPrintMotd no\nAcceptEnv LANG LC_*\n"
+    },
+    {
+      "id": "run",
+      "type": "service",
+      "unit": "sshd.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "config"
+      ]
+    }
+  ]
+}