jschoubben
689c2c6d33
Hold a node from composing to sending, so a push composed before converge or adopt is never sent after it (hq ADR 0100)
2026-09-22 18:10:04 +02:00
jschoubben
1eff586a40
Hold the filter module to replacing the stock unit's flushing stop (hq ADR 0100)
2026-09-22 18:06:15 +02:00
jschoubben
4bb19c9e40
Give a machine port one holder: refuse ssh's, another module's and a doubled one, and release the assignment a given port replaces (hq ADR 0100)
2026-09-22 18:05:31 +02:00
jschoubben
9280513afa
Refuse token issue --adopted for a converged node and point to adopt, rather than flip it quietly (hq ADR 0100)
2026-09-22 18:03:45 +02:00
jschoubben
41c300eae0
Name every kind of an untaken module's resources in the adoption envelope, not only files and containers (hq ADR 0103)
2026-09-22 18:03:03 +02:00
jschoubben
c91fe1a6eb
Converge only on the preview the operator saw, named by its digest, and never on an account older than 15 minutes (hq ADR 0100)
2026-09-22 18:02:30 +02:00
jschoubben
ba0f44a36d
Say in the converge preview that routed traffic is not previewed and is dropped unless declared (hq ADR 0100)
2026-09-22 18:01:04 +02:00
jschoubben
3dc7d0e386
Preview ssh as the derived filter admits it, and say a narrowing to the private network closes (hq ADR 0100)
2026-09-22 18:00:53 +02:00
jschoubben
ade6b2bfb6
Declare nftables before the guard's table, so a node joining adopted without nft can load it (hq ADR 0103)
2026-09-22 17:59:32 +02:00
jschoubben
a2dfaaf4d1
Guard only packets addressed to this machine, and order the guard's unit before the network and against shutdown (hq ADR 0103)
2026-09-22 17:59:09 +02:00
jschoubben
a82bfb41f2
Leave an IPv6 loopback mapping out of what a container publishes, reading ports from the end (hq ADR 0100)
2026-09-22 17:58:50 +02:00
jschoubben
8db66e9532
Derive the guard from taken modules only: their published private-network ports and their manifests' guards (hq ADR 0103)
2026-09-22 17:58:37 +02:00
jschoubben
28b7fb81ba
Write the registry's trust into the runtime's file and reload the runtime instead of restarting it; prefix reload-on like restart-on (hq ADR 0102)
2026-09-22 17:51:38 +02:00
jschoubben
c93128d82f
Hold the catalogue's store, broker and filter manifests to what adoption needs of them (hq ADR 0100)
2026-09-22 17:33:09 +02:00
jschoubben
dbf62b5212
Read the foundation's ports from each node's settings, wherever a port is used (hq ADR 0100)
2026-09-22 17:31:07 +02:00
jschoubben
1ea84f8b8f
Take a module, converge a node after a preview, and return it to adopted, from the command line and the API (hq ADR 0100)
2026-09-22 17:27:35 +02:00
jschoubben
28894fa5bd
Keep what an adopted node reports holding, the firewall it found and what is reachable on it (hq ADR 0100)
2026-09-22 17:23:09 +02:00
jschoubben
c3b1617693
Declare openings and a refusal-only guard on an adopted node in place of the filter (hq ADR 0100)
2026-09-22 17:21:44 +02:00
jschoubben
a86a6c2974
Carry an adopted node's mode and taken modules in every declaration, from one marshaller (hq ADR 0100)
2026-09-22 17:17:54 +02:00
jschoubben
1c32af6a22
Record whether a node is adopted and which modules were taken on it (hq ADR 0100)
2026-09-22 17:14:05 +02:00
jschoubben
0a39b7df82
Merge pull request 'Nothing the control queue carries is lost while the store restarts (issue 083)' ( #43 ) from multiple-fixes into main
2026-09-22 14:42:57 +02:00
jschoubben
4f3b4e6014
Review of 083: an upgrade handled during shutdown is left for the broker; an enrolment cut short by shutdown is told to try again; a refused redelivery says what it probably is
2026-09-22 14:39:15 +02:00
jschoubben
32b8af6a9b
The enrolment proof's message has a known answer, repeated in the host's test
2026-09-22 14:33:33 +02:00
jschoubben
4567fa666c
Review of 083: finishing an enrolment whose token was spent takes proof of the key's private half, a live lease and a first delivery — a public key alone cannot replay a spent token; shutdown leaves held messages for the broker; identical builds supersede; what is held leaves room in the prefetch
2026-09-22 14:33:13 +02:00
jschoubben
a3b7e830c8
Review of 083: a message the store cannot take is held and retried on a ticker, not slept on, so enrolments are answered meanwhile; a newer one per subject supersedes; the password is replaced after the spend; the same presenter may finish after a lost answer; upgrades retry only on the store
2026-09-22 14:23:03 +02:00
jschoubben
1a41b88ed3
Nothing the control queue carries is lost while the store restarts: an enrolment claims its token and spends it last, and is asked to try again; build results, upgrades and catch-ups are handed back, bounded (novox/hq issue 083)
2026-09-22 14:06:28 +02:00
jschoubben
b9cdb96a90
Merge pull request 'A report that arrives while the store restarts is kept, not lost (issue 082)' ( #42 ) from multiple-fixes into main
2026-09-22 13:53:13 +02:00
jschoubben
3fd0c37d22
Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause
2026-09-22 13:34:04 +02:00
jschoubben
047830a6b5
A report the store cannot take yet is handed back to the broker, not acknowledged and lost (novox/hq issue 082)
2026-09-22 13:25:13 +02:00
jschoubben
ff26ea959d
Merge pull request 'Every machine was named twice over; only a machine on the private network is named (issue 079)' ( #41 ) from multiple-fixes into main
2026-09-22 02:19:13 +02:00
jschoubben
5150c0a0f8
One predicate for the private network: the filter's accept set is the set the names and the resolver mean; the catalogue is read once for the three mesh-wide questions
2026-09-22 02:04:28 +02:00
jschoubben
6a64aba506
Only a machine on the private network is named: the names follow the resolver's rule, one predicate for both (novox/hq issue 079)
2026-09-22 01:41:13 +02:00
jschoubben
8152665298
The facts write the suffix the control plane composed the names with, handed down rather than written twice (review of issue 079); the fixture is keyed as production keys it
2026-09-22 01:27:50 +02:00
jschoubben
b529c49cff
A machine's names are not suffixed twice: the facts take the internal names the control plane hands them (novox/hq issue 079)
2026-09-22 01:13:28 +02:00
jschoubben
713b43799f
Merge pull request 'Multiple fixes: a run-once step may name what it reads (ADR 0099); secret accept refuses an undeclared name (078)' ( #40 ) from multiple-fixes into main
2026-09-21 23:58:47 +02:00
jschoubben
0d1f2a4152
Review: module issue's pre-check factored and tested; a pair delivery for a requirement the module keeps no secret for is refused; builder issue's usage says the module comes first
2026-09-21 23:58:36 +02:00
jschoubben
66332705cd
module issue refuses a module with no broker own secret before making the account (issue 078)
2026-09-21 23:46:28 +02:00
jschoubben
35c5c2bb9b
secret accept is refused for a name the module does not declare, and a pair delivery for a requirement or local it has not got (novox/hq issue 078)
2026-09-21 23:31:06 +02:00
jschoubben
e4da83496f
A run-once step may name what it reads: the pair run-once + restart-on is no longer refused (novox/hq ADR 0099)
2026-09-21 23:31:06 +02:00
jschoubben
52d39f0740
Merge pull request 'The control plane's recipe declares its base, and an undeclared FROM is refused (ADR 0097 live)' ( #39 ) from multiple-fixes into main
2026-09-21 22:58:22 +02:00
jschoubben
b3486270d1
The control plane's recipe starts FROM the base its manifest declares, and an undeclared base is refused
...
The mesh's own images declare theirs now, so the refusal ADR 0097 deferred is live.
The builder's own image and the examples take arguments with defaults; make builds
them, not the mesh.
2026-09-21 22:16:10 +02:00
jschoubben
d7dab9c09f
Merge pull request 'Multiple fixes: several secrets per module (069), ask a module's tool (049), copy an upstream image (046), declare a vendor image (064)' ( #38 ) from multiple-fixes into main
2026-09-21 21:05:11 +02:00
jschoubben
9f3790dcda
Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves
...
A secrets object with one local name delivered no file. Two requirements could share
a local name. secret recover and the export could not tell two locals apart. The
recipe check missed continued lines and read heredoc bodies as bases. repo:tag@digest
kept the tag in the repository. ask now publishes mandatory, so a tool nothing serves
is said at once rather than after the wait.
2026-09-21 21:03:22 +02:00
jschoubben
e81f352979
An undeclared COPY --from is refused; an undeclared FROM is said, not yet refused
...
The mesh's own images start FROM a public base — the control plane's, the builder's,
the tool runtime's — and refusing those refuses genesis. They declare their bases
next; until then the base is named every build, with the remedy.
2026-09-21 20:48:00 +02:00
jschoubben
6f6e1244d4
A build declares the vendor image it stands on, and a recipe fetches nothing undeclared
...
build.on takes {arg, image@sha256:…} beside {arg, module, artifact}: the image is
copied into the mesh's registry before the build (ADR 0096) and the recipe reads the
copy from the argument. A FROM or COPY --from naming a registry image the manifest
did not declare is refused before the build, naming it and the remedy; stages,
declared arguments and scratch are not fetches (novox/hq 04-ISSUES/064, ADR 0097).
2026-09-21 20:45:36 +02:00
jschoubben
412599de9a
An upstream image is copied between registries, never through a machine's image store
...
A published image is an index over several architectures; pulled, the runtime's
store keeps the index and refuses to push one platform out of it. The builder now
reads the index and every manifest it names over the registry API, with the
anonymous bearer token the public hub hands out, moves each blob by digest into the
mesh's registry, puts the manifests and then the index under the module's repository,
and pins the index. Genesis, with no registry to copy into, keeps the pull
(novox/hq 04-ISSUES/046, ADR 0096).
2026-09-21 20:42:30 +02:00
jschoubben
5049d201c6
A provider keeps one grant file per holder, with the local name in its id and path
...
The lab's vault refused a declaration naming two files with one identity: the
two secrets of one consumer. The holder's suffix is in the resource id and the path now.
2026-09-21 20:41:19 +02:00
jschoubben
3e5c010c5e
A need is kept once per provision, consumer, local name and provider
...
Two consumers of one same-node provision produced two raw needs and, fanned out per
consumer, four — the same credential twice for each. Harmless, since a pair is one
row however often it is asked for, and wrong all the same.
2026-09-21 20:38:01 +02:00
jschoubben
76773dfbf5
Several secrets expand where the consumer is known, not on the first module to mention the provision
...
The lab's two-secrets consumer was given one credential and no file: the expansion
ran on the resolver's walk over names, on whichever module mentioned the provision
first, and the per-consumer pass copied that. It expands in that pass now, and a
test has two consumers of one provision, one keeping one file and one keeping two.
2026-09-21 20:36:19 +02:00
jschoubben
973cda5d76
ask: the control plane calls a module's tool and prints its answer
...
A module serves tools under an account scoped to exactly that, and nothing else in
the mesh held an account that could ask one. The control plane does: ask publishes
on the RPC exchange with a private reply queue bound under its own name, checks the
correlation, prints the answer, and exits non-zero for a tool that answered with an
error or a module that never answered (novox/hq 04-ISSUES/049, ADR 0095).
2026-09-21 20:34:03 +02:00
jschoubben