5 Commits

Include renames

Author	SHA1	Message	Date
jochen	f5824b31c6	Keep places and accesses at the terminal, and refuse a line break in any setting ... Through the settings verb, or a settings line run by the generic command verb, any caller of the mesh's console could place a module's directory at /etc with an owner of its own and have the node-engine, as root, hand it over at the next push, or mount any of the machine's paths into a container (hq issue 339). A change to either key is now refused in every process a verb runs, the generic verb refuses settings writes outright, and neither key may name the machine's own trees from anywhere, the terminal included. A line break, carriage return or NUL in any setting, which a file it is written into reads as a line of the caller's own, is refused where a layer is kept and where it is composed; PEM blocks alone may hold lines.	2026-10-08 23:58:08 +02:00
jschoubben	c3b88b9148	Rename mesh-control -> mesh-controller, substrate -> foundation ... One name per thing, per the HQ glossary: the module/container/image/binary/repo becomes mesh-controller, the seat the-controller, and the store+broker pair the foundation (embedded base bundles, default template and example lock renamed with their go:embed directives). No behaviour change — a pure vocabulary rename. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx	2026-09-16 18:40:40 +02:00
jschoubben	c4030947b0	The routing record is 0066, not 0056 ... 0056 is 'the authority is the control plane, not a database'. A citation pointing at the wrong decision is worse than none: it reads as corroboration. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF	2026-09-11 00:09:56 +02:00
jschoubben	9fab0b731a	catalogue: a contribution reaches the port its own machine published, from any machine ... The co-located fix could not reach a grant assembled for a consumer on another machine: ContributionsFrom never sees a port map, so the proxy was told the workload's software port and dialled a number that machine never published. The consumer's own assignments are fetched where the grant is built and applied there. The same fault as 038, one node over. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF	2026-09-10 21:08:09 +02:00
jschoubben	b824c65ab0	catalogue: a co-located provider's served values, and a co-located contribution's port ... Two more of one fault, and the fault is the same as 04-ISSUES/038: the same-node path diverging from the cross-node one. The mesh works out what a provider on ANOTHER machine serves by walking that node — reading its manifest with that machine's port assignments, then settling the result with that node's settings layers — before offering it to a consumer. A provider on the consumer's OWN machine never passes through that walk, so every step of it had to be repeated in resolve.go's servedHere and declaration.go's here(). 038 repeated the port. Nothing repeated the settling. So a served value the operator supplied reached a co-located consumer as the manifest's empty default. On the ADR 0056 anchor that value is an internal CA's root: step-ca and route-proxy on one node, route-proxy's binding carrying root: "", an empty CA bundle written, a silent fall back to the system trust store, and issuance stopping with nothing saying why. The same step-ca on another node would have worked. The second is the mirror direction. gitea declares a bare container port 3000 and the machine publishes it as 20000:3000, but gitea's route CONTRIBUTION still said 3000 — so the proxy beside it dialled a port nothing listens on and answered 502. 038 fixed what a consumer is TOLD about a provider; this is what a workload TELLS a provider about itself. The redirect uses the CONTRIBUTING module's assignment, because the port is the workload's, not the proxy's; a contribution carried here from another machine is left exactly as it is, its port being that machine's to assign. Both are settled in Declaration, which is the first moment the machine's ports and the provider's settings both exist. That also removes an order dependence: the resolver built its same-node needs mid-walk, from whichever modules had been chosen by the time the requirement came up and in whatever order a map iterated, so what a co-located binding carried depended on the order somebody happened to assign things in. Re-deriving from the finished closure does not. servedHere keeps its job — deciding whether a same-node provider serves anything at all, which is what makes the need exist — and now says that its values are provisional. novox/hq ADR 0056 Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF	2026-09-10 20:57:23 +02:00