The mint leaves the control plane's old-bus secret alone

The control plane is a module too, and its broker secret is the old bus's credential it is still using while the mint runs. Writing the new bus's blob there cut the mesh off from its own old bus mid-move. Its new-bus credential is the controller principal's bus secret; the module principal is skipped.
Merge pull request 'The control plane mounts the bus secret it reads' (#100 ) from fix/the-controller-mounts-its-bus-secret into main
2026-09-28 01:08:11 +02:00 · 2026-09-27 23:03:42 +00:00 · 2026-09-28 01:03:18 +02:00 · 2026-09-27 22:56:55 +00:00 · 2026-09-28 00:55:39 +02:00 · 2026-09-27 22:38:27 +00:00
3 changed files with 21 additions and 4 deletions
@@ -537,6 +537,15 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 	if err != nil {
 		return nil, err
 	}
+	// **With the seat holders on record**, or a machine running the next holder of a seat beside
+	// the current one resolves as two holders, is refused, and drops out of the map — taking the
+	// address every other machine composes for what it offers (novox/hq ADR 0131). Found live:
+	// the control node vanished from the private network the moment the new bus was assigned
+	// beside the old one.
+	holdings, err := inv.Holdings(ctx)
+	if err != nil {
+		return nil, err
+	}
 	var out []inventory.Overlay
 	for _, p := range places {
 		if p.Address == "" {
@@ -549,7 +558,7 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 		caps, _ := inv.ProfileOf(ctx, p.Name)
 		got, err := catalogue.Resolve(shelf, assigned,
 			catalogue.Node{Name: p.Name, Site: p.Site, Capabilities: caps},
-			catalogue.World{Unchecked: true})
+			catalogue.World{Unchecked: true, Holdings: holdings})
 		if err != nil {
 			continue
 		}
@@ -340,6 +340,14 @@ func rolloutMint(ctx context.Context, again bool) error {
 			machines++

 		case broker.KindModule:
+			if p.Module == "mesh-controller" {
+				// The control plane is a module too, and its `broker` secret is the old bus's
+				// credential it is still using while this runs. Writing the new bus's blob there
+				// cut the mesh off from its own old bus mid-move (2026-09-28). Its new-bus credential
+				// is the controller principal's `bus` secret above; nothing else is needed here.
+				skipped++
+				continue
+			}
 			m, inShelf := shelf[p.Module]
 			if !inShelf {
 				skipped++
@@ -47,15 +47,14 @@
        "MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
        "MESH_STORE_IDENTITY_FILE": "/run/secrets/identity",
        "MESH_STORE_LICENCES_FILE": "/run/secrets/licences",
-        "MESH_BROKER_AMQP_FILE": "/run/secrets/broker",
        "MESH_BROKER_MANAGEMENT_FILE": "/run/secrets/broker-management",
        "MESH_BROKER_ADDRESS_FILE": "/run/secrets/broker-address",
        "MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}",
        "MESH_STORE_IDENTITY_PORT": "${seat:mesh-store:5432}",
        "MESH_STORE_LICENCES_PORT": "${seat:mesh-store:5432}",
-        "MESH_BROKER_AMQP_PORT": "${seat:mesh-broker:5672}",
        "MESH_BROKER_MANAGEMENT_PORT": "${seat:mesh-broker:15672}",
-        "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}"
+        "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}",
+        "MESH_BUS_NATS_FILE": "/run/secrets/bus"
      },
      "volumes": [
        "/var/lib/mesh-broker-tls:/broker-tls:ro",
@@ -63,6 +62,7 @@
        "/var/lib/mesh/mesh-controller/identity:/run/secrets/identity:ro",
        "/var/lib/mesh/mesh-controller/licences:/run/secrets/licences:ro",
        "/var/lib/mesh/mesh-controller/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/mesh-controller/bus:/run/secrets/bus:ro",
        "/var/lib/mesh/mesh-controller/broker-management:/run/secrets/broker-management:ro",
        "/var/lib/mesh/mesh-controller/broker-address:/run/secrets/broker-address:ro"
      ],
Author	SHA1	Message	Date
jschoubben	4d62e6caf1	The mint leaves the control plane's old-bus secret alone The control plane is a module too, and its broker secret is the old bus's credential it is still using while the mint runs. Writing the new bus's blob there cut the mesh off from its own old bus mid-move. Its new-bus credential is the controller principal's bus secret; the module principal is skipped.	2026-09-28 01:08:11 +02:00
jschoubben	386ae676ca	Merge pull request 'The control plane mounts the bus secret it reads' (#100 ) from fix/the-controller-mounts-its-bus-secret into main	2026-09-27 23:03:42 +00:00
jschoubben	f8a9c3d6bc	The control plane mounts the bus secret it reads MESH_BUS_NATS_FILE named /run/secrets/bus and nothing put a file there: the manifest binds each secret explicitly, and the switch added the secret and the variable but not the bind. Found live — the control plane came up on the new bus and could not read its own credential.	2026-09-28 01:03:18 +02:00
jschoubben	83671fae5f	Merge pull request 'The network map resolves each machine with the seat holders on record' (#99 ) from fix/the-network-map-knows-the-holders into main	2026-09-27 22:56:55 +00:00
jschoubben	9b715524a2	The network map resolves each machine with the seat holders on record Without them, a machine running the next holder of a seat beside the current one resolves as two holders, is refused, and drops out of the map — and with it the address every other machine composes for what it offers. Found live: the control node vanished from the private network the moment the new bus was assigned beside the old one, and nothing on any machine could be composed.	2026-09-28 00:55:39 +02:00
jschoubben	e06fc1ed16	Merge pull request 'The control plane speaks the new bus' (#98 ) from switch/the-controller-speaks-nats into main	2026-09-27 22:38:27 +00:00
jschoubben	13d7c5c5dd	Merge pull request 'The mint names the bus by bare host, and can mint again' (#97 ) from fix/mint-bare-host-and-again into main	2026-09-27 22:37:36 +00:00
jschoubben	84024cbdb6	The control plane speaks the new bus One environment variable moves it (design 25): MESH_BUS_NATS, read from the `bus` secret `rollout mint` sealed to its machine, and the two that named the old bus go, because being told about both is refused at start. Registered and built ahead of the push that flips it, so the flip and the bus it flips to arrive in one declaration — the same push that starts the new bus and hands this machine its membership. Deliberately not merged until every credential is minted.	2026-09-28 00:31:57 +02:00