Commit Graph

Select branches

Hide Pull Requests

feat/1945-user-list-switch

feat/325-identities-and-kept-folders

feat/328-libraries-and-module-users

feat/bus-view-principal

feat/chain-on-the-bus

feat/files-through-the-store-files-verbs

feat/r4e-controller

fix/1106-sdk-member-merges

fix/1334-a-bus-reload-fails-a-tier

fix/1399-person-word-test

fix/1649-held-ask-handed-out-twice

fix/1652-checks-wait

fix/1658-sdk-items

fix/1931-reconnects-verb

fix/1945-credential-on-assignment

fix/1945-mesh-grants-publishes-memberships

fix/270-a-dead-bus-watch-is-heard

fix/613-node-smb-server

fix/630-config-values-from-four-sources

fix/701-a-name-nothing-answers-is-not-used

fix/906-lease-renewal

fix/checker-full-failure

fix/forge-requires-no-status

fix/issued-states-follow-the-module

fix/r6-key-waits-said

fix/r6-look-again-after-unlock

fix/r6-mirror-on-change

fix/store-forge-address

fix/sweep-2026-10-30

main

test/plan-diff-left-out-line

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#112

#113

#114

#115

#116

#117

#118

#119

#12

#120

#121

#122

#123

#124

#125

#126

#127

#128

#129

#13

#130

#131

#132

#133

#134

#135

#136

#137

#138

#139

#14

#140

#141

#142

#143

#144

#145

#146

#147

#148

#149

#15

#150

#151

#152

#153

#154

#155

#156

#157

#158

#159

#16

#160

#161

#162

#163

#164

#165

#166

#167

#168

#169

#17

#170

#171

#172

#173

#174

#175

#176

#177

#178

#179

#18

#180

#181

#182

#183

#184

#185

#186

#187

#188

#189

#19

#190

#191

#192

#193

#194

#195

#196

#197

#198

#199

#2

#20

#200

#201

#202

#203

#204

#205

#206

#207

#208

#209

#21

#210

#211

#212

#213

#214

#215

#216

#217

#218

#219

#22

#220

#221

#222

#223

#224

#225

#226

#227

#228

#229

#23

#230

#231

#232

#233

#234

#235

#236

#237

#238

#239

#24

#240

#241

#242

#243

#244

#245

#246

#247

#248

#249

#25

#250

#251

#252

#253

#254

#255

#256

#257

#258

#259

#26

#260

#261

#262

#263

#264

#265

#266

#267

#268

#269

#27

#270

#271

#272

#273

#274

#275

#276

#277

#278

#279

#28

#280

#281

#282

#283

#284

#285

#286

#287

#288

#289

#29

#290

#291

#292

#293

#294

#295

#296

#297

#298

#299

#3

#30

#300

#301

#302

#303

#304

#305

#306

#307

#308

#309

#31

#310

#311

#312

#313

#314

#315

#316

#317

#318

#319

#32

#320

#321

#322

#323

#324

#325

#326

#327

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#338

#339

#34

#340

#341

#342

#343

#344

#345

#346

#347

#348

#349

#35

#350

#351

#352

#353

#354

#355

#356

#357

#358

#359

#36

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#37

#370

#371

#372

#373

#374

#375

#376

#377

#378

#379

#38

#380

#381

#382

#383

#384

#385

#386

#387

#388

#389

#39

#390

#391

#392

#393

#394

#395

#396

#397

#398

#399

#4

#40

#400

#401

#402

#403

#404

#405

#406

#407

#408

#409

#41

#410

#411

#412

#413

#414

#415

#416

#417

#418

#419

#42

#420

#421

#422

#423

#424

#425

#426

#427

#428

#429

#43

#430

#431

#432

#433

#434

#435

#436

#437

#438

#439

#44

#440

#441

#442

#443

#444

#445

#446

#447

#448

#449

#45

#450

#451

#452

#453

#454

#455

#456

#457

#458

#459

#46

#460

#461

#462

#463

#464

#465

#466

#467

#468

#469

#47

#470

#471

#472

#473

#474

#475

#476

#477

#478

#479

#48

#480

#481

#482

#483

#484

#485

#486

#487

#488

#489

#49

#490

#491

#5

#50

#51

#52

#53

#54

#55

#56

#57

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#67

#68

#69

#7

#70

#71

#72

#73

#74

#75

#76

#77

#78

#79

#8

#80

#81

#82

#83

#84

#85

#86

#87

#88

#89

#9

#90

#91

#92

#93

#94

#95

#96

#97

#98

#99

modules/route-proxy/contract/v0.1.0

Mono Color

• ba0f44a36d Say in the converge preview that routed traffic is not previewed and is dropped unless declared (hq ADR 0100) jschoubben 2026-09-22 18:01:04 +02:00
• 3dc7d0e386 Preview ssh as the derived filter admits it, and say a narrowing to the private network closes (hq ADR 0100) jschoubben 2026-09-22 18:00:53 +02:00
• ade6b2bfb6 Declare nftables before the guard's table, so a node joining adopted without nft can load it (hq ADR 0103) jschoubben 2026-09-22 17:59:32 +02:00
• a2dfaaf4d1 Guard only packets addressed to this machine, and order the guard's unit before the network and against shutdown (hq ADR 0103) jschoubben 2026-09-22 17:59:09 +02:00
• a82bfb41f2 Leave an IPv6 loopback mapping out of what a container publishes, reading ports from the end (hq ADR 0100) jschoubben 2026-09-22 17:58:50 +02:00
• 8db66e9532 Derive the guard from taken modules only: their published private-network ports and their manifests' guards (hq ADR 0103) jschoubben 2026-09-22 17:58:37 +02:00
• 28b7fb81ba Write the registry's trust into the runtime's file and reload the runtime instead of restarting it; prefix reload-on like restart-on (hq ADR 0102) jschoubben 2026-09-22 17:51:38 +02:00
• c93128d82f Hold the catalogue's store, broker and filter manifests to what adoption needs of them (hq ADR 0100) jschoubben 2026-09-22 17:33:09 +02:00
• dbf62b5212 Read the foundation's ports from each node's settings, wherever a port is used (hq ADR 0100) jschoubben 2026-09-22 17:31:07 +02:00
• 1ea84f8b8f Take a module, converge a node after a preview, and return it to adopted, from the command line and the API (hq ADR 0100) jschoubben 2026-09-22 17:27:35 +02:00
• 28894fa5bd Keep what an adopted node reports holding, the firewall it found and what is reachable on it (hq ADR 0100) jschoubben 2026-09-22 17:23:09 +02:00
• c3b1617693 Declare openings and a refusal-only guard on an adopted node in place of the filter (hq ADR 0100) jschoubben 2026-09-22 17:21:44 +02:00
• a86a6c2974 Carry an adopted node's mode and taken modules in every declaration, from one marshaller (hq ADR 0100) jschoubben 2026-09-22 17:17:54 +02:00
• 1c32af6a22 Record whether a node is adopted and which modules were taken on it (hq ADR 0100) jschoubben 2026-09-22 17:14:05 +02:00
• 0a39b7df82 Merge pull request 'Nothing the control queue carries is lost while the store restarts (issue 083)' (#43) from multiple-fixes into main jschoubben 2026-09-22 14:42:57 +02:00
• 4f3b4e6014 Review of 083: an upgrade handled during shutdown is left for the broker; an enrolment cut short by shutdown is told to try again; a refused redelivery says what it probably is jschoubben 2026-09-22 14:39:15 +02:00
• 32b8af6a9b The enrolment proof's message has a known answer, repeated in the host's test jschoubben 2026-09-22 14:33:33 +02:00
• 4567fa666c Review of 083: finishing an enrolment whose token was spent takes proof of the key's private half, a live lease and a first delivery — a public key alone cannot replay a spent token; shutdown leaves held messages for the broker; identical builds supersede; what is held leaves room in the prefetch jschoubben 2026-09-22 14:33:13 +02:00
• a3b7e830c8 Review of 083: a message the store cannot take is held and retried on a ticker, not slept on, so enrolments are answered meanwhile; a newer one per subject supersedes; the password is replaced after the spend; the same presenter may finish after a lost answer; upgrades retry only on the store jschoubben 2026-09-22 14:23:03 +02:00
• 1a41b88ed3 Nothing the control queue carries is lost while the store restarts: an enrolment claims its token and spends it last, and is asked to try again; build results, upgrades and catch-ups are handed back, bounded (novox/hq issue 083) jschoubben 2026-09-22 14:06:28 +02:00
• b9cdb96a90 Merge pull request 'A report that arrives while the store restarts is kept, not lost (issue 082)' (#42) from multiple-fixes into main jschoubben 2026-09-22 13:53:13 +02:00
• 3fd0c37d22 Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause jschoubben 2026-09-22 13:34:04 +02:00
• 047830a6b5 A report the store cannot take yet is handed back to the broker, not acknowledged and lost (novox/hq issue 082) jschoubben 2026-09-22 13:25:13 +02:00
• ff26ea959d Merge pull request 'Every machine was named twice over; only a machine on the private network is named (issue 079)' (#41) from multiple-fixes into main jschoubben 2026-09-22 02:19:13 +02:00
• 5150c0a0f8 One predicate for the private network: the filter's accept set is the set the names and the resolver mean; the catalogue is read once for the three mesh-wide questions jschoubben 2026-09-22 02:04:28 +02:00
• 6a64aba506 Only a machine on the private network is named: the names follow the resolver's rule, one predicate for both (novox/hq issue 079) jschoubben 2026-09-22 01:41:13 +02:00
• 8152665298 The facts write the suffix the control plane composed the names with, handed down rather than written twice (review of issue 079); the fixture is keyed as production keys it jschoubben 2026-09-22 01:27:50 +02:00
• b529c49cff A machine's names are not suffixed twice: the facts take the internal names the control plane hands them (novox/hq issue 079) jschoubben 2026-09-22 01:13:28 +02:00
• 713b43799f Merge pull request 'Multiple fixes: a run-once step may name what it reads (ADR 0099); secret accept refuses an undeclared name (078)' (#40) from multiple-fixes into main jschoubben 2026-09-21 23:58:47 +02:00
• 0d1f2a4152 Review: module issue's pre-check factored and tested; a pair delivery for a requirement the module keeps no secret for is refused; builder issue's usage says the module comes first jschoubben 2026-09-21 23:58:36 +02:00
• 66332705cd module issue refuses a module with no broker own secret before making the account (issue 078) jschoubben 2026-09-21 23:46:28 +02:00
• 35c5c2bb9b secret accept is refused for a name the module does not declare, and a pair delivery for a requirement or local it has not got (novox/hq issue 078) jschoubben 2026-09-21 23:31:06 +02:00
• e4da83496f A run-once step may name what it reads: the pair run-once + restart-on is no longer refused (novox/hq ADR 0099) jschoubben 2026-09-21 23:31:06 +02:00
• 52d39f0740 Merge pull request 'The control plane's recipe declares its base, and an undeclared FROM is refused (ADR 0097 live)' (#39) from multiple-fixes into main jschoubben 2026-09-21 22:58:22 +02:00
• b3486270d1 The control plane's recipe starts FROM the base its manifest declares, and an undeclared base is refused jschoubben 2026-09-21 22:16:10 +02:00
• d7dab9c09f Merge pull request 'Multiple fixes: several secrets per module (069), ask a module's tool (049), copy an upstream image (046), declare a vendor image (064)' (#38) from multiple-fixes into main jschoubben 2026-09-21 21:05:11 +02:00
• 9f3790dcda Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves jschoubben 2026-09-21 21:03:22 +02:00
• e81f352979 An undeclared COPY --from is refused; an undeclared FROM is said, not yet refused jschoubben 2026-09-21 20:48:00 +02:00
• 6f6e1244d4 A build declares the vendor image it stands on, and a recipe fetches nothing undeclared jschoubben 2026-09-21 20:45:36 +02:00
• 412599de9a An upstream image is copied between registries, never through a machine's image store jschoubben 2026-09-21 20:42:30 +02:00
• 5049d201c6 A provider keeps one grant file per holder, with the local name in its id and path jschoubben 2026-09-21 20:41:19 +02:00
• 3e5c010c5e A need is kept once per provision, consumer, local name and provider jschoubben 2026-09-21 20:38:01 +02:00
• 76773dfbf5 Several secrets expand where the consumer is known, not on the first module to mention the provision jschoubben 2026-09-21 20:36:19 +02:00
• 973cda5d76 ask: the control plane calls a module's tool and prints its answer jschoubben 2026-09-21 20:34:03 +02:00
• 6ae4ae1dba A module may hold several secrets from one provider, each a pair of its own jschoubben 2026-09-21 20:28:16 +02:00
• f3bfc11565 Merge pull request 'Multiple fixes: a stuck machine is said to be one (065), an undeclared mount is refused (026), an operator delivers a pair credential (070)' (#37) from feat/multiple-fixes into main jschoubben 2026-09-21 19:23:33 +02:00
• 53a79a17a1 Review: a failure is the same by resource id, not by the host's words; bound files and /run/docker.sock are declared jschoubben 2026-09-21 19:23:02 +02:00
• 396e05bb65 An operator delivers a pair credential, and the mesh never replaces it jschoubben 2026-09-21 17:50:41 +02:00
• 537ad544d3 A container may not mount a path the module never declared — and three things declare one jschoubben 2026-09-21 17:47:44 +02:00
• fcaad7271a A failure that repeats is said to be stuck jschoubben 2026-09-21 17:43:24 +02:00
• 69d0b94395 Merge pull request 'The link knows a superseded report (issue 031)' (#36) from feat/migration-blockers into main jschoubben 2026-09-21 13:48:43 +02:00
• 1ab0364705 The link knows a superseded report (issue 031) jschoubben 2026-09-21 12:11:52 +02:00
• 153990348c Merge pull request 'A secret reaches a process as a file (ADR 0086, closes issue 041)' (#35) from feat/secret-not-in-environment into main jschoubben 2026-09-21 11:59:02 +02:00
• 67de216160 The controller's own manifest reads its credentials from files too jschoubben 2026-09-21 10:33:22 +02:00
• 69bb0fcb67 A module names who its secret files belong to (secrets-owner) jschoubben 2026-09-21 10:19:00 +02:00
• 4531f2244f A secret reaches a process as a file (ADR 0086) jschoubben 2026-09-21 10:10:33 +02:00
• 6b695c82d7 Merge pull request 'Secrets vault: operator key, a second seal on every secret, recovery and export' (#34) from feat/secrets-vault into main jschoubben 2026-09-21 09:34:47 +02:00
• 77e6c1a684 Recoverable means sealed to the current operator key; recovery names the provider jschoubben 2026-09-21 01:16:32 +02:00
• 565f144a20 A pair credential is sealed to the operator key too jschoubben 2026-09-21 00:36:16 +02:00
• e140ed5d0b An operator key, a second seal on every own secret, and the vault keeps the export jschoubben 2026-09-20 23:53:50 +02:00
• 1c2e94e1a0 Merge pull request 'The catalogue moves out, to novox/mesh-catalog' (#33) from chore/catalogue-moves-out into main jschoubben 2026-09-20 22:13:37 +02:00
• 4ac12115ba The catalogue moves out, to novox/mesh-catalog jschoubben 2026-09-03 00:15:46 +02:00
• 630eed82f3 Merge pull request 'The consistency cascade sends tolerantly and stops loudly (057 review)' (#32) from fix/cascade-is-tolerant into main jschoubben 2026-09-20 13:41:55 +02:00
• d6ee77f17c The consistency cascade sends tolerantly and stops loudly (issue 057 review) jschoubben 2026-09-20 13:27:12 +02:00
• 5dd2432b50 Merge pull request 'One push leaves the mesh consistent; the foundation's ports are forwarded (057, 063)' (#31) from fix/one-push-is-enough into main jschoubben 2026-09-20 12:53:14 +02:00
• 97c076ea48 The one-push cascade compares against what was last sent (issue 057) jschoubben 2026-09-18 02:37:26 +02:00
• 25e42b3ad6 The foundation's ports are forwarded, not only accepted on input (issue 063) jschoubben 2026-09-18 02:19:34 +02:00
• f47b6e1c31 One push leaves the mesh consistent (issue 057) jschoubben 2026-09-18 02:05:55 +02:00
• 0b574f3972 Merge pull request 'The broker credential resolves the seat, not the hub (issue 059)' (#30) from fix/broker-address-resolves-the-seat into main jschoubben 2026-09-18 01:12:49 +02:00
• 79a9e17df0 The broker credential resolves the mesh-broker seat, not the hub (issue 059) jschoubben 2026-09-17 22:31:36 +02:00
• 9c718025c0 Merge pull request 'The network carries the registry trust (ADR 0082, issues 042/048/062)' (#29) from feat/the-network-carries-registry-trust into main jschoubben 2026-09-18 01:00:37 +02:00
• 98aea8b25c An artifact-store lookup failure refuses the compose jschoubben 2026-09-18 00:14:49 +02:00
• bc289cbe04 The restart-on rename reads both list shapes jschoubben 2026-09-17 23:35:12 +02:00
• 0e9035d479 The network carries the registry trust (ADR 0082, issues 042/048) jschoubben 2026-09-17 23:05:23 +02:00
• 39dc927a6f Merge pull request 'The controller's seat is mesh-controller; second-node assignment refused' (#28) from multi-node/foundation-seats into main jschoubben 2026-09-17 02:16:05 +02:00
• fc4c5d1a60 The controller's seat is mesh-controller; a foundation module on a second node is refused jschoubben 2026-09-17 02:13:26 +02:00
• 5718add8c3 Merge pull request 'A cross-node module reaches the broker by the hub's overlay name' (#27) from multi-node/broker-reaches-over-overlay into main jschoubben 2026-09-17 01:44:41 +02:00
• afce2a5f41 A cross-node module reaches the broker by the hub's overlay name, not the public address jschoubben 2026-09-17 01:34:11 +02:00
• 68201c6478 Merge pull request 'Self-upgrade installer: SDK-by-version, mesh-controller rename, foundation adopted' (#26) from feat/a-bed-that-hands-over-nothing into main jschoubben 2026-09-16 23:21:34 +02:00
• c3b88b9148 Rename mesh-control -> mesh-controller, substrate -> foundation jschoubben 2026-09-16 18:40:40 +02:00
• 366840fc0d push --wait: optionally block until a named node applies what it was sent jschoubben 2026-09-16 13:23:01 +02:00
• 6a7e701629 Write the package credential only into a build that asks for it jschoubben 2026-09-16 12:45:18 +02:00
• ae55bd7bde Builds that need the registry run on the host network jschoubben 2026-09-16 10:33:07 +02:00
• 4b9bc50aad The builder resolves the SDK from the mesh registry, and can publish packages jschoubben 2026-09-16 10:27:26 +02:00
• 2fb700d61b Builder diagnostics go to stderr; stdout is the result alone jschoubben 2026-09-15 23:01:04 +02:00
• 9070d2502c The builder narrates every step, and every command it runs jschoubben 2026-09-15 22:26:35 +02:00
• b8cacbaf4d What remains of names.go is the naming jschoubben 2026-09-15 21:33:20 +02:00
• fcdb065660 The mesh's knowledge is a fact a module asks for, not three modules jschoubben 2026-09-15 21:31:18 +02:00
• 18ec632baa The example manifest follows the rename jschoubben 2026-09-15 20:51:00 +02:00
• 385bc5b9bf A module can be told which port it was given jschoubben 2026-09-15 13:20:01 +02:00
• e3748bc06f One module, several languages, each bundle packed alone jschoubben 2026-09-15 02:09:06 +02:00
• 4b7bd1b3e2 A module says what it is written in, and needs no Dockerfile jschoubben 2026-09-15 01:59:07 +02:00
• 3ae7b88c6d A catalogue asks for what it was not there to hear jschoubben 2026-09-15 01:26:58 +02:00
• 2b82872ac3 A build keeps what it was told jschoubben 2026-09-15 01:22:34 +02:00
• dda001d64b The firewall opens the port the mesh itself runs on jschoubben 2026-09-15 00:54:31 +02:00
• 5062c36fc9 A binding answered on this very node still carries an address jschoubben 2026-09-14 21:11:37 +02:00
• 30dfc9969c Merge pull request 'Only a thing built and never run is unassignable' (#25) from fix/only-a-build-input-is-unassignable into main jschoubben 2026-09-14 17:33:02 +02:00
• 25d2fe1308 Only a thing built and never run is unassignable jschoubben 2026-09-14 17:32:43 +02:00
• 68e9a16c57 Merge pull request 'ssh is never left without a rule' (#24) from fix/ssh-is-never-left-with-no-rule into main jschoubben 2026-09-14 17:16:31 +02:00
• 55d468798d ssh is never left without a rule jschoubben 2026-09-14 16:53:39 +02:00