7352c846dd
A module is told its port in a container's environment too (hq issue 088)
jschoubben2026-09-22 22:36:28 +02:00
45425702d5
Merge pull request 'Hold the forge to being an ordinary provider, in tests (hq issue 085)' (#45) from feat/packages-port into main
jschoubben2026-09-22 21:59:52 +02:00
729537e745
Tie the builder's carried binding to what the forge serves, and hold at shut
jschoubben2026-09-22 21:56:51 +02:00
0e413e3e7a
Hold the forge's port to the same rule as every other provider's
jschoubben2026-09-22 21:40:08 +02:00
252186d90c
Merge pull request 'Adoption mode: a node in use is adopted before it is converged (hq ADR 0100–0103)' (#44) from feat/adoption-mode into main
jschoubben2026-09-22 21:01:51 +02:00
fad8b30e43
Say that the guard names the runtime's bridges where the filter names their addresses (hq ADR 0103)
jschoubben2026-09-22 19:51:10 +02:00
1096299e06
Hold a converged declaration to the bytes main sends, captured from it, rather than to re-marshalling itself (hq ADR 0100)
jschoubben2026-09-22 19:51:10 +02:00
379f459498
Hold the filter module to reloading its rules and restarting only on its units (hq ADR 0102)
jschoubben2026-09-22 19:47:43 +02:00
d05a5e87af
Hold the node while an assignment is recorded, so none lands between a preview and the flip (hq ADR 0100)
jschoubben2026-09-22 19:47:23 +02:00
01814854b8
Refuse the flip on an account naming nothing reachable, and mark such an account partial in the preview (hq ADR 0100)
jschoubben2026-09-22 19:47:23 +02:00
2cf8739a84
Clear the whole account an adopted node gave when it converges (hq ADR 0100)
jschoubben2026-09-22 19:45:35 +02:00
87ecc9326e
Refuse a port given for the whole mesh where it is set, not at every node's composition (hq ADR 0100)
jschoubben2026-09-22 19:45:35 +02:00
0f3eedd163
Do not guard a port this node is told to open to everyone (hq ADR 0103)
jschoubben2026-09-22 19:44:35 +02:00
dd6aad4a2f
Give a machine port only to a port a module's container publishes, which is the only one the mesh can move (hq ADR 0038)
jschoubben2026-09-22 19:44:35 +02:00
65187d4de0
Wait for a held node without pinning a pool connection, and give up after a bounded wait naming it (hq ADR 0100)
jschoubben2026-09-22 18:31:10 +02:00
2e6b9d30bd
Give a cascade round's hold back on every return, a body that cannot be marshalled included (hq ADR 0100)
jschoubben2026-09-22 18:31:00 +02:00
cc47330884
Reload the guard on its table rather than restart it, so a change leaves no port unguarded (hq ADR 0103)
jschoubben2026-09-22 18:27:27 +02:00
bfe4991dd7
Name every held kind of each module the flip takes in the converge preview and its digest (hq ADR 0103)
jschoubben2026-09-22 18:27:19 +02:00
689c2c6d33
Hold a node from composing to sending, so a push composed before converge or adopt is never sent after it (hq ADR 0100)
jschoubben2026-09-22 18:10:04 +02:00
1eff586a40
Hold the filter module to replacing the stock unit's flushing stop (hq ADR 0100)
jschoubben2026-09-22 18:06:15 +02:00
4bb19c9e40
Give a machine port one holder: refuse ssh's, another module's and a doubled one, and release the assignment a given port replaces (hq ADR 0100)
jschoubben2026-09-22 18:05:31 +02:00
9280513afa
Refuse token issue --adopted for a converged node and point to adopt, rather than flip it quietly (hq ADR 0100)
jschoubben2026-09-22 18:03:45 +02:00
41c300eae0
Name every kind of an untaken module's resources in the adoption envelope, not only files and containers (hq ADR 0103)
jschoubben2026-09-22 18:03:03 +02:00
c91fe1a6eb
Converge only on the preview the operator saw, named by its digest, and never on an account older than 15 minutes (hq ADR 0100)
jschoubben2026-09-22 18:02:30 +02:00
ba0f44a36d
Say in the converge preview that routed traffic is not previewed and is dropped unless declared (hq ADR 0100)
jschoubben2026-09-22 18:01:04 +02:00
3dc7d0e386
Preview ssh as the derived filter admits it, and say a narrowing to the private network closes (hq ADR 0100)
jschoubben2026-09-22 18:00:53 +02:00
ade6b2bfb6
Declare nftables before the guard's table, so a node joining adopted without nft can load it (hq ADR 0103)
jschoubben2026-09-22 17:59:32 +02:00
a2dfaaf4d1
Guard only packets addressed to this machine, and order the guard's unit before the network and against shutdown (hq ADR 0103)
jschoubben2026-09-22 17:59:09 +02:00
a82bfb41f2
Leave an IPv6 loopback mapping out of what a container publishes, reading ports from the end (hq ADR 0100)
jschoubben2026-09-22 17:58:50 +02:00
8db66e9532
Derive the guard from taken modules only: their published private-network ports and their manifests' guards (hq ADR 0103)
jschoubben2026-09-22 17:58:37 +02:00
28b7fb81ba
Write the registry's trust into the runtime's file and reload the runtime instead of restarting it; prefix reload-on like restart-on (hq ADR 0102)
jschoubben2026-09-22 17:51:38 +02:00
c93128d82f
Hold the catalogue's store, broker and filter manifests to what adoption needs of them (hq ADR 0100)
jschoubben2026-09-22 17:33:09 +02:00
dbf62b5212
Read the foundation's ports from each node's settings, wherever a port is used (hq ADR 0100)
jschoubben2026-09-22 17:31:07 +02:00
1ea84f8b8f
Take a module, converge a node after a preview, and return it to adopted, from the command line and the API (hq ADR 0100)
jschoubben2026-09-22 17:27:35 +02:00
28894fa5bd
Keep what an adopted node reports holding, the firewall it found and what is reachable on it (hq ADR 0100)
jschoubben2026-09-22 17:23:09 +02:00
c3b1617693
Declare openings and a refusal-only guard on an adopted node in place of the filter (hq ADR 0100)
jschoubben2026-09-22 17:21:44 +02:00
a86a6c2974
Carry an adopted node's mode and taken modules in every declaration, from one marshaller (hq ADR 0100)
jschoubben2026-09-22 17:17:54 +02:00
1c32af6a22
Record whether a node is adopted and which modules were taken on it (hq ADR 0100)
jschoubben2026-09-22 17:14:05 +02:00
0a39b7df82
Merge pull request 'Nothing the control queue carries is lost while the store restarts (issue 083)' (#43) from multiple-fixes into main
jschoubben2026-09-22 14:42:57 +02:00
4f3b4e6014
Review of 083: an upgrade handled during shutdown is left for the broker; an enrolment cut short by shutdown is told to try again; a refused redelivery says what it probably is
jschoubben2026-09-22 14:39:15 +02:00
32b8af6a9b
The enrolment proof's message has a known answer, repeated in the host's test
jschoubben2026-09-22 14:33:33 +02:00
4567fa666c
Review of 083: finishing an enrolment whose token was spent takes proof of the key's private half, a live lease and a first delivery — a public key alone cannot replay a spent token; shutdown leaves held messages for the broker; identical builds supersede; what is held leaves room in the prefetch
jschoubben2026-09-22 14:33:13 +02:00
a3b7e830c8
Review of 083: a message the store cannot take is held and retried on a ticker, not slept on, so enrolments are answered meanwhile; a newer one per subject supersedes; the password is replaced after the spend; the same presenter may finish after a lost answer; upgrades retry only on the store
jschoubben2026-09-22 14:23:03 +02:00
1a41b88ed3
Nothing the control queue carries is lost while the store restarts: an enrolment claims its token and spends it last, and is asked to try again; build results, upgrades and catch-ups are handed back, bounded (novox/hq issue 083)
jschoubben2026-09-22 14:06:28 +02:00
b9cdb96a90
Merge pull request 'A report that arrives while the store restarts is kept, not lost (issue 082)' (#42) from multiple-fixes into main
jschoubben2026-09-22 13:53:13 +02:00
3fd0c37d22
Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause
jschoubben2026-09-22 13:34:04 +02:00
047830a6b5
A report the store cannot take yet is handed back to the broker, not acknowledged and lost (novox/hq issue 082)
jschoubben2026-09-22 13:25:13 +02:00
ff26ea959d
Merge pull request 'Every machine was named twice over; only a machine on the private network is named (issue 079)' (#41) from multiple-fixes into main
jschoubben2026-09-22 02:19:13 +02:00
5150c0a0f8
One predicate for the private network: the filter's accept set is the set the names and the resolver mean; the catalogue is read once for the three mesh-wide questions
jschoubben2026-09-22 02:04:28 +02:00
6a64aba506
Only a machine on the private network is named: the names follow the resolver's rule, one predicate for both (novox/hq issue 079)
jschoubben2026-09-22 01:41:13 +02:00
8152665298
The facts write the suffix the control plane composed the names with, handed down rather than written twice (review of issue 079); the fixture is keyed as production keys it
jschoubben2026-09-22 01:27:50 +02:00
b529c49cff
A machine's names are not suffixed twice: the facts take the internal names the control plane hands them (novox/hq issue 079)
jschoubben2026-09-22 01:13:28 +02:00
713b43799f
Merge pull request 'Multiple fixes: a run-once step may name what it reads (ADR 0099); secret accept refuses an undeclared name (078)' (#40) from multiple-fixes into main
jschoubben2026-09-21 23:58:47 +02:00
0d1f2a4152
Review: module issue's pre-check factored and tested; a pair delivery for a requirement the module keeps no secret for is refused; builder issue's usage says the module comes first
jschoubben2026-09-21 23:58:36 +02:00
66332705cd
module issue refuses a module with no broker own secret before making the account (issue 078)
jschoubben2026-09-21 23:46:28 +02:00
35c5c2bb9b
secret accept is refused for a name the module does not declare, and a pair delivery for a requirement or local it has not got (novox/hq issue 078)
jschoubben2026-09-21 23:31:06 +02:00
e4da83496f
A run-once step may name what it reads: the pair run-once + restart-on is no longer refused (novox/hq ADR 0099)
jschoubben2026-09-21 23:31:06 +02:00
52d39f0740
Merge pull request 'The control plane's recipe declares its base, and an undeclared FROM is refused (ADR 0097 live)' (#39) from multiple-fixes into main
jschoubben2026-09-21 22:58:22 +02:00
b3486270d1
The control plane's recipe starts FROM the base its manifest declares, and an undeclared base is refused
jschoubben2026-09-21 22:16:10 +02:00
d7dab9c09f
Merge pull request 'Multiple fixes: several secrets per module (069), ask a module's tool (049), copy an upstream image (046), declare a vendor image (064)' (#38) from multiple-fixes into main
jschoubben2026-09-21 21:05:11 +02:00
9f3790dcda
Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves
jschoubben2026-09-21 21:03:22 +02:00
e81f352979
An undeclared COPY --from is refused; an undeclared FROM is said, not yet refused
jschoubben2026-09-21 20:48:00 +02:00
6f6e1244d4
A build declares the vendor image it stands on, and a recipe fetches nothing undeclared
jschoubben2026-09-21 20:45:36 +02:00
412599de9a
An upstream image is copied between registries, never through a machine's image store
jschoubben2026-09-21 20:42:30 +02:00
5049d201c6
A provider keeps one grant file per holder, with the local name in its id and path
jschoubben2026-09-21 20:41:19 +02:00
3e5c010c5e
A need is kept once per provision, consumer, local name and provider
jschoubben2026-09-21 20:38:01 +02:00
76773dfbf5
Several secrets expand where the consumer is known, not on the first module to mention the provision
jschoubben2026-09-21 20:36:19 +02:00
973cda5d76
ask: the control plane calls a module's tool and prints its answer
jschoubben2026-09-21 20:34:03 +02:00
6ae4ae1dba
A module may hold several secrets from one provider, each a pair of its own
jschoubben2026-09-21 20:28:16 +02:00
f3bfc11565
Merge pull request 'Multiple fixes: a stuck machine is said to be one (065), an undeclared mount is refused (026), an operator delivers a pair credential (070)' (#37) from feat/multiple-fixes into main
jschoubben2026-09-21 19:23:33 +02:00
53a79a17a1
Review: a failure is the same by resource id, not by the host's words; bound files and /run/docker.sock are declared
jschoubben2026-09-21 19:23:02 +02:00
396e05bb65
An operator delivers a pair credential, and the mesh never replaces it
jschoubben2026-09-21 17:50:41 +02:00
537ad544d3
A container may not mount a path the module never declared — and three things declare one
jschoubben2026-09-21 17:47:44 +02:00
fcaad7271a
A failure that repeats is said to be stuck
jschoubben2026-09-21 17:43:24 +02:00
69d0b94395
Merge pull request 'The link knows a superseded report (issue 031)' (#36) from feat/migration-blockers into main
jschoubben2026-09-21 13:48:43 +02:00
1ab0364705
The link knows a superseded report (issue 031)
jschoubben2026-09-21 12:11:52 +02:00
153990348c
Merge pull request 'A secret reaches a process as a file (ADR 0086, closes issue 041)' (#35) from feat/secret-not-in-environment into main
jschoubben2026-09-21 11:59:02 +02:00
67de216160
The controller's own manifest reads its credentials from files too
jschoubben2026-09-21 10:33:22 +02:00
69bb0fcb67
A module names who its secret files belong to (secrets-owner)
jschoubben2026-09-21 10:19:00 +02:00
4531f2244f
A secret reaches a process as a file (ADR 0086)
jschoubben2026-09-21 10:10:33 +02:00
6b695c82d7
Merge pull request 'Secrets vault: operator key, a second seal on every secret, recovery and export' (#34) from feat/secrets-vault into main
jschoubben2026-09-21 09:34:47 +02:00
77e6c1a684
Recoverable means sealed to the current operator key; recovery names the provider
jschoubben2026-09-21 01:16:32 +02:00
565f144a20
A pair credential is sealed to the operator key too
jschoubben2026-09-21 00:36:16 +02:00
e140ed5d0b
An operator key, a second seal on every own secret, and the vault keeps the export
jschoubben2026-09-20 23:53:50 +02:00
1c2e94e1a0
Merge pull request 'The catalogue moves out, to novox/mesh-catalog' (#33) from chore/catalogue-moves-out into main
jschoubben2026-09-20 22:13:37 +02:00
4ac12115ba
The catalogue moves out, to novox/mesh-catalog
jschoubben2026-09-03 00:15:46 +02:00
630eed82f3
Merge pull request 'The consistency cascade sends tolerantly and stops loudly (057 review)' (#32) from fix/cascade-is-tolerant into main
jschoubben2026-09-20 13:41:55 +02:00
d6ee77f17c
The consistency cascade sends tolerantly and stops loudly (issue 057 review)
jschoubben2026-09-20 13:27:12 +02:00
5dd2432b50
Merge pull request 'One push leaves the mesh consistent; the foundation's ports are forwarded (057, 063)' (#31) from fix/one-push-is-enough into main
jschoubben2026-09-20 12:53:14 +02:00
97c076ea48
The one-push cascade compares against what was last sent (issue 057)
jschoubben2026-09-18 02:37:26 +02:00
25e42b3ad6
The foundation's ports are forwarded, not only accepted on input (issue 063)
jschoubben2026-09-18 02:19:34 +02:00
f47b6e1c31
One push leaves the mesh consistent (issue 057)
jschoubben2026-09-18 02:05:55 +02:00
0b574f3972
Merge pull request 'The broker credential resolves the seat, not the hub (issue 059)' (#30) from fix/broker-address-resolves-the-seat into main
jschoubben2026-09-18 01:12:49 +02:00
79a9e17df0
The broker credential resolves the mesh-broker seat, not the hub (issue 059)
jschoubben2026-09-17 22:31:36 +02:00
9c718025c0
Merge pull request 'The network carries the registry trust (ADR 0082, issues 042/048/062)' (#29) from feat/the-network-carries-registry-trust into main
jschoubben2026-09-18 01:00:37 +02:00
98aea8b25c
An artifact-store lookup failure refuses the compose
jschoubben2026-09-18 00:14:49 +02:00
bc289cbe04
The restart-on rename reads both list shapes
jschoubben2026-09-17 23:35:12 +02:00
0e9035d479
The network carries the registry trust (ADR 0082, issues 042/048)
jschoubben2026-09-17 23:05:23 +02:00
39dc927a6f
Merge pull request 'The controller's seat is mesh-controller; second-node assignment refused' (#28) from multi-node/foundation-seats into main
jschoubben2026-09-17 02:16:05 +02:00
fc4c5d1a60
The controller's seat is mesh-controller; a foundation module on a second node is refused
jschoubben2026-09-17 02:13:26 +02:00
jschoubben