jochen 1b502a37e0 Let only the authority's root hold lines, refuse every line end, and keep places off the runtime's data and any .ssh ...

The review of hq issue 339 found the PEM exception too wide (any module, any
key, any label, anything base64), \v, \f, NEL and the Unicode separators
still let a value end a line in some readers, and the spool, /opt, the
container runtimes' data and an account's .ssh still placeable. Lines are now
taken only in step-ca's root setting, as certificates encoding/pem decodes and
x509 parses; every line end is refused; and those paths are the machine's own.
The test certificate is a real one, made for the tests with its key thrown away.

2026-10-09 00:28:08 +02:00

..

a_service_process_test.go

Compose a module's Go service as a process the host runs (hq issue 213)

2026-10-04 01:11:26 +02:00

accesses_test.go

catalogue: a module accesses operator-owned data, and does not own it

2026-09-05 22:10:58 +02:00

adoption_test.go

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

adoption.go

Say that the guard names the runtime's bridges where the filter names their addresses (hq ADR 0103)

2026-09-22 19:51:10 +02:00

amqp_is_not_a_provision_test.go

AMQP is not a provision: the bus seat delivers the bus, and the word is refused

2026-09-27 23:29:00 +02:00

artifact_store_alias_test.go

The artifact store's seat is named for its scope: mesh-artifact-store

2026-09-30 21:14:40 +02:00

artifact_store_seat_test.go

The artifact store's seat is named for its scope: mesh-artifact-store

2026-09-30 21:14:40 +02:00

artifacts_test.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

artifacts.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

backup_test.go

Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

2026-10-08 15:20:59 +02:00

bootstrap_cycle_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

bound_into_files_test.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00

bound_into_files.go

The derived-value record is ADR 0202 (was 0201)

2026-10-08 01:42:19 +02:00

bound_test.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

bound.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

broker_seat_test.go

The artifact store's seat is named for its scope: mesh-artifact-store

2026-09-30 21:14:40 +02:00

brokered_test.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

build_system_test.go

An artifact says which operating system it is built for

2026-09-29 00:54:27 +02:00

build_test.go

The builder resolves the SDK from the mesh registry, and can publish packages

2026-09-16 10:27:26 +02:00

build.go

Compose a module's Go service as a process the host runs (hq issue 213)

2026-10-04 01:11:26 +02:00

bus_snapshot_test.go

Grant the bus's own module the snapshot API and nothing else (hq ADR 0235)

2026-10-06 18:20:57 +02:00

catalogue_check_test.go

Derive data protection from a module's declared data (hq ADR 0233)

2026-10-06 16:47:49 +02:00

catrust_manifest_test.go

The trust module renders the authority it was bound to

2026-09-29 15:07:33 +02:00

chosen.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

co_located_test.go

Let only the authority's root hold lines, refuse every line end, and keep places off the runtime's data and any .ssh

2026-10-09 00:28:08 +02:00

computed_test.go

The private network writes nothing into the runtime's file (hq issue 190)

2026-10-05 22:19:43 +02:00

consumer_into_serves.go

Fill a preference's ${setting:} from its manifest default (hq ADR 0262)

2026-10-08 17:24:32 +02:00

contributes_test.go

A setting reaches only what declares it, the mesh places its own files, registration refuses a name

2026-09-30 22:29:28 +02:00

contribution_dependencies_test.go

node-power: the power seat, and code for its moments placed by its holder (hq ADR 0211)

2026-10-04 15:59:17 +02:00

controller_is_a_process_test.go

Run the controller as a Go bundle the host starts as a process (hq issue 213)

2026-10-04 01:45:25 +02:00

cron.go

catalogue: carry and validate a container schedule (ADR 0053)

2026-09-06 14:08:51 +02:00

data_test.go

Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

2026-10-08 15:20:59 +02:00

data.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

declaration_test.go

The mesh composes the accounts; the module owns its server

2026-09-27 02:50:23 +02:00

declaration.go

Keep a left-out module's provisions and backups, and refuse more identity keys (hq ADR 0262)

2026-10-08 18:03:46 +02:00

delivery_seat_test.go

Promise retire-history on the delivery seat, optional until its holder serves it (hq issue 313)

2026-10-08 11:20:45 +02:00

delivery_seat.go

Promise retire-history on the delivery seat, optional until its holder serves it (hq issue 313)

2026-10-08 11:20:45 +02:00

derived_for_consumer_test.go

The derived-value record is ADR 0202 (was 0201)

2026-10-08 01:42:19 +02:00

dir_into_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

dir_into.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

domain_test.go

Rename the mesh's seats to mesh-*, keeping their interfaces

2026-09-26 23:07:09 +02:00

endpoint_test.go

A route that names an endpoint still carries that endpoint's port

2026-09-29 11:55:28 +02:00

endpoints_setting_test.go

An assignment configures an endpoint as one thing

2026-09-29 11:25:40 +02:00

environment_into_test.go

Compose the account's environment and the shell's code from every module (hq ADR 0203, 0204)

2026-10-04 04:03:50 +02:00

environment_into.go

Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

2026-10-08 15:20:59 +02:00

events.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

filtering_foundation_test.go

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

filtering_test.go

The hub relays the mesh passing through it

2026-10-02 11:17:09 +02:00

filtering.go

The hub relays the mesh passing through it

2026-10-02 11:17:09 +02:00

foundation_manifests_test.go

Build every artifact the forge declares in the forge tests

2026-10-08 15:20:59 +02:00

generated_collision_test.go

The private network writes nothing into the runtime's file (hq issue 190)

2026-10-05 22:19:43 +02:00

genesis_image_test.go

Pin the image's Go base in the Dockerfile, which genesis builds as it stands (hq issue 223)

2026-10-04 01:49:05 +02:00

go_bundle_test.go

A bundle in a compiled language may name which command it builds

2026-09-30 09:55:54 +02:00

grant_secret_owner_test.go

A grant secret belongs to whoever provisions, and the sweep skips what it will not address

2026-10-04 12:21:49 +02:00

graphical_session_test.go

The graphical session's seats, a display's machine reach, and the session's slots (hq ADR 0208)

2026-10-04 12:38:53 +02:00

graphical_session.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

health_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

health.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

holdings_test.go

A claim may name the verbs it serves for its seat (hq ADR 0160)

2026-10-01 15:18:34 +02:00

hostname_seat_test.go

Rename node-hosts-file to node-hostname, and refuse one seat claimed under two names (hq ADR 0223)

2026-10-05 23:43:15 +02:00

identity_bound_test.go

Bound a consumer's identity by the provision it requires (hq issue 263)

2026-10-06 02:16:20 +02:00

identity_test.go

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:47:13 +02:00

identity.go

Bound a consumer's identity by the provision it requires (hq issue 263)

2026-10-06 02:16:20 +02:00

installation_test.go

A definition names no installation: the check, an operator's value, a context on the git seat

2026-09-30 18:38:06 +02:00

installation.go

Read stored manifests leniently and mark the defaults layer (hq ADR 0262 review)

2026-10-08 17:24:32 +02:00

invokes_test.go

A module may invoke tools, and a manifest is checked where it is written

2026-09-30 16:12:43 +02:00

jails_into_test.go

A changed jail filter restarts fail2ban

2026-10-02 23:28:25 +02:00

jails_into.go

A changed jail filter restarts fail2ban

2026-10-02 23:28:25 +02:00

kept_test.go

An operator key, a second seal on every own secret, and the vault keeps the export

2026-09-20 23:56:49 +02:00

licence_test.go

catalogue: deliver a keyless same-node provider's served facts

2026-09-07 05:08:04 +02:00

machine_into_files_test.go

A module can name the mesh's range: ${machine:mesh-range} (novox/hq ADR 0112)

2026-09-27 16:52:00 +02:00

machine_into_files.go

The service manager is a node seat with the unit verbs, and a user shape names the account (hq ADR 0176, 0177)

2026-10-02 16:48:16 +02:00

machineside_test.go

What review found in the port machinery, fixed

2026-09-01 21:54:05 +02:00

manifest.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

mounts_test.go

A filter module's own filter file counts as declared for a mount (hq ADR 0169)

2026-10-02 14:04:35 +02:00

names_test.go

No container is given the mesh's names; it resolves them

2026-09-30 14:38:07 +02:00

naming_test.go

Refuse an action where it was written, not on the machine

2026-09-01 02:55:56 +02:00

naming.go

A provision names the engine, because a consumer is coupled to one

2026-08-31 17:12:46 +02:00

needs_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

no_subjects_test.go

Event names are checked now, per manifest and across the catalogue

2026-09-27 14:43:16 +02:00

node_resolver_test.go

Compose the catalogue's systemd-resolved beside an uplink in a test (hq ADR 0247)

2026-10-07 21:27:34 +02:00

node_resolver.go

The machine's own resolver is a node seat, and the uplink steps back from the resolver file where it is held (hq ADR 0247)

2026-10-07 21:22:52 +02:00

operators_machine_test.go

Promise unlink-dangling on the service manager, optional (hq issue 332)

2026-10-08 17:39:08 +02:00

own_name_test.go

A module is told the name it is served under (hq 122)

2026-09-30 17:08:44 +02:00

own_secret_taken_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

pin_names_module_test.go

The first pass does not refuse two providers beside the consumer

2026-10-01 17:34:17 +02:00

placed_paths_test.go

The path-preservation proof resolves access ids to their default paths too

2026-10-01 00:01:41 +02:00

placement_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

placement.go

Let only the authority's root hold lines, refuse every line end, and keep places off the runtime's data and any .ssh

2026-10-09 00:28:08 +02:00

port_into_test.go

Prove the untouched environment is the same map, not an equal one

2026-09-22 23:29:28 +02:00

port_into.go

Compose a process's environment as a container's

2026-10-04 00:27:42 +02:00

prepares_test.go

A module's name may contain a dot, so the derived step adds none

2026-09-28 15:44:18 +02:00

print_rehearsal_test.go

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

process_env_test.go

Compose a process's environment as a container's

2026-10-04 00:27:42 +02:00

provided_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

public_issuer_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

published_ports_test.go

A container publishes only a port its module declares (hq issue 227)

2026-10-04 12:25:27 +02:00

reach_test.go

Reach asks for names on a routed endpoint, and its port stays the manifest's

2026-09-29 02:50:41 +02:00

received_on_the_bus_test.go

The proxy is told its routes and the mesh on the bus, and serves internal names to the mesh only

2026-10-02 01:46:30 +02:00

recreates.go

Say what each verb replaces, so the agent is pointed at it instead of a shell command (hq ADR 0245)

2026-10-07 20:44:47 +02:00

reflects_renamed_test.go

The restart-on rename reads both list shapes

2026-09-17 23:35:12 +02:00

replaces_test.go

Say what each verb replaces, so the agent is pointed at it instead of a shell command (hq ADR 0245)

2026-10-07 20:44:47 +02:00

replays_test.go

Replay issues 292 and 298 as tests the commit before each fix fails (hq ADR 0237)

2026-10-08 01:26:39 +02:00

resolve_keeps_references_test.go

A resolved manifest keeps a built reference in the store's own form, never the address it was reached by (hq ADR 0155)

2026-10-02 23:13:22 +02:00

resolve_loopback_test.go

A binding answered on this very node still carries an address

2026-09-14 21:11:37 +02:00

resolve_test.go

The broker credential resolves the mesh-broker seat, not the hub (issue 059)

2026-09-18 01:02:26 +02:00

resolve.go

Let a seat receive blocks as data its holder renders, placed where the machine has the hardware (hq ADR 0255)

2026-10-08 15:20:59 +02:00

resolver_file_is_the_uplinks_test.go

The machine's own resolver is a node seat, and the uplink steps back from the resolver file where it is held (hq ADR 0247)

2026-10-07 21:22:52 +02:00

resolver_manifests_test.go

Test the resolver file as the uplink's, and refuse a second writer of a fact's path (hq ADR 0223)

2026-10-05 23:39:15 +02:00

retirement_event_test.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

roster_test.go

A route's internal name says where the request arrives

2026-09-30 14:51:12 +02:00

roster.go

Test the resolver file as the uplink's, and refuse a second writer of a fact's path (hq ADR 0223)

2026-10-05 23:39:15 +02:00

routing_test.go

A route's internal name says where the request arrives

2026-09-30 14:51:12 +02:00

runonce_test.go

A run-once step may name what it reads: the pair run-once + restart-on is no longer refused (novox/hq ADR 0099)

2026-09-21 23:31:06 +02:00

runtime_gate_test.go

A tool container on the runtime's image is refused once the runtime is registered (hq ADR 0175, to-be 38 WP2.4)

2026-10-02 18:30:14 +02:00

runtime_test.go

integrate: go served

2026-10-03 23:12:21 +02:00

runtime.go

A runtime compiled to a binary runs itself (hq ADR 0193)

2026-10-03 21:24:12 +02:00

schedule_test.go

catalogue: carry and validate a container schedule (ADR 0053)

2026-09-06 14:08:51 +02:00

seat_answers_before_local_test.go

A mesh seat's holder elsewhere answers before this machine's own provider (issue 258)

2026-10-05 21:14:01 +02:00

seat_contributions_test.go

A seat says what it receives, and its holder places every module's contribution (hq ADR 0212)

2026-10-04 16:48:01 +02:00

seat_contributions.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

seat_data_test.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

seat_data.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

seat_dependencies_test.go

Refuse an unmet seat dependency the catalogue could meet (hq ADR 0207 §4)

2026-10-04 13:07:45 +02:00

seat_dependencies.go

Let a seat receive blocks as data its holder renders, placed where the machine has the hardware (hq ADR 0255)

2026-10-08 15:20:59 +02:00

seat_into_test.go

Tell a module where a mesh seat's holder is reached (hq ADR 0222)

2026-10-05 22:16:23 +02:00

seat_into.go

Tell a module where a mesh seat's holder is reached (hq ADR 0222)

2026-10-05 22:16:23 +02:00

seats_declared_test.go

A claim may name the verbs it serves for its seat (hq ADR 0160)

2026-10-01 15:18:34 +02:00

seats_declared.go

Module state is hq ADR 0201 after all: the derived-value record moved to 0202 on hq main

2026-10-04 11:02:42 +02:00

seats_test.go

Add the node-nfs-server and node-mounts seats, so a share and a mount have a role the mesh defines (hq ADR 0263)

2026-10-08 18:24:38 +02:00

seats.go

Add the node-nfs-server and node-mounts seats, so a share and a mount have a role the mesh defines (hq ADR 0263)

2026-10-08 18:24:38 +02:00

secret_restart_test.go

An assignment issues its bus credential, a push refuses one nobody issued, and what reads a secret restarts on it (hq issue 203)

2026-10-03 04:01:17 +02:00

secrets_in_environment_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

secrets_into_files_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

secrets_into_files.go

A module may hold several secrets from one provider, each a pair of its own

2026-09-21 20:28:16 +02:00

setting_defaults_test.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

setting_defaults.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

setting_into_test.go

A definition names no installation: the check, an operator's value, a context on the git seat

2026-09-30 18:38:06 +02:00

setting_into.go

Read stored manifests leniently and mark the defaults layer (hq ADR 0262 review)

2026-10-08 17:24:32 +02:00

settings_judge_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

settings_test.go

A served value or a contribution's may be the operator's: ${setting:…} fills there too, refused by name when unset

2026-09-30 22:34:43 +02:00

settings.go

Let only the authority's root hold lines, refuse every line end, and keep places off the runtime's data and any .ssh

2026-10-09 00:28:08 +02:00

several_contributions_test.go

contributes: a module's grant carries no value where it contributed several times

2026-09-24 18:54:35 +02:00

several_secrets_test.go

Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

2026-09-21 21:03:22 +02:00

shared_account_test.go

Compose an account given only groups where its module wrote it (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

shared_credential_test.go

A provider with one credential shares it with every consumer, remade for all at once (hq ADR 0158)

2026-10-01 12:26:44 +02:00

shares_test.go

Describe nfs-server's exports and test as per-node addresses, as the server exports them since the review (hq ADR 0263 rule 5)

2026-10-08 21:14:09 +02:00

shares.go

Describe nfs-server's exports and test as per-node addresses, as the server exports them since the review (hq ADR 0263 rule 5)

2026-10-08 21:14:09 +02:00

short_form_port_protocol_test.go

A short-form port keeps its protocol and still gets its machine port

2026-09-30 16:58:23 +02:00

showcase_manifest_test.go

A module can be told which port it was given

2026-09-15 13:20:01 +02:00

ssh_client_test.go

Hold ssh-client to its new shape: an include region first, the mesh's hosts in config.d (mesh-catalog #266)

2026-10-04 12:52:03 +02:00

state_test.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

state.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

terminal_settings_test.go

Let only the authority's root hold lines, refuse every line end, and keep places off the runtime's data and any .ssh

2026-10-09 00:28:08 +02:00

the_bus_is_never_public_test.go

The bus is never public: the broker port is no longer a foundation opening

2026-10-02 22:52:22 +02:00

two_consumers_test.go

A consumer is a module on a machine, not a machine

2026-09-01 02:40:09 +02:00

two_resolvers_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

unknown_field.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

upgrade_test.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

upgrade.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

uplink_verbs_test.go

Give the uplink seat its verbs, optional until its holders serve them (hq ADR 0241)

2026-10-07 20:37:33 +02:00

vault_seat_test.go

The vault's seat, and a report that carries the machine's profile (hq ADR 0161)

2026-10-01 15:58:04 +02:00

verbs_test.go

The mesh's own verbs are the mesh-controller seat's tools

2026-09-30 17:39:38 +02:00

verbs.go

Keep what a consumer gives up on until a person delivers it again or drops it

2026-10-08 18:32:58 +02:00

version_in_a_path_test.go

A resource can name the version of the build it uses

2026-09-30 10:03:55 +02:00

while_stopped_test.go

while-stopped names the container as the machine knows it (hq ADR 0189)

2026-10-04 04:18:22 +02:00

zones_test.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00

zones.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00