jochen 2bfa6ae4a0 No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236) ...

A send carries the machine's whole declaration, so at the switch to roll the next send of
anything would have carried the old default's backlog, unjudged, to every machine. A gated
send now carries and judges everything waiting on its machine; every other send is refused
or leaves the machine; a release plan walks what waits one machine at a time, the control
node last, and one that fails holds the next until a person releases it.

2026-10-06 19:14:25 +02:00

..

0001-nodes.sql

The control plane, as far as identity

2026-08-29 02:44:09 +02:00

0002-enrolment-tokens.sql

Node records, and the right to join once

2026-08-29 14:46:03 +02:00

0003-what-a-node-owns.sql

The mesh keeps a copy of what each node owns

2026-08-29 16:51:54 +02:00

0004-the-overlay.sql

The mesh computes a private network it cannot impersonate

2026-08-29 16:58:56 +02:00

0005-modules-and-assignments.sql

The mesh decides what a node runs

2026-08-29 22:00:06 +02:00

0006-where-a-module-came-from.sql

The mesh knows where a module came from, and whether it is behind

2026-08-29 22:32:16 +02:00

0007-settings.sql

Settings: changing a module's config without editing its file

2026-08-29 23:01:09 +02:00

0008-which-provider.sql

Where the answer to a requirement is allowed to live

2026-08-29 23:51:50 +02:00

0009-secrets.sql

Credentials the mesh delivers and cannot read

2026-08-30 00:21:18 +02:00

0010-builds.sql

Builds have a history, and failures are rows like any other

2026-08-30 10:18:23 +02:00

0011-what-a-node-did.sql

Keep what each machine did, so status can say what is wrong

2026-08-30 18:08:59 +02:00

0012-a-modules-own-secret.sql

A module may need a secret of its own, and the provisioner watches

2026-08-30 18:22:05 +02:00

0013-a-secret-the-mesh-cannot-reinvent.sql

A secret the mesh was given is not one the mesh can reinvent

2026-08-31 00:32:11 +02:00

0014-what-a-machine-was-last-sent.sql

"Behind" means not running what the mesh would send

2026-08-31 05:17:21 +02:00

0015-a-consumer-is-a-module-on-a-machine.sql

A consumer is a module on a machine, not a machine

2026-09-01 02:40:09 +02:00

0016-the-mesh-assigns-the-port.sql

The mesh assigns the port, and a module says it once

2026-09-01 17:52:53 +02:00

0017-what-a-machine-already-holds.sql

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

0018-a-report-names-its-declaration.sql

Caught up is an equality, not an ordering

2026-09-02 00:02:44 +02:00

0019-a-nodes-public-domain.sql

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

0020-a-module-is-a-repository-and-a-path.sql

Build a module from a repository and a path within it

2026-09-12 16:45:50 +02:00

0021-what-to-do-when-a-module-is-upgraded.sql

The mesh acts on what the catalogue decided a build meant

2026-09-13 01:55:07 +02:00

0022-a-build-keeps-what-it-was-told.sql

A build keeps what it was told

2026-09-15 01:22:34 +02:00

0023-an-operator-key-and-a-second-seal.sql

An operator key, a second seal on every own secret, and the vault keeps the export

2026-09-20 23:56:49 +02:00

0024-a-pair-credential-is-sealed-to-the-operator-too.sql

A pair credential is sealed to the operator key too

2026-09-21 00:36:16 +02:00

0025-a-failure-that-repeats-is-said-to-be-stuck.sql

Review: a failure is the same by resource id, not by the host's words; bound files and /run/docker.sock are declared

2026-09-21 19:23:02 +02:00

0026-a-pair-credential-says-where-it-came-from.sql

An operator delivers a pair credential, and the mesh never replaces it

2026-09-21 17:50:41 +02:00

0027-a-module-may-hold-several-secrets-from-one-provider.sql

A module may hold several secrets from one provider, each a pair of its own

2026-09-21 20:28:16 +02:00

0028-a-token-is-claimed-before-it-is-spent.sql

Nothing the control queue carries is lost while the store restarts: an enrolment claims its token and spends it last, and is asked to try again; build results, upgrades and catch-ups are handed back, bounded (novox/hq issue 083)

2026-09-22 14:06:28 +02:00

0029-a-node-is-adopted-or-converged.sql

Record whether a node is adopted and which modules were taken on it (hq ADR 0100)

2026-09-22 17:14:05 +02:00

0030-what-an-adopted-node-reports.sql

Keep what an adopted node reports holding, the firewall it found and what is reachable on it (hq ADR 0100)

2026-09-22 17:23:09 +02:00

0031-the-tunnel-a-node-found.sql

Adopt the predecessor's tunnel in place: its range, its address, its peers

2026-09-23 23:26:34 +02:00

0032-a-source-may-live-on-a-seat.sql

Seats are a closed set, a seat's holder answers for what it delivers, and a build source may live on the git seat

2026-09-25 20:48:10 +02:00

0033-a-carried-peer-is-nameable.sql

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

0034-the-seats-are-data.sql

Seats are data the controller owns, loaded from its store (ADR 0122, phase 1)

2026-09-27 16:04:44 +02:00

0035-a-seat-keeps-its-former-names.sql

Seats keep their former names, so a rename breaks nothing (ADR 0122, phase 2)

2026-09-27 16:32:22 +02:00

0036-a-node-has-an-operator-account.sql

The mesh owns the operator's ~/.ssh: account fact + home-scoped resources (to-be 29)

2026-09-27 17:50:56 +02:00

0037-the-bus-keeps-its-users-hashes.sql

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

0038-a-person-may-reach-the-mesh.sql

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

0039-a-seat-is-held-by-one-assignment-on-record.sql

A seat is handed over as one act, and the holder is on record

2026-09-27 23:22:20 +02:00

0040-the-broker-seat-delivers-the-bus.sql

AMQP is not a provision: the bus seat delivers the bus, and the word is refused

2026-09-27 23:29:00 +02:00

0041-a-machine-is-told-its-membership-for-the-new-bus.sql

The move mints every credential and tells each machine its membership

2026-09-28 00:16:24 +02:00

0042-a-build-says-which-repositories-it-read.sql

A merge rebuilds what it changed, and what packages it

2026-09-28 09:20:01 +02:00

0043-a-machine-says-which-networks-it-routes.sql

A machine says which networks it routes, and its filter forwards them

2026-09-28 21:29:10 +02:00

0044-a-machine-says-which-links-face-outside.sql

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

0045-a-machine-says-which-host-runs-it.sql

The mesh knows which host runs a machine, and says who is behind another

2026-09-30 08:53:59 +02:00

0046-each-send-is-numbered.sql

Each send is numbered, inside the signed bytes

2026-09-30 14:09:12 +02:00

0047-a-seat-carries-its-tools.sql

The mesh's own verbs are the mesh-controller seat's tools

2026-09-30 17:39:38 +02:00

0048-the-artifact-store-seat-is-named-for-its-scope.sql

The seat rename survives a row seeded under the new name

2026-09-30 21:34:34 +02:00

0049-a-shared-credential-is-one-value-sealed-many-times.sql

A provider with one credential shares it with every consumer, remade for all at once (hq ADR 0158)

2026-10-01 12:26:44 +02:00

0050-a-pin-names-the-module.sql

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

0051-a-pin-made-before-is-completed.sql

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

0052-a-merge-is-a-plan-the-mesh-keeps.sql

A merge produces a tiered plan the mesh keeps (hq ADR 0162)

2026-10-01 17:53:55 +02:00

0053-a-machine-says-what-strays-on-it.sql

A take is a comparison: the preview, its refusals, the strays, and the policy said at build (hq ADR 0163)

2026-10-01 21:25:27 +02:00

0054-a-machine-says-what-filters-it.sql

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

0055-an-older-build-never-replaces-a-newer.sql

An older build request never replaces a newer one's artifact

2026-10-04 00:22:11 +02:00

0056-what-the-store-no-longer-keeps.sql

Rebased onto main: ADR 0188 renumbered to 0201, migration 0055 to 0056

2026-10-04 02:45:06 +02:00

0058-a-newer-plan-supersedes-an-older.sql

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

0060-the-per-node-resolver-seat-is-gone.sql

Delete node-dns-resolver and make resolver config need the uplink

2026-10-05 21:57:04 +02:00

0061-a-send-records-the-builds-it-carried.sql

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

0062-a-replicated-seat-has-several-holders-on-record.sql

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

0063-the-resolver-file-is-the-uplinks.sql

Number the resolver-config migration 0063: it merges first

2026-10-06 00:07:54 +02:00

0064-a-machines-names-are-one-seats.sql

Number the hostname seat migration 0064: it merges after the resolver-config one

2026-10-06 00:07:57 +02:00

0065-a-provider-says-which-consumer-it-keeps-failing.sql

Report a provider that keeps failing a consumer in status (hq ADR 0224)

2026-10-06 00:13:23 +02:00

0066-the-durations-the-bounds-are-set-from.sql

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

0067-a-given-secret-lives-until-the-first-good-start.sql

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

0068-order-and-one-writer.sql

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

0070-a-known-failure-heals-itself.sql

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

0071-a-binding-to-data-is-kept.sql

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

0072-a-module-declares-the-data-it-holds.sql

Measure each item its own way; never compare a partial size (hq ADR 0233)

2026-10-06 17:00:22 +02:00

0073-a-build-rolls-out-gated-and-rolls-back.sql

No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236)

2026-10-06 19:14:25 +02:00