mesh-controller

Files

T

jschoubben 983bf65141 Answer the controller's own verbs, root-free among them, from the serving controller alone (hq ADR 0259 §8)

The confirmation review asked who may answer root-free on the bus. Composed from the controller's own
manifest, the module principal of the machine running the controller and that machine's runtime were
granted the controller seat's tool subjects too: either could answer root-free, and the runtime's
credential is one an agent on that machine may hold. The controller's seat is now served by the
controller principal alone, in grants and memberships; TestOnlyTheServingControllerMayAnswerRootFree
failed before (3 answerers) and passes. And a machine waiting for its first setuid search is not
root-free, whatever ADR 0266's quiet window does to the self-check.

2026-10-09 13:51:18 +02:00

migrations

Count the quiet after a restart from when the controller first saw the search pending

2026-10-09 12:37:18 +02:00

addresses.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

adoption_test.go

A repeat assignment says nothing changed (ADR 0115)

2026-09-26 19:02:35 +02:00

adoption.go

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

agent_account_test.go

Refuse a node's accounts through any verb, and a stale or service-account agent verdict

2026-10-09 10:11:21 +02:00

artifacts_test.go

Answer what the records keep, collect on a person's word, and name a machine's images (hq ADR 0251)

2026-10-08 12:04:42 +02:00

bindings_test.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

bindings.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

buildinput_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

builds_test.go

A merge rebuilds what it changed, and what packages it

2026-09-28 09:20:01 +02:00

builds.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

busrecords_test.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

busrecords.go

Serve a trusted holder from a runtime of its own account, refuse it in the machine's runtime, and say while an agent can become root where it runs (hq ADR 0259 §8)

2026-10-09 13:48:56 +02:00

busstep.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

bususers_test.go

Genesis can raise a mesh on the new bus, and the carried user list is checked against the composer

2026-09-27 16:39:19 +02:00

bususers.go

One runtime principal per node carries every assigned module's tools (hq ADR 0175, to-be 38 WP2.1)

2026-10-02 18:16:14 +02:00

catalogue_test.go

Refuse the tools-container shape for every module (to-be 38 WP4b's last step)

2026-10-04 02:28:54 +02:00

catalogue.go

Judge the one protection rule the forge applies, and keep a recorded repository id

2026-10-09 12:58:28 +02:00

collection_test.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

collection.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

data_test.go

Measure each item its own way; never compare a partial size (hq ADR 0233)

2026-10-06 17:00:22 +02:00

data.go

Measure each item its own way; never compare a partial size (hq ADR 0233)

2026-10-06 17:00:22 +02:00

dependencies_test.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

dependencies.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

doing_test.go

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

durations_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

durations.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

forget_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

fortest.go

Give each pending assignment its own condition, and keep a raised row until it clears

2026-10-08 16:45:43 +02:00

gate.go

Put back on a failed gate only a build of the module's own repository

2026-10-09 12:37:18 +02:00

given_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

given.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

heals_test.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

heals.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

health.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

heldhere_test.go

Issue only the recorded holder a seat held once for the mesh (novox/hq issue 218)

2026-10-03 23:30:27 +02:00

hold_plans_test.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

hold_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

hold.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

holdings_test.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

inventory_test.go

Review of 083: finishing an enrolment whose token was spent takes proof of the key's private half, a live lease and a first delivery — a public key alone cannot replay a spent token; shutdown leaves held messages for the broker; identical builds supersede; what is held leaves room in the prefetch

2026-09-22 14:33:13 +02:00

inventory.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

mirrored_test.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

named_peer_test.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

nodes.go

Count the quiet after a restart from when the controller first saw the search pending

2026-10-09 12:37:18 +02:00

older_build_test.go

An older build request never replaces a newer one's artifact

2026-10-04 00:22:11 +02:00

operator_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

operator.go

Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

2026-09-21 21:03:22 +02:00

order_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

order.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

pending_test.go

Make pending assignments safe to race, settle them on a tick, and say only what was checked

2026-10-08 16:38:11 +02:00

pending.go

2026-10-09 12:37:18 +02:00

people_test.go

Tests follow the grants and issue 203: a person may ask what answers; the resolver test mints its credential

2026-10-03 23:15:57 +02:00

pin_completed_test.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

plans_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

plans.go

Put a broken module back at once, and excuse a wait only for a move that added an account group (hq issue 318 review)

2026-10-08 15:25:58 +02:00

ports_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

ports.go

Read the foundation's ports from each node's settings, wherever a port is used (hq ADR 0100)

2026-09-22 17:31:07 +02:00

public_domain_test.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

reachable_test.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

reachable.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

reported.go

Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

2026-10-06 20:31:10 +02:00

retire_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

rootfree_grants_test.go

Answer the controller's own verbs, root-free among them, from the serving controller alone (hq ADR 0259 §8)

2026-10-09 13:51:18 +02:00

seats_test.go

Give the build verb the command's other two shapes, so a changed base or a source that moved can be rebuilt through the console

2026-10-08 01:37:30 +02:00

seats.go

Let failed join the seat optional, and let a seeded row carry both changes

2026-10-07 20:05:01 +02:00

secrets_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

secrets.go

Say a machine waiting for its push as waiting, not uncomposable (hq issue 275)

2026-10-06 18:05:38 +02:00

sent_builds_test.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

sent_bus_users_test.go

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

settings_judged_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

source.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

store_as_run_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

tunnel_test.go

Adopt the tunnel as a mesh fact, refuse a mismatched takeover, and rekey after enrolment

2026-09-24 00:02:07 +02:00

tunnel.go

The mesh's interface takes over the found tunnel's MTU

2026-09-26 22:40:42 +02:00

unknown_field_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

unseen_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

unseen.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00