jschoubben 96e15f8693 Hold a joining module at the build it ran, own its directories by its own group, and take a library only when its act is done (hq ADR 0328 review, ADR 0334) ...

A held module is composed exactly as before it joined, at the build its machine runs, so its port, resources and
contributions stay. A joining module's directories belong to its user and its own group, and its tools' directories
are refused closed to that group; the runner joins it where the engine can say so. A take records the root and is
taken only when the engine states the act done. Libraries' paths and verdicts count modules pulled in by a
requirement, and a unit takes the identity.

2026-10-13 00:03:18 +02:00

..

0001-nodes.sql

The control plane, as far as identity

2026-08-29 02:44:09 +02:00

0002-enrolment-tokens.sql

Node records, and the right to join once

2026-08-29 14:46:03 +02:00

0003-what-a-node-owns.sql

The mesh keeps a copy of what each node owns

2026-08-29 16:51:54 +02:00

0004-the-overlay.sql

The mesh computes a private network it cannot impersonate

2026-08-29 16:58:56 +02:00

0005-modules-and-assignments.sql

The mesh decides what a node runs

2026-08-29 22:00:06 +02:00

0006-where-a-module-came-from.sql

The mesh knows where a module came from, and whether it is behind

2026-08-29 22:32:16 +02:00

0007-settings.sql

Settings: changing a module's config without editing its file

2026-08-29 23:01:09 +02:00

0008-which-provider.sql

Where the answer to a requirement is allowed to live

2026-08-29 23:51:50 +02:00

0009-secrets.sql

Credentials the mesh delivers and cannot read

2026-08-30 00:21:18 +02:00

0010-builds.sql

Builds have a history, and failures are rows like any other

2026-08-30 10:18:23 +02:00

0011-what-a-node-did.sql

Keep what each machine did, so status can say what is wrong

2026-08-30 18:08:59 +02:00

0012-a-modules-own-secret.sql

A module may need a secret of its own, and the provisioner watches

2026-08-30 18:22:05 +02:00

0013-a-secret-the-mesh-cannot-reinvent.sql

A secret the mesh was given is not one the mesh can reinvent

2026-08-31 00:32:11 +02:00

0014-what-a-machine-was-last-sent.sql

"Behind" means not running what the mesh would send

2026-08-31 05:17:21 +02:00

0015-a-consumer-is-a-module-on-a-machine.sql

A consumer is a module on a machine, not a machine

2026-09-01 02:40:09 +02:00

0016-the-mesh-assigns-the-port.sql

The mesh assigns the port, and a module says it once

2026-09-01 17:52:53 +02:00

0017-what-a-machine-already-holds.sql

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

0018-a-report-names-its-declaration.sql

Caught up is an equality, not an ordering

2026-09-02 00:02:44 +02:00

0019-a-nodes-public-domain.sql

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

0020-a-module-is-a-repository-and-a-path.sql

Build a module from a repository and a path within it

2026-09-12 16:45:50 +02:00

0021-what-to-do-when-a-module-is-upgraded.sql

The mesh acts on what the catalogue decided a build meant

2026-09-13 01:55:07 +02:00

0022-a-build-keeps-what-it-was-told.sql

A build keeps what it was told

2026-09-15 01:22:34 +02:00

0023-an-operator-key-and-a-second-seal.sql

An operator key, a second seal on every own secret, and the vault keeps the export

2026-09-20 23:56:49 +02:00

0024-a-pair-credential-is-sealed-to-the-operator-too.sql

A pair credential is sealed to the operator key too

2026-09-21 00:36:16 +02:00

0025-a-failure-that-repeats-is-said-to-be-stuck.sql

Review: a failure is the same by resource id, not by the host's words; bound files and /run/docker.sock are declared

2026-09-21 19:23:02 +02:00

0026-a-pair-credential-says-where-it-came-from.sql

An operator delivers a pair credential, and the mesh never replaces it

2026-09-21 17:50:41 +02:00

0027-a-module-may-hold-several-secrets-from-one-provider.sql

A module may hold several secrets from one provider, each a pair of its own

2026-09-21 20:28:16 +02:00

0028-a-token-is-claimed-before-it-is-spent.sql

Nothing the control queue carries is lost while the store restarts: an enrolment claims its token and spends it last, and is asked to try again; build results, upgrades and catch-ups are handed back, bounded (novox/hq issue 083)

2026-09-22 14:06:28 +02:00

0029-a-node-is-adopted-or-converged.sql

Record whether a node is adopted and which modules were taken on it (hq ADR 0100)

2026-09-22 17:14:05 +02:00

0030-what-an-adopted-node-reports.sql

Keep what an adopted node reports holding, the firewall it found and what is reachable on it (hq ADR 0100)

2026-09-22 17:23:09 +02:00

0031-the-tunnel-a-node-found.sql

Adopt the predecessor's tunnel in place: its range, its address, its peers

2026-09-23 23:26:34 +02:00

0032-a-source-may-live-on-a-seat.sql

Seats are a closed set, a seat's holder answers for what it delivers, and a build source may live on the git seat

2026-09-25 20:48:10 +02:00

0033-a-carried-peer-is-nameable.sql

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

0034-the-seats-are-data.sql

Seats are data the controller owns, loaded from its store (ADR 0122, phase 1)

2026-09-27 16:04:44 +02:00

0035-a-seat-keeps-its-former-names.sql

Seats keep their former names, so a rename breaks nothing (ADR 0122, phase 2)

2026-09-27 16:32:22 +02:00

0036-a-node-has-an-operator-account.sql

The mesh owns the operator's ~/.ssh: account fact + home-scoped resources (to-be 29)

2026-09-27 17:50:56 +02:00

0037-the-bus-keeps-its-users-hashes.sql

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

0038-a-person-may-reach-the-mesh.sql

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

0039-a-seat-is-held-by-one-assignment-on-record.sql

A seat is handed over as one act, and the holder is on record

2026-09-27 23:22:20 +02:00

0040-the-broker-seat-delivers-the-bus.sql

AMQP is not a provision: the bus seat delivers the bus, and the word is refused

2026-09-27 23:29:00 +02:00

0041-a-machine-is-told-its-membership-for-the-new-bus.sql

The move mints every credential and tells each machine its membership

2026-09-28 00:16:24 +02:00

0042-a-build-says-which-repositories-it-read.sql

A merge rebuilds what it changed, and what packages it

2026-09-28 09:20:01 +02:00

0043-a-machine-says-which-networks-it-routes.sql

A machine says which networks it routes, and its filter forwards them

2026-09-28 21:29:10 +02:00

0044-a-machine-says-which-links-face-outside.sql

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

0045-a-machine-says-which-host-runs-it.sql

The mesh knows which host runs a machine, and says who is behind another

2026-09-30 08:53:59 +02:00

0046-each-send-is-numbered.sql

Each send is numbered, inside the signed bytes

2026-09-30 14:09:12 +02:00

0047-a-seat-carries-its-tools.sql

The mesh's own verbs are the mesh-controller seat's tools

2026-09-30 17:39:38 +02:00

0048-the-artifact-store-seat-is-named-for-its-scope.sql

The seat rename survives a row seeded under the new name

2026-09-30 21:34:34 +02:00

0049-a-shared-credential-is-one-value-sealed-many-times.sql

A provider with one credential shares it with every consumer, remade for all at once (hq ADR 0158)

2026-10-01 12:26:44 +02:00

0050-a-pin-names-the-module.sql

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

0051-a-pin-made-before-is-completed.sql

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

0052-a-merge-is-a-plan-the-mesh-keeps.sql

A merge produces a tiered plan the mesh keeps (hq ADR 0162)

2026-10-01 17:53:55 +02:00

0053-a-machine-says-what-strays-on-it.sql

A take is a comparison: the preview, its refusals, the strays, and the policy said at build (hq ADR 0163)

2026-10-01 21:25:27 +02:00

0054-a-machine-says-what-filters-it.sql

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

0055-an-older-build-never-replaces-a-newer.sql

An older build request never replaces a newer one's artifact

2026-10-04 00:22:11 +02:00

0056-what-the-store-no-longer-keeps.sql

Rebased onto main: ADR 0188 renumbered to 0201, migration 0055 to 0056

2026-10-04 02:45:06 +02:00

0058-a-newer-plan-supersedes-an-older.sql

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

0060-the-per-node-resolver-seat-is-gone.sql

Delete node-dns-resolver and make resolver config need the uplink

2026-10-05 21:57:04 +02:00

0061-a-send-records-the-builds-it-carried.sql

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

0062-a-replicated-seat-has-several-holders-on-record.sql

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

0063-the-resolver-file-is-the-uplinks.sql

Number the resolver-config migration 0063: it merges first

2026-10-06 00:07:54 +02:00

0064-a-machines-names-are-one-seats.sql

Number the hostname seat migration 0064: it merges after the resolver-config one

2026-10-06 00:07:57 +02:00

0065-a-provider-says-which-consumer-it-keeps-failing.sql

Report a provider that keeps failing a consumer in status (hq ADR 0224)

2026-10-06 00:13:23 +02:00

0066-the-durations-the-bounds-are-set-from.sql

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

0067-a-given-secret-lives-until-the-first-good-start.sql

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

0068-order-and-one-writer.sql

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

0070-a-known-failure-heals-itself.sql

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

0071-a-binding-to-data-is-kept.sql

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

0072-a-module-declares-the-data-it-holds.sql

Measure each item its own way; never compare a partial size (hq ADR 0233)

2026-10-06 17:00:22 +02:00

0073-a-build-rolls-out-gated-and-rolls-back.sql

No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236)

2026-10-06 19:14:25 +02:00

0074-a-build-says-what-it-was-made-from.sql

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

0075-a-walk-waits-for-its-delivery.sql

Let a walk wait for its delivery's word, and serve the delivery's owner (hq ADR 0239)

2026-10-07 00:01:42 +02:00

0076-a-module-says-how-it-is-healthy.sql

Keep what each machine says of what it runs, raise it, and gate on it (hq ADR 0240, to-be 48 Phase A)

2026-10-07 02:28:16 +02:00

0077-a-machine-says-how-its-network-is.sql

Raise a machine's network from what its engine says, once (hq ADR 0241)

2026-10-07 18:52:16 +02:00

0078-what-a-change-replaces.sql

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

0079-a-token-is-issued-for-a-tunnel-key.sql

A token can be issued for a machine's tunnel key, and it joins through the tunnel

2026-10-08 02:06:19 +02:00

0080-a-failed-unit-is-never-silent.sql

Raise a failed unit, the module's and the machine's (hq issue 315)

2026-10-08 11:28:52 +02:00

0081-a-mirrored-base-is-recorded.sql

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

0082-an-assignment-waits-for-its-build.sql

Give each pending assignment its own condition, and keep a raised row until it clears

2026-10-08 16:45:43 +02:00

0083-a-node-names-the-account-its-agents-run-as.sql

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

0084-a-build-asked-at-the-terminal-says-so.sql

Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

2026-10-09 12:37:18 +02:00

0085-the-controller-keeps-when-a-root-search-began-pending.sql

Count the quiet after a restart from when the controller first saw the search pending

2026-10-09 12:37:18 +02:00

0086-a-plan-keeps-when-its-merge-was-made.sql

Order a branch's plans by its merges, and build the newest commit (hq issue 349)

2026-10-09 15:00:56 +02:00

0087-a-controller-records-what-its-stores-schema-reaches.sql

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

0088-a-build-says-its-build-source.sql

Move a module on a merge only when its build source holds a changed file (hq ADR 0267, issue 363)

2026-10-10 03:20:36 +02:00

0089-merges-are-assembled-in-a-rolling-window.sql

Assemble merges in a rolling window and walk each batch once (hq ADR 0276, issue 362)

2026-10-10 13:20:04 +02:00

0090-a-layer-says-who-set-it.sql

A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

2026-10-10 14:42:40 +02:00

0091-a-secret-ask-is-bounded.sql

A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

2026-10-10 15:24:08 +02:00

0092-a-reading-says-the-path-it-was-measured-at.sql

Read a shrink against the item's own path, so a moved directory starts its size history again (hq issue 368)

2026-10-10 17:42:46 +02:00

0093-a-walk-keeps-its-phases.sql

Keep each walk's phases and say a delivery over its budget (hq ADR 0282 slice 1, issue 382)

2026-10-10 20:15:01 +02:00

0094-a-declaration-says-the-generation-it-came-from.sql

Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

2026-10-11 11:55:27 +02:00

0095-a-condition-keeps-its-looks-beside-the-bucket.sql

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)

2026-10-12 12:11:13 +02:00

0096-a-module-joins-and-a-library-has-a-group.sql

Hold a joining module at the build it ran, own its directories by its own group, and take a library only when its act is done (hq ADR 0328 review, ADR 0334)

2026-10-13 00:03:18 +02:00