jschoubben 55d468798d ssh is never left without a rule ...

The floor allowed ssh from the mesh's addresses, and from everywhere on a
machine that faces outward. On a machine the mesh knows no addresses for it
emitted neither — so the chain dropped by default and ssh was simply shut.

That is the first machine anybody adopts: reached over the network, with the
port needed to fix it closed by the act of adopting it. Found by reading the
rules off a live machine rather than trusting the generator.

2026-09-14 16:53:39 +02:00

..

accesses_test.go

catalogue: a module accesses operator-owned data, and does not own it

2026-09-05 22:10:58 +02:00

bootstrap_cycle_test.go

What review found in the port machinery, fixed

2026-09-01 21:54:05 +02:00

bound_into_files_test.go

catalogue: announce a same-node provider at the port it is published on

2026-09-09 23:02:50 +02:00

bound_into_files.go

identity: a consumer's identity fits the tightest backend, via a slug (ADR 0054)

2026-09-05 02:51:39 +02:00

brokered_test.go

A consumer is a module on a machine, not a machine

2026-09-01 02:40:09 +02:00

build_test.go

A module says what it builds, and the built manifest is a different

2026-08-30 03:29:17 +02:00

build.go

A module may mirror an image it did not write

2026-08-30 18:28:05 +02:00

co_located_test.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

computed_test.go

Where the answer to a requirement is allowed to live

2026-08-29 23:51:50 +02:00

contributes_test.go

fix: a require-only consumer of a parameterless provision still asks (and is minted a credential)

2026-09-06 23:20:58 +02:00

cron.go

catalogue: carry and validate a container schedule (ADR 0053)

2026-09-06 14:08:51 +02:00

declaration.go

The firewall governs what is forwarded, and never closes ssh

2026-09-14 15:27:10 +02:00

domain_test.go

Where the answer to a requirement is allowed to live

2026-08-29 23:51:50 +02:00

filtering_test.go

ssh is never left without a rule

2026-09-14 16:53:39 +02:00

filtering.go

ssh is never left without a rule

2026-09-14 16:53:39 +02:00

identity_test.go

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:47:13 +02:00

identity.go

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:47:13 +02:00

licence_test.go

catalogue: deliver a keyless same-node provider's served facts

2026-09-07 05:08:04 +02:00

machine_into_files_test.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

machine_into_files.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

machineside_test.go

What review found in the port machinery, fixed

2026-09-01 21:54:05 +02:00

manifest.go

An artifact may name which stage of its recipe to stop at

2026-09-14 01:57:07 +02:00

names_test.go

catalogue: give host-network containers the mesh's names too

2026-09-07 03:44:28 +02:00

naming_test.go

Refuse an action where it was written, not on the machine

2026-09-01 02:55:56 +02:00

naming.go

A provision names the engine, because a consumer is coupled to one

2026-08-31 17:12:46 +02:00

needs_test.go

needs is now own-secrets, named for whose it is

2026-08-31 13:47:21 +02:00

parseall_test.go

A container may not mount a path the module never declared

2026-09-01 19:36:01 +02:00

print_rehearsal_test.go

ssh is never left without a rule

2026-09-14 16:53:39 +02:00

provided_test.go

Where the answer to a requirement is allowed to live

2026-08-29 23:51:50 +02:00

resolve_test.go

Resolve: one un-hostable assignment no longer refuses the whole node

2026-09-08 18:37:41 +02:00

resolve.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

routing_test.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

runonce_test.go

catalogue: run-once is a step the host runs to completion (ADR 0052)

2026-09-05 23:57:33 +02:00

schedule_test.go

catalogue: carry and validate a container schedule (ADR 0053)

2026-09-06 14:08:51 +02:00

secrets_into_files_test.go

fix: fill a ptr-secret placeholder from the file-owner's credential, not the last consumer's

2026-09-06 13:46:55 +02:00

secrets_into_files.go

fix: fill a ptr-secret placeholder from the file-owner's credential, not the last consumer's

2026-09-06 13:46:55 +02:00

settings_test.go

A module can tell its provider what it needs

2026-08-29 23:35:43 +02:00

settings.go

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:47:13 +02:00

two_consumers_test.go

A consumer is a module on a machine, not a machine

2026-09-01 02:40:09 +02:00