jochen 95e7a7120a Register only from a protected trunk of the same repository, and mark the serving controller never the terminal ...

A source repository's name is not its identity, and a trunk anyone may push
to makes the trunk rule mean nothing (the review of 2026-10-09). Through any
verb a module now registers only from a repository on the mesh's forge whose
trunk refuses direct pushes, requires a status and lets no administrator
merge past one, asked of the forge's own tools; and only from the repository
by the forge's id, recorded at registration (migration 0084), so one deleted
and made again under the name is refused. The serving controller marks its
environment, so nothing it runs or starts reads as the terminal, and a
terminal request covers only the repository and path it asked.

2026-10-09 12:37:18 +02:00

..

testdata

Raise a machine's network from what its engine says, once (hq ADR 0241)

2026-10-07 18:52:16 +02:00

acting.go

Serve the read verbs on the serving controller's own connection, and name every connection

2026-10-08 21:08:34 +02:00

acts_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

acts.go

Say why assign finds no module, and keep an assignment pending on its build

2026-10-08 16:38:11 +02:00

addresses_test.go

The registry-trust test reads the runtime's module, which now writes the trust (ADR 0222)

2026-10-05 22:47:43 +02:00

adopting_test.go

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

adoption.go

node show cites ADR 0180 for a removed front end (hq ADR 0186)

2026-10-02 18:42:16 +02:00

agent_account_test.go

Let the generic command verb only read, and keep keys and tokens at the terminal

2026-10-09 10:12:05 +02:00

agent_account.go

Refuse a node's accounts through any verb, and a stale or service-account agent verdict

2026-10-09 10:11:21 +02:00

api_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

api.go

A module depends on the node seats that apply its resources (hq ADR 0207)

2026-10-04 12:34:11 +02:00

ask.go

One bus: the AMQP transport is gone from the controller

2026-09-28 03:36:16 +02:00

awaiting_push_test.go

Say a machine waiting for its push as waiting, not uncomposable (hq issue 275)

2026-10-06 18:05:38 +02:00

bindings_test.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

bindings.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

board_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

board.go

Record whether a node is adopted and which modules were taken on it (hq ADR 0100)

2026-09-22 17:14:05 +02:00

build_seat_test.go

The controller asks the build role that has a holder, and hears both roles' outcomes (hq ADR 0190, the handover)

2026-10-03 02:51:03 +02:00

build_source_test.go

Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

2026-10-09 12:37:18 +02:00

build_source.go

Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

2026-10-09 12:37:18 +02:00

build_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

build.go

Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

2026-10-09 12:37:18 +02:00

bus_step.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

bus_waits_test.go

Name the bus upgrade as the mesh call a person makes, and say a same-source rebuild needs no step (review of #173)

2026-10-09 02:54:23 +02:00

bus_waits.go

Say S17 clears once the new bus is sent, as it does

2026-10-09 03:23:47 +02:00

buscertificate_test.go

The mesh makes the bus's certificate itself

2026-09-29 15:42:51 +02:00

buscertificate.go

A token is an account on the bus, and genesis can place the list

2026-09-29 17:36:50 +02:00

busobjects_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

busobjects.go

Assert the bus's objects on every send, not only at start (hq issue 208)

2026-10-06 11:45:51 +02:00

calls_verb_test.go

Let the generic command verb only read, and keep keys and tokens at the terminal

2026-10-09 10:12:05 +02:00

changeplan_test.go

Name the bus upgrade as the mesh call a person makes, and say a same-source rebuild needs no step (review of #173)

2026-10-09 02:54:23 +02:00

changeplan.go

Name the bus upgrade as the mesh call a person makes, and say a same-source rebuild needs no step (review of #173)

2026-10-09 02:54:23 +02:00

check_here.go

Cite the hq issues by the numbers they were given: 285, 286, 287

2026-10-08 01:42:22 +02:00

check_test.go

Let the module graph decide what a pull request's check runs, in two layers (hq ADR 0237)

2026-10-06 22:34:56 +02:00

check.go

Count a file that says nothing as trusted, and drop the refusal date

2026-10-09 01:44:50 +02:00

checks_test.go

Publish only a commit on its module's trunk; post a pull request's change plan (hq ADR 0238)

2026-10-06 22:49:55 +02:00

checks.go

Raise the mesh as it is in the gate, call a baseline that does not compose an error, and let a check run by hand as the seat runs it

2026-10-07 01:33:18 +02:00

collect.go

Leave an eligible index for a confirmed collect instead of letting it go alone

2026-10-08 15:47:42 +02:00

collection.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

conditions_brief_test.go

Page an answer larger than one message of the bus, and keep overviews brief (hq issue 314)

2026-10-08 12:19:16 +02:00

conditions_test.go

Switch the memory store's failure under its lock, so a test cannot race the keeper

2026-10-09 01:25:04 +02:00

conditions.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

confirm.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

credential_on_assign_test.go

An assignment issues its bus credential, a push refuses one nobody issued, and what reads a secret restarts on it (hq issue 203)

2026-10-03 04:01:17 +02:00

data_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

data.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

deadletters_test.go

Answer dead-letters on the lent serving connection, and keep one clip helper

2026-10-08 21:09:08 +02:00

deadletters.go

Answer dead-letters on the lent serving connection, and keep one clip helper

2026-10-08 21:09:08 +02:00

delivery_conditions_test.go

Say a walk that waits too long, and a delivery's own stalls (hq ADR 0239)

2026-10-07 00:16:32 +02:00

delivery_conditions.go

Open every explanation with what the operator needs to do, and offer the answers

2026-10-08 13:58:53 +02:00

delivery_order_test.go

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

delivery_test.go

Resolve a group's order rules by precedence, not as a cycle (hq issue 309)

2026-10-08 10:43:42 +02:00

delivery.go

Resolve a group's order rules by precedence, not as a cycle (hq issue 309)

2026-10-08 10:43:42 +02:00

dependents_test.go

A merge of a base rebuilds what stands on it

2026-10-01 16:09:26 +02:00

doctor_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

doctor.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

dry_run_test.go

Take no dry run in: mark it on the request, echo it on the outcome, set it aside

2026-10-05 09:50:20 +02:00

durations.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

epoch_send_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

facts_test.go

Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

2026-10-06 20:31:10 +02:00

facts.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

found_wait_test.go

Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition

2026-10-09 01:23:44 +02:00

gate_followup_test.go

Excuse no wait for a move from a build not known, and count a module put back only once there is one (hq issue 318 review)

2026-10-08 15:49:07 +02:00

gate_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

gate.go

Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition

2026-10-09 01:23:44 +02:00

given_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

given.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

grant_follows_binding_test.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

handacts_test.go

Let the generic command verb only read, and keep keys and tokens at the terminal

2026-10-09 10:12:05 +02:00

handacts.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

healers_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

healers.go

Say a walk that waits too long, and a delivery's own stalls (hq ADR 0239)

2026-10-07 00:16:32 +02:00

health_check_test.go

Count a file that says nothing as trusted, and drop the refusal date

2026-10-09 01:44:50 +02:00

health_probes.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

held_back_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

held_back.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

hold_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

hold.go

Hold a node from composing to sending, so a push composed before converge or adopt is never sent after it (hq ADR 0100)

2026-09-22 18:10:04 +02:00

holders_silent_test.go

Make the login shell's execute optional, so a machine may withhold it

2026-10-09 00:07:33 +02:00

holdings_test.go

A holder by derivation is recorded before an assignment can unsettle it (hq 170)

2026-09-30 14:39:59 +02:00

holdings.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

hosts_behind_test.go

A commit has no order, so the mesh says who runs what and claims no newer

2026-09-30 09:28:56 +02:00

identity_bound_test.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

issue_204_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

join_through_the_tunnel_test.go

Hold that a joining machine is a peer of the hub only while its token lives

2026-10-08 02:06:19 +02:00

lease_command_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

lease_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

licence.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

machine_network_test.go

Raise a machine's network from what its engine says, once (hq ADR 0241)

2026-10-07 18:52:16 +02:00

machine_network.go

Raise a machine's network from what its engine says, once (hq ADR 0241)

2026-10-07 18:52:16 +02:00

machine_units_test.go

Raise a failed unit, the module's and the machine's (hq issue 315)

2026-10-08 11:28:52 +02:00

machine_units.go

Open every explanation with what the operator needs to do, and offer the answers

2026-10-08 13:58:53 +02:00

main.go

Serve the read verbs on the serving controller's own connection, and name every connection

2026-10-08 21:08:34 +02:00

merge_gate_test.go

Cite the hq issues by the numbers they were given: 285, 286, 287

2026-10-08 01:42:22 +02:00

merge_gate.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

mesh_for_test.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

mirrors_test.go

Leave an eligible index for a confirmed collect instead of letting it go alone

2026-10-08 15:47:42 +02:00

mirrors.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

missed_merges_test.go

Catch up on merges the bus announced and never handed over (hq issue 266)

2026-10-06 01:29:21 +02:00

missed_merges.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

module_health_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

module_health.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

modules_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

modules.go

Refuse any change through a verb to a module with a trusted mergeable file

2026-10-09 02:54:41 +02:00

network_test.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00

network.go

A token can be issued for a machine's tunnel key, and it joins through the tunnel

2026-10-08 02:06:19 +02:00

new_module_on_merge_test.go

Build and register a new module when its merge lands (hq issue 300)

2026-10-07 22:32:20 +02:00

nodes_test.go

Refuse token issue --adopted for a converged node and point to adopt, rather than flip it quietly (hq ADR 0100)

2026-09-22 18:03:45 +02:00

nodes.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

operator.go

Work slower than the window says so, and one address is the bus's

2026-09-28 09:51:50 +02:00

order_test.go

A changed file touches exactly the modules whose build reads it (hq issue 280, ADR 0237)

2026-10-06 22:34:57 +02:00

pending_test.go

Give each pending assignment its own condition, and keep a raised row until it clears

2026-10-08 16:45:43 +02:00

pending.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

person_wait_test.go

Put a broken module back at once, and excuse a wait only for a move that added an account group (hq issue 318 review)

2026-10-08 15:25:58 +02:00

plain_words_test.go

Say held updates wait because a walk failed, in the glossary's words

2026-10-08 17:02:30 +02:00

plain_words.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

plan_clock_test.go

Count a plan's time from its tier, and save it only when a step changed it (hq issue 296)

2026-10-07 20:42:13 +02:00

plan_retry.go

Serve the read verbs on the serving controller's own connection, and name every connection

2026-10-08 21:08:34 +02:00

plan_test.go

review: hold the hosts region through composition, and say so in plan

2026-09-27 00:05:41 +02:00

plan.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

planner_records_test.go

Hold the delivery planner to its recorded rules with a table and a property

2026-10-08 22:15:20 +02:00

planner_rules_test.go

Plan a controller merge in the worker-of order in the three-kinds test

2026-10-08 22:22:24 +02:00

plans_one_at_a_time_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

probes.go

Deliver a dead letter again only where it is received, and never stop serving for the notices

2026-10-08 18:32:58 +02:00

provider_hold_test.go

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

2026-10-07 16:17:52 +02:00

provider_hold.go

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

2026-10-07 16:17:52 +02:00

push_recreates_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

push_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

push.go

Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

2026-10-09 12:37:18 +02:00

queue_test.go

Count a plan's time from its tier, and save it only when a step changed it (hq issue 296)

2026-10-07 20:42:13 +02:00

queue.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

readable_test.go

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

readable.go

Say why assign finds no module, and keep an assignment pending on its build

2026-10-08 16:38:11 +02:00

reconnects_test.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

reconnects.go

Answer dead-letters on the lent serving connection, and keep one clip helper

2026-10-08 21:09:08 +02:00

recorded_kept_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

recorded_kept.go

Say what each verb replaces, so the agent is pointed at it instead of a shell command (hq ADR 0245)

2026-10-07 20:44:47 +02:00

recorded_push_test.go

Record a push that only moves recorded builds as the person's word, not a repair (hq issue 301)

2026-10-08 00:12:23 +02:00

recorded_push.go

Record a push that only moves recorded builds as the person's word, not a repair (hq issue 301)

2026-10-08 00:12:23 +02:00

references.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

registry_verbs_test.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

registry_verbs.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

release_plan_test.go

Plan a controller merge in the worker-of order in the three-kinds test

2026-10-08 22:22:24 +02:00

release_plan.go

Tell the operator at once when sends wait for the bus's planned step, and say it before the merge (hq issue 336)

2026-10-09 02:33:57 +02:00

release_test.go

No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236)

2026-10-06 19:14:25 +02:00

release.go

Name what a held release holds, and where it is released

2026-10-08 16:44:02 +02:00

replay292_test.go

Replay issues 292 and 298 as tests the commit before each fix fails (hq ADR 0237)

2026-10-08 01:26:39 +02:00

replay309_test.go

Resolve a group's order rules by precedence, not as a cycle (hq issue 309)

2026-10-08 10:43:42 +02:00

replay318_test.go

Put a broken module back at once, and excuse a wait only for a move that added an account group (hq issue 318 review)

2026-10-08 15:25:58 +02:00

replay325_test.go

Say why assign finds no module, and keep an assignment pending on its build

2026-10-08 16:38:11 +02:00

replay327_test.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

replay335_test.go

Test that a carried module takes its lead's pass before its step is read (hq issue 335 review)

2026-10-08 21:08:12 +02:00

replay336_test.go

TestReplay336 reads the bus call in its mesh form

2026-10-09 03:08:21 +02:00

replays_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

retire_verbs.go

Derive data protection from a module's declared data (hq ADR 0233)

2026-10-06 16:47:49 +02:00

retirement_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

retirement.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

rollout_first_test.go

Stop a rollout whose first machine is silent, and choose one that is heard from (hq issue 249, ADR 0218)

2026-10-05 18:17:52 +02:00

rollout_test.go

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

rollout.go

Serve the read verbs on the serving controller's own connection, and name every connection

2026-10-08 21:08:34 +02:00

roster_failure_test.go

The roster is the machines: each node's internal domain covers its routes (hq ADR 0191)

2026-10-03 16:10:16 +02:00

rotate_test.go

rotate: narrow a pair credential to one consuming module (hq issue 268)

2026-10-06 02:13:48 +02:00

rotate.go

rotate: narrow a pair credential to one consuming module (hq issue 268)

2026-10-06 02:13:48 +02:00

same_source_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

sayable_test.go

Give every condition a headline, an explanation and a resolved line in plain words

2026-10-08 13:22:27 +02:00

seat_dependencies_test.go

Refuse an unmet seat dependency the catalogue could meet (hq ADR 0207 §4)

2026-10-04 13:07:45 +02:00

seats_test.go

Name system seats by scope; let a module define its own (ADR 0121)

2026-09-27 14:30:56 +02:00

seats.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

seatverbs_schema_test.go

Let the generic command verb only read, and keep keys and tokens at the terminal

2026-10-09 10:12:05 +02:00

seatverbs_test.go

Refuse a plans line that acts wherever its subcommand stands

2026-10-09 10:12:41 +02:00

seatverbs.go

Refuse a plans line that acts wherever its subcommand stands

2026-10-09 10:12:41 +02:00

secret_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

secret.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

selfexec_test.go

Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

2026-10-07 02:45:09 +02:00

selfexec.go

Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

2026-10-07 02:45:09 +02:00

sendable_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

sendable.go

Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

2026-10-08 15:20:59 +02:00

sequence_test.go

Each send is numbered, inside the signed bytes

2026-09-30 14:09:12 +02:00

servingbus.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

settings_effective_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

signals_test.go

Tell the operator at once when sends wait for the bus's planned step, and say it before the merge (hq issue 336)

2026-10-09 02:33:57 +02:00

signals.go

Say S17 clears once the new bus is sent, as it does

2026-10-09 03:23:47 +02:00

source_test.go

Rename the mesh's seats to mesh-*, keeping their interfaces

2026-09-26 23:07:09 +02:00

source.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

standing_test.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

standing.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

status_summary_test.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

status_summary.go

Keep what each machine says of what it runs, raise it, and gate on it (hq ADR 0240, to-be 48 Phase A)

2026-10-07 02:28:16 +02:00

status_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

status.go

Make pending assignments safe to race, settle them on a tick, and say only what was checked

2026-10-08 16:38:11 +02:00

stores.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

supersede_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

take_preview_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

terminal_settings_test.go

Refuse any change through a verb to a module with a trusted mergeable file

2026-10-09 02:54:41 +02:00

tier_send_test.go

Excuse no wait for a move from a build not known, and count a module put back only once there is one (hq issue 318 review)

2026-10-08 15:49:07 +02:00

unheld_report_test.go

An act says the unmet seat dependencies of the node it acted on, not the mesh's (hq ADR 0207)

2026-10-04 12:50:25 +02:00

unknown_fields_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

unknown_fields.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

unseen_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

unseen.go

Answer what the records keep, collect on a person's word, and name a machine's images (hq ADR 0251)

2026-10-08 12:04:42 +02:00

untaken_test.go

A held module is in status, and it stops the mesh reading as well

2026-09-30 08:46:20 +02:00

upgrades.go

Say why assign finds no module, and keep an assignment pending on its build

2026-10-08 16:38:11 +02:00

watchdogs.go

Tell the operator at once when sends wait for the bus's planned step, and say it before the merge (hq issue 336)

2026-10-09 02:33:57 +02:00

well_scope_test.go

The all-well sentence says what it is not a claim about

2026-09-30 08:58:59 +02:00

witness.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

worker_order_test.go

The build seat's holder follows the controller that defines its worker (hq issue 206)

2026-10-03 04:04:41 +02:00