Archived
jschoubben
b824c65ab0
Two more of one fault, and the fault is the same as 04-ISSUES/038: the same-node path diverging from the cross-node one. The mesh works out what a provider on ANOTHER machine serves by walking that node — reading its manifest with that machine's port assignments, then settling the result with that node's settings layers — before offering it to a consumer. A provider on the consumer's OWN machine never passes through that walk, so every step of it had to be repeated in resolve.go's servedHere and declaration.go's here(). 038 repeated the port. Nothing repeated the settling. So a served value the operator supplied reached a co-located consumer as the manifest's empty default. On the ADR 0056 anchor that value is an internal CA's root: step-ca and route-proxy on one node, route-proxy's binding carrying root: "", an empty CA bundle written, a silent fall back to the system trust store, and issuance stopping with nothing saying why. The same step-ca on another node would have worked. The second is the mirror direction. gitea declares a bare container port 3000 and the machine publishes it as 20000:3000, but gitea's route CONTRIBUTION still said 3000 — so the proxy beside it dialled a port nothing listens on and answered 502. 038 fixed what a consumer is TOLD about a provider; this is what a workload TELLS a provider about itself. The redirect uses the CONTRIBUTING module's assignment, because the port is the workload's, not the proxy's; a contribution carried here from another machine is left exactly as it is, its port being that machine's to assign. Both are settled in Declaration, which is the first moment the machine's ports and the provider's settings both exist. That also removes an order dependence: the resolver built its same-node needs mid-walk, from whichever modules had been chosen by the time the requirement came up and in whatever order a map iterated, so what a co-located binding carried depended on the order somebody happened to assign things in. Re-deriving from the finished closure does not. servedHere keeps its job — deciding whether a same-node provider serves anything at all, which is what makes the need exist — and now says that its values are provisional. novox/hq ADR 0056 Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF