jochen 867a3f81a9 Hold a record-policy move that changes a non-file/directory resource (issue 785) ...

ADR 0377 §3's allowlist names only tools bundles, files no container mounts
and holds no data, and manifest fields that recreate nothing. Holds only
checked containers, files, directories and processes/services; any other
resource type (archive, package, user, network, ...) fell through unheld.
Add a default case that holds and names the resource type and id.

2026-10-15 14:59:06 +02:00

..

a_service_process_test.go

Compose a module's Go service as a process the host runs (hq issue 213)

2026-10-04 01:11:26 +02:00

accesses_test.go

catalogue: a module accesses operator-owned data, and does not own it

2026-09-05 22:10:58 +02:00

adoption_test.go

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

adoption.go

Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)

2026-10-13 11:20:22 +02:00

agent_account_test.go

Fill machine facts in a user's home, so an agent account named with a home is made there

2026-10-09 11:02:44 +02:00

amqp_is_not_a_provision_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

artifact_store_alias_test.go

The artifact store's seat is named for its scope: mesh-artifact-store

2026-09-30 21:14:40 +02:00

artifact_store_seat_test.go

The artifact store's seat is named for its scope: mesh-artifact-store

2026-09-30 21:14:40 +02:00

artifacts_test.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

artifacts.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

backup_test.go

Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

2026-10-08 15:20:59 +02:00

bootstrap_cycle_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

bound_into_files_test.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00

bound_into_files.go

Let a requirement be optional, binding only a provider that already runs (hq issue 166, ADR 0330)

2026-10-13 01:53:18 +02:00

bound_test.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

bound.go

Let a provider serve its consumers its own composed names (hq ADR 0346, issue 624)

2026-10-13 20:29:17 +02:00

broker_seat_test.go

The artifact store's seat is named for its scope: mesh-artifact-store

2026-09-30 21:14:40 +02:00

brokered_test.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

build_system_test.go

An artifact says which operating system it is built for

2026-09-29 00:54:27 +02:00

build_test.go

Say what a build was made from, and hand an image compiling Go only that (hq ADR 0267, issue 363)

2026-10-10 02:47:35 +02:00

build.go

Judge an upstream pin's host like any name, and harden the upstream unpack (review 35, hq issue 345)

2026-10-12 13:51:35 +02:00

bus_snapshot_test.go

Raise every bus user's slow consumer and closed connection as S9, from the bus module's events (hq issue 270, ADR 0357)

2026-10-14 08:41:47 +02:00

busy_test.go

Hold a walk's first-machine gate while its busy container finishes its build

2026-10-13 00:53:10 +02:00

busy.go

Hold a walk's first-machine gate while its busy container finishes its build

2026-10-13 00:53:10 +02:00

catalogue_check_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

catrust_manifest_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

chosen.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

co_located_test.go

Let only the authority's root hold lines, refuse every line end, and keep places off the runtime's data and any .ssh

2026-10-09 00:28:08 +02:00

computed_test.go

The private network writes nothing into the runtime's file (hq issue 190)

2026-10-05 22:19:43 +02:00

consumer_into_serves.go

List the provider-elsewhere store test, read a machine's domain as its profile, reuse the settings read once, and refuse a nested own name (hq ADR 0346, review 228)

2026-10-13 20:32:51 +02:00

contributes_test.go

A setting reaches only what declares it, the mesh places its own files, registration refuses a name

2026-09-30 22:29:28 +02:00

contribution_dependencies_test.go

Let several modules declare one package, and refuse only present beside absent (hq ADR 0303)

2026-10-11 21:55:20 +02:00

controller_is_a_process_test.go

Run the controller as a Go bundle the host starts as a process (hq issue 213)

2026-10-04 01:45:25 +02:00

cron.go

catalogue: carry and validate a container schedule (ADR 0053)

2026-09-06 14:08:51 +02:00

data_test.go

Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

2026-10-08 15:20:59 +02:00

data.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

declaration_test.go

The mesh composes the accounts; the module owns its server

2026-09-27 02:50:23 +02:00

declaration.go

Merge origin/main into feat/335, and pin mesh-host at #98's new head

2026-10-14 00:01:21 +02:00

delivery_seat_test.go

Test that a delivery seat holder without times still holds the seat, and one serving it is not refused (hq issue 382, review of #206)

2026-10-10 20:55:43 +02:00

delivery_seat.go

Say a leaf delivery's budget as three minutes in the times verb's description

2026-10-12 01:46:26 +02:00

derived_for_consumer_test.go

The derived-value record is ADR 0202 (was 0201)

2026-10-08 01:42:19 +02:00

dir_into_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

dir_into.go

Judge a definition's resolved paths where the definition is judged, by the node-engine's own rules, so a refusal never freezes a machine (review of #228, issue 496)

2026-10-11 18:59:07 +02:00

domain_test.go

Rename the mesh's seats to mesh-*, keeping their interfaces

2026-09-26 23:07:09 +02:00

endpoint_test.go

A route that names an endpoint still carries that endpoint's port

2026-09-29 11:55:28 +02:00

endpoints_setting_test.go

An assignment configures an endpoint as one thing

2026-09-29 11:25:40 +02:00

engine_guard_test.go

Judge a definition's resolved paths where the definition is judged, by the node-engine's own rules, so a refusal never freezes a machine (review of #228, issue 496)

2026-10-11 18:59:07 +02:00

environment_into_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

environment_into.go

Sweep the definition, not the filled values, and judge each field alike at check and composition (issue 231)

2026-10-11 02:15:37 +02:00

events.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

filtering_foundation_test.go

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

filtering_test.go

The hub relays the mesh passing through it

2026-10-02 11:17:09 +02:00

filtering.go

Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)

2026-10-13 11:20:22 +02:00

foundation_manifests_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

generated_collision_test.go

catalogue: say in the comments that a package may be declared by several modules (issue 628)

2026-10-13 11:52:17 +00:00

genesis_image_test.go

Pin the image's Go base in the Dockerfile, which genesis builds as it stands (hq issue 223)

2026-10-04 01:49:05 +02:00

genesis_registry_test.go

Let the build agent run on the genesis document until its registry binds (hq issue 121, ADR 0336)

2026-10-13 02:53:41 +02:00

go_bundle_test.go

A bundle in a compiled language may name which command it builds

2026-09-30 09:55:54 +02:00

grant_secret_owner_test.go

A grant secret belongs to whoever provisions, and the sweep skips what it will not address

2026-10-04 12:21:49 +02:00

graphical_session_test.go

Take a module's own secret through a hidden prompt on the operator's desk, so a bot token never passes through an agent's session (hq ADR 0259 §10)

2026-10-09 16:22:47 +02:00

graphical_session.go

give: take only a value a person holds, ask the desk by name, let the controller alone ask it, and announce every value given

2026-10-09 16:22:47 +02:00

health_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

health.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

holdings_test.go

A claim may name the verbs it serves for its seat (hq ADR 0160)

2026-10-01 15:18:34 +02:00

holds_test.go

Hold a record-policy move that changes a non-file/directory resource (issue 785)

2026-10-15 14:59:06 +02:00

hostname_seat_test.go

Rename node-hosts-file to node-hostname, and refuse one seat claimed under two names (hq ADR 0223)

2026-10-05 23:43:15 +02:00

identity_bound_test.go

Bound a consumer's identity by the provision it requires (hq issue 263)

2026-10-06 02:16:20 +02:00

identity_test.go

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:47:13 +02:00

identity.go

Bound a consumer's identity by the provision it requires (hq issue 263)

2026-10-06 02:16:20 +02:00

installation_test.go

A definition names no installation: the check, an operator's value, a context on the git seat

2026-09-30 18:38:06 +02:00

installation.go

Judge an upstream pin's host like any name, and harden the upstream unpack (review 35, hq issue 345)

2026-10-12 13:51:35 +02:00

invokes_test.go

A module may invoke tools, and a manifest is checked where it is written

2026-09-30 16:12:43 +02:00

issued_credential_test.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

issued_outside_test.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

jails_into_test.go

A changed jail filter restarts fail2ban

2026-10-02 23:28:25 +02:00

jails_into.go

A changed jail filter restarts fail2ban

2026-10-02 23:28:25 +02:00

kept_test.go

An operator key, a second seal on every own secret, and the vault keeps the export

2026-09-20 23:56:49 +02:00

kinded_test.go

Hold a private kind's holder to an account of its own, as a verified one is (hq ADR 0259 §7, §8)

2026-10-09 13:51:54 +02:00

licence_test.go

catalogue: deliver a keyless same-node provider's served facts

2026-09-07 05:08:04 +02:00

localnetwork_test.go

Test that a global IPv6 subnet is public and never counts as the local network (issue 154, ADR 0340)

2026-10-13 13:20:50 +02:00

localnetwork.go

Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)

2026-10-13 11:20:22 +02:00

login_shell_execute_test.go

Make the login shell's execute optional, so a machine may withhold it

2026-10-09 00:07:33 +02:00

logs_test.go

Let a module declare a log the controller creates and never removes (ADR 0297)

2026-10-11 19:22:43 +02:00

logs.go

Let a module declare a log the controller creates and never removes (ADR 0297)

2026-10-11 19:22:43 +02:00

machine_into_files_test.go

A module can name the mesh's range: ${machine:mesh-range} (novox/hq ADR 0112)

2026-09-27 16:52:00 +02:00

machine_into_files.go

Fill machine facts in a user's home, so an agent account named with a home is made there

2026-10-09 11:02:44 +02:00

machineside_test.go

What review found in the port machinery, fixed

2026-09-01 21:54:05 +02:00

manifest.go

Let an own secret's manifest declare a desk prompt (issue 789)

2026-10-15 13:47:20 +02:00

mounts_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

names_test.go

No container is given the mesh's names; it resolves them

2026-09-30 14:38:07 +02:00

naming_test.go

Refuse an action where it was written, not on the machine

2026-09-01 02:55:56 +02:00

naming.go

A provision names the engine, because a consumer is coupled to one

2026-08-31 17:12:46 +02:00

needs_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

no_subjects_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

node_resolver_test.go

Compose the catalogue's systemd-resolved beside an uplink in a test (hq ADR 0247)

2026-10-07 21:27:34 +02:00

node_resolver.go

Step back from a rendered resolver file only, and compare a declared path cleaned (issue 412, review 80)

2026-10-12 17:08:55 +02:00

operators_machine_test.go

Require the service manager's reset-failed, wanted-by and unlink-dangling verbs now every holder serves them (issue 332)

2026-10-12 12:03:37 +02:00

optional_requirements_test.go

Store optional requirements beside a plain requires list (hq issue 166, review of #281)

2026-10-13 01:53:18 +02:00

optional_requirements.go

Store optional requirements beside a plain requires list (hq issue 166, review of #281)

2026-10-13 01:53:18 +02:00

outside_not_given_test.go

Make no value for an own secret issued outside the mesh that nobody gave (issue 401)

2026-10-12 17:15:12 +02:00

own_name_test.go

A module is told the name it is served under (hq 122)

2026-09-30 17:08:44 +02:00

own_secret_prompt_test.go

Let an own secret's manifest declare a desk prompt (issue 789)

2026-10-15 13:47:20 +02:00

own_secret_taken_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

pin_names_module_test.go

The first pass does not refuse two providers beside the consumer

2026-10-01 17:34:17 +02:00

placed_paths_test.go

The path-preservation proof resolves access ids to their default paths too

2026-10-01 00:01:41 +02:00

placement_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

placement.go

Judge a definition's resolved paths where the definition is judged, by the node-engine's own rules, so a refusal never freezes a machine (review of #228, issue 496)

2026-10-11 18:59:07 +02:00

port_into_test.go

Prove the untouched environment is the same map, not an equal one

2026-09-22 23:29:28 +02:00

port_into.go

Compose a process's environment as a container's

2026-10-04 00:27:42 +02:00

prepares_test.go

A module's name may contain a dot, so the derived step adds none

2026-09-28 15:44:18 +02:00

print_rehearsal_test.go

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

process_env_test.go

Compose a process's environment as a container's

2026-10-04 00:27:42 +02:00

provided_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

public_issuer_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

published_ports_test.go

A container publishes only a port its module declares (hq issue 227)

2026-10-04 12:25:27 +02:00

reach_test.go

Reach asks for names on a routed endpoint, and its port stays the manifest's

2026-09-29 02:50:41 +02:00

reads_test.go

Name the vault's placed directories among a node's secret places, fail loudly on one that cannot be resolved, and keep the reads account out of every group (review 54, issue 418)

2026-10-12 14:30:00 +02:00

reads.go

Name the vault's placed directories among a node's secret places, fail loudly on one that cannot be resolved, and keep the reads account out of every group (review 54, issue 418)

2026-10-12 14:30:00 +02:00

received_on_the_bus_test.go

The proxy is told its routes and the mesh on the bus, and serves internal names to the mesh only

2026-10-02 01:46:30 +02:00

recreates.go

Hold a record-policy move that changes a non-file/directory resource (issue 785)

2026-10-15 14:59:06 +02:00

reflects_renamed_test.go

The restart-on rename reads both list shapes

2026-09-17 23:35:12 +02:00

replaces_test.go

Say what each verb replaces, so the agent is pointed at it instead of a shell command (hq ADR 0245)

2026-10-07 20:44:47 +02:00

replay166_test.go

Replay issue 166 with only what the catalogue had before its fix (for mesh-lab R166)

2026-10-13 02:27:07 +02:00

replay279_test.go

Add the replays of issues 279 and 412, written with only what the catalogue had before each fix

2026-10-13 02:02:20 +02:00

replay412_test.go

Add the replays of issues 279 and 412, written with only what the catalogue had before each fix

2026-10-13 02:02:20 +02:00

replays_test.go

Replay issues 292 and 298 as tests the commit before each fix fails (hq ADR 0237)

2026-10-08 01:26:39 +02:00

resolve_keeps_references_test.go

A resolved manifest keeps a built reference in the store's own form, never the address it was reached by (hq ADR 0155)

2026-10-02 23:13:22 +02:00

resolve_loopback_test.go

A binding answered on this very node still carries an address

2026-09-14 21:11:37 +02:00

resolve_test.go

The broker credential resolves the mesh-broker seat, not the hub (issue 059)

2026-09-18 01:02:26 +02:00

resolve.go

Let a provider serve its consumers its own composed names (hq ADR 0346, issue 624)

2026-10-13 20:29:17 +02:00

resolved_path_test.go

Judge a definition's resolved paths where the definition is judged, by the node-engine's own rules, so a refusal never freezes a machine (review of #228, issue 496)

2026-10-11 18:59:07 +02:00

resolver_file_is_the_uplinks_test.go

The machine's own resolver is a node seat, and the uplink steps back from the resolver file where it is held (hq ADR 0247)

2026-10-07 21:22:52 +02:00

resolver_manifests_test.go

Add the replay of issue 348, and refuse bind-dynamic now the catalogue binds once (hq issue 348)

2026-10-13 06:09:09 +02:00

retirement_event_test.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

roster_test.go

A route's internal name says where the request arrives

2026-09-30 14:51:12 +02:00

roster.go

Test the resolver file as the uplink's, and refuse a second writer of a fact's path (hq ADR 0223)

2026-10-05 23:39:15 +02:00

routing_test.go

A route's internal name says where the request arrives

2026-09-30 14:51:12 +02:00

runonce_test.go

A run-once step may name what it reads: the pair run-once + restart-on is no longer refused (novox/hq ADR 0099)

2026-09-21 23:31:06 +02:00

runtime_gate_test.go

A tool container on the runtime's image is refused once the runtime is registered (hq ADR 0175, to-be 38 WP2.4)

2026-10-02 18:30:14 +02:00

runtime_test.go

Refuse a module of its own account running as the node's operator or agent account (hq ADR 0259 §8, review L4)

2026-10-09 13:48:56 +02:00

runtime.go

Name the vault's placed directories among a node's secret places, fail loudly on one that cannot be resolved, and keep the reads account out of every group (review 54, issue 418)

2026-10-12 14:30:00 +02:00

schedule_test.go

catalogue: carry and validate a container schedule (ADR 0053)

2026-09-06 14:08:51 +02:00

seat_answers_before_local_test.go

A mesh seat's holder elsewhere answers before this machine's own provider (issue 258)

2026-10-05 21:14:01 +02:00

seat_contributions_test.go

A seat says what it receives, and its holder places every module's contribution (hq ADR 0212)

2026-10-04 16:48:01 +02:00

seat_contributions.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

seat_data_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

seat_data.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

seat_dependencies_test.go

Refuse an unmet seat dependency the catalogue could meet (hq ADR 0207 §4)

2026-10-04 13:07:45 +02:00

seat_dependencies.go

catalogue: say in the comments that a package may be declared by several modules (issue 628)

2026-10-13 11:52:17 +00:00

seat_into_test.go

Tell a module where a mesh seat's holder is reached (hq ADR 0222)

2026-10-05 22:16:23 +02:00

seat_into.go

Tell a module where a mesh seat's holder is reached (hq ADR 0222)

2026-10-05 22:16:23 +02:00

seat_paths_test.go

Step back from a rendered resolver file only, and compare a declared path cleaned (issue 412, review 80)

2026-10-12 17:08:55 +02:00

seat_paths.go

Step back from a rendered resolver file only, and compare a declared path cleaned (issue 412, review 80)

2026-10-12 17:08:55 +02:00

seats_declared_test.go

A claim may name the verbs it serves for its seat (hq ADR 0160)

2026-10-01 15:18:34 +02:00

seats_declared.go

Hear a restricted stream only from a module's own account, never the tool runner's (issue 727)

2026-10-15 14:11:37 +02:00

seats_test.go

Define the node-reads seat, refuse a holder without an account of its own, and tell it where its node keeps a secret (hq ADR 0310, issue 418)

2026-10-12 13:57:24 +02:00

seats.go

Name the paths a seat's holder owns, and refuse a claim or a declaration without the seat (issue 412)

2026-10-12 16:19:49 +02:00

secret_family_test.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

secret_restart_test.go

Restart what reads a secret family member when the member is given again (issue 405)

2026-10-11 02:51:11 +02:00

secrets_in_environment_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

secrets_into_files_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

secrets_into_files.go

Make no value for an own secret issued outside the mesh that nobody gave (issue 401)

2026-10-12 17:15:12 +02:00

served_own_names_test.go

List the provider-elsewhere store test, read a machine's domain as its profile, reuse the settings read once, and refuse a nested own name (hq ADR 0346, review 228)

2026-10-13 20:32:51 +02:00

served_own_names.go

List the provider-elsewhere store test, read a machine's domain as its profile, reuse the settings read once, and refuse a nested own name (hq ADR 0346, review 228)

2026-10-13 20:32:51 +02:00

setting_defaults_test.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

setting_defaults.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

setting_in_owner_test.go

Keep a directory owner's settings at the controller's terminal (issue 279)

2026-10-12 15:37:29 +02:00

setting_in_unit_test.go

Allow a setting in a unit's name only as a template's whole instance, never leading with a dash, at most 64 characters

2026-10-09 01:51:37 +02:00

setting_into_test.go

A definition names no installation: the check, an operator's value, a context on the git seat

2026-09-30 18:38:06 +02:00

setting_into.go

Keep a directory owner's settings at the controller's terminal (issue 279)

2026-10-12 15:37:29 +02:00

setting_takes_test.go

Judge ADR 0326 §3 only where a definition is written (hq issue 574)

2026-10-13 00:54:26 +02:00

setting_takes.go

Judge ADR 0326 §3 only where a definition is written (hq issue 574)

2026-10-13 00:54:26 +02:00

settings_judge_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

settings_test.go

settings: no layer replaces a value the vault fills, at any depth (issue 610)

2026-10-13 17:43:24 +00:00

settings.go

settings: no layer replaces a value the vault fills, at any depth (issue 610)

2026-10-13 17:43:24 +00:00

several_contributions_test.go

contributes: a module's grant carries no value where it contributed several times

2026-09-24 18:54:35 +02:00

several_secrets_test.go

Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

2026-09-21 21:03:22 +02:00

shared_account_test.go

Compose an account given only groups where its module wrote it (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

shared_credential_test.go

A provider with one credential shares it with every consumer, remade for all at once (hq ADR 0158)

2026-10-01 12:26:44 +02:00

shares_test.go

Describe nfs-server's exports and test as per-node addresses, as the server exports them since the review (hq ADR 0263 rule 5)

2026-10-08 21:14:09 +02:00

shares.go

Describe nfs-server's exports and test as per-node addresses, as the server exports them since the review (hq ADR 0263 rule 5)

2026-10-08 21:14:09 +02:00

short_form_port_protocol_test.go

A short-form port keeps its protocol and still gets its machine port

2026-09-30 16:58:23 +02:00

showcase_manifest_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

ssh_client_test.go

Hold ssh-client to its new shape: an include region first, the mesh's hosts in config.d (mesh-catalog #266)

2026-10-04 12:52:03 +02:00

state_test.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

state.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

streams_test.go

Hear a restricted stream only from a module's own account, never the tool runner's (issue 727)

2026-10-15 14:11:37 +02:00

streams.go

Hear a restricted stream only from a module's own account, never the tool runner's (issue 727)

2026-10-15 14:11:37 +02:00

terminal_keys.go

Let a trusted file that names its keys hold only those keys at the terminal (hq issue 586, ADR 0329 §5)

2026-10-13 05:22:35 +02:00

terminal_settings_test.go

Let a trusted file that names its keys hold only those keys at the terminal (hq issue 586, ADR 0329 §5)

2026-10-13 05:22:35 +02:00

the_bus_is_never_public_test.go

The bus is never public: the broker port is no longer a foundation opening

2026-10-02 22:52:22 +02:00

two_consumers_test.go

A consumer is a module on a machine, not a machine

2026-09-01 02:40:09 +02:00

two_resolvers_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

unconsumed_placeholder_test.go

Let a shell parameter operator after a known word pass, so ${PORT:-8080} is not refused (issue 231)

2026-10-11 02:20:43 +02:00

unconsumed_placeholder.go

Let a directory's owner follow the account its module runs as (issue 279)

2026-10-12 15:37:23 +02:00

unhealthy_test.go

Raise a module's unhealthy urgent when its manifest says why (hq ADR 0355, issue 691)

2026-10-14 15:13:57 +02:00

unhealthy.go

Raise a module's unhealthy urgent when its manifest says why (hq ADR 0355, issue 691)

2026-10-14 15:13:57 +02:00

unknown_field.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

upgrade_test.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

upgrade.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

uplink_verbs_test.go

Name the paths a seat's holder owns, and refuse a claim or a declaration without the seat (issue 412)

2026-10-12 16:19:49 +02:00

upstream_file_test.go

Judge an upstream pin's host like any name, and harden the upstream unpack (review 35, hq issue 345)

2026-10-12 13:51:35 +02:00

vault_seat_test.go

The vault's seat, and a report that carries the machine's profile (hq ADR 0161)

2026-10-01 15:58:04 +02:00

verbs_test.go

The mesh's own verbs are the mesh-controller seat's tools

2026-09-30 17:39:38 +02:00

verbs.go

Keep a try off the forge and bound how many run (hq issue 686)

2026-10-14 02:29:28 +02:00

version_in_a_path_test.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

waits_test.go

Let the tool runner's account hear the event families its manifest names (issue 745, ADR 0367)

2026-10-14 23:05:14 +00:00

while_stopped_test.go

while-stopped names the container as the machine knows it (hq ADR 0189)

2026-10-04 04:18:22 +02:00

zones_test.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00

zones.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00