jochen d9289ef6d4 Gate a release plan's first machine and roll a failed build back there (hq ADR 0236) ...

A build that reported applied was sent everywhere; one that then did nothing, served
no tools or broke its machine's word reached every machine. Now the first machine is
judged by the component's health (the core's definitions, as doctor probes H-*, or a
module's own) three times over two minutes within ten; a failing gate puts the previous
build back there once, marks the build, and says it as a condition and an event.
Upgrades roll out by default; the bus is a planned step; a module deleted at its
source is not built (the public-acme plan failure).

2026-10-06 18:56:54 +02:00

..

0001-nodes.sql

The control plane, as far as identity

2026-08-29 02:44:09 +02:00

0002-enrolment-tokens.sql

Node records, and the right to join once

2026-08-29 14:46:03 +02:00

0003-what-a-node-owns.sql

The mesh keeps a copy of what each node owns

2026-08-29 16:51:54 +02:00

0004-the-overlay.sql

The mesh computes a private network it cannot impersonate

2026-08-29 16:58:56 +02:00

0005-modules-and-assignments.sql

The mesh decides what a node runs

2026-08-29 22:00:06 +02:00

0006-where-a-module-came-from.sql

The mesh knows where a module came from, and whether it is behind

2026-08-29 22:32:16 +02:00

0007-settings.sql

Settings: changing a module's config without editing its file

2026-08-29 23:01:09 +02:00

0008-which-provider.sql

Where the answer to a requirement is allowed to live

2026-08-29 23:51:50 +02:00

0009-secrets.sql

Credentials the mesh delivers and cannot read

2026-08-30 00:21:18 +02:00

0010-builds.sql

Builds have a history, and failures are rows like any other

2026-08-30 10:18:23 +02:00

0011-what-a-node-did.sql

Keep what each machine did, so status can say what is wrong

2026-08-30 18:08:59 +02:00

0012-a-modules-own-secret.sql

A module may need a secret of its own, and the provisioner watches

2026-08-30 18:22:05 +02:00

0013-a-secret-the-mesh-cannot-reinvent.sql

A secret the mesh was given is not one the mesh can reinvent

2026-08-31 00:32:11 +02:00

0014-what-a-machine-was-last-sent.sql

"Behind" means not running what the mesh would send

2026-08-31 05:17:21 +02:00

0015-a-consumer-is-a-module-on-a-machine.sql

A consumer is a module on a machine, not a machine

2026-09-01 02:40:09 +02:00

0016-the-mesh-assigns-the-port.sql

The mesh assigns the port, and a module says it once

2026-09-01 17:52:53 +02:00

0017-what-a-machine-already-holds.sql

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

0018-a-report-names-its-declaration.sql

Caught up is an equality, not an ordering

2026-09-02 00:02:44 +02:00

0019-a-nodes-public-domain.sql

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

0020-a-module-is-a-repository-and-a-path.sql

Build a module from a repository and a path within it

2026-09-12 16:45:50 +02:00

0021-what-to-do-when-a-module-is-upgraded.sql

The mesh acts on what the catalogue decided a build meant

2026-09-13 01:55:07 +02:00

0022-a-build-keeps-what-it-was-told.sql

A build keeps what it was told

2026-09-15 01:22:34 +02:00

0023-an-operator-key-and-a-second-seal.sql

An operator key, a second seal on every own secret, and the vault keeps the export

2026-09-20 23:56:49 +02:00

0024-a-pair-credential-is-sealed-to-the-operator-too.sql

A pair credential is sealed to the operator key too

2026-09-21 00:36:16 +02:00

0025-a-failure-that-repeats-is-said-to-be-stuck.sql

Review: a failure is the same by resource id, not by the host's words; bound files and /run/docker.sock are declared

2026-09-21 19:23:02 +02:00

0026-a-pair-credential-says-where-it-came-from.sql

An operator delivers a pair credential, and the mesh never replaces it

2026-09-21 17:50:41 +02:00

0027-a-module-may-hold-several-secrets-from-one-provider.sql

A module may hold several secrets from one provider, each a pair of its own

2026-09-21 20:28:16 +02:00

0028-a-token-is-claimed-before-it-is-spent.sql

Nothing the control queue carries is lost while the store restarts: an enrolment claims its token and spends it last, and is asked to try again; build results, upgrades and catch-ups are handed back, bounded (novox/hq issue 083)

2026-09-22 14:06:28 +02:00

0029-a-node-is-adopted-or-converged.sql

Record whether a node is adopted and which modules were taken on it (hq ADR 0100)

2026-09-22 17:14:05 +02:00

0030-what-an-adopted-node-reports.sql

Keep what an adopted node reports holding, the firewall it found and what is reachable on it (hq ADR 0100)

2026-09-22 17:23:09 +02:00

0031-the-tunnel-a-node-found.sql

Adopt the predecessor's tunnel in place: its range, its address, its peers

2026-09-23 23:26:34 +02:00

0032-a-source-may-live-on-a-seat.sql

Seats are a closed set, a seat's holder answers for what it delivers, and a build source may live on the git seat

2026-09-25 20:48:10 +02:00

0033-a-carried-peer-is-nameable.sql

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

0034-the-seats-are-data.sql

Seats are data the controller owns, loaded from its store (ADR 0122, phase 1)

2026-09-27 16:04:44 +02:00

0035-a-seat-keeps-its-former-names.sql

Seats keep their former names, so a rename breaks nothing (ADR 0122, phase 2)

2026-09-27 16:32:22 +02:00

0036-a-node-has-an-operator-account.sql

The mesh owns the operator's ~/.ssh: account fact + home-scoped resources (to-be 29)

2026-09-27 17:50:56 +02:00

0037-the-bus-keeps-its-users-hashes.sql

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

0038-a-person-may-reach-the-mesh.sql

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

0039-a-seat-is-held-by-one-assignment-on-record.sql

A seat is handed over as one act, and the holder is on record

2026-09-27 23:22:20 +02:00

0040-the-broker-seat-delivers-the-bus.sql

AMQP is not a provision: the bus seat delivers the bus, and the word is refused

2026-09-27 23:29:00 +02:00

0041-a-machine-is-told-its-membership-for-the-new-bus.sql

The move mints every credential and tells each machine its membership

2026-09-28 00:16:24 +02:00

0042-a-build-says-which-repositories-it-read.sql

A merge rebuilds what it changed, and what packages it

2026-09-28 09:20:01 +02:00

0043-a-machine-says-which-networks-it-routes.sql

A machine says which networks it routes, and its filter forwards them

2026-09-28 21:29:10 +02:00

0044-a-machine-says-which-links-face-outside.sql

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

0045-a-machine-says-which-host-runs-it.sql

The mesh knows which host runs a machine, and says who is behind another

2026-09-30 08:53:59 +02:00

0046-each-send-is-numbered.sql

Each send is numbered, inside the signed bytes

2026-09-30 14:09:12 +02:00

0047-a-seat-carries-its-tools.sql

The mesh's own verbs are the mesh-controller seat's tools

2026-09-30 17:39:38 +02:00

0048-the-artifact-store-seat-is-named-for-its-scope.sql

The seat rename survives a row seeded under the new name

2026-09-30 21:34:34 +02:00

0049-a-shared-credential-is-one-value-sealed-many-times.sql

A provider with one credential shares it with every consumer, remade for all at once (hq ADR 0158)

2026-10-01 12:26:44 +02:00

0050-a-pin-names-the-module.sql

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

0051-a-pin-made-before-is-completed.sql

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

0052-a-merge-is-a-plan-the-mesh-keeps.sql

A merge produces a tiered plan the mesh keeps (hq ADR 0162)

2026-10-01 17:53:55 +02:00

0053-a-machine-says-what-strays-on-it.sql

A take is a comparison: the preview, its refusals, the strays, and the policy said at build (hq ADR 0163)

2026-10-01 21:25:27 +02:00

0054-a-machine-says-what-filters-it.sql

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

0055-an-older-build-never-replaces-a-newer.sql

An older build request never replaces a newer one's artifact

2026-10-04 00:22:11 +02:00

0056-what-the-store-no-longer-keeps.sql

Rebased onto main: ADR 0188 renumbered to 0201, migration 0055 to 0056

2026-10-04 02:45:06 +02:00

0058-a-newer-plan-supersedes-an-older.sql

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

0060-the-per-node-resolver-seat-is-gone.sql

Delete node-dns-resolver and make resolver config need the uplink

2026-10-05 21:57:04 +02:00

0061-a-send-records-the-builds-it-carried.sql

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

0062-a-replicated-seat-has-several-holders-on-record.sql

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

0063-the-resolver-file-is-the-uplinks.sql

Number the resolver-config migration 0063: it merges first

2026-10-06 00:07:54 +02:00

0064-a-machines-names-are-one-seats.sql

Number the hostname seat migration 0064: it merges after the resolver-config one

2026-10-06 00:07:57 +02:00

0065-a-provider-says-which-consumer-it-keeps-failing.sql

Report a provider that keeps failing a consumer in status (hq ADR 0224)

2026-10-06 00:13:23 +02:00

0066-the-durations-the-bounds-are-set-from.sql

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

0067-a-given-secret-lives-until-the-first-good-start.sql

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

0068-order-and-one-writer.sql

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

0070-a-known-failure-heals-itself.sql

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

0071-a-binding-to-data-is-kept.sql

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

0072-a-module-declares-the-data-it-holds.sql

Measure each item its own way; never compare a partial size (hq ADR 0233)

2026-10-06 17:00:22 +02:00

0073-a-build-rolls-out-gated-and-rolls-back.sql

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00