mesh-controller

a_service_process_test.go

Compose a module's Go service as a process the host runs (hq issue 213)

2026-10-04 01:11:26 +02:00

accesses_test.go

catalogue: a module accesses operator-owned data, and does not own it

2026-09-05 22:10:58 +02:00

adoption_test.go

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

adoption.go

Say that the guard names the runtime's bridges where the filter names their addresses (hq ADR 0103)

2026-09-22 19:51:10 +02:00

agent_account_test.go

Fill machine facts in a user's home, so an agent account named with a home is made there

2026-10-09 11:02:44 +02:00

amqp_is_not_a_provision_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

artifact_store_alias_test.go

The artifact store's seat is named for its scope: mesh-artifact-store

2026-09-30 21:14:40 +02:00

artifact_store_seat_test.go

The artifact store's seat is named for its scope: mesh-artifact-store

2026-09-30 21:14:40 +02:00

artifacts_test.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

artifacts.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

backup_test.go

Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

2026-10-08 15:20:59 +02:00

bootstrap_cycle_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

bound_into_files_test.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00

bound_into_files.go

The derived-value record is ADR 0202 (was 0201)

2026-10-08 01:42:19 +02:00

bound_test.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

bound.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

broker_seat_test.go

The artifact store's seat is named for its scope: mesh-artifact-store

2026-09-30 21:14:40 +02:00

brokered_test.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

build_system_test.go

An artifact says which operating system it is built for

2026-09-29 00:54:27 +02:00

build_test.go

Say what a build was made from, and hand an image compiling Go only that (hq ADR 0267, issue 363)

2026-10-10 02:47:35 +02:00

build.go

Say what a build was made from, and hand an image compiling Go only that (hq ADR 0267, issue 363)

2026-10-10 02:47:35 +02:00

bus_snapshot_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

catalogue_check_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

catrust_manifest_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

chosen.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

co_located_test.go

Let only the authority's root hold lines, refuse every line end, and keep places off the runtime's data and any .ssh

2026-10-09 00:28:08 +02:00

computed_test.go

The private network writes nothing into the runtime's file (hq issue 190)

2026-10-05 22:19:43 +02:00

consumer_into_serves.go

Fill a preference's ${setting:} from its manifest default (hq ADR 0262)

2026-10-08 17:24:32 +02:00

contributes_test.go

A setting reaches only what declares it, the mesh places its own files, registration refuses a name

2026-09-30 22:29:28 +02:00

contribution_dependencies_test.go

node-power: the power seat, and code for its moments placed by its holder (hq ADR 0211)

2026-10-04 15:59:17 +02:00

controller_is_a_process_test.go

Run the controller as a Go bundle the host starts as a process (hq issue 213)

2026-10-04 01:45:25 +02:00

cron.go

catalogue: carry and validate a container schedule (ADR 0053)

2026-09-06 14:08:51 +02:00

data_test.go

Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

2026-10-08 15:20:59 +02:00

data.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

declaration_test.go

The mesh composes the accounts; the module owns its server

2026-09-27 02:50:23 +02:00

declaration.go

Say a module assigned and left out of its machine's composition as a condition (issue 380)

2026-10-11 04:43:58 +02:00

delivery_seat_test.go

Test that a delivery seat holder without times still holds the seat, and one serving it is not refused (hq issue 382, review of #206 )

2026-10-10 20:55:43 +02:00

delivery_seat.go

Mark times optional on the delivery seat until mesh-delivery serves it (hq ADR 0282, design 33 §7)

2026-10-10 20:35:24 +02:00

derived_for_consumer_test.go

The derived-value record is ADR 0202 (was 0201)

2026-10-08 01:42:19 +02:00

dir_into_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

dir_into.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

domain_test.go

Rename the mesh's seats to mesh-*, keeping their interfaces

2026-09-26 23:07:09 +02:00

endpoint_test.go

A route that names an endpoint still carries that endpoint's port

2026-09-29 11:55:28 +02:00

endpoints_setting_test.go

An assignment configures an endpoint as one thing

2026-09-29 11:25:40 +02:00

environment_into_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

environment_into.go

Sweep the definition, not the filled values, and judge each field alike at check and composition (issue 231)

2026-10-11 02:15:37 +02:00

events.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

filtering_foundation_test.go

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

filtering_test.go

The hub relays the mesh passing through it

2026-10-02 11:17:09 +02:00

filtering.go

The hub relays the mesh passing through it

2026-10-02 11:17:09 +02:00

foundation_manifests_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

generated_collision_test.go

The private network writes nothing into the runtime's file (hq issue 190)

2026-10-05 22:19:43 +02:00

genesis_image_test.go

Pin the image's Go base in the Dockerfile, which genesis builds as it stands (hq issue 223)

2026-10-04 01:49:05 +02:00

go_bundle_test.go

A bundle in a compiled language may name which command it builds

2026-09-30 09:55:54 +02:00

grant_secret_owner_test.go

A grant secret belongs to whoever provisions, and the sweep skips what it will not address

2026-10-04 12:21:49 +02:00

graphical_session_test.go

Take a module's own secret through a hidden prompt on the operator's desk, so a bot token never passes through an agent's session (hq ADR 0259 §10)

2026-10-09 16:22:47 +02:00

graphical_session.go

give: take only a value a person holds, ask the desk by name, let the controller alone ask it, and announce every value given

2026-10-09 16:22:47 +02:00

health_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

health.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

holdings_test.go

A claim may name the verbs it serves for its seat (hq ADR 0160)

2026-10-01 15:18:34 +02:00

hostname_seat_test.go

Rename node-hosts-file to node-hostname, and refuse one seat claimed under two names (hq ADR 0223)

2026-10-05 23:43:15 +02:00

identity_bound_test.go

Bound a consumer's identity by the provision it requires (hq issue 263)

2026-10-06 02:16:20 +02:00

identity_test.go

Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

2026-09-05 12:47:13 +02:00

identity.go

Bound a consumer's identity by the provision it requires (hq issue 263)

2026-10-06 02:16:20 +02:00

installation_test.go

A definition names no installation: the check, an operator's value, a context on the git seat

2026-09-30 18:38:06 +02:00

installation.go

Read stored manifests leniently and mark the defaults layer (hq ADR 0262 review)

2026-10-08 17:24:32 +02:00

invokes_test.go

A module may invoke tools, and a manifest is checked where it is written

2026-09-30 16:12:43 +02:00

jails_into_test.go

A changed jail filter restarts fail2ban

2026-10-02 23:28:25 +02:00

jails_into.go

A changed jail filter restarts fail2ban

2026-10-02 23:28:25 +02:00

kept_test.go

An operator key, a second seal on every own secret, and the vault keeps the export

2026-09-20 23:56:49 +02:00

kinded_test.go

Hold a private kind's holder to an account of its own, as a verified one is (hq ADR 0259 §7, §8)

2026-10-09 13:51:54 +02:00

licence_test.go

catalogue: deliver a keyless same-node provider's served facts

2026-09-07 05:08:04 +02:00

login_shell_execute_test.go

Make the login shell's execute optional, so a machine may withhold it

2026-10-09 00:07:33 +02:00

machine_into_files_test.go

A module can name the mesh's range: ${machine:mesh-range} (novox/hq ADR 0112)

2026-09-27 16:52:00 +02:00

machine_into_files.go

Fill machine facts in a user's home, so an agent account named with a home is made there

2026-10-09 11:02:44 +02:00

machineside_test.go

What review found in the port machinery, fixed

2026-09-01 21:54:05 +02:00

manifest.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

mounts_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

names_test.go

No container is given the mesh's names; it resolves them

2026-09-30 14:38:07 +02:00

naming_test.go

Refuse an action where it was written, not on the machine

2026-09-01 02:55:56 +02:00

naming.go

A provision names the engine, because a consumer is coupled to one

2026-08-31 17:12:46 +02:00

needs_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

no_subjects_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

node_resolver_test.go

Compose the catalogue's systemd-resolved beside an uplink in a test (hq ADR 0247)

2026-10-07 21:27:34 +02:00

node_resolver.go

The machine's own resolver is a node seat, and the uplink steps back from the resolver file where it is held (hq ADR 0247)

2026-10-07 21:22:52 +02:00

operators_machine_test.go

Promise unlink-dangling on the service manager, optional (hq issue 332)

2026-10-08 17:39:08 +02:00

own_name_test.go

A module is told the name it is served under (hq 122)

2026-09-30 17:08:44 +02:00

own_secret_taken_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

pin_names_module_test.go

The first pass does not refuse two providers beside the consumer

2026-10-01 17:34:17 +02:00

placed_paths_test.go

The path-preservation proof resolves access ids to their default paths too

2026-10-01 00:01:41 +02:00

placement_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

placement.go

Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition

2026-10-09 01:23:44 +02:00

port_into_test.go

Prove the untouched environment is the same map, not an equal one

2026-09-22 23:29:28 +02:00

port_into.go

Compose a process's environment as a container's

2026-10-04 00:27:42 +02:00

prepares_test.go

A module's name may contain a dot, so the derived step adds none

2026-09-28 15:44:18 +02:00

print_rehearsal_test.go

The filter constrains what arrives from outside, and names no network

2026-09-29 01:01:29 +02:00

process_env_test.go

Compose a process's environment as a container's

2026-10-04 00:27:42 +02:00

provided_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

public_issuer_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

published_ports_test.go

A container publishes only a port its module declares (hq issue 227)

2026-10-04 12:25:27 +02:00

reach_test.go

Reach asks for names on a routed endpoint, and its port stays the manifest's

2026-09-29 02:50:41 +02:00

received_on_the_bus_test.go

The proxy is told its routes and the mesh on the bus, and serves internal names to the mesh only

2026-10-02 01:46:30 +02:00

recreates.go

Say what each verb replaces, so the agent is pointed at it instead of a shell command (hq ADR 0245)

2026-10-07 20:44:47 +02:00

reflects_renamed_test.go

The restart-on rename reads both list shapes

2026-09-17 23:35:12 +02:00

replaces_test.go

Say what each verb replaces, so the agent is pointed at it instead of a shell command (hq ADR 0245)

2026-10-07 20:44:47 +02:00

replays_test.go

Replay issues 292 and 298 as tests the commit before each fix fails (hq ADR 0237)

2026-10-08 01:26:39 +02:00

resolve_keeps_references_test.go

A resolved manifest keeps a built reference in the store's own form, never the address it was reached by (hq ADR 0155)

2026-10-02 23:13:22 +02:00

resolve_loopback_test.go

A binding answered on this very node still carries an address

2026-09-14 21:11:37 +02:00

resolve_test.go

The broker credential resolves the mesh-broker seat, not the hub (issue 059)

2026-09-18 01:02:26 +02:00

resolve.go

Grant a seat's traffic by caller and by kind, so an ask's asker and a channel's kind are facts the bus enforces (hq ADR 0259)

2026-10-09 13:48:56 +02:00

resolver_file_is_the_uplinks_test.go

The machine's own resolver is a node seat, and the uplink steps back from the resolver file where it is held (hq ADR 0247)

2026-10-07 21:22:52 +02:00

resolver_manifests_test.go

Judge the runtime's daemon.json against the docker module's own keys, not a frozen copy

2026-10-11 18:46:31 +02:00

retirement_event_test.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

roster_test.go

A route's internal name says where the request arrives

2026-09-30 14:51:12 +02:00

roster.go

Test the resolver file as the uplink's, and refuse a second writer of a fact's path (hq ADR 0223)

2026-10-05 23:39:15 +02:00

routing_test.go

A route's internal name says where the request arrives

2026-09-30 14:51:12 +02:00

runonce_test.go

A run-once step may name what it reads: the pair run-once + restart-on is no longer refused (novox/hq ADR 0099)

2026-09-21 23:31:06 +02:00

runtime_gate_test.go

A tool container on the runtime's image is refused once the runtime is registered (hq ADR 0175, to-be 38 WP2.4)

2026-10-02 18:30:14 +02:00

runtime_test.go

Refuse a module of its own account running as the node's operator or agent account (hq ADR 0259 §8, review L4)

2026-10-09 13:48:56 +02:00

runtime.go

Refuse a module of its own account running as the node's operator or agent account (hq ADR 0259 §8, review L4)

2026-10-09 13:48:56 +02:00

schedule_test.go

catalogue: carry and validate a container schedule (ADR 0053)

2026-09-06 14:08:51 +02:00

seat_answers_before_local_test.go

A mesh seat's holder elsewhere answers before this machine's own provider (issue 258)

2026-10-05 21:14:01 +02:00

seat_contributions_test.go

A seat says what it receives, and its holder places every module's contribution (hq ADR 0212)

2026-10-04 16:48:01 +02:00

seat_contributions.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

seat_data_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

seat_data.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

seat_dependencies_test.go

Refuse an unmet seat dependency the catalogue could meet (hq ADR 0207 §4)

2026-10-04 13:07:45 +02:00

seat_dependencies.go

Let a seat receive blocks as data its holder renders, placed where the machine has the hardware (hq ADR 0255)

2026-10-08 15:20:59 +02:00

seat_into_test.go

Tell a module where a mesh seat's holder is reached (hq ADR 0222)

2026-10-05 22:16:23 +02:00

seat_into.go

Tell a module where a mesh seat's holder is reached (hq ADR 0222)

2026-10-05 22:16:23 +02:00

seats_declared_test.go

A claim may name the verbs it serves for its seat (hq ADR 0160)

2026-10-01 15:18:34 +02:00

seats_declared.go

The gate's module check notes a seat another module declares, which it was not given (hq issue 364)

2026-10-10 03:53:07 +02:00

seats_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

seats.go

Make the login shell's execute optional, so a machine may withhold it

2026-10-09 00:07:33 +02:00

secret_family_test.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

secret_restart_test.go

Restart what reads a secret family member when the member is given again (issue 405)

2026-10-11 02:51:11 +02:00

secrets_in_environment_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

secrets_into_files_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

secrets_into_files.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

setting_defaults_test.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

setting_defaults.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

setting_in_unit_test.go

Allow a setting in a unit's name only as a template's whole instance, never leading with a dash, at most 64 characters

2026-10-09 01:51:37 +02:00

setting_into_test.go

A definition names no installation: the check, an operator's value, a context on the git seat

2026-09-30 18:38:06 +02:00

setting_into.go

Say a module assigned and left out of its machine's composition as a condition (issue 380)

2026-10-11 04:43:58 +02:00

settings_judge_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

settings_test.go

A served value or a contribution's may be the operator's: ${setting:…} fills there too, refused by name when unset

2026-09-30 22:34:43 +02:00

settings.go

Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition

2026-10-09 01:23:44 +02:00

several_contributions_test.go

contributes: a module's grant carries no value where it contributed several times

2026-09-24 18:54:35 +02:00

several_secrets_test.go

Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

2026-09-21 21:03:22 +02:00

shared_account_test.go

Compose an account given only groups where its module wrote it (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

shared_credential_test.go

A provider with one credential shares it with every consumer, remade for all at once (hq ADR 0158)

2026-10-01 12:26:44 +02:00

shares_test.go

Describe nfs-server's exports and test as per-node addresses, as the server exports them since the review (hq ADR 0263 rule 5)

2026-10-08 21:14:09 +02:00

shares.go

Describe nfs-server's exports and test as per-node addresses, as the server exports them since the review (hq ADR 0263 rule 5)

2026-10-08 21:14:09 +02:00

short_form_port_protocol_test.go

A short-form port keeps its protocol and still gets its machine port

2026-09-30 16:58:23 +02:00

showcase_manifest_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

ssh_client_test.go

Hold ssh-client to its new shape: an include region first, the mesh's hosts in config.d (mesh-catalog #266 )

2026-10-04 12:52:03 +02:00

state_test.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

state.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

terminal_keys.go

Refuse any change through a verb to a module with a trusted mergeable file

2026-10-09 02:54:41 +02:00

terminal_settings_test.go

Make a mergeable file's own keys the terminal's, so no verb can set what every agent session obeys

2026-10-09 02:27:24 +02:00

the_bus_is_never_public_test.go

The bus is never public: the broker port is no longer a foundation opening

2026-10-02 22:52:22 +02:00

two_consumers_test.go

A consumer is a module on a machine, not a machine

2026-09-01 02:40:09 +02:00

two_resolvers_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

unconsumed_placeholder_test.go

Let a shell parameter operator after a known word pass, so ${PORT:-8080} is not refused (issue 231)

2026-10-11 02:20:43 +02:00

unconsumed_placeholder.go

Let a shell parameter operator after a known word pass, so ${PORT:-8080} is not refused (issue 231)

2026-10-11 02:20:43 +02:00

unknown_field.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

upgrade_test.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

upgrade.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

uplink_verbs_test.go

Give the uplink seat its verbs, optional until its holders serve them (hq ADR 0241)

2026-10-07 20:37:33 +02:00

vault_seat_test.go

The vault's seat, and a report that carries the machine's profile (hq ADR 0161)

2026-10-01 15:58:04 +02:00

verbs_test.go

The mesh's own verbs are the mesh-controller seat's tools

2026-09-30 17:39:38 +02:00

verbs.go

Let delivery-stop leave merges out and walk the others again, so a group stop ends only its own change (hq issue 459, ADR 0299)

2026-10-11 19:54:12 +02:00

version_in_a_path_test.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

while_stopped_test.go

while-stopped names the container as the machine knows it (hq ADR 0189)

2026-10-04 04:18:22 +02:00

zones_test.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00

zones.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00