Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk carries no composition rule. The catalogue functions only the node-engine's composition reaches (Resolve, Resolution's Compose, Declaration, DataItems, LeftOut, Rules and the rest, the settings, placeholder and template refusals, the rendering helpers) are copied with their tests into internal/compose/resolution; a method of a mesh-sdk shape becomes a function taking it first. The composition calls its own copies, and the captured catalogue its tests read lives here now, shared by mesh-compose's tests. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
2026-11-02 19:15:55 +01:00
parent be0226b624
commit d68e241724
686 changed files with 35703 additions and 80 deletions
@@ -0,0 +1,35 @@
+# Managed by the mesh (module systemd-networkd). Replaced on every push; edit
+# the catalogue instead.
+#
+# This machine's uplink is systemd-networkd's, and the mesh asks one thing of it
+# here (novox/hq ADR 0117): leave the private network's interface alone. mesh0
+# is the mesh's; the mesh brings it up and configures it itself. The mesh never
+# declares a link, an address, a route, a wireless network or its credentials,
+# nor a network file for any of this machine's own interfaces — those are
+# the operator's, and the link they make is the only channel the mesh reaches
+# this machine over.
+#
+# 00-: networkd applies the first .network file, in alphanumeric order across
+# every directory, that matches an interface, and ignores every later one even
+# if it matches too (systemd.network(5), [Match]). A catch-all of the operator's
+# — Name=*, Type=ether, a file with no [Match] at all — sorted before
+# this one would claim mesh0 first. 00 sorts before every numbered prefix the
+# man page recommends.
+#
+# Unmanaged=yes: "no attempts are made to bring up or configure matching links,
+# equivalent to when there are no matching network files" (systemd.network(5),
+# [Link], since 233). A match that ends the search, and does nothing else.
+#
+# No DNS setting, because none is needed: networkd never writes
+# /etc/resolv.conf. What it learns from a lease it hands only to
+# systemd-resolved, which the mesh does not run (novox/hq ADR 0196). So this
+# module declares the resolver file itself, beside this one, listing the
+# mesh's resolvers (novox/hq ADR 0223).
+#
+# The service is reloaded when this file changes, never restarted: a restart
+# drops the links networkd holds, this machine's channel to the mesh among them.
+[Match]
+Name=mesh0
+
+[Link]
+Unmanaged=yes
@@ -0,0 +1,65 @@
+{
+  "module": "systemd-networkd",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the machine's network: a build that breaks it can cut the machine off from the bus, and then neither the gate's rollback nor a push reaches it (hq ADR 0236)"
+  },
+  "slug": "networkd",
+  "requires": [
+    "wildcard-resolution"
+  ],
+  "capabilities": [
+    "service-manager",
+    "uplink-systemd-networkd"
+  ],
+  "claims": [
+    {
+      "name": "node-uplink",
+      "scope": "node"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/uplink-tools",
+        "binary": "uplink-tools",
+        "loads": [
+          "uplink-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "facts": {
+    "resolvers": {
+      "path": "/etc/resolv.conf",
+      "template": "# Managed by the mesh, and written by the module holding this machine's uplink:\n# the program that manages the machine's network would otherwise rewrite this\n# file on every change of network, so its holder is the one that writes it\n# (novox/hq ADR 0117, ADR 0223). Replaced on every push; edit nothing here.\n#\n# Every resolver of the mesh, by address, and nothing else (novox/hq ADR 0223) —\n# this machine's own first when it holds one, then the others by name. Each\n# answers the mesh's names from the same roster and forwards every other name, so\n# whichever answers first gives the one answer. There is no public resolver here:\n# a C library that asks every listed server at once and takes the first reply —\n# musl, so every Alpine container — took a public resolver's \"no such name\" for\n# a mesh name and failed. A machine that reaches none of these has no names until\n# it does. Containers copy these lines from their machine.\n{{range index .Holders \"mesh-dns-resolver\"}}nameserver {{.Address}}\n{{end}}options timeout:1 attempts:2 edns0\n"
+    }
+  },
+  "resources": [
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/systemd/network/00-mesh0.network",
+      "mode": "0644",
+      "template": "files/00-mesh0.network"
+    },
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "systemd-networkd.service",
+      "reload-on": [
+        "config"
+      ]
+    }
+  ]
+}