6 Commits

Include renames

Author	SHA1	Message	Date
jochen	7283209d1a	Place the bus's users after every push until the bus is adopted (hq issue 608) ... The bus reads its user list from a file that, until the broker step adopts it as the nats module, only the installer writes, and the installer wrote it only at enrolment. The build agent's account, minted with step 13's push, never reached the bus; the agent was refused (Authorization Violation) and the sdk step's build waited until it was killed. Every push genesis makes now places the composed list and has the bus re-read it, until the nats module is registered (ADR 0331 §5, ADR 0333 §4).	2026-10-13 06:58:39 +02:00
jschoubben	5e3dd3f59c	Raise a machine in use adopted: keep its firewall, load no dropping table, guard the mesh's own ports, and take only the mesh's own modules (hq ADR 0100)	2026-09-22 17:32:44 +02:00
jschoubben	3964d9da0a	Take the foundation's ports as genesis inputs, check them free, and hand them to the controller as the node's settings (hq ADR 0100)	2026-09-22 17:28:36 +02:00
jschoubben	5223169226	Genesis registers the control plane with the manifest its build produced ... The control plane's manifest existed twice: at the root of its repository, read whenever the mesh rebuilds it from source, and as a copy in the catalogue, read by genesis. Nothing kept them equal, and the first rebuild replaced the mesh's record with the repository's shape while every later push was refused (novox/hq 04-ISSUES/072). The builder's one-shot result already carries the manifest it built, artifact resolved to the image; step 3 keeps it and step 9 registers it, re-pinning the built image's bare id to the reference the registry assigned. The catalogue is still read for the registry's and the builder's manifests and for phase two.	2026-09-21 15:17:47 +02:00
jschoubben	121367319d	Rename mesh-control -> mesh-controller, substrate -> foundation ... One name per thing, per the HQ glossary: the module/container/image/binary/repo becomes mesh-controller, the seat the-controller, and the store+broker pair the foundation (embedded base bundles, default template and example lock renamed with their go:embed directives). No behaviour change — a pure vocabulary rename. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx	2026-09-16 18:40:40 +02:00
jschoubben	f534cf8b42	bootstrap: the rest of the pivot — enrol, registry, publish, reinstall, retire ... Steps 6 to 10, which turn a substrate into a mesh that can maintain itself (novox/hq ADR 0067). 6 enrol a node record, a token, `mesh-host enrol`, and the host agent running. Proved by the mesh having HEARD from the node, not by a process existing: a host that cannot reach the broker looks exactly like a successful install until the first push applies nothing. 7 registry the module that gives this mesh an image store, registered from a --catalog checkout, assigned and pushed. Its image is upstream and never built (04-ISSUES/029) — a placeholder digest there is refused. Verified by asking `/v2/`, because a container that is up is not a registry that serves. 8 publish the carried image pushed into that registry, which assigns it the first manifest digest it has ever had. This is the hinge: without it the mesh works and can never upgrade itself. 9 control the control plane registered as an ordinary module pinned to that digest, with the substrate's own store connections delivered through `secret accept` — read out of the bundle that made them, because the mesh cannot invent a credential that predates it. 10 retire the temporary control plane dropped from the bundle and removed by the host's ordinary removal pass. Every step asks before it acts and reports "already done". No step leaves the machine without a control plane: steps 9 and 10 overlap deliberately, and two stateless control planes are untidy rather than broken. mesh-control's `internal/builder`.PublishImage is mirrored rather than imported — tier 0 depends on nothing that must be installed first — with one correction: the digest is chosen from RepoDigests by repository instead of taken as element zero, so an image pushed to two registries cannot silently pin this mesh to the wrong one. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF	2026-09-10 23:59:57 +02:00