6 Commits

Include renames

Author	SHA1	Message	Date
jochen	37947ca4ee	Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331) ... The installer could not raise a first node: the old bundle's control plane had no MESH_BUS_NATS and crash-looped, and the NATS bundle was refused because rootsecrets only knew the previous broker's guest:guest@ template. One bundle now, the NATS one. rootsecrets makes the controller's bus account and puts it in both placeholders (the address and the bcrypt hash in the carried user list), kept with its hash so a re-run writes the same bundle. Preflight refuses a template naming no bus connection it knows, naming the placeholder, instead of waiting out the verify step. The broker step adopts the bus as the nats module and refuses, by name, a catalogue without it or a server that is not the foundation's container.	2026-10-12 22:49:49 +02:00
jschoubben	c32eada62b	The base filter opens the bus and the registry in the input chain too ... A container on the machine dialling a port the machine publishes reaches it through the runtime's proxy — input, not forward — and the builder could not reach the broker. The derived ruleset opens the mesh's own ports in both chains; the base one now does the same.	2026-09-21 12:28:57 +02:00
jschoubben	b72b71a989	The host applies the newest declaration, a file may be created once, the foundation filters first ... 031: a window of unacknowledged declarations is drained to the newest; the rest are set aside and reported as superseded. 035: a file resource may say create-once — written when absent, kept untouched when present (ADR 0087). 054: the bundle installs nftables and loads a base ruleset before the store and broker, in the table the filter module later replaces (ADR 0088).	2026-09-21 12:11:52 +02:00
jschoubben	56124c38b7	Phase 3.2: the foundation broker binds amqp (5672) mesh-wide for consumers ... Like the store, the amqp provision is plaintext 5672 (vhost-per-login), so a consumer must reach it — bind 0.0.0.0 (firewall-gated to `mesh`, WireGuard- encrypted on the wire) instead of loopback. amqps (5671) was already mesh-wide; management (15672) stays loopback for the host-networked provisioner. Issue 051 (WBS 3.2). Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx	2026-09-16 21:24:13 +02:00
jschoubben	9109a8c178	Phase 3.1: adopt the foundation store as the postgres module ... InstallStore turns the mesh-store the foundation raised at genesis into the postgres module, adopted in place: it verifies the module's server names the same container and the same image the foundation is running (fail-fast on a drift, rather than tearing down the mesh's store), then registers, builds the provisioner, and carries the superuser in via secret accept — the mesh cannot invent a credential that already made the databases (mirroring the control plane's store-connection delivery, control.go). pinImage generalised to any module for reuse. Issue 051 (WBS 3.1). One server holds the controller's contexts and every module's database. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx	2026-09-16 21:04:06 +02:00
jschoubben	121367319d	Rename mesh-control -> mesh-controller, substrate -> foundation ... One name per thing, per the HQ glossary: the module/container/image/binary/repo becomes mesh-controller, the seat the-controller, and the store+broker pair the foundation (embedded base bundles, default template and example lock renamed with their go:embed directives). No behaviour change — a pure vocabulary rename. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx	2026-09-16 18:40:40 +02:00