5 Commits

Include renames

Author	SHA1	Message	Date
jochen	37947ca4ee	Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331) ... The installer could not raise a first node: the old bundle's control plane had no MESH_BUS_NATS and crash-looped, and the NATS bundle was refused because rootsecrets only knew the previous broker's guest:guest@ template. One bundle now, the NATS one. rootsecrets makes the controller's bus account and puts it in both placeholders (the address and the bcrypt hash in the carried user list), kept with its hash so a re-run writes the same bundle. Preflight refuses a template naming no bus connection it knows, naming the placeholder, instead of waiting out the verify step. The broker step adopts the bus as the nats module and refuses, by name, a catalogue without it or a server that is not the foundation's container.	2026-10-12 22:49:49 +02:00
jschoubben	c32eada62b	The base filter opens the bus and the registry in the input chain too ... A container on the machine dialling a port the machine publishes reaches it through the runtime's proxy — input, not forward — and the builder could not reach the broker. The derived ruleset opens the mesh's own ports in both chains; the base one now does the same.	2026-09-21 12:28:57 +02:00
jschoubben	b72b71a989	The host applies the newest declaration, a file may be created once, the foundation filters first ... 031: a window of unacknowledged declarations is drained to the newest; the rest are set aside and reported as superseded. 035: a file resource may say create-once — written when absent, kept untouched when present (ADR 0087). 054: the bundle installs nftables and loads a base ruleset before the store and broker, in the table the filter module later replaces (ADR 0088).	2026-09-21 12:11:52 +02:00
jschoubben	d756effc33	The broker-admin marker ends in a newline, and the transcript never says a credential ... The verify reads the marker with the shell's read, which fails at end of file without a line ending; the action ran and its verify said no. And the applier reports each action with its command line, two of which now carry the real store and broker passwords — the installer masks the values it made in everything it says.	2026-09-21 01:32:51 +02:00
jschoubben	ee0c8b856e	Genesis makes the root secrets, the operator key, and installs the vault ... The template raises the store with the password 'bootstrap' and the broker with its image's default administrator, and the installer carried both into the mesh as accepted secrets — permanent, and not secret (novox/hq issue 071). Now the installer makes both credentials, once, at the paths the postgres and lavinmq modules declare as their own secrets, rewrites the produced bundle to use them (the store reads its password from a file; the broker's default account is given the new password by an action before anything dials it), and writes the bundle at 0600 since it now carries them. Before the first secret is accepted it makes the operator's sealing key beside the bundle and gives the mesh the public half, so everything minted from there is sealed to it too (ADR 0085, amended). Phase three adopts the broker as the lavinmq module beside the store and installs mesh-vault as a foundation module; the run ends by writing the operator-sealed export beside the key.	2026-09-21 00:12:55 +02:00