Installation sets up the builder, so a raised mesh can produce #10

2026-09-14T10:31:57Z

jschoubben commented

2026-09-14 10:31:57 +00:00

Genesis ended with a mesh that runs and cannot make anything. Every module in the catalogue names artifacts and nothing had built them, so the first thing anybody had to do on a new mesh was install a builder by hand — which is exactly what I have been doing by hand in the lab all along, and precisely the gap the design record named as the one thing stopping a fresh mesh from producing.

The installer already carries a builder. It is what builds the control plane. So this is the same two acts the control plane goes through, in the same order and for the same reasons: publish it, so the mesh names it by a digest its own registry assigned rather than a local identity nothing else can fetch; then install it as an ordinary module pinned to that. Then the part only it needs — a broker account, issued before the push so it arrives in the declaration the machine receives rather than in the one after it. A builder that arrives without its credential starts, finds nothing it may read, and waits, which looks identical to a builder with no work.

publishAs is the old PublishControlPlane generalised; a second copy that drifted would be the kind of difference nobody finds until one of them stops working.

Verified on a bare machine, with nothing done by hand afterwards. The install ends with the builder running. That mesh was then asked for the shared base images and built both, publishing them to its own registry; then asked for postgres, which names those bases rather than any copy of them, and built it. And assign anchor mesh-tools is now refused, because a thing the mesh builds is not a thing a machine runs.

Genesis ended with a mesh that runs and cannot make anything. Every module in the catalogue names artifacts and nothing had built them, so the first thing anybody had to do on a new mesh was install a builder by hand — which is exactly what I have been doing by hand in the lab all along, and precisely the gap the design record named as the one thing stopping a fresh mesh from producing. The installer already carries a builder. It is what builds the control plane. So this is the same two acts the control plane goes through, in the same order and for the same reasons: publish it, so the mesh names it by a digest its own registry assigned rather than a local identity nothing else can fetch; then install it as an ordinary module pinned to that. Then the part only it needs — a broker account, issued before the push so it arrives in the declaration the machine receives rather than in the one after it. A builder that arrives without its credential starts, finds nothing it may read, and waits, which looks identical to a builder with no work. `publishAs` is the old `PublishControlPlane` generalised; a second copy that drifted would be the kind of difference nobody finds until one of them stops working. **Verified on a bare machine, with nothing done by hand afterwards.** The install ends with the builder running. That mesh was then asked for the shared base images and built both, publishing them to its own registry; then asked for postgres, which names those bases rather than any copy of them, and built it. And `assign anchor mesh-tools` is now refused, because a thing the mesh builds is not a thing a machine runs.

jschoubben added 1 commit 2026-09-14 10:31:57 +00:00

Installation sets up the builder, so a raised mesh can produce 8eeb28f00b

Genesis ended with a mesh that runs and cannot make anything: every module in
the catalogue names artifacts and nothing had built them, so the first thing
anybody had to do was install a builder by hand.

The installer already carries one — it is what built the control plane — so
this is the same two acts the control plane goes through, in the same order:
publish it, so the mesh names it by a digest its own registry assigned rather
than a local identity nothing else can fetch, then install it as an ordinary
module pinned to that. And then the part only it needs, a broker account, issued
before the push so it arrives with the declaration rather than after it.

Verified on a bare machine: the install ends with a builder running, and that
mesh then built the shared base images and a module on top of them with nobody
helping it.

jschoubben merged commit 6205a93bfe into main

2026-09-14 10:32:04 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#10