The host applies the newest declaration, a file may be created once, the foundation filters first (issues 031, 035, 054) #16

2026-09-21T11:48:33Z

jschoubben commented

2026-09-21 11:48:33 +00:00

Part of the migration-blockers feature (novox/hq ADRs 0087 and 0088).

Issue 031: the link drains a burst of declarations to the newest and applies that one; superseded ones are acked unapplied and reported.
Issue 035 / ADR 0087: a file declared create-once is seeded once and what grows in it is kept (outcome kept).
Issue 054 / ADR 0088: the foundation bundle installs the packet filter and loads a base ruleset before the store and broker come up — drop by default; ssh, the bus and the registry admitted in the input chain (the bus and registry also forwarded); the container runtime's networks forwarded. The bundle test checks order and rules.

Proven by the genesis bed (probes the machine from outside during the install: the store's port never answers, the bus's does) and the two-node beds. Merge order: mesh-controller → mesh-catalog → this → mesh-lab → hq.

Part of the migration-blockers feature (novox/hq ADRs 0087 and 0088). - Issue 031: the link drains a burst of declarations to the newest and applies that one; superseded ones are acked unapplied and reported. - Issue 035 / ADR 0087: a file declared `create-once` is seeded once and what grows in it is kept (outcome `kept`). - Issue 054 / ADR 0088: the foundation bundle installs the packet filter and loads a base ruleset before the store and broker come up — drop by default; ssh, the bus and the registry admitted in the input chain (the bus and registry also forwarded); the container runtime's networks forwarded. The bundle test checks order and rules. Proven by the genesis bed (probes the machine from outside during the install: the store's port never answers, the bus's does) and the two-node beds. Merge order: mesh-controller → mesh-catalog → this → mesh-lab → hq.

jschoubben added 2 commits 2026-09-21 11:48:33 +00:00

The host applies the newest declaration, a file may be created once, the foundation filters first b72b71a989

031: a window of unacknowledged declarations is drained to the newest; the
rest are set aside and reported as superseded. 035: a file resource may say
create-once — written when absent, kept untouched when present (ADR 0087).
054: the bundle installs nftables and loads a base ruleset before the store
and broker, in the table the filter module later replaces (ADR 0088).

The base filter opens the bus and the registry in the input chain too c32eada62b

A container on the machine dialling a port the machine publishes reaches it
through the runtime's proxy — input, not forward — and the builder could not
reach the broker. The derived ruleset opens the mesh's own ports in both
chains; the base one now does the same.

jschoubben merged commit 4661025eb7 into main

2026-09-21 11:48:52 +00:00

jschoubben deleted branch feat/migration-blockers

2026-09-21 11:48:52 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#16