The installer carries a builder and builds the control plane it raises #9

2026-09-13T09:16:45Z

jschoubben commented

2026-09-13 09:16:45 +00:00

It carried the thing it was going to run; it now carries the thing that makes it (novox/hq ADR 0073). One artifact either way — but a mesh raised this way holds a control plane it built from a repository and a commit it can name, and can therefore build again. A mesh handed a finished image could not, and had no way to find that out until somebody needed it to.

A build step sits between load and bundle, because the bundle must name an image and that image no longer arrives finished. Everything after it is unchanged: a locally built image is named by the digest of its own configuration, which is exactly what the carried one was named by. That is also why this needs no registry — the machine that builds the image is the machine that runs it.

Refused in preflight when nothing says what to build, so a run that cannot finish says so before it has changed anything. A commit rather than a branch: what genesis clones is the trust anchor for everything the mesh will ever run.

One defect the lab caught that no unit test would have. The publish step still pushed the carried image, so the registry got a builder under the control plane's name and the mesh installed a builder as its control plane — which presented as something that started, printed a builder's usage, exited cleanly, and did it again.

Verified on one machine and on four: the control plane each mesh runs is one it built, pinned to a digest its own registry serves.

It carried the thing it was going to run; it now carries the thing that makes it (novox/hq ADR 0073). One artifact either way — but a mesh raised this way holds a control plane it built from a repository and a commit it can name, and can therefore build again. A mesh handed a finished image could not, and had no way to find that out until somebody needed it to. A build step sits between load and bundle, because the bundle must name an image and that image no longer arrives finished. Everything after it is unchanged: a locally built image is named by the digest of its own configuration, which is exactly what the carried one was named by. That is also why this needs no registry — the machine that builds the image is the machine that runs it. Refused in preflight when nothing says what to build, so a run that cannot finish says so before it has changed anything. A commit rather than a branch: what genesis clones is the trust anchor for everything the mesh will ever run. **One defect the lab caught that no unit test would have.** The publish step still pushed the *carried* image, so the registry got a builder under the control plane's name and the mesh installed a builder as its control plane — which presented as something that started, printed a builder's usage, exited cleanly, and did it again. Verified on one machine and on four: the control plane each mesh runs is one it built, pinned to a digest its own registry serves.

jschoubben added 3 commits 2026-09-13 09:16:45 +00:00

The installer carries a builder and builds the control plane it raises e1a2fe7323

It carried the thing it was going to run; it now carries the thing that makes
it. One artifact either way — but a mesh raised this way holds a control plane
it built from a repository and a commit it can name, and can therefore build
again. A mesh handed a finished image could not, and had no way to find that
out until somebody needed it to.

A build step sits between load and bundle, because the bundle must name an
image and that image no longer arrives finished. Everything after it is
unchanged: a locally built image is named by the digest of its own
configuration, which is exactly what the carried one was named by.

Refused in preflight when nothing says what to build, so a run that cannot
finish says so before it has changed anything.

Publish the image this mesh built, not the one the installer carried 432e3edcfd

The carried image is the builder now. The publish step still pushed it, so the
registry got a builder under the control plane's name and the mesh installed it
as the control plane — which presented as a control plane that started, printed
a builder's usage, exited cleanly, and did it again. Caught by the lab on the
first genesis run, at the step that waits for it to answer.

Preflight names the carried image for what it is 163a44a49a

It said 'control plane' beside a builder's tag, which is the sort of line that
teaches a reader the wrong thing about what the installer carries.

jschoubben merged commit 3dfe574e46 into main

2026-09-13 09:16:51 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#9