# Examples ## `foundation-first-node.lock` The one genesis bundle (novox/hq ADR 0331): what a machine must be before a mesh exists — the bootstrap in [novox/hq `07-the-foundation.md`](https://git.novox.be/novox/hq), whole, on the bus the mesh runs on: ``` 0 a container runtime, and a filter before anything listens 1 the store runs 2 a database per context `inventory`, `identity` and `licences` 3 those contexts' schemas mesh-controller migrate 4 the bus's certificate mesh-controller broker certificate 5 the bus runs NATS, with the controller's account as its first user 6 the control plane runs mesh-controller serve, given the bus (MESH_BUS_NATS) ``` **A machine that applies this is a mesh** — one node, with nothing joined to it yet, which is exactly what the first node is (novox/hq ADR 0004). From here it hands out tokens and everything else joins the ordinary way. It is a **template**: `mesh-bootstrap` reads it, makes the store's superuser and the controller's account on the bus, and writes them where the template says `bootstrap` (internal/bootstrap, rootsecrets.go). A template whose bus connection it does not recognise is refused at preflight, naming the placeholder it looked for. The bundle that raised the previous broker was deleted with ADR 0331; there is one bundle, and every lab bed names it. Build an installer carrying a builder, and point it at this: ``` make bootstrap IMAGE= mesh-bootstrap --bundle examples/foundation-first-node.lock … ``` **The registry address is the lab's.** The images are written as `192.0.2.250:5000/…@sha256:…`; the lab rewrites the third-party ones to upstream references by the same digest, and the installer replaces the control plane's with the image it built.