jochen 5f147fe6b9 Seal the build agent the forge genesis raised, in place of the builder's npm-password (hq issue 121, ADR 0336) ...

The build agent declares neither the retired builder's npm-password own-secret
nor a serves setting, so the packages step handed its credential to nothing
and genesis's sdk step had no way to publish. The packages step now seals the
genesis-package-registry own-secret to build-agent: the forge on this node's
loopback, the port given for the package registry, its npm path, and the
mesh-builder account with its password. setFoundationSettings no longer gives
the builder a serves.port.

2026-10-13 03:01:35 +02:00

..

testdata

Delete a forwarded opening the way ufw accepts it, and read a fresh machine's resolver as not in use — both measured on a lab machine (hq ADR 0100)

2026-09-22 17:37:01 +02:00

adopt_in_place_test.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

adopted_test.go

Place the bus's users again on a re-run until the bus is adopted (hq issue 146, review 102)

2026-10-12 23:06:33 +02:00

adopted.go

Place the bus's users again on a re-run until the bus is adopted (hq issue 146, review 102)

2026-10-12 23:06:33 +02:00

apply_test.go

Refuse every file once the mesh has spoken, plan the cutover as one, and let the kept declaration repair the mode

2026-09-23 23:35:49 +02:00

apply.go

An apply leaves a container a maintenance window holds still (hq issue 224)

2026-10-05 18:27:04 +02:00

bootstrap.go

Raise genesis's bus where the nats module keeps it, so adopting it keeps it (hq issue 590, ADR 0333)

2026-10-13 02:09:03 +02:00

build_test.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

build.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

builder_test.go

Seal the build agent the forge genesis raised, in place of the builder's npm-password (hq issue 121, ADR 0336)

2026-10-13 03:01:35 +02:00

builder.go

Install the build agent at genesis, the module that builds since ADR 0190 (hq issue 596)

2026-10-13 02:25:10 +02:00

choices_test.go

The installer goes as far as it can, and asks where a human must choose

2026-09-15 21:56:23 +02:00

choices.go

The installer goes as far as it can, and asks where a human must choose

2026-09-15 21:56:23 +02:00

control_test.go

Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331)

2026-10-12 22:49:49 +02:00

control.go

Leave a file the controller's manifest writes itself out of genesis's secrets (hq issue 597)

2026-10-13 02:23:21 +02:00

enrol_test.go

Raise genesis's bus where the nats module keeps it, so adopting it keeps it (hq issue 590, ADR 0333)

2026-10-13 02:09:03 +02:00

enrol.go

Raise genesis's bus where the nats module keeps it, so adopting it keeps it (hq issue 590, ADR 0333)

2026-10-13 02:09:03 +02:00

genesis_forge_test.go

A taken container keeps a found network, a left-out module is kept, and genesis raises the forge as its module declares (hq ADR 0163)

2026-10-01 23:45:05 +02:00

genesis_form_test.go

Leave a file the controller's manifest writes itself out of genesis's secrets (hq issue 597)

2026-10-13 02:23:21 +02:00

genesis_form.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

genesis_handover_test.go

Raise a process-form controller at genesis as the container it replaces (hq issue 223)

2026-10-04 01:47:33 +02:00

genesis_registry_test.go

Seal the build agent the forge genesis raised, in place of the builder's npm-password (hq issue 121, ADR 0336)

2026-10-13 03:01:35 +02:00

inuse_test.go

A taken container keeps a found network, a left-out module is kept, and genesis raises the forge as its module declares (hq ADR 0163)

2026-10-01 23:45:05 +02:00

inuse.go

Exempt only the daemons a fresh machine was measured to run from counting as in use (hq ADR 0101)

2026-09-22 19:57:52 +02:00

load_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

load.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

module.go

Raise a machine in use adopted: keep its firewall, load no dropping table, guard the mesh's own ports, and take only the mesh's own modules (hq ADR 0100)

2026-09-22 17:32:44 +02:00

network_module_test.go

Genesis assigns mesh-wireguard, not the retired networking bundle (hq ADR 0226)

2026-10-06 14:59:26 +02:00

operator.go

Installer review: secrets are staged privately, and a bundle is 0600 whether or not it existed

2026-09-21 01:26:35 +02:00

phase2_test.go

Refuse an endpoint whose port is not the one the private network's hub binds (hq ADR 0100)

2026-09-22 19:58:37 +02:00

phase2.go

Genesis assigns mesh-wireguard, not the retired networking bundle (hq ADR 0226)

2026-10-06 14:59:26 +02:00

phase3_test.go

Raise genesis's bus where the nats module keeps it, so adopting it keeps it (hq issue 590, ADR 0333)

2026-10-13 02:09:03 +02:00

phase3.go

Raise genesis's bus where the nats module keeps it, so adopting it keeps it (hq issue 590, ADR 0333)

2026-10-13 02:09:03 +02:00

phase_packages_gitea.go

Genesis raises gitea correctly: host network, honest SQL, matched ROOT_URL

2026-09-16 14:11:36 +02:00

phase_packages.go

Seal the build agent the forge genesis raised, in place of the builder's npm-password (hq issue 121, ADR 0336)

2026-10-13 03:01:35 +02:00

ports_test.go

Raise genesis's bus where the nats module keeps it, so adopting it keeps it (hq issue 590, ADR 0333)

2026-10-13 02:09:03 +02:00

ports.go

Seal the build agent the forge genesis raised, in place of the builder's npm-password (hq issue 121, ADR 0336)

2026-10-13 03:01:35 +02:00

preflight_test.go

Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331)

2026-10-12 22:49:49 +02:00

preflight.go

Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331)

2026-10-12 22:49:49 +02:00

publish_test.go

Cite the hq issues by the numbers they were given: 285, 286, 287

2026-10-07 02:00:13 +02:00

publish.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

registry_test.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00

registry.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

retire_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

retire.go

Refuse a declaration for the other mode, or older than the mesh's last, and say what an apply would change first

2026-09-23 23:15:28 +02:00

rewrite_test.go

Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331)

2026-10-12 22:49:49 +02:00

rewrite.go

Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331)

2026-10-12 22:49:49 +02:00

rootsecrets_test.go

Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331)

2026-10-12 22:49:49 +02:00

rootsecrets.go

Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331)

2026-10-12 22:49:49 +02:00

talk.go

Installer review: secrets are staged privately, and a bundle is 0600 whether or not it existed

2026-09-21 01:26:35 +02:00

trust_test.go

Hold the trust-before-push order by a test, and refuse early what would stop it (issue 92)

2026-10-12 16:29:14 +02:00

trust.go

Hold the trust-before-push order by a test, and refuse early what would stop it (issue 92)

2026-10-12 16:29:14 +02:00

verify_test.go

Raise genesis's bus where the nats module keeps it, so adopting it keeps it (hq issue 590, ADR 0333)

2026-10-13 02:09:03 +02:00

verify.go

inspect by kind, not the ambiguous bare form — a same-named network stops a container from ever being found

2026-09-24 19:50:16 +02:00