mesh-adminandClaude Opus 5.5
c892062251
The controller now keeps the assignments and each registered module's declared config on the bus (hq issue 652, design 57 F3), so its composed grant gains the two buckets and their two events. The installer's first user list must equal that composition, or the controller is refused at genesis; mesh-controller's genesis template test holds the two to each other. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Examples
foundation-first-node.lock
The one genesis bundle (novox/hq ADR 0331): what a machine must be before a mesh exists — the
bootstrap in novox/hq 07-the-foundation.md, whole, on the bus the
mesh runs on:
0 a container runtime, and a filter before anything listens
1 the store runs
2 a database per context `inventory`, `identity` and `licences`
3 those contexts' schemas mesh-controller migrate
4 the bus's certificate mesh-controller broker certificate
5 the bus runs NATS as mesh-broker-nats, where the nats module keeps it
(ADR 0333), with the controller's account as its first user
6 the control plane runs mesh-controller serve, given the bus (MESH_BUS_NATS)
A machine that applies this is a mesh — one node, with nothing joined to it yet, which is exactly what the first node is (novox/hq ADR 0004). From here it hands out tokens and everything else joins the ordinary way.
It is a template: mesh-bootstrap reads it, makes the store's superuser and the controller's
account on the bus, and writes them where the template says bootstrap (internal/bootstrap,
rootsecrets.go). A template whose bus connection it does not recognise is refused at preflight,
naming the placeholder it looked for. The bundle that raised the previous broker was deleted with
ADR 0331; there is one bundle, and every lab bed names it.
The bus is raised where the nats module keeps it (novox/hq ADR 0333): the container
mesh-broker-nats, its configuration and user list in /var/lib/nats-module/conf, its streams in
/var/lib/mesh-broker-nats, its certificate in /var/lib/mesh-broker-tls, published on the node's bus
port. At the installer's broker step the module adopts it: its own image replaces the upstream one, once,
on the same streams, users and certificate. internal/bootstrap holds the bundle to the module's manifest.
Build an installer carrying a builder, and point it at this:
make bootstrap IMAGE=<builder image>
mesh-bootstrap --bundle examples/foundation-first-node.lock …
The registry address is the lab's. The images are written as 192.0.2.250:5000/…@sha256:…; the
lab rewrites the third-party ones to upstream references by the same digest, and the installer
replaces the control plane's with the image it built.