A bed says what it actually needs to be pointed at

The instructions in every bed named the bundle that raises the predecessor's broker, so a first attempt ends in a control plane crash-looping on a missing MESH_BUS_NATS — which reads like a broken lab. They name the bundle that works now, and the README says the host binary needs SYSTEM=arch, because one built without it refuses everything with an empty system name. And the three habits that each cost a run before they were adopted: MESH_LAB_KEEP to leave the machine standing, MESH_LAB_WARM while iterating, and rebuilding all three repositories the bed places rather than the one that changed.
2026-09-29 17:45:09 +02:00
parent f2d6ab3bf9
commit a734d427c0
33 changed files with 56 additions and 33 deletions
@@ -16,7 +16,7 @@
 *
 *   MESH_LAB_INCUS='sudo -n incus'
 *   MESH_LAB_HOST_BINARY=.../mesh-host/mesh-host
- *   MESH_LAB_BUNDLE=.../mesh-host/examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../mesh-host/examples/foundation-first-node-nats.lock
 *   MESH_LAB_CATALOG=.../mesh-catalog/modules
 */
 import { test, before, after } from "node:test";
@@ -34,7 +34,7 @@
 *
 *   MESH_LAB_INCUS='sudo -n incus'
 *   MESH_LAB_HOST_BINARY=<mesh-host>/mesh-host   MESH_LAB_BOOTSTRAP_BINARY=<mesh-host>/mesh-bootstrap
- *   MESH_LAB_BUNDLE=<mesh-host>/examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=<mesh-host>/examples/foundation-first-node-nats.lock
 *   MESH_LAB_CATALOG=<mesh-catalog>/modules      MESH_LAB_MODULES=<mesh-controller>/examples/modules
 *   MESH_TOOLS=<mesh-tools>  MESH_SDK=<mesh-sdk>  (default: the checkouts beside this one)
 *   MESH_LAB_KEEP=1   leave it standing      MESH_LAB_WARM=1   iterate from the adopted foundation
@@ -36,7 +36,7 @@
 * in for the authenticated cross-node call a manager node would make). The node-private-key stub of
 * the earlier cut is GONE — the host uses its own real key.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   Build both runtime images into the local daemon first:
 *     scripts/build-module-runtime.sh anthropic-manager  /tmp/anthropic-manager.tar
 *     scripts/build-module-runtime.sh anthropic-consumer  /tmp/anthropic-consumer.tar
@@ -10,7 +10,7 @@
 * It needs the host binary, the foundation bundle, and the runtime image the scenario loads:
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host
- *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-runtime-image.sh builds mesh-runtime-audit:development into the local daemon,
 *   which scenarios/audit-node.yml stocks — so no MESH_LAB_RUNTIME here; the host pulls it.
 */
@@ -13,7 +13,7 @@
 * would say nothing at all about removal — which is the half issue 129 asked for by name.
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host
- *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   MESH_LAB_CATALOG=.../mesh-catalog/modules
 *   step-ca's image is upstream, pinned by the catalogue, pulled by the machine over its uplink.
 *   ca-trust carries no image: a script, a unit, and the machine's own systemd.
@@ -17,7 +17,7 @@
 *
 * All are assigned to the one anchor, pushed ONCE, and the node converges ONCE with every one up.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-module-runtime.sh {mongodb,unifi,postgres} build the runtime images into the local
 *   daemon; scenarios/catalogue-apps.yml stocks them. mongo:7, lscr.io/linuxserver/unifi-controller
 *   and synesthesiam/marytts must be in the local daemon to be stocked.
@@ -23,7 +23,7 @@
 *
 * All is assigned to the one anchor, pushed ONCE, and the node converges ONCE with both modules up.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-module-runtime.sh {sonarr,radarr} build the runtime images into the local daemon;
 *   scenarios/catalogue-media.yml stocks them. lscr.io/linuxserver/{sonarr,radarr} must be in the
 *   local daemon; the service images are pulled from the internet. Each *arr runtime is given a lab
@@ -22,7 +22,7 @@
 * the seed), and mosquitto's provisioner — running in the assigned runtime — creates a scoped client
 * for a contribution the mesh delivered, which then authenticates with the password the mesh minted.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-module-runtime.sh mosquitto builds mesh-runtime-mosquitto:development (carrying
 *   mosquitto_ctrl and the compiled bootstrap entrypoint) into the local daemon, which
 *   scenarios/catalogue-mqtt.yml stocks. eclipse-mosquitto:2 must be in the local daemon to be
@@ -18,7 +18,7 @@
 * path is fulfilled by creating the consumer's login with the mesh-minted password — it seals nothing
 * and needs no seal key (novox/hq ADR 0048, issue 032-provider-runtime-has-no-seal-key).
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-module-runtime.sh {postgres,redis,minio,plex} build the four runtime images into the
 *   local daemon; scenarios/catalogue-small.yml stocks them. postgres:17-alpine, redis:7-alpine and
 *   minio/minio:latest is pulled from the internet by the node itself.
@@ -22,7 +22,7 @@
 * It needs a host binary and the foundation bundle:
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host
- *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *
 * HELPER — stock the two runtimes into the local daemon before the run (some may already be there):
 *   scripts/build-module-runtime.sh postgres     /tmp/postgres.tar
@@ -25,7 +25,7 @@
 * registry by digest; the host pulls and runs it on the cadence.
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host (feat/apply-schedule — the scheduler that fires the step)
- *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   MESH_LAB_MODULES=.../mesh-controller/examples/modules (feat/schedule-container — the parser that
 *   carries `schedule` through). scenarios/schedule-tick.yml stocks alpine:latest (which must be in
 *   the local daemon) and serves it by digest; there is no runtime image — schedtest is a bare tick.
@@ -17,7 +17,7 @@
 * A tool would only fail if it were actually invoked without real creds — which this bed does not do,
 * because the point is exactly that serving does not require them.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-module-runtime.sh confluence builds mesh-runtime-confluence:development into the
 *   local daemon; scenarios/tools-confluence.yml stocks it. There is no service image.
 */
@@ -16,7 +16,7 @@
 * A tool would only fail if it were actually invoked without real creds — which this bed does not do,
 * because the point is exactly that serving does not require them.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-module-runtime.sh gitlab builds mesh-runtime-gitlab:development into the local
 *   daemon; scenarios/tools-gitlab.yml stocks it. There is no service image — gitlab is tools-only.
 */
@@ -22,7 +22,7 @@
 * It needs a host binary and the foundation bundle:
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host
- *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *
 * HELPER — stock the three runtimes into the local daemon before the run (some may already be there):
 *   scripts/build-module-runtime.sh postgres /tmp/postgres.tar
@@ -22,7 +22,7 @@
 * The manifests are the catalogue's own (../mesh-catalog/modules/{mesh-vault,redis}/module.json), with
 * the runtime artifact named as the image the lab built, exactly as the other assigned-* beds do.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-module-runtime.sh mesh-vault / redis build the two runtime images into the local
 *   daemon; scenarios/vault-node.yml stocks them.
 */
@@ -19,7 +19,7 @@
 *      by the firewall the nftables module derives (issues 055/056/057 in one bed).
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BOOTSTRAP_BINARY=.../mesh-bootstrap
- *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock  (the TEMPLATE)
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock  (the TEMPLATE)
 *   MESH_LAB_CATALOG=.../mesh-catalog/modules
 *   MESH_LAB_SOURCE=git://<forge>/mesh-controller.git   MESH_LAB_SOURCE_REF=<commit>
 *   MESH_LAB_BUILD_REF=<branch or commit for module builds, default main>
@@ -17,7 +17,7 @@
 * It needs the host binary and the foundation bundle, like the mesh walk, plus a runtime image:
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host
- *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   MESH_LAB_RUNTIME=.../mesh-runtime-audit.tar   (docker save of the runtime+audit-logger image;
 *                                                  built by scripts/build-runtime-image.sh)
 *
@@ -31,7 +31,7 @@
 *   MESH_LAB_INCUS='sudo -n incus'
 *   MESH_LAB_HOST_BINARY=.../mesh-host/mesh-host
 *   MESH_LAB_BOOTSTRAP_BINARY=.../mesh-host/mesh-bootstrap
- *   MESH_LAB_BUNDLE=.../mesh-host/examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../mesh-host/examples/foundation-first-node-nats.lock
 *   MESH_LAB_CATALOG=.../mesh-catalog/modules
 *   MESH_LAB_SOURCE=<forge>/mesh-controller.git   MESH_LAB_SOURCE_REF=<commit>
 *   MESH_LAB_KEEP=1   to leave it standing afterwards
@@ -12,7 +12,7 @@
 *   MESH_LAB_INCUS='sudo -n incus'
 *   MESH_LAB_HOST_BINARY=.../mesh-host/mesh-host
 *   MESH_LAB_BOOTSTRAP_BINARY=.../mesh-host/mesh-bootstrap
- *   MESH_LAB_BUNDLE=.../mesh-host/examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../mesh-host/examples/foundation-first-node-nats.lock
 *   MESH_LAB_CATALOG=.../mesh-catalog/modules
 *   MESH_LAB_KEEP=1   to leave it standing afterwards
 */
@@ -23,7 +23,7 @@ import { mustBeHandedOver, pinnedInto, referenceFor, repositoryOf, type HeldImag
 /**
 * The example bundle in mesh-host names a registry that no longer exists.
 *
- * `examples/foundation-first-node.lock` was written **for a target**, and the target was the lab: it
+ * `examples/foundation-first-node-nats.lock` was written **for a target**, and the target was the lab: it
 * pins `192.0.2.250:5000/…` because that is where the registry the lab used to raise served from.
 * That registry is gone, so those three references name nothing.
 *
@@ -25,7 +25,7 @@
 * its vhost — the provider named the vhost after the login — and nothing is hardcoded; the provider's
 * `serves` carries the port so the consumer references `${bound:amqp:port}`.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *
 * HELPER — stock the two runtimes into the local daemon before the run (some may already be there):
 *   scripts/build-module-runtime.sh lavinmq   /tmp/lavinmq.tar
@@ -15,7 +15,7 @@
 * asserts the templated URL and that a request to it reaches the running server (ollama answers
 * /v1/models even with no model pulled — the wiring is what is proven, not a model's output).
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   No module runtime image is built — both modules are pure declaration.
 */

@@ -11,7 +11,7 @@
 * Mint on one side and create on the other agreeing, with no shared key and nothing placed by the
 * test, is the entire provider/consumer contract working as one thing.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-module-runtime.sh redis builds mesh-runtime-redis:development, which
 *   scenarios/redis-node.yml stocks.
 */
@@ -9,7 +9,7 @@
 * It needs a host binary and the foundation bundle:
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host
- *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *
 * The bundle's image references are rewritten to the ones this scenario's own registry serves.
 * A digest belongs to whatever registry serves it, so a committed bundle names a registry that is
@@ -31,7 +31,7 @@
 *   MESH_LAB_INCUS='sudo -n incus'
 *   MESH_LAB_HOST_BINARY=.../mesh-host/mesh-host
 *   MESH_LAB_BOOTSTRAP_BINARY=.../mesh-host/mesh-bootstrap
- *   MESH_LAB_BUNDLE=.../mesh-host/examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../mesh-host/examples/foundation-first-node-nats.lock
 *   MESH_LAB_CATALOG=.../mesh-catalog/modules
 *   MESH_LAB_SOURCE=<forge>/mesh-controller.git   MESH_LAB_SOURCE_REF=<commit>
 *   MESH_LAB_KEEP=1   to leave it standing afterwards
@@ -12,7 +12,7 @@
 * ordinary sealed-delivery path — with NO manager, NO refresh, NO access/refresh split, NO usage. The
 * whole of OpenAI's integration in the control plane is one registry line (vendor -> static-key).
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   Build the consumer runtime image into the local daemon first:
 *     scripts/build-module-runtime.sh openai-consumer  /tmp/openai-consumer.tar
 */
@@ -25,7 +25,7 @@
 * publicly-trusted certificate and answering an HTTP-01 challenge at the name — is proven separately
 * by certificates.test.ts, which drives the same proxy binary against a real ACME server (Pebble).
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-route-proxy-image.sh builds mesh-route-proxy:development into the local daemon;
 *   scenarios/route-forwarding.yml stocks it and alpine:latest, and serves both by digest.
 */
@@ -12,7 +12,7 @@
 * the container was replaced (a new container id) and the config on disk carries the new value.
 * It builds the host from source (no --no-build), because the behaviour under test is the host's.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   scripts/build-module-runtime.sh grafana builds mesh-runtime-grafana:development, which
 *   scenarios/grafana-node.yml stocks.
 */
@@ -14,7 +14,7 @@
 * It needs a host binary and the foundation bundle:
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host
- *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 */
 import { test, before, after } from "node:test";
 import assert from "node:assert/strict";
@@ -20,7 +20,7 @@
 * references of OURS are rewritten to the IDs the machine holds, and the co-located
 * host-port collisions are remapped at load time (see REMAP).
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 */

 import { test, before, after } from "node:test";
@@ -50,7 +50,7 @@
 * (whole-mesh-full-live) and NOT torn down — it is left standing and browsable. Without it the bed
 * behaves like every other: raise in before(), destroy in after().
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 *   MESH_LAB_BOOTSTRAP_BINARY=.../mesh-bootstrap   MESH_LAB_CATALOG=.../mesh-catalog/modules
 */

@@ -28,7 +28,7 @@
 *   host ports here (container ports unchanged); the provider ports the consumers actually connect to
 *   (postgres 5432, minio 9000, mongodb 27017, mssql 1433) are left as-is. See REMAP below.
 *
- *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
+ *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node-nats.lock
 * scripts/build-module-runtime.sh builds one runtime per module that has code; the route-proxy image
 * is built by scripts/build-route-proxy-image.sh; scenarios/whole-mesh-novox.yml stocks them all
 * alongside every server image.