6 Commits

Include renames

Author	SHA1	Message	Date
jochen	1af6efb356	Name the one genesis bundle in every bed and the README (hq issue 146, ADR 0331) ... mesh-host now carries one genesis bundle, foundation-first-node.lock, on the bus the mesh runs on; the NATS one it replaces is deleted. Beds that still named it would point at a file that is gone, and the harness's rewrite for the previous broker's image rewrote nothing.	2026-10-12 22:50:50 +02:00
jschoubben	a734d427c0	A bed says what it actually needs to be pointed at ... The instructions in every bed named the bundle that raises the predecessor's broker, so a first attempt ends in a control plane crash-looping on a missing MESH_BUS_NATS — which reads like a broken lab. They name the bundle that works now, and the README says the host binary needs SYSTEM=arch, because one built without it refuses everything with an empty system name. And the three habits that each cost a run before they were adopted: MESH_LAB_KEEP to leave the machine standing, MESH_LAB_WARM while iterating, and rebuilding all three repositories the bed places rather than the one that changed.	2026-09-29 17:45:09 +02:00
jschoubben	64c081d025	The vault bed installs a consumer that keeps two secrets, and both are delivered and rotated ... Two files with two values, two holders in the vault's ledger — the identity with the local name after it — and one rotate moves both (novox/hq ADR 0094).	2026-09-21 20:29:49 +02:00
jschoubben	599d41eb42	Beds for the seed file and for the foundation's filter ... The vault bed grows into a create-once file and pushes again; the genesis bed probes the machine from the workstation for the whole install and asserts the store's port never answers while the bus's does.	2026-09-21 12:11:52 +02:00
jschoubben	fb72db73bc	The vault bed recovers redis's vault-provided secret from the export	2026-09-21 00:36:16 +02:00
jschoubben	639175ec4a	A bed for the vault: redis's password as a secret it provides, rotated ... Design 13's three logins, for a secret that had no owner before (novox/hq ADR 0085): the delivered password authenticates against the real redis, the one `rotate secret` delivers authenticates, and the one rotated away is refused. Plus the owner's half: the vault's ledger names the holder and the fingerprint, notices the rotation, and answers over the mesh by fingerprint, never by value. Runs the catalogue's own manifests.	2026-09-21 00:01:50 +02:00