jschoubben
4d2ec6e6a8
Merge pull request 'A cache consumer must present its login; the two-node bed runs green again' ( #49 ) from multiple-fixes into main
2026-09-22 13:53:15 +02:00
jschoubben
dba95f7e27
The two-node bed's baserow data directory is 0755, as the catalogue's
2026-09-22 13:46:04 +02:00
jschoubben
3ce66e8369
The two-node bed's copies declare the secrets they take through the environment, as the catalogue does (ADR 0086)
2026-09-22 13:30:01 +02:00
jschoubben
3f71b91fb8
The two-node bed's timeout report shows the node that did not answer, not always the second one
2026-09-22 12:59:28 +02:00
jschoubben
2dfffd6dac
Review of 081: the bed asserts baserow chose its own cache and it challenges for its password; the check reads only what a module hands its software; stale comments
2026-09-22 12:34:59 +02:00
jschoubben
36f2fd1c2c
A cache consumer presents the login it was granted, checked over the catalogue; the two-node bed's baserow keeps its own cache and the bed asserts it answers (issue 081)
2026-09-22 12:26:34 +02:00
jschoubben
7a5d670e4e
Merge pull request 'The large mesh bed runs end to end again: 21/21' ( #48 ) from multiple-fixes into main
2026-09-22 02:19:15 +02:00
jschoubben
8a85e2d02e
The grant bed's tenancy assertions are scoped to the login's keyspace, as redis scopes the ACL
2026-09-22 01:41:16 +02:00
jschoubben
146d7da9ef
The large bed starts the hand-started builder where a build is asked for: it does not outlive the broker's first reconcile
2026-09-22 01:30:53 +02:00
jschoubben
10cfbd094a
Review: the cache grant's tenancy assertions move into the grant bed; retirement notes say what the beds prove; the builder binary is pushed on a warm return; the large bed needs the catalogue
2026-09-22 01:27:52 +02:00
jschoubben
353cf88a4b
The large mesh bed catches up with the mesh: the anchor's filter derived, ports declared, an image awaited, one host and builder on a warm return, resolvers from the catalogue; four tests retired for the beds that prove them
2026-09-22 01:16:13 +02:00
jschoubben
9eaa3a623d
node_modules is not tracked: the link committed by mistake goes, and the ignore covers a link too
2026-09-22 00:38:07 +02:00
jschoubben
a964ec287d
Merge pull request 'Issue 074 closed: the last WEARING fixtures renamed or retired; a stale delivery fixed' ( #47 ) from multiple-fixes into main
2026-09-21 23:58:49 +02:00
jschoubben
2da442729f
Review: the node_modules link is not committed; two beds no longer issue modules with no broker secret; a stale header
2026-09-21 23:56:02 +02:00
jschoubben
03bbc37572
Beds issue only modules with a broker secret: an own secret is minted at resolve
2026-09-21 23:46:27 +02:00
jschoubben
484fafe799
mesh.test.ts: the consumer's login carries its slug
2026-09-21 23:43:01 +02:00
jschoubben
7c81902571
mesh.test.ts: meshboard gets a slug (ADR 0049); the builder-as-module test is retired, genesis proves it
2026-09-21 23:38:58 +02:00
jschoubben
080150addb
provider-on-backend-network: no longer names a retired bed
2026-09-21 23:35:17 +02:00
jschoubben
fd1e5499d0
Retire provider-uses-mesh-credential: the grant end-to-end bed proves it against the catalogue's redis, with the mesh writing the contributions; its no-seal-key assertion moves there (issue 074)
2026-09-21 23:35:01 +02:00
jschoubben
0d8eac88c3
whole-mesh-full delivers amqp-email-forwarder's smtp-password under the name the module declares (found by issue 078's refusal)
2026-09-21 23:31:34 +02:00
jschoubben
2e0f11dfc2
Three beds give their fixtures names that are no catalogue module's (issue 074)
2026-09-21 23:25:36 +02:00
jschoubben
e1739b1caf
Merge pull request 'The route-forwarding bed installs the catalogue's authority, proxy and consumer; the whole-mesh bed installs the vault first' ( #46 ) from multiple-fixes into main
2026-09-21 22:58:25 +02:00
jschoubben
b0eddd28d8
build-route-proxy-image.sh builds FROM the bases the manifest declares
2026-09-21 22:56:25 +02:00
jschoubben
2ce130c256
whole-mesh-full: an own-secret is declared under own-secrets
2026-09-21 22:55:00 +02:00
jschoubben
e64d296c80
whole-mesh-full: issue a module with an own-secret, not only one with a broker account
2026-09-21 22:54:09 +02:00
jschoubben
acb8d3da88
whole-mesh-full: the vault before the modules that keep secrets in it; no operator root or app secrets delivered (ADRs 0094, 0098)
2026-09-21 22:53:28 +02:00
jschoubben
f785f5892a
The route-forwarding bed converges the overlay before the modules: the proxy fetches the roots at the private-network address at first start
2026-09-21 22:41:36 +02:00
jschoubben
d95174da02
The route-forwarding bed places its machine on the overlay: the authority certifies its private-network address
2026-09-21 22:35:33 +02:00
jschoubben
2530ca762e
The lab stands in for the builder on an upstream artifact too: the reference the manifest pins
...
hello-web's server is somebody else's image the mesh would copy in (ADR 0096); the
loader refused it as an artifact nobody stocked.
2026-09-21 22:33:44 +02:00
jschoubben
107257faf4
The route-forwarding bed installs the catalogue's authority, proxy and consumer
...
step-ca beside the proxy, the proxy fetching the authority's root through its gate,
hello-web routed under the node's public domain by its label (ADR 0066). The last
declared mesh test but one reads the catalogue (novox/hq 04-ISSUES/074, 076).
2026-09-21 22:27:17 +02:00
jschoubben
690596d33b
The whole-mesh bed installs the vault before the modules that keep a secret from it; route-forwarding waits on issue 076
2026-09-21 22:16:15 +02:00
jschoubben
31163865d2
Merge pull request 'Multiple fixes: six beds retired (074), the certificate bed against Pebble and step-ca (020), a coupled-pair spike (066)' ( #45 ) from multiple-fixes into main
2026-09-21 22:13:19 +02:00
jschoubben
69d3813ae1
The certificate bed reads the names a certificate is for from its alternative names
...
Pebble, like the public authority it stands in for, leaves the subject empty; the
bed read the subject and refused a valid certificate.
2026-09-21 22:11:01 +02:00
jschoubben
2bc1230252
The certificate bed's backend is a real server: its netcat loop never listened
...
Every request through the proxy was refused by the backend, which read as the
certificate never arriving and hid behind the authority's refusal — until the second
authority issued one and the request behind the handshake still failed.
2026-09-21 22:08:52 +02:00
jschoubben
b6be7ac8af
The second-authority test stops the proxy by its anchored path: the process name is truncated in the table
2026-09-21 22:02:08 +02:00
jschoubben
38672cd356
The second-authority test stops the proxy by name, not by a pattern its own shell matches
2026-09-21 21:57:39 +02:00
jschoubben
8a3e7dbd1b
A spike for issue 066: a coupled pair half-applied, and what the machine is observed doing
...
A config file, a run-once gate that validates it, and a service that reads it once at
start. The second push changes the file and makes the gate refuse it: the file is
applied, the gate fails, the service stays — v2 on disk, v1 served, the push
reported failed. Evidence for the decision 066 asks for, not a rule enforced.
2026-09-21 21:55:45 +02:00
jschoubben
ab5b0d11da
The certificate bed orders the same certificate from a second authority, the catalogue's own
...
Issue 020 could not tell a Pebble interop detail from a fault of the proxy's. The
bed now raises step-ca as the catalogue pins it and orders again through the same
proxy and the same challenge path (novox/hq 04-ISSUES/020).
2026-09-21 21:54:13 +02:00
jschoubben
26177d81be
Six beds retired: their coverage lives in the catalogue beds and the whole-mesh beds now
...
The four sidecar beds (grafana, plex, sonarr, redis) proved a sidecar comes up and
serves tools with the module's server cut away; the catalogue beds and the whole-mesh
beds prove the modules whole. The minio and postgres grant beds proved a grant
mechanism with a second store beside the foundation's; the grant bed and the vault bed
prove it against the catalogue. Ten conversions become six deletions (novox/hq
04-ISSUES/074).
2026-09-21 21:53:11 +02:00
jschoubben
543ccb7380
Merge pull request 'Multiple fixes: the vault bed keeps two secrets, the confluence bed asks through the control plane, the runtime build installs its SDK and speaks' ( #44 ) from multiple-fixes into main
2026-09-21 21:05:12 +02:00
jschoubben
85dc827660
The confluence bed asks a tool through the control plane, and the tool answers
...
No account in the mesh but the control plane's may create a reply queue and publish
to a module's request key (novox/hq 04-ISSUES/049, ADR 0095).
2026-09-21 20:34:03 +02:00
jschoubben
2f11a29c4d
The runtime build installs the module's SDK itself and shows its compiler's output
...
A module never built on this workstation had no node_modules, tsc failed on the
first import behind /dev/null, and the suite reported a build that said nothing.
2026-09-21 20:31:47 +02:00
jschoubben
64c081d025
The vault bed installs a consumer that keeps two secrets, and both are delivered and rotated
...
Two files with two values, two holders in the vault's ledger — the identity with the
local name after it — and one rotate moves both (novox/hq ADR 0094).
2026-09-21 20:29:49 +02:00
jschoubben
467416728e
Merge pull request 'The run rebuilds the module runtimes its beds stock (075); two mechanism beds read the catalogue's redis (074)' ( #43 ) from feat/mesh-tests-and-runtimes into main
2026-09-21 19:36:44 +02:00
jschoubben
e4c924a85e
The grant bed's consumer takes a slug: its derived identity was one character over what a backend keeps
2026-09-21 19:32:36 +02:00
jschoubben
1b2443690d
Two mechanism beds install the catalogue's redis with the vault beside it
...
A module's name is its tool namespace and its broker scope, so a fixture running
the module's runtime cannot carry another name (novox/hq ADR 0093). The grant and
backend-network beds now read the catalogue's redis and install mesh-vault, which
provides the secret it requires; the redis-node scenario stocks the vault's runtime.
The remaining declared copies say why they stand (novox/hq 04-ISSUES/074).
2026-09-21 19:30:34 +02:00
jschoubben
d7959001dd
The run rebuilds the module runtimes its beds stock
...
A per-module bed stocks mesh-runtime-<module>:development from the workstation's
image store, built by hand by a script the suite never called; six were two weeks
older than the manifests they served. For the beds named, every runtime their
scenarios stock is compared against the module's source and the tool runtime and
SDK it is built on, and rebuilt where older, missing or uncommitted; a failed
build stops the suite (novox/hq 04-ISSUES/075).
2026-09-21 19:26:59 +02:00
jschoubben
be58bd96f6
Merge pull request 'Genesis reads the registry's and the builder's manifests from the catalogue, not the control plane's (hq issue 072)' ( #42 ) from feat/one-controller-manifest into main
2026-09-21 19:23:56 +02:00
jschoubben
6083b9310a
Genesis reads the registry's and the builder's manifests from the catalogue, not the control plane's
...
The control plane's manifest comes out of the build the installer runs (novox/hq ADR
0069, 04-ISSUES/072); the catalogue no longer holds a copy, and a bed that demanded
one would stop a genesis that is about to succeed.
2026-09-21 19:23:44 +02:00
jschoubben
c8c3028f38
Merge pull request 'Beds read the catalogue: one loader, eight beds converted, the rest declared (hq issue 073)' ( #41 ) from feat/beds-read-the-catalogue into main
2026-09-21 19:23:15 +02:00
jschoubben