jschoubben
d93dc2628f
Adoption bed: the anchor keeps its host service, so a machine that reboots comes back holding itself; only the fresh-machine dry run goes without
2026-09-22 20:52:42 +02:00
jschoubben
23ca9cadad
Adoption bed: the machine the predecessor leaves also runs a container with no restart policy
2026-09-22 20:05:21 +02:00
jschoubben
204a226e36
Adoption bed: prove the guard rather than the found firewall, the runtime's own settings and a container with no restart policy, a held file not reverted once its writer stops, and the operator's rule outliving the mesh's opening
2026-09-22 19:53:47 +02:00
jschoubben
8d9e4bdb77
Adoption bed: the container probe asks the guard's promise, admitting the container interface through the found firewall for itself alone
2026-09-22 19:00:39 +02:00
jschoubben
3f224c2876
Adoption bed: an opening the operator's own rule answers is satisfied, and a failed container probe records its evidence
2026-09-22 18:49:06 +02:00
jschoubben
a53dc8c586
Adoption bed (in progress): a machine in use raised adopted, held, opened through its firewall, taken and converged (hq ADR 0100-0103)
2026-09-22 18:19:36 +02:00
jschoubben
bb746505dc
Merge pull request 'The store-window bed: a machine enrols and a report arrives while the store is away (issue 083)' ( #50 ) from multiple-fixes into main
2026-09-22 14:42:59 +02:00
jschoubben
514f7a46cd
The store-window bed holds a report through the gap, asserts the enrolment is answered meanwhile, and compares the keys the mesh recorded with the ones the machine generated
2026-09-22 14:24:01 +02:00
jschoubben
c9fd6d7887
A bed that takes the store away while a machine enrols, and holds the enrolment to completing on its own (novox/hq issue 083)
2026-09-22 14:08:45 +02:00
jschoubben
4d2ec6e6a8
Merge pull request 'A cache consumer must present its login; the two-node bed runs green again' ( #49 ) from multiple-fixes into main
2026-09-22 13:53:15 +02:00
jschoubben
dba95f7e27
The two-node bed's baserow data directory is 0755, as the catalogue's
2026-09-22 13:46:04 +02:00
jschoubben
3ce66e8369
The two-node bed's copies declare the secrets they take through the environment, as the catalogue does (ADR 0086)
2026-09-22 13:30:01 +02:00
jschoubben
3f71b91fb8
The two-node bed's timeout report shows the node that did not answer, not always the second one
2026-09-22 12:59:28 +02:00
jschoubben
2dfffd6dac
Review of 081: the bed asserts baserow chose its own cache and it challenges for its password; the check reads only what a module hands its software; stale comments
2026-09-22 12:34:59 +02:00
jschoubben
36f2fd1c2c
A cache consumer presents the login it was granted, checked over the catalogue; the two-node bed's baserow keeps its own cache and the bed asserts it answers (issue 081)
2026-09-22 12:26:34 +02:00
jschoubben
7a5d670e4e
Merge pull request 'The large mesh bed runs end to end again: 21/21' ( #48 ) from multiple-fixes into main
2026-09-22 02:19:15 +02:00
jschoubben
8a85e2d02e
The grant bed's tenancy assertions are scoped to the login's keyspace, as redis scopes the ACL
2026-09-22 01:41:16 +02:00
jschoubben
146d7da9ef
The large bed starts the hand-started builder where a build is asked for: it does not outlive the broker's first reconcile
2026-09-22 01:30:53 +02:00
jschoubben
10cfbd094a
Review: the cache grant's tenancy assertions move into the grant bed; retirement notes say what the beds prove; the builder binary is pushed on a warm return; the large bed needs the catalogue
2026-09-22 01:27:52 +02:00
jschoubben
353cf88a4b
The large mesh bed catches up with the mesh: the anchor's filter derived, ports declared, an image awaited, one host and builder on a warm return, resolvers from the catalogue; four tests retired for the beds that prove them
2026-09-22 01:16:13 +02:00
jschoubben
9eaa3a623d
node_modules is not tracked: the link committed by mistake goes, and the ignore covers a link too
2026-09-22 00:38:07 +02:00
jschoubben
a964ec287d
Merge pull request 'Issue 074 closed: the last WEARING fixtures renamed or retired; a stale delivery fixed' ( #47 ) from multiple-fixes into main
2026-09-21 23:58:49 +02:00
jschoubben
2da442729f
Review: the node_modules link is not committed; two beds no longer issue modules with no broker secret; a stale header
2026-09-21 23:56:02 +02:00
jschoubben
03bbc37572
Beds issue only modules with a broker secret: an own secret is minted at resolve
2026-09-21 23:46:27 +02:00
jschoubben
484fafe799
mesh.test.ts: the consumer's login carries its slug
2026-09-21 23:43:01 +02:00
jschoubben
7c81902571
mesh.test.ts: meshboard gets a slug (ADR 0049); the builder-as-module test is retired, genesis proves it
2026-09-21 23:38:58 +02:00
jschoubben
080150addb
provider-on-backend-network: no longer names a retired bed
2026-09-21 23:35:17 +02:00
jschoubben
fd1e5499d0
Retire provider-uses-mesh-credential: the grant end-to-end bed proves it against the catalogue's redis, with the mesh writing the contributions; its no-seal-key assertion moves there (issue 074)
2026-09-21 23:35:01 +02:00
jschoubben
0d8eac88c3
whole-mesh-full delivers amqp-email-forwarder's smtp-password under the name the module declares (found by issue 078's refusal)
2026-09-21 23:31:34 +02:00
jschoubben
2e0f11dfc2
Three beds give their fixtures names that are no catalogue module's (issue 074)
2026-09-21 23:25:36 +02:00
jschoubben
e1739b1caf
Merge pull request 'The route-forwarding bed installs the catalogue's authority, proxy and consumer; the whole-mesh bed installs the vault first' ( #46 ) from multiple-fixes into main
2026-09-21 22:58:25 +02:00
jschoubben
b0eddd28d8
build-route-proxy-image.sh builds FROM the bases the manifest declares
2026-09-21 22:56:25 +02:00
jschoubben
2ce130c256
whole-mesh-full: an own-secret is declared under own-secrets
2026-09-21 22:55:00 +02:00
jschoubben
e64d296c80
whole-mesh-full: issue a module with an own-secret, not only one with a broker account
2026-09-21 22:54:09 +02:00
jschoubben
acb8d3da88
whole-mesh-full: the vault before the modules that keep secrets in it; no operator root or app secrets delivered (ADRs 0094, 0098)
2026-09-21 22:53:28 +02:00
jschoubben
f785f5892a
The route-forwarding bed converges the overlay before the modules: the proxy fetches the roots at the private-network address at first start
2026-09-21 22:41:36 +02:00
jschoubben
d95174da02
The route-forwarding bed places its machine on the overlay: the authority certifies its private-network address
2026-09-21 22:35:33 +02:00
jschoubben
2530ca762e
The lab stands in for the builder on an upstream artifact too: the reference the manifest pins
...
hello-web's server is somebody else's image the mesh would copy in (ADR 0096); the
loader refused it as an artifact nobody stocked.
2026-09-21 22:33:44 +02:00
jschoubben
107257faf4
The route-forwarding bed installs the catalogue's authority, proxy and consumer
...
step-ca beside the proxy, the proxy fetching the authority's root through its gate,
hello-web routed under the node's public domain by its label (ADR 0066). The last
declared mesh test but one reads the catalogue (novox/hq 04-ISSUES/074, 076).
2026-09-21 22:27:17 +02:00
jschoubben
690596d33b
The whole-mesh bed installs the vault before the modules that keep a secret from it; route-forwarding waits on issue 076
2026-09-21 22:16:15 +02:00
jschoubben
31163865d2
Merge pull request 'Multiple fixes: six beds retired (074), the certificate bed against Pebble and step-ca (020), a coupled-pair spike (066)' ( #45 ) from multiple-fixes into main
2026-09-21 22:13:19 +02:00
jschoubben
69d3813ae1
The certificate bed reads the names a certificate is for from its alternative names
...
Pebble, like the public authority it stands in for, leaves the subject empty; the
bed read the subject and refused a valid certificate.
2026-09-21 22:11:01 +02:00
jschoubben
2bc1230252
The certificate bed's backend is a real server: its netcat loop never listened
...
Every request through the proxy was refused by the backend, which read as the
certificate never arriving and hid behind the authority's refusal — until the second
authority issued one and the request behind the handshake still failed.
2026-09-21 22:08:52 +02:00
jschoubben
b6be7ac8af
The second-authority test stops the proxy by its anchored path: the process name is truncated in the table
2026-09-21 22:02:08 +02:00
jschoubben
38672cd356
The second-authority test stops the proxy by name, not by a pattern its own shell matches
2026-09-21 21:57:39 +02:00
jschoubben
8a3e7dbd1b
A spike for issue 066: a coupled pair half-applied, and what the machine is observed doing
...
A config file, a run-once gate that validates it, and a service that reads it once at
start. The second push changes the file and makes the gate refuse it: the file is
applied, the gate fails, the service stays — v2 on disk, v1 served, the push
reported failed. Evidence for the decision 066 asks for, not a rule enforced.
2026-09-21 21:55:45 +02:00
jschoubben
ab5b0d11da
The certificate bed orders the same certificate from a second authority, the catalogue's own
...
Issue 020 could not tell a Pebble interop detail from a fault of the proxy's. The
bed now raises step-ca as the catalogue pins it and orders again through the same
proxy and the same challenge path (novox/hq 04-ISSUES/020).
2026-09-21 21:54:13 +02:00
jschoubben
26177d81be
Six beds retired: their coverage lives in the catalogue beds and the whole-mesh beds now
...
The four sidecar beds (grafana, plex, sonarr, redis) proved a sidecar comes up and
serves tools with the module's server cut away; the catalogue beds and the whole-mesh
beds prove the modules whole. The minio and postgres grant beds proved a grant
mechanism with a second store beside the foundation's; the grant bed and the vault bed
prove it against the catalogue. Ten conversions become six deletions (novox/hq
04-ISSUES/074).
2026-09-21 21:53:11 +02:00
jschoubben
543ccb7380
Merge pull request 'Multiple fixes: the vault bed keeps two secrets, the confluence bed asks through the control plane, the runtime build installs its SDK and speaks' ( #44 ) from multiple-fixes into main
2026-09-21 21:05:12 +02:00
jschoubben
85dc827660
The confluence bed asks a tool through the control plane, and the tool answers
...
No account in the mesh but the control plane's may create a reply queue and publish
to a module's request key (novox/hq 04-ISSUES/049, ADR 0095).
2026-09-21 20:34:03 +02:00
jschoubben