08e3aa04e7
Merge pull request 'Adoption bed: a machine in use raised adopted, held, taken and converged (hq ADR 0100–0103)' (#51) from feat/adoption-mode into main
main
jschoubben2026-09-22 21:02:12 +02:00
d93dc2628f
Adoption bed: the anchor keeps its host service, so a machine that reboots comes back holding itself; only the fresh-machine dry run goes without
jschoubben2026-09-22 20:52:42 +02:00
23ca9cadad
Adoption bed: the machine the predecessor leaves also runs a container with no restart policy
jschoubben2026-09-22 20:05:21 +02:00
204a226e36
Adoption bed: prove the guard rather than the found firewall, the runtime's own settings and a container with no restart policy, a held file not reverted once its writer stops, and the operator's rule outliving the mesh's opening
jschoubben2026-09-22 19:53:47 +02:00
8d9e4bdb77
Adoption bed: the container probe asks the guard's promise, admitting the container interface through the found firewall for itself alone
jschoubben2026-09-22 19:00:39 +02:00
3f224c2876
Adoption bed: an opening the operator's own rule answers is satisfied, and a failed container probe records its evidence
jschoubben2026-09-22 18:49:06 +02:00
a53dc8c586
Adoption bed (in progress): a machine in use raised adopted, held, opened through its firewall, taken and converged (hq ADR 0100-0103)
jschoubben2026-09-22 18:19:36 +02:00
bb746505dc
Merge pull request 'The store-window bed: a machine enrols and a report arrives while the store is away (issue 083)' (#50) from multiple-fixes into main
jschoubben2026-09-22 14:42:59 +02:00
514f7a46cd
The store-window bed holds a report through the gap, asserts the enrolment is answered meanwhile, and compares the keys the mesh recorded with the ones the machine generated
jschoubben2026-09-22 14:24:01 +02:00
c9fd6d7887
A bed that takes the store away while a machine enrols, and holds the enrolment to completing on its own (novox/hq issue 083)
jschoubben2026-09-22 14:08:45 +02:00
4d2ec6e6a8
Merge pull request 'A cache consumer must present its login; the two-node bed runs green again' (#49) from multiple-fixes into main
jschoubben2026-09-22 13:53:15 +02:00
dba95f7e27
The two-node bed's baserow data directory is 0755, as the catalogue's
jschoubben2026-09-22 13:46:04 +02:00
3ce66e8369
The two-node bed's copies declare the secrets they take through the environment, as the catalogue does (ADR 0086)
jschoubben2026-09-22 13:30:01 +02:00
3f71b91fb8
The two-node bed's timeout report shows the node that did not answer, not always the second one
jschoubben2026-09-22 12:59:28 +02:00
2dfffd6dac
Review of 081: the bed asserts baserow chose its own cache and it challenges for its password; the check reads only what a module hands its software; stale comments
jschoubben2026-09-22 12:34:59 +02:00
36f2fd1c2c
A cache consumer presents the login it was granted, checked over the catalogue; the two-node bed's baserow keeps its own cache and the bed asserts it answers (issue 081)
jschoubben2026-09-22 12:26:34 +02:00
7a5d670e4e
Merge pull request 'The large mesh bed runs end to end again: 21/21' (#48) from multiple-fixes into main
jschoubben2026-09-22 02:19:15 +02:00
8a85e2d02e
The grant bed's tenancy assertions are scoped to the login's keyspace, as redis scopes the ACL
jschoubben2026-09-22 01:41:16 +02:00
146d7da9ef
The large bed starts the hand-started builder where a build is asked for: it does not outlive the broker's first reconcile
jschoubben2026-09-22 01:30:53 +02:00
10cfbd094a
Review: the cache grant's tenancy assertions move into the grant bed; retirement notes say what the beds prove; the builder binary is pushed on a warm return; the large bed needs the catalogue
jschoubben2026-09-22 01:27:52 +02:00
353cf88a4b
The large mesh bed catches up with the mesh: the anchor's filter derived, ports declared, an image awaited, one host and builder on a warm return, resolvers from the catalogue; four tests retired for the beds that prove them
jschoubben2026-09-22 01:16:13 +02:00
9eaa3a623d
node_modules is not tracked: the link committed by mistake goes, and the ignore covers a link too
jschoubben2026-09-22 00:38:07 +02:00
a964ec287d
Merge pull request 'Issue 074 closed: the last WEARING fixtures renamed or retired; a stale delivery fixed' (#47) from multiple-fixes into main
jschoubben2026-09-21 23:58:49 +02:00
2da442729f
Review: the node_modules link is not committed; two beds no longer issue modules with no broker secret; a stale header
jschoubben2026-09-21 23:56:02 +02:00
03bbc37572
Beds issue only modules with a broker secret: an own secret is minted at resolve
jschoubben2026-09-21 23:46:27 +02:00
484fafe799
mesh.test.ts: the consumer's login carries its slug
jschoubben2026-09-21 23:43:01 +02:00
7c81902571
mesh.test.ts: meshboard gets a slug (ADR 0049); the builder-as-module test is retired, genesis proves it
jschoubben2026-09-21 23:38:58 +02:00
080150addb
provider-on-backend-network: no longer names a retired bed
jschoubben2026-09-21 23:35:17 +02:00
fd1e5499d0
Retire provider-uses-mesh-credential: the grant end-to-end bed proves it against the catalogue's redis, with the mesh writing the contributions; its no-seal-key assertion moves there (issue 074)
jschoubben2026-09-21 23:35:01 +02:00
0d8eac88c3
whole-mesh-full delivers amqp-email-forwarder's smtp-password under the name the module declares (found by issue 078's refusal)
jschoubben2026-09-21 23:31:34 +02:00
2e0f11dfc2
Three beds give their fixtures names that are no catalogue module's (issue 074)
jschoubben2026-09-21 23:25:36 +02:00
e1739b1caf
Merge pull request 'The route-forwarding bed installs the catalogue's authority, proxy and consumer; the whole-mesh bed installs the vault first' (#46) from multiple-fixes into main
jschoubben2026-09-21 22:58:25 +02:00
b0eddd28d8
build-route-proxy-image.sh builds FROM the bases the manifest declares
jschoubben2026-09-21 22:56:25 +02:00
2ce130c256
whole-mesh-full: an own-secret is declared under own-secrets
jschoubben2026-09-21 22:55:00 +02:00
e64d296c80
whole-mesh-full: issue a module with an own-secret, not only one with a broker account
jschoubben2026-09-21 22:54:09 +02:00
acb8d3da88
whole-mesh-full: the vault before the modules that keep secrets in it; no operator root or app secrets delivered (ADRs 0094, 0098)
jschoubben2026-09-21 22:53:28 +02:00
f785f5892a
The route-forwarding bed converges the overlay before the modules: the proxy fetches the roots at the private-network address at first start
jschoubben2026-09-21 22:41:36 +02:00
d95174da02
The route-forwarding bed places its machine on the overlay: the authority certifies its private-network address
jschoubben2026-09-21 22:35:33 +02:00
2530ca762e
The lab stands in for the builder on an upstream artifact too: the reference the manifest pins
jschoubben2026-09-21 22:33:44 +02:00
107257faf4
The route-forwarding bed installs the catalogue's authority, proxy and consumer
jschoubben2026-09-21 22:27:17 +02:00
690596d33b
The whole-mesh bed installs the vault before the modules that keep a secret from it; route-forwarding waits on issue 076
jschoubben2026-09-21 22:16:15 +02:00
31163865d2
Merge pull request 'Multiple fixes: six beds retired (074), the certificate bed against Pebble and step-ca (020), a coupled-pair spike (066)' (#45) from multiple-fixes into main
jschoubben2026-09-21 22:13:19 +02:00
69d3813ae1
The certificate bed reads the names a certificate is for from its alternative names
jschoubben2026-09-21 22:11:01 +02:00
2bc1230252
The certificate bed's backend is a real server: its netcat loop never listened
jschoubben2026-09-21 22:08:52 +02:00
b6be7ac8af
The second-authority test stops the proxy by its anchored path: the process name is truncated in the table
jschoubben2026-09-21 22:02:08 +02:00
38672cd356
The second-authority test stops the proxy by name, not by a pattern its own shell matches
jschoubben2026-09-21 21:57:39 +02:00
8a3e7dbd1b
A spike for issue 066: a coupled pair half-applied, and what the machine is observed doing
jschoubben2026-09-21 21:55:45 +02:00
ab5b0d11da
The certificate bed orders the same certificate from a second authority, the catalogue's own
jschoubben2026-09-21 21:54:13 +02:00
26177d81be
Six beds retired: their coverage lives in the catalogue beds and the whole-mesh beds now
jschoubben2026-09-21 21:53:11 +02:00
543ccb7380
Merge pull request 'Multiple fixes: the vault bed keeps two secrets, the confluence bed asks through the control plane, the runtime build installs its SDK and speaks' (#44) from multiple-fixes into main
jschoubben2026-09-21 21:05:12 +02:00
85dc827660
The confluence bed asks a tool through the control plane, and the tool answers
jschoubben2026-09-21 20:34:03 +02:00
2f11a29c4d
The runtime build installs the module's SDK itself and shows its compiler's output
jschoubben2026-09-21 20:31:47 +02:00
64c081d025
The vault bed installs a consumer that keeps two secrets, and both are delivered and rotated
jschoubben2026-09-21 20:29:49 +02:00
467416728e
Merge pull request 'The run rebuilds the module runtimes its beds stock (075); two mechanism beds read the catalogue's redis (074)' (#43) from feat/mesh-tests-and-runtimes into main
jschoubben2026-09-21 19:36:44 +02:00
e4c924a85e
The grant bed's consumer takes a slug: its derived identity was one character over what a backend keeps
jschoubben2026-09-21 19:32:36 +02:00
1b2443690d
Two mechanism beds install the catalogue's redis with the vault beside it
jschoubben2026-09-21 19:30:34 +02:00
d7959001dd
The run rebuilds the module runtimes its beds stock
jschoubben2026-09-21 19:26:59 +02:00
be58bd96f6
Merge pull request 'Genesis reads the registry's and the builder's manifests from the catalogue, not the control plane's (hq issue 072)' (#42) from feat/one-controller-manifest into main
jschoubben2026-09-21 19:23:56 +02:00
6083b9310a
Genesis reads the registry's and the builder's manifests from the catalogue, not the control plane's
jschoubben2026-09-21 15:19:25 +02:00
c8c3028f38
Merge pull request 'Beds read the catalogue: one loader, eight beds converted, the rest declared (hq issue 073)' (#41) from feat/beds-read-the-catalogue into main
jschoubben2026-09-21 19:23:15 +02:00
ec23e9f4cd
The catalogue is named or absent, the scanner reads both key orders, the loader has unit tests
jschoubben2026-09-21 19:21:54 +02:00
8c37328ba3
The catalogue is recognised by the registry's manifest, not the control plane's
jschoubben2026-09-21 15:18:46 +02:00
e596758db9
The five beds that read the catalogue read it through the harness
jschoubben2026-09-21 14:33:02 +02:00
2456b2f533
Beds read the catalogue: a shared loader, eight beds converted, the rest declared
jschoubben2026-09-21 14:27:49 +02:00
f2d29491b2
The receipt claims the catalogue the beds read
jschoubben2026-09-21 14:14:54 +02:00
43bf78bd63
Merge pull request 'Beds for the seed file and the foundation's filter; beds deliver secrets as files; a bundle-raised bed derives the anchor's filter' (#40) from feat/migration-blockers into main
jschoubben2026-09-21 13:48:57 +02:00
b0e7cf96d1
The apps bed's mongodb names its secrets' owner, as the catalogue's does, and says what the server said when the consumer cannot reach it
jschoubben2026-09-21 13:43:42 +02:00
e085e31f95
A bed that raises the foundation from the bundle derives the anchor's filter before it relies on the hub
jschoubben2026-09-21 13:30:26 +02:00
af14f1c909
The model-usage bed can be left standing, and its account names the filters
jschoubben2026-09-21 13:18:23 +02:00
ba49f571dc
The model-usage bed says what the machine knows when the login fails
jschoubben2026-09-21 13:12:19 +02:00
67a1f6a012
The harness pins minio from quay.io, as the catalogue does (docker.io denies anonymous pulls)
jschoubben2026-09-21 12:58:35 +02:00
b7316d40fe
The three beds' inline postgres reads its superuser from a file, as the catalogue's does
jschoubben2026-09-21 12:55:35 +02:00
97d71503ee
Three beds deliver the secrets they copy from the catalogue as files (issue 073)
jschoubben2026-09-21 12:32:00 +02:00
599d41eb42
Beds for the seed file and for the foundation's filter
jschoubben2026-09-21 12:11:52 +02:00
7e2e97f056
Merge pull request 'Beds for the vault and for genesis's root secrets' (#39) from feat/secrets-vault into main
jschoubben2026-09-21 10:03:22 +02:00
7fad006e56
A push that said 'told' is a push that sent, whatever became of the exec afterwards
jschoubben2026-09-21 01:47:26 +02:00
fb72db73bc
The vault bed recovers redis's vault-provided secret from the export
jschoubben2026-09-21 00:36:16 +02:00
960fa3607f
The genesis bed waits for the node to settle before asking it anything
jschoubben2026-09-21 00:33:23 +02:00
9da2d01ca0
The genesis bed checks the root secrets: made, sealed to the operator key, recoverable
jschoubben2026-09-21 00:12:55 +02:00
639175ec4a
A bed for the vault: redis's password as a secret it provides, rotated
jschoubben2026-09-20 23:11:58 +02:00
a43e6d2927
Merge pull request 'Land the whole-mesh-novox bed (green) and the minio quay.io fix' (#38) from fix/minio-and-whole-mesh-novox-bed into main
jschoubben2026-09-20 22:08:50 +02:00
6bdf7104c8
whole-mesh-novox: the postgres server container is mesh-store, not postgres
jschoubben2026-09-20 16:34:51 +02:00
0a05fbb434
whole-mesh-novox goes green: the store superuser, the artifact shape, and the missing CA
jschoubben2026-09-20 16:22:24 +02:00
a57eba9de0
build-module-runtime: pull minio mc from quay.io (docker.io denies anonymous pulls)
jschoubben2026-09-20 22:06:26 +02:00
3c3fa04949
Merge pull request 'The bed's 058 claim, base64 dump, and 063 comment made honest (review)' (#36) from bed/honest-058-and-diagnostics into main
jschoubben2026-09-20 13:42:00 +02:00
064a7a0934
The bed's 058 claim, base64 dump, and 063 comment are made honest (review)
jschoubben2026-09-20 13:32:14 +02:00
27665501dc
Merge pull request 'The bed enforces one-push provisioning, a patient runtime, and a broker restart (057/058/063)' (#35) from bed/one-push-and-a-patient-runtime into main
jschoubben2026-09-20 12:53:18 +02:00
68133c2c56
The bed restarts the broker and reconnects across the overlay (issue 063)
jschoubben2026-09-18 02:21:48 +02:00
38a7180b8b
The bed enforces one-push provisioning and a patient runtime (057/058)
jschoubben2026-09-18 02:07:59 +02:00
85c8ad8131
Merge pull request 'The no-fake multi-node gate: built-store-cross-node' (#34) from bed/built-store-cross-node into main
jschoubben2026-09-18 01:00:49 +02:00
cb353f9881
The trust wait dumps mesh-host's log and the declaration on failure
jschoubben2026-09-18 00:15:16 +02:00
ca263d2a8b
The trust lands before anything builds
jschoubben2026-09-17 23:16:26 +02:00
1e510787c1
Merge pull request 'warm refuses a departed instance instead of crashing into it' (#33) from fix/warm-refuses-the-departed into main
jschoubben2026-09-17 23:08:04 +02:00
8374f4dc19
warm refuses a departed instance instead of crashing into it
jschoubben2026-09-17 23:07:50 +02:00
b6d2a0602a
Merge pull request 'The settle check records settling instead of inferring it from the clock' (#32) from fix/settle-check-edge into main
jschoubben2026-09-17 22:54:24 +02:00
832c287ccc
The bed passes the gate under exactOptionalPropertyTypes
jschoubben2026-09-17 22:54:09 +02:00
31969e20e3
The bed rides the typecheck-gated main
jschoubben2026-09-17 22:54:06 +02:00
90e84279f7
Merge pull request 'Every test passes the typecheck gate' (#31) from fix/tests-pass-the-typecheck-gate into main
jschoubben2026-09-17 22:53:53 +02:00
jschoubben