543ccb7380
Merge pull request 'Multiple fixes: the vault bed keeps two secrets, the confluence bed asks through the control plane, the runtime build installs its SDK and speaks' (#44) from multiple-fixes into main
jschoubben2026-09-21 21:05:12 +02:00
85dc827660
The confluence bed asks a tool through the control plane, and the tool answers
jschoubben2026-09-21 20:34:03 +02:00
2f11a29c4d
The runtime build installs the module's SDK itself and shows its compiler's output
jschoubben2026-09-21 20:31:47 +02:00
64c081d025
The vault bed installs a consumer that keeps two secrets, and both are delivered and rotated
jschoubben2026-09-21 20:29:49 +02:00
467416728e
Merge pull request 'The run rebuilds the module runtimes its beds stock (075); two mechanism beds read the catalogue's redis (074)' (#43) from feat/mesh-tests-and-runtimes into main
jschoubben2026-09-21 19:36:44 +02:00
e4c924a85e
The grant bed's consumer takes a slug: its derived identity was one character over what a backend keeps
jschoubben2026-09-21 19:32:36 +02:00
1b2443690d
Two mechanism beds install the catalogue's redis with the vault beside it
jschoubben2026-09-21 19:30:34 +02:00
d7959001dd
The run rebuilds the module runtimes its beds stock
jschoubben2026-09-21 19:26:59 +02:00
be58bd96f6
Merge pull request 'Genesis reads the registry's and the builder's manifests from the catalogue, not the control plane's (hq issue 072)' (#42) from feat/one-controller-manifest into main
jschoubben2026-09-21 19:23:56 +02:00
6083b9310a
Genesis reads the registry's and the builder's manifests from the catalogue, not the control plane's
jschoubben2026-09-21 15:19:25 +02:00
c8c3028f38
Merge pull request 'Beds read the catalogue: one loader, eight beds converted, the rest declared (hq issue 073)' (#41) from feat/beds-read-the-catalogue into main
jschoubben2026-09-21 19:23:15 +02:00
ec23e9f4cd
The catalogue is named or absent, the scanner reads both key orders, the loader has unit tests
jschoubben2026-09-21 19:21:54 +02:00
8c37328ba3
The catalogue is recognised by the registry's manifest, not the control plane's
jschoubben2026-09-21 15:18:46 +02:00
e596758db9
The five beds that read the catalogue read it through the harness
jschoubben2026-09-21 14:33:02 +02:00
2456b2f533
Beds read the catalogue: a shared loader, eight beds converted, the rest declared
jschoubben2026-09-21 14:27:49 +02:00
f2d29491b2
The receipt claims the catalogue the beds read
jschoubben2026-09-21 14:14:54 +02:00
43bf78bd63
Merge pull request 'Beds for the seed file and the foundation's filter; beds deliver secrets as files; a bundle-raised bed derives the anchor's filter' (#40) from feat/migration-blockers into main
jschoubben2026-09-21 13:48:57 +02:00
b0e7cf96d1
The apps bed's mongodb names its secrets' owner, as the catalogue's does, and says what the server said when the consumer cannot reach it
jschoubben2026-09-21 13:43:42 +02:00
e085e31f95
A bed that raises the foundation from the bundle derives the anchor's filter before it relies on the hub
jschoubben2026-09-21 13:30:26 +02:00
af14f1c909
The model-usage bed can be left standing, and its account names the filters
jschoubben2026-09-21 13:18:23 +02:00
ba49f571dc
The model-usage bed says what the machine knows when the login fails
jschoubben2026-09-21 13:12:19 +02:00
67a1f6a012
The harness pins minio from quay.io, as the catalogue does (docker.io denies anonymous pulls)
jschoubben2026-09-21 12:58:35 +02:00
b7316d40fe
The three beds' inline postgres reads its superuser from a file, as the catalogue's does
jschoubben2026-09-21 12:55:35 +02:00
97d71503ee
Three beds deliver the secrets they copy from the catalogue as files (issue 073)
jschoubben2026-09-21 12:32:00 +02:00
599d41eb42
Beds for the seed file and for the foundation's filter
jschoubben2026-09-21 12:11:52 +02:00
7e2e97f056
Merge pull request 'Beds for the vault and for genesis's root secrets' (#39) from feat/secrets-vault into main
jschoubben2026-09-21 10:03:22 +02:00
7fad006e56
A push that said 'told' is a push that sent, whatever became of the exec afterwards
jschoubben2026-09-21 01:47:26 +02:00
fb72db73bc
The vault bed recovers redis's vault-provided secret from the export
jschoubben2026-09-21 00:36:16 +02:00
960fa3607f
The genesis bed waits for the node to settle before asking it anything
jschoubben2026-09-21 00:33:23 +02:00
9da2d01ca0
The genesis bed checks the root secrets: made, sealed to the operator key, recoverable
jschoubben2026-09-21 00:12:55 +02:00
639175ec4a
A bed for the vault: redis's password as a secret it provides, rotated
jschoubben2026-09-20 23:11:58 +02:00
a43e6d2927
Merge pull request 'Land the whole-mesh-novox bed (green) and the minio quay.io fix' (#38) from fix/minio-and-whole-mesh-novox-bed into main
jschoubben2026-09-20 22:08:50 +02:00
6bdf7104c8
whole-mesh-novox: the postgres server container is mesh-store, not postgres
jschoubben2026-09-20 16:34:51 +02:00
0a05fbb434
whole-mesh-novox goes green: the store superuser, the artifact shape, and the missing CA
jschoubben2026-09-20 16:22:24 +02:00
a57eba9de0
build-module-runtime: pull minio mc from quay.io (docker.io denies anonymous pulls)
jschoubben2026-09-20 22:06:26 +02:00
3c3fa04949
Merge pull request 'The bed's 058 claim, base64 dump, and 063 comment made honest (review)' (#36) from bed/honest-058-and-diagnostics into main
jschoubben2026-09-20 13:42:00 +02:00
064a7a0934
The bed's 058 claim, base64 dump, and 063 comment are made honest (review)
jschoubben2026-09-20 13:32:14 +02:00
27665501dc
Merge pull request 'The bed enforces one-push provisioning, a patient runtime, and a broker restart (057/058/063)' (#35) from bed/one-push-and-a-patient-runtime into main
jschoubben2026-09-20 12:53:18 +02:00
68133c2c56
The bed restarts the broker and reconnects across the overlay (issue 063)
jschoubben2026-09-18 02:21:48 +02:00
38a7180b8b
The bed enforces one-push provisioning and a patient runtime (057/058)
jschoubben2026-09-18 02:07:59 +02:00
85c8ad8131
Merge pull request 'The no-fake multi-node gate: built-store-cross-node' (#34) from bed/built-store-cross-node into main
jschoubben2026-09-18 01:00:49 +02:00
cb353f9881
The trust wait dumps mesh-host's log and the declaration on failure
jschoubben2026-09-18 00:15:16 +02:00
ca263d2a8b
The trust lands before anything builds
jschoubben2026-09-17 23:16:26 +02:00
1e510787c1
Merge pull request 'warm refuses a departed instance instead of crashing into it' (#33) from fix/warm-refuses-the-departed into main
jschoubben2026-09-17 23:08:04 +02:00
8374f4dc19
warm refuses a departed instance instead of crashing into it
jschoubben2026-09-17 23:07:50 +02:00
b6d2a0602a
Merge pull request 'The settle check records settling instead of inferring it from the clock' (#32) from fix/settle-check-edge into main
jschoubben2026-09-17 22:54:24 +02:00
832c287ccc
The bed passes the gate under exactOptionalPropertyTypes
jschoubben2026-09-17 22:54:09 +02:00
31969e20e3
The bed rides the typecheck-gated main
jschoubben2026-09-17 22:54:06 +02:00
90e84279f7
Merge pull request 'Every test passes the typecheck gate' (#31) from fix/tests-pass-the-typecheck-gate into main
jschoubben2026-09-17 22:53:53 +02:00
494f73369a
Every test passes the typecheck gate
jschoubben2026-09-17 22:53:34 +02:00
27b5f8d092
The bed passes the typecheck gate
jschoubben2026-09-17 22:52:31 +02:00
b77d03a1f8
readFileSync is imported, not assumed
jschoubben2026-09-17 22:48:34 +02:00
48f8fe6168
The settle check records settling instead of inferring it from the clock
jschoubben2026-09-17 22:39:48 +02:00
158fe5c327
Apply the bed review: one buildable consumer, honest gates, tighter plumbing
jschoubben2026-09-17 22:39:49 +02:00
428f13bfae
The settle check records settling instead of inferring it from the clock
jschoubben2026-09-17 22:39:48 +02:00
d3a6dc9784
The bed adopts only what genesis leaves it: the broker
jschoubben2026-09-17 22:23:13 +02:00
bfd70e9e57
The no-fake multi-node bed: two machines, everything built by the mesh itself
jschoubben2026-09-17 22:15:34 +02:00
e3d96d9fa9
Merge pull request 'Remove the inert MESH_SEAL_KEY; cite ADR 0048 correctly' (#30) from cleanup/seal-key-tombstones into main
jschoubben2026-09-17 22:02:45 +02:00
2438883a5f
Remove the inert MESH_SEAL_KEY, and cite the ADR that retired it correctly
jschoubben2026-09-17 22:02:31 +02:00
1e4713c311
Merge pull request 'two-node-db on the one-store model: store cross-node proven end-to-end' (#29) from multi-node/one-store-beds into main
jschoubben2026-09-17 09:54:43 +02:00
0e382f1db7
two-node-db is GREEN on the one-store model — store cross-node proven end-to-end
jschoubben2026-09-17 09:53:35 +02:00
d8540bec42
Convert two-node-db to the one-store model (WIP: blocked on issue 058)
jschoubben2026-09-17 09:00:33 +02:00
a8afe5ce53
Merge pull request 'A two-node bed: a joined node opens the adopted broker over the overlay' (#28) from multi-node/cross-node-bed into main
jschoubben2026-09-17 01:44:53 +02:00
b6bf31d4e6
The cross-node bed is green: push the provider node after adding the remote consumer
jschoubben2026-09-17 01:34:22 +02:00
155800bc9a
A two-node bed: a joined node opening the adopted broker over the overlay (055)
jschoubben2026-09-17 01:01:54 +02:00
03d036cbeb
Merge pull request 'One-node bed: SDK-by-version, rename, and the store/broker upgrade proofs' (#27) from feat/a-bed-that-hands-over-nothing into main
jschoubben2026-09-16 23:25:34 +02:00
440e2653b2
Phase 3.3/3.4: prove the store and broker upgrade in place, through the window
jschoubben2026-09-16 21:51:20 +02:00
70c1545161
Phase 3.2: lavinmq declares no network — it adopts mesh-broker
jschoubben2026-09-16 21:33:16 +02:00
49b80d8516
The one-node bed supervises the host as a service, so reboot is a real check
jschoubben2026-09-16 16:20:44 +02:00
f57e05e75e
The one-node bed places at the site it operates, and tolerates the CP recreating
jschoubben2026-09-16 14:10:26 +02:00
eff91742e8
The bed publishes the SDK before the base build
jschoubben2026-09-16 10:27:37 +02:00
61abeb7f6b
The lab stocks the full catalogue, not the bootstrap three
jschoubben2026-09-16 01:01:19 +02:00
09a22de78f
The lab answers the installer's questions the unattended way
jschoubben2026-09-15 21:57:26 +02:00
e451a9191a
The lab names the modules as the catalogue does
jschoubben2026-09-15 20:51:00 +02:00
fce554d150
A run-once step leaves nothing to ask, and V4 asked anyway
jschoubben2026-09-15 01:35:42 +02:00
1425f5e7d4
Verify every resource kind, not the one I kept looking at
jschoubben2026-09-15 00:46:05 +02:00
3ebf0bb38c
Containers coming back is not the mesh coming back
jschoubben2026-09-14 23:44:24 +02:00
9b8b21ac17
E1 moves the module's source for real
jschoubben2026-09-14 23:36:05 +02:00
475fd9a088
Register the firewall before assigning it
jschoubben2026-09-14 22:52:26 +02:00
f132a4bcbd
The packet filter is a module too, and it was assigned to nothing
jschoubben2026-09-14 22:45:52 +02:00
6b482ee7dc
Assigning networking is not being on the network
jschoubben2026-09-14 22:26:04 +02:00
d0d56782a0
Split describing the mesh from the catalogue holding it
jschoubben2026-09-14 22:17:06 +02:00
3690e17cf4
Ask the catalogue as the only thing that is allowed to
jschoubben2026-09-14 22:08:52 +02:00
572aae2eb4
A plan with codes, stated up front and reported against
jschoubben2026-09-14 22:00:13 +02:00
2f470f27b8
Genesis makes six claims; assert them separately
jschoubben2026-09-14 21:58:58 +02:00
7641bb2059
A one-node mesh, and twelve things that have to be true of it
jschoubben2026-09-14 21:52:24 +02:00
9146f30859
Name the container, and issue the account
jschoubben2026-09-14 21:20:57 +02:00
c3d5ec1d55
Build each repository from its own ref, and build the provider
jschoubben2026-09-14 21:05:28 +02:00
f04911a763
Give the module the broker it asks for, rather than a module that asks for nothing
jschoubben2026-09-14 20:56:35 +02:00
4ef0a19053
A manifest the control plane can open, and stop swallowing the failure when it cannot
jschoubben2026-09-14 20:46:11 +02:00
babf08b9f8
Raise machines that are somebody, and a bed that hands over nothing
jschoubben2026-09-14 20:41:55 +02:00
7fa1f1f0bb
Merge pull request 'One archive per machine, not one per image' (#26) from fix/the-lab-ships-runtimes-not-toolchains into main
jschoubben2026-09-14 19:58:20 +02:00
5d1f7762c2
One archive per machine, not one per image
jschoubben2026-09-14 19:58:01 +02:00
8fca04f560
Merge pull request 'Configure the resolver rather than fight it' (#25) from fix/configure-the-resolver-rather-than-fight-it into main
jschoubben2026-09-14 18:45:58 +02:00
fa5e5cb912
Configure the resolver rather than fight it
jschoubben2026-09-14 18:45:40 +02:00
eed5647146
Merge pull request 'One dropped lookup should not cost a two-hour run' (#24) from fix/one-dropped-lookup-should-not-cost-a-run into main
jschoubben2026-09-14 18:23:49 +02:00
ea0a7f7e64
One dropped lookup should not cost a two-hour run
jschoubben2026-09-14 18:23:25 +02:00
jschoubben