Land the whole-mesh-novox bed (green) and the minio quay.io fix #38

2026-09-20T20:08:44Z

jschoubben commented

2026-09-20 20:08:44 +00:00

Two clean, current pieces of lab work, consolidated:

whole-mesh-novox bed goes green — the store superuser delivery, the artifact→image shape, the missing CA, and the postgres server container being mesh-store (not postgres). Based on today's main (0 commits behind), touches only test/integration/whole-mesh-novox.test.ts. Proven green in the lab earlier today.
minio mc from quay.io — build-module-runtime.sh copied mc from docker.io/minio/mc, which now denies anonymous pulls; quay.io serves it. Pairs with the mesh-catalog minio image fix (PR #29).

tsc -p tsconfig.test.json passes.

Deliberately not included (kept as branches for a focused pass, not dropped):

feat/catalogue-broad — its own commit says "not merged to main until a multi-node scenario exists" (the breadth bed can't pass on one node by design). Preserved.
feat/novox-conversions-validation — superseded: main's whole-mesh-novox.yml already carries the converted novox set.
wip/whole-mesh-one-store-rewrite-path — the parked rewrite path.

https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

Two clean, current pieces of lab work, consolidated: - **`whole-mesh-novox` bed goes green** — the store superuser delivery, the artifact→image shape, the missing CA, and the postgres server container being `mesh-store` (not `postgres`). Based on today's main (0 commits behind), touches only `test/integration/whole-mesh-novox.test.ts`. Proven green in the lab earlier today. - **minio `mc` from quay.io** — `build-module-runtime.sh` copied `mc` from `docker.io/minio/mc`, which now denies anonymous pulls; quay.io serves it. Pairs with the mesh-catalog minio image fix (PR #29). `tsc -p tsconfig.test.json` passes. **Deliberately not included** (kept as branches for a focused pass, not dropped): - `feat/catalogue-broad` — its own commit says *"not merged to main until a multi-node scenario exists"* (the breadth bed can't pass on one node by design). Preserved. - `feat/novox-conversions-validation` — superseded: main's `whole-mesh-novox.yml` already carries the converted novox set. - `wip/whole-mesh-one-store-rewrite-path` — the parked rewrite path. https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

jschoubben added 3 commits 2026-09-20 20:08:44 +00:00

build-module-runtime: pull minio mc from quay.io (docker.io denies anonymous pulls) a57eba9de0

whole-mesh-novox goes green: the store superuser, the artifact shape, and the missing CA 0a05fbb434

The bed had never resolved, then never converged. Fixed, in order:
- loadManifest maps a runtime container's 060 `artifact` to the stocked
  mesh-runtime-<module> image (keyed on the module name), so the push is
  no longer refused by built() — and drops the build section.
- Stale identities renamed: registry->distribution, firewall->nftables.
- step-ca added to the set: the web modules hard-require `route`,
  route-proxy provides it but requires `acme-ca`, and nothing provided
  that — so the whole web stack never resolved. step-ca is the missing CA.
- THE STORE SUPERUSER is delivered via `secret accept` before the push.
  postgres raises mesh-store with POSTGRES_PASSWORD=bootstrap, but
  `module add` minted a random superuser own-secret that did not match,
  so the provisioner could not log in and created NO consumer roles —
  every DB consumer (gitea/keycloak/nextcloud/umami/mailu) failed. This
  was the real cause behind what looked like per-module gaps; keycloak
  and umami converge once it is delivered (ADR 0078, hq phase3).
- mesh() retries through the controller recreating itself during the
  057 cascade (No such exec instance), so a real success is not read as
  a failed push.
- invoicing dropped (private-registry images the lab cannot pull).

Remaining KNOWN_GAPS are genuine catalog/upstream/resource gaps: minio
(stale Docker Hub digest), mssql (Error 945, memory), mailu (config
env), photos (alpine placeholder), nftables (service).

whole-mesh-novox: the postgres server container is mesh-store, not postgres 6bdf7104c8

The CORE convergence wait hung on a container named 'postgres' that
never exists — the postgres module's server is the adopted-store
container 'mesh-store' (like lavinmq's mesh-broker). Everything else
converged; this was the last phantom-name blocker.

jschoubben merged commit a43e6d2927 into main

2026-09-20 20:08:51 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-lab#38