Adoption bed: a machine in use raised adopted, held, taken and converged (hq ADR 0100–0103) #51

2026-09-22T17:28:27Z

jschoubben commented

2026-09-22 17:28:27 +00:00

This adds test/integration/adoption.test.ts and scenarios/adoption.yml. It also extends the genesis helper with adopted genesis, given ports and expected refusals.

Setup. The bed prepares a machine the way a predecessor leaves one:

ufw denying incoming and routed traffic, with the ufw-docker pattern;
a service container and its file;
a stand-in writer that keeps changing that file;
a container holding the registry's port.

Checks. It then walks ADR 0100's "How it is checked" in order:

genesis refusals, and the adopted foundation on a given port;
nothing that serves changes;
the store unreachable from outside, before and after a firewall reload;
a second machine joining through the found firewall, after a reload and after a reboot;
assigning prepares, the stand-in writer is caught, and taking cuts over;
the converge preview, the flip, and returning to adopted.

Result. Run 2 passed 18 of 19 checks against mesh-host 60bb3d8, mesh-controller 65187d4 and mesh-catalog 84012fa. The one failure, B4, tested the found firewall's inbound policy rather than the guard. The probe now admits the container interface for itself alone. That form was verified by hand on the kept machine, but not yet in a full run.

This adds `test/integration/adoption.test.ts` and `scenarios/adoption.yml`. It also extends the genesis helper with adopted genesis, given ports and expected refusals. **Setup.** The bed prepares a machine the way a predecessor leaves one: - ufw denying incoming and routed traffic, with the ufw-docker pattern; - a service container and its file; - a stand-in writer that keeps changing that file; - a container holding the registry's port. **Checks.** It then walks ADR 0100's "How it is checked" in order: - genesis refusals, and the adopted foundation on a given port; - nothing that serves changes; - the store unreachable from outside, before and after a firewall reload; - a second machine joining through the found firewall, after a reload and after a reboot; - assigning prepares, the stand-in writer is caught, and taking cuts over; - the converge preview, the flip, and returning to adopted. **Result.** Run 2 passed 18 of 19 checks against mesh-host 60bb3d8, mesh-controller 65187d4 and mesh-catalog 84012fa. The one failure, B4, tested the found firewall's inbound policy rather than the guard. The probe now admits the container interface for itself alone. That form was verified by hand on the kept machine, but not yet in a full run.

jschoubben added 3 commits 2026-09-22 17:28:27 +00:00

Adoption bed (in progress): a machine in use raised adopted, held, opened through its firewall, taken and converged (hq ADR 0100-0103) a53dc8c586

Adoption bed: an opening the operator's own rule answers is satisfied, and a failed container probe records its evidence 3f224c2876

Adoption bed: the container probe asks the guard's promise, admitting the container interface through the found firewall for itself alone 8d9e4bdb77

jschoubben added 2 commits 2026-09-22 18:07:18 +00:00

Adoption bed: prove the guard rather than the found firewall, the runtime's own settings and a container with no restart policy, a held file not reverted once its writer stops, and the operator's rule outliving the mesh's opening 204a226e36

Adoption bed: the machine the predecessor leaves also runs a container with no restart policy 23ca9cadad

jschoubben added 1 commit 2026-09-22 19:02:08 +00:00

Adoption bed: the anchor keeps its host service, so a machine that reboots comes back holding itself; only the fresh-machine dry run goes without d93dc2628f

jschoubben merged commit 08e3aa04e7 into main

2026-09-22 19:02:12 +00:00

jschoubben deleted branch feat/adoption-mode