Beds for the seed file and the foundation's filter; beds deliver secrets as files; a bundle-raised bed derives the anchor's filter #40

2026-09-21T11:48:33Z

jschoubben commented

2026-09-21 11:48:33 +00:00

Part of the migration-blockers feature (novox/hq ADRs 0087 and 0088; issues 031, 035, 054, 041, 073).

Vault bed: a seed file survives a re-push (create-once).
Genesis bed: probes the machine from outside for the length of the install (the store's port never answers, the bus's does); settles after genesis; tolerates a push that is merely told.
The three beds that copy catalogue manifests deliver their secrets as files, as the catalogue does (issue 073), and the harness pins minio from quay.io.
A bed that raises the foundation from the bundle and places an overlay hub on the anchor now derives the anchor's filter first (deriveTheFilterOn in the harness): the base ruleset closes the hub's port until the filter module is assigned, which genesis does and these beds did not. Applied to assigned-model-usage, lavinmq-bed and whole-mesh-ace; the last two were changed by the same pattern and not run.
The model-usage and apps beds print a failure-time account and can be left standing.

Green on this branch: genesis bed, vault bed, assigned-model-usage, assigned-catalogue-small, assigned-catalogue-apps. Merge order: mesh-controller → mesh-catalog → mesh-host → this → hq.

Part of the migration-blockers feature (novox/hq ADRs 0087 and 0088; issues 031, 035, 054, 041, 073). - Vault bed: a seed file survives a re-push (create-once). - Genesis bed: probes the machine from outside for the length of the install (the store's port never answers, the bus's does); settles after genesis; tolerates a push that is merely told. - The three beds that copy catalogue manifests deliver their secrets as files, as the catalogue does (issue 073), and the harness pins minio from quay.io. - A bed that raises the foundation from the bundle and places an overlay hub on the anchor now derives the anchor's filter first (`deriveTheFilterOn` in the harness): the base ruleset closes the hub's port until the filter module is assigned, which genesis does and these beds did not. Applied to assigned-model-usage, lavinmq-bed and whole-mesh-ace; the last two were changed by the same pattern and not run. - The model-usage and apps beds print a failure-time account and can be left standing. Green on this branch: genesis bed, vault bed, assigned-model-usage, assigned-catalogue-small, assigned-catalogue-apps. Merge order: mesh-controller → mesh-catalog → mesh-host → this → hq.

jschoubben added 8 commits 2026-09-21 11:48:34 +00:00

Beds for the seed file and for the foundation's filter 599d41eb42

The vault bed grows into a create-once file and pushes again; the genesis bed
probes the machine from the workstation for the whole install and asserts the
store's port never answers while the bus's does.

Three beds deliver the secrets they copy from the catalogue as files (issue 073) 97d71503ee

The three beds' inline postgres reads its superuser from a file, as the catalogue's does b7316d40fe

The harness pins minio from quay.io, as the catalogue does (docker.io denies anonymous pulls) 67a1f6a012

The model-usage bed says what the machine knows when the login fails ba49f571dc

The model-usage bed can be left standing, and its account names the filters af14f1c909

A bed that raises the foundation from the bundle derives the anchor's filter before it relies on the hub e085e31f95

The base ruleset (ADR 0088) admits ssh, the bus and the registry and nothing else until the mesh
derives one, and the mesh derives one only where the filter module is assigned — which genesis
does and these beds did not. Without it the hub's WireGuard port stayed closed, no joined node's
tunnel formed, and every module dialling the anchor by its overlay name timed out fetching the
broker's certificate; the model-usage bed showed it as a login that failed for a role never made.

The apps bed's mongodb names its secrets' owner, as the catalogue's does, and says what the server said when the consumer cannot reach it b0e7cf96d1

jschoubben merged commit 43bf78bd63 into main

2026-09-21 11:48:59 +00:00

jschoubben deleted branch feat/migration-blockers

2026-09-21 11:48:59 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-lab#40