Multiple fixes: six beds retired (074), the certificate bed against Pebble and step-ca (020), a coupled-pair spike (066) #45

2026-09-21T20:13:11Z

jschoubben commented

2026-09-21 20:13:11 +00:00

074 — six beds retired with their scenarios: the four sidecar beds (grafana, plex, sonarr, redis) and the minio and postgres grant beds duplicated coverage the catalogue beds, the whole-mesh beds, the grant bed and the vault bed now give against the catalogue. Two stay declared (route-forwarding, the large mesh test).
020 — the certificate bed orders the same certificate from a second authority, the catalogue's step-ca, through the same proxy and challenge path. Two bed defects were the symptom all along: its netcat backend never listened (replaced by a real small server), and its check read the certificate's subject, which Pebble leaves empty (now the alternative names). Green 3/3: Pebble issues, step-ca issues, nothing is ordered for an unrouted name.
066 — a spike bed: a config file, a run-once validator, a service that restarts on the file. A refused file reaches the disk and nothing else; the service never serves it; the push reports failed. Green; the observation is the evidence the issue asked for.

Unit tests 159/159. hq MR on the same branch name.

- **074** — six beds retired with their scenarios: the four sidecar beds (grafana, plex, sonarr, redis) and the minio and postgres grant beds duplicated coverage the catalogue beds, the whole-mesh beds, the grant bed and the vault bed now give against the catalogue. Two stay declared (route-forwarding, the large mesh test). - **020** — the certificate bed orders the same certificate from a second authority, the catalogue's step-ca, through the same proxy and challenge path. Two bed defects were the symptom all along: its netcat backend never listened (replaced by a real small server), and its check read the certificate's subject, which Pebble leaves empty (now the alternative names). Green 3/3: Pebble issues, step-ca issues, nothing is ordered for an unrouted name. - **066** — a spike bed: a config file, a run-once validator, a service that restarts on the file. A refused file reaches the disk and nothing else; the service never serves it; the push reports failed. Green; the observation is the evidence the issue asked for. Unit tests 159/159. hq MR on the same branch name.

jschoubben added 7 commits 2026-09-21 20:13:11 +00:00

Six beds retired: their coverage lives in the catalogue beds and the whole-mesh beds now 26177d81be

The four sidecar beds (grafana, plex, sonarr, redis) proved a sidecar comes up and
serves tools with the module's server cut away; the catalogue beds and the whole-mesh
beds prove the modules whole. The minio and postgres grant beds proved a grant
mechanism with a second store beside the foundation's; the grant bed and the vault bed
prove it against the catalogue. Ten conversions become six deletions (novox/hq
04-ISSUES/074).

The certificate bed orders the same certificate from a second authority, the catalogue's own ab5b0d11da

Issue 020 could not tell a Pebble interop detail from a fault of the proxy's. The
bed now raises step-ca as the catalogue pins it and orders again through the same
proxy and the same challenge path (novox/hq 04-ISSUES/020).

A spike for issue 066: a coupled pair half-applied, and what the machine is observed doing 8a3e7dbd1b

A config file, a run-once gate that validates it, and a service that reads it once at
start. The second push changes the file and makes the gate refuse it: the file is
applied, the gate fails, the service stays — v2 on disk, v1 served, the push
reported failed. Evidence for the decision 066 asks for, not a rule enforced.

The second-authority test stops the proxy by name, not by a pattern its own shell matches 38672cd356

The second-authority test stops the proxy by its anchored path: the process name is truncated in the table b6be7ac8af

The certificate bed's backend is a real server: its netcat loop never listened 2bc1230252

Every request through the proxy was refused by the backend, which read as the
certificate never arriving and hid behind the authority's refusal — until the second
authority issued one and the request behind the handshake still failed.

The certificate bed reads the names a certificate is for from its alternative names 69d3813ae1

Pebble, like the public authority it stands in for, leaves the subject empty; the
bed read the subject and refused a valid certificate.

jschoubben merged commit 31163865d2 into main

2026-09-21 20:13:20 +00:00

jschoubben deleted branch multiple-fixes

2026-09-21 20:13:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-lab#45