25 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	4e0c57771e	Bound the bodies an answer shows, naming the rest (issue 1126)	2026-10-28 01:09:02 +01:00
jschoubben	b31c4580aa	A candidate answer shows every differing resource, masked; a module folded in the node's own is judged there; the node's own carries its bus membership as it runs it (issue 1126, seed #531) ... novox's answer to seed #531 named 15 resources by id alone, so why each differed was guessed. ModuleDiffers.Bodies keeps every differing resource with both bodies, each value under a key a secret could be in masked (the same, another seal of the same value, another value). The five old-form modules read 'removed' because the agent also lists them by module from the declaration kept before the switch; they are judged inside the node's own. And the node's own lacked bus-membership, which only the controller composes from its store: the membership the node runs is carried, until the grants part hands it sealed.	2026-10-28 01:08:49 +01:00
jschoubben	7359d187db	A stub keeps its module's directories, so the places its own secrets and data name still resolve (issue 1126: novox refused nats's ${dir:mesh-state})	2026-10-28 00:21:45 +01:00
jschoubben	e32d777530	A deleting head's answer compares the controller's compositions with what runs, and is refused only without returning; fold the shadow's tests into TestInput (issue 1126, review of the shadow, round 1)	2026-10-27 23:32:31 +01:00
jschoubben	2fd5ffdd62	A node's answer names every module it cannot compose, a folded module of an old-form build is left to the node as it runs, and no store reached says why (issue 1126, the seed's shadow) ... The seed's shadow answers named the first refusal only (ace: baserow's archive, novox: de-spiegel), so each round showed one more. A build that cannot be read or taken in, and a module the composition refuses, are now each composed as a stub and named. A module folded into the node's own composition whose manifest names a build (de-spiegel, nats, photos, systemd-resolved: haves naming a build-... id) runs a build only the controller holds: it is composed as a stub and its resources are carried as the node runs them.	2026-10-27 23:17:05 +01:00
jschoubben	7a8e9f9706	Wait for a done key whose artifact names no reference, as the controller's take-in does, and hold the fold guard with a row (issue 1126, review round 1)	2026-10-27 21:12:13 +01:00
jschoubben	d7a758894a	Leave a module the node runs inside its own composition to its manifest, as the fold composes it, so taking builds in moves no folded module (issue 1126)	2026-10-27 21:11:20 +01:00
jschoubben	04de3e5da2	Compose a node's own modules from their builds and read what providers elsewhere serve, so a self-composing node hands moved modules and settles served settings as the controller does (issue 1126) ... frombus composed every module from the indexer's raw manifest: no moved module was handed, so the node stood in for own secrets the vault leaves to the provisioner (the seed's refusals on all four nodes), and a provider elsewhere had no config values, so mailu's served domain refused shanks. - takein: the controller's take-in of a done key (artifacts, launchers, the templates archive's texts, Resolve) as one SDK rule; catalogue.Launchers holds the launcher rule buildstep now delegates to. - frombus: each module placed on the composing node, and each kept at another build (Scope.KeptAt, a fingerprint), composes from its built manifest; another node's modules give the keys their served values fill (Reader.Served). - buscompose: Declared.Served and Principal.ServedReads grant every node the read of exactly those keys of mesh-config_resolved. - compose.ArtifactStoreAddress: the store as the node's composition routes to it.	2026-10-27 21:11:20 +01:00
jschoubben	05b6783103	Fold a module no new-form build names into the node's own composition, as the controller does, so a self-composing node keeps the tunnel and the bus (issue 1126) ... mesh-wireguard (built by nobody) and every module a node runs inside its own composition (Node.InOwn, from frombus.InOwn of what it runs) were cut out as skipped: every node's shadow answered differs to the placement seed, and a node composing itself after it would drop their resources. compositions now folds them in place, module taken off, filled paths with them, as mesh-controller's compositionsOf does; a want naming a new-form build still moves one out.	2026-10-27 08:50:26 +01:00
jschoubben	cadd7b1b2f	Ask the vault in a candidate answer only for credentials of modules the node runs, and refuse a stand-in of a running module, so a placement that adds a module is answered as added (issue 1126, ADR 0559 §4)	2026-10-27 02:43:10 +01:00
jschoubben	062c29c3a2	Judge a node's own composition in its candidate answer only where it runs one, as its agent applies it only on a want (issue 1126)	2026-10-27 02:27:04 +01:00
jschoubben	ba398e2460	Answer a placement candidate as ADR 0559 has it: added and removed modules, per-module refusals, both digests of a difference, and a node's read of every candidate key (issue 1126)	2026-10-27 02:19:27 +01:00
jschoubben	82f10c3bc9	Let frombus and the composer compose with a given placement and compare a node's compositions with what it runs, so a placement candidate can be answered and checked (issue 1126)	2026-10-27 02:12:11 +01:00
jschoubben	3968849b1b	Review of L2: the export is a placement file at its version with its modules (S1); a node asks the vault only when a module placed on it declares an own secret, so one with none composes whether or not the vault answers (H8's failure) (issue 1126)	2026-10-26 20:08:32 +01:00
jschoubben	9713c3023a	Placement carries a settings-form module's config values, which mesh-config does not hold, and the export writes them (issue 1126, ADR 0555 §1): the media modules on one node would compose without them	2026-10-26 19:38:37 +01:00
jschoubben	944a35d200	A node's record carries the mesh's own certificate as the machine holds it, and frombus composes with the composing node's (issue 1126, ADR 0555 §3)	2026-10-26 19:23:06 +01:00
jschoubben	7d81e8326f	frombus gives the composing node's core credentials as the vault's boxes sealed to it, from the same own secrets (issue 1126, ADR 0349 §16, ADR 0550 §5)	2026-10-26 19:22:58 +01:00
jschoubben	91413de335	compose names the pair credentials a node's composition reads as consumer and provider, and frombus asks them sealed before it composes (issue 1126, ADR 0550 §5)	2026-10-26 19:18:46 +01:00
jschoubben	dfe3ba9475	frombus exports a node's placement from a composition input, Input's inverse for what a person decides, and the controller's seat declares placement-export (issue 1126, ADR 0555 §6)	2026-10-26 19:11:34 +01:00
jschoubben	f1d7c7377d	frombus reads the composing node's own secrets sealed to it, and node principals may ask the vault's own in their own name (issue 1126, ADR 0550 §5)	2026-10-26 19:03:00 +01:00
jschoubben	b72de2b75a	A node applying what it composed refuses a composition that stands in for anything its input lacks, the bus's user list alone held out (issue 1126, ADR 0547 §2)	2026-10-26 18:59:05 +01:00
jschoubben	2b0689f654	A node's record rides in its own have key, <node>.node: no bucket, writer or grant of its own, and its key's change is what readers hear (issue 1126, ADR 0555 §3)	2026-10-26 18:29:45 +01:00
jschoubben	5b1e990eb4	The tunnel found at adoption and the names of the hub's peers are kept in the placement; whether the hub took it over and who enrolled under a peer's key are read from placement and records, as the controller reads them (issue 1126, ADR 0555)	2026-10-26 18:26:11 +01:00
jschoubben	a431746c0e	What a person decides of a node lives in its placement file and what the machine observes in its record; two nodes on one address or two hubs are refused (issue 1126, K2)	2026-10-26 18:17:59 +01:00
jschoubben	e982072443	frombus fills the composition's input from placement, node records, the indexer's manifests and mesh-config's slice, so one composer serves the node agent, the check and the grants part (issue 1126, ADR 0547 §2, ADR 0549 §3)	2026-10-26 18:06:04 +01:00