nordisk/holger

Stinky lane 5 — the suite, monetize, and the MVP line

Written 2026-09-20 against holger main 542e296, monetize 84f0a8a, monetize-impl b5ab0e9, gunnar 1d0fd62, znippy/edda/modgunn as checked out. Every finding is tagged MEASURED (ran a command / read the line and it is so today), READ (a doc or comment says so; not re-proven here), or DESIGNED (proposed here, no code). No live machine touched, no credential read, no key value anywhere in this file.

The owner's brief this lane answers, 2026-09-20, near verbatim: holger/gunnar/dwarves/mimir/modgunn can become a suite — standalone first, reuse where it helps; the MVP's LAST feature is holger in the cloud with repo A→B and then holger on-prem with repo C; what does not fit becomes holger Pro; monetize exists as an open-source resource-allocation plugin plus vetra/monetize-impl for the paid part (UpCloud + Stripe); and holger needs a plugin for monetize.

A. THE SUITE — where reuse is real and where it would be a coupling mistake

A.0 Vocabulary, fixed before anything else (LAW)

Two words are spelled "suite" and they are not the same word (workspace_nordisk/nornir-workspace.toml:48-59, MEASURED):

mimir is in the owner's list and NOT in the law's product list. MEASURED: find /home/rickard/git -maxdepth 3 -iname '*mimir*' returns no repo and no crate. Mímir is (a) 11 443 lines of compiled Rust INSIDE nornir — nornir/src/mimir.rs, mimir_analyze.rs, mimir_calibrate.rs, mimir_clones.rs, mimir_subclone.rs, mimir_slices.rs, mimir_dup.rs and 23 lens modules under nornir/src/mimir_lens/, exported at nornir/src/lib.rs:269-299, served by a gRPC service (nornir/Cargo.toml:692 MimirSvcTrait); (b) the 72-table Iceberg warehouse those read (nornir/.nornir/mimir-datastructure-manual.md:5,9,30-41); (c) ~25 design docs under workspace_nordisk/.nornir/mimir-* of which the trust lineage (mimir-agent-trust-lineage-design-2026-07-24.md:5 "No code shipped") and "mimir v2 the purgatorium" (workspace_nordisk/mimir-v2.md, code actually lives in edda/crates/nornir-purgatory) are ideas. Its consumer is dwarves (dwarves/crates/dwarves/Cargo.toml:291 mimir = ["coverage"], GUI at dwarves-gui/Cargo.toml:539).

Honest answer: mimir today is a CAPABILITY OF NORNIR — a subsystem plus an idea, not a product and not a library. If the owner wants it in the suite as a peer, it needs a repo, a crate name, a recipe and a row; today nornir is the product and mimir is what nornir's warehouse knows. This doc treats "mimir" as "nornir's code-intelligence warehouse" everywhere below.

A.1 The dependency graph as it IS (MEASURED, Cargo.toml lines)

No cycle among the seven products. The hub is edda/crates/* + libraries. Nothing depends on holger except dwarves, optionally; holger depends on no sibling PRODUCT except modgunn.

A.2 The standards ARE in the house, and holger's use of them is HALF-TRUE, not none

The brief says "holger uses none of them". MEASURED, it is more nuanced and the nuance is the finding:

The reuse trap nobody has measured: the DSSE/M-of-N API is unreachable from crates.io — local znippy-common 0.9.15 vs published 0.9.13 which lacks sign (holger/Cargo.toml:113 patches it in; znippy-common/Cargo.toml:3-6 calls the result "19 holger crates unpublishable fork riders"). Every "reuse znippy's DSSE" sentence in promote-sync-attest-design.md is therefore a sentence about a PATH dep, which is exactly the shape A.4 forbids for a standalone clone.

The seventh-envelope rule holds today. MEASURED the five bespoke containers: KORPSIG1 (edda/crates/korp-installer/src/rollback.rs:105), holger.update-bundle/v1 (holger/update-bundle/src/schema.rs:4, ed25519 over exact bytes), gunnar-sshsig-v2 (gunnar/crates/gunnar-grpc/src/auth.rs:164), monetize's in-object EntitlementFact.signature (monetize/crates/monetize-product/src/lib.rs:453), Skidbladnir .sig.json (Skidbladnir/src/archive.rs:428). attest.rs:26-40 inventories all five and adds none. The unmerged holger metering branches add a SIXTH VERIFIER of an existing envelope (monetize's, via monetize_embed::signing::verify_fact, holger-wt-metering/server/lib/src/metered.rs:110-112) — that is reuse, not a new envelope, and it is the right shape.

A.3 The reuse audit, pair by pair

Rule the owner set: standalone first. So every row says how the standalone case survives. The house answer is almost always a crate in edda (exists to avoid circular deps, nornir-workspace.toml:18), and almost never product→product.

holger ↔ gunnar — two content-addressed stores with the same organs and ZERO shared code

MEASURED: no Cargo edge either way (A.1). Both have: CAS (gunnar gunnar-store, gunnar-core/src/doc.rs:6; holger attest.rs digest-keyed + promote/mod.rs:576 blake3 blob tree), gates (gunnar gunnar-policy/src/lib.rs:173 trait Gate; holger PolicyGate concrete struct promote/mod.rs:66), attestation (gunnar gunnar-core/src/{provenance,key_attestation,transparency,seal}.rs; holger attest.rs), twin (gunnar gunnar-cli/src/control/twin.rs; holger one-medium holger-recipe/src/packaging.rs:258), metering (gunnar gunnar-core/src/entitlement.rs; holger two unmerged branches, B.4), console (gunnar gunnar-server/src/dashboard*; holger holger-front + holger-ui), a clock (gunnar gunnar-clock peer://; holger none, SystemTime).

holger ↔ dwarves — dwarves builds, holger stores; today it is an env var and a path patch

MEASURED: dwarves/crates/dwarves/src/artifact_store.rs:202 DWARVES_HOLGER_DIR, configured() :214-216 returns None unless feature+env; it links holger-server-lib IN-PROCESS (Cargo.toml:355 "never a twin CAS"). There is no publish verb and no network hop — a forge on dwarf cannot push into a holger on another host; it can only write into a holger directory it can see. The dwarves→holger patch is flagged LOCAL-DEV-ONLY (dwarves/Cargo.toml:23-29).

holger ↔ modgunn — the one real product→product edge, and it is scoped right

MEASURED server/lib/Cargo.toml:137 features = ["scan"]. The verdict is content-addressed by (blob_sha256, policy_version, advisory_db_rev) (READ, promotion-design.md §4). Standalone survives because modgunn 0.0.6 is on crates.io (modgunn/Cargo.toml:3, no publish = false) and version = "0.0" is named beside the path. Stink: holger takes the scanner and refuses the verifier (provenance-verify off) while attest.rs re-implements verification over the same znippy DSSE — one house, two verifiers of one envelope. Either holger turns on provenance-verify and drops its own verify_envelope, or modgunn's verifier moves to edda and both call it.

holger ↔ nornir/skade — nothing today, and the one thing that belongs there is the audit QUERY

⟶ BUILT 2026-09-21 — see .nornir/HOLGER-PLAN.md §4 "the audit query seam — 2026-09-21", which carries the measured can/cannot table for AuditService.Query, the holger.audit.export.v1 layout, the AuditService.ListSegments door, the end-to-end reader proof, and the eight things a lakehouse still cannot ask. The ruling below stands and was implemented as written: holger grew NO query engine and NO edge to skade or nornir — it published the layout and a way to enumerate it, and a reader pulls.

MEASURED: no holger→skade edge; feature-complete-gaps.md:320-325 already rules "a servable who pulled X query belongs in skade". C.4 needs exactly that query. The standalone answer: holger writes Arrow IPC already (audit/arrow_ipc.rs) — skade reads Arrow IPC natively. So the query surface can be holger-audit-query over skade as an ORIGINAL/Pro capability, while MVP's C answer (C.4) needs only a fold over read_dir grouped by ident — no skade, no iceberg, no arrow-59 fork in an airgap binary.

holger ↔ mimir — an idea only

Nothing to share until mimir is a thing (A.0). The one honest link: mimir's vuln_findings are modgunn's, and holger's ScannerGate reads modgunn's advisory feed; if both read one warehouse the verdict is computed once. DESIGNED, far.

A.4 The constraint that kills lazy answers (MEASURED)

• Skidbladnir MUST be used by all nordisk services (law line 15). holger: server/lib/Cargo.toml:208 optional under federation (⇒ full only) + the handler plugin in every tier; service lifecycle holger service {add,…} via Skidbladnir systemd. So MVP's mvp-server links Skidbladnir only through the handler plugin — the service-support half rides nornir-service (edda, :254). Whether that satisfies "MUST be used by all services" is an owner call; it is at least not the federation crate.
• A repo must build from a standalone clone. holger-front was made a 3-dep leaf (holger-front/Cargo.toml:8-13) and the thing published today was holger-errcode 0.1.2 (commit bb2b22e, 2026-09-20 01:52) because holger-front names four error rows that 0.1.1 lacked. ⚠ bb2b22e is not an ancestor of main 542e296 — working tree errcode/Cargo.toml:5 still reads 0.1.1. The registry moved and the trunk did not.
• The same test with the same answer for every "reuse gunnar" proposal: if the shared piece is not on crates.io under a version holger names, it is a path dep, and a path dep is a clone that does not build alone. znippy-common sign fails this test TODAY (A.2). Fixing it is a dwarves crate-release of znippy-common 0.9.15, and it is the precondition for slice 7 of the design.

B. MONETIZE — two halves, and holger's plugin

B.1 The split as it really is (MEASURED)

Correction to the brief's framing: the open half is NOT "a resource-allocation plugin with no money in it". The open half is the whole money engine minus the vendors; the product plugins (products/gunnar, products/holger) are the resource-allocation half and are what a product build links via monetize-embed. What carries no money is the product's open build, policed by open_build_speaks_no_money.rs in gunnar (gunnar/crates/gunnar-server/tests/) and copied to both holger branches. "unlimited" has no spelling in monetize (monetize-server/src/oversell.rs:38); on the open appliance it is the ABSENCE of an Allowance (gunnar/crates/gunnar-lfs/src/allowance.rs:64-65).

The live-charge fact, verified as far as a file lets you: reconcile.rs:84-88 key_mode() distinguishes live/test by key prefix at runtime; the vetra front's key is rk_live_, livemode true (memory, not re-read here). No key value is in either tree; the only key-shaped literal is the fake sk_test_not_a_real_key (stripe/tests.rs:40).

B.2 The gunnar scars, each verified

B.3 What holger already has toward monetize — two branches doing the same thing (MEASURED)

• monetize/products/holger — monetize-product-holger, impl Product for HolgerProduct over a vendored holger.proto. Since 2026-09-18 it answers list_tenants (= AdminService.ListRepositories; a tenant IS a repository, holger has no namespaces) and read_usage (four meters from ListArtifacts + ArchiveInfo), and REFUSES BY NAME read_activity, can_absorb, servable, push_entitlement, metered_door, purge_tenant (products/holger/src/lib.rs:1-60,194-220,595-603). Only ONE meter is BACKED: artifact_bytes (test at :727-730).
• holger branch monetize-doors (/home/rickard/git/holger-wt-one, f0ce959, 2026-09-16 04:07): UsageService.Read + EntitlementService.Set/Get, holger-entitlement.proto, usage.rs + entitlement.rs, 22 files +2355.
• holger branch feat/metering-doors (/home/rickard/git/holger-wt-metering, f6ff7ec, 2026-09-16 03:06, ONE HOUR EARLIER): UsageService.ReadUsage + EntitlementService.Set, holger-metered.proto, metered.rs + metering.rs, 22 files +2326. Carries the sentence the brief quotes: a cap on a meter this server only measures server-wide is "Refused at the sale rather than stored, logged and then ignored" (metered.rs:19, code METERED_CAP_UNPOLICEABLE :250).
• Neither is merged (git merge-base --is-ancestor both → not). main has NO metered feature, no monetize dep, no usage RPC. grep -rn metered server/lib/Cargo.toml = one comment line (:163). The plugin's push_entitlement therefore refuses today for a true reason.
• Both branches agree on the load-bearing decision — MeterScope: artifacts and archive_bytes are per repository; bytes_served, requests, proxy_upstream_hits, repos are SERVER-WIDE Prometheus counters and go out labelled so, never apportioned ("a number that is stable, plausible and wrong").

Stink: two 2 300-line branches with different proto package names and RPC names for the same two doors, four days old, both unmerged, and the design doc that would pick one does not exist. Whichever the owner merges, the other is a git branch -D; the longer both live the more each drifts from main's auth-passkey and front changes (both branches predate b8e13a0).

B.4 DESIGNED — what holger meters, and what it refuses to meter

Rules that follow (DESIGNED, keep the branch's instinct):

1. Sell only what the box can refuse. artifact_bytes and artifacts are the two honest meters. repos is honest but its cap is a boot refusal — sell it only as a plan shape (which repos the fact names), never as a runtime cap. Server-wide meters are Measured (shown, tested, never capped) — METERED_CAP_UNPOLICEABLE at the sale, as the branch does.
2. Airgap = a signed fact with an paid_until, and the box keeps counting. A holger inside a wire cannot phone home, so the plugin cannot pull usage. The fact travels IN with the bundle (holger.update-bundle/v1 already carries payloads + evidence; an EntitlementFact is one more evidence member), and usage travels OUT in the audit segments the courier carries back (ArrowIpcAuditLog::read_dir). Past paid_until the box does what 6b of the design already proposes for expired metadata: read-only, never brick — config field, no default. A meter that cannot be read by the seller for a quarter is still a meter; the invoice is late, not wrong.
3. The open build shows it and tests it. UsageService.Read is mounted in every build (both branches agree); the guard open_build_speaks_no_money.rs proves no plan vocabulary is in the open string table.

B.5 DESIGNED — the holger plugin for monetize, concretely

There are two things that could be called "holger's monetize plugin" and only one of them is holger's:

It must be a native seam, not a wasm plugin — three measured reasons.

1. wasm-plugins is OFF in every tier of both suites (server/lib/Cargo.toml:448-462; wasmtime 27, 17 advisories, 4 sandbox escapes). Holger's plugin ABI (plugin/abi/src/lib.rs:152) is a package handler ABI — format logic over host-owned bytes. It has no host imports for "refuse this put", "read this counter", "verify this signature against this key". Adding them is a new ABI, not a plugin.
2. monetize itself has no dynamic loading anywhere — "no dylib, no wasm, no libloading" (monetize-pay/src/factory.rs:20-22) — and its registration contract is three fields and a function pointer. The gunnar plugin is native. A wasm holger plugin would be the odd one out in its own family.
3. The metered half must be ABSENT from the open build, not disabled — gunnar's rule, adopted by both holger branches. A cargo feature achieves absence; a wasm file present-or-not on disk does not (the host would still carry the vocabulary to load it).

Concrete proposal (patch sketch, DESIGNED):

holger/server/lib/Cargo.toml
  [features] metered = ["dep:monetize-embed", "dep:monetize-product"]   # registry deps, both published
  monetize-embed   = { version = "0.x", optional = true }   # NOT path — standalone clone rule (A.4)
  monetize-product = { version = "0.x", optional = true }

proto/holger.proto               UsageService.Read(repository) -> readings[{meter, value, scope, source}]   # every build
proto/holger-metered.proto       EntitlementService.{Set,Get,List}                                            # package holger.metered.v1, `metered` only

holger-recipe/src/variants.rs    mvp-server-metered = mvp-server row + "metered" feature, SAME argv otherwise (gunnar's metered_twin shape)
                                 holger-appliance-iso stays ONE row (server + twin) — the metered twin is the metered build by construction
xtask installer                  --monetize-pubkey <hex|path>  → boot param korp.env.HOLGER_MONETIZE_PUBKEY; open build refuses the flag BY NAME
server/lib/tests/open_build_speaks_no_money.rs   three guards (clap surface, string table, live output) — already written on both branches

Pick ONE branch (recommendation: feat/metering-doors — its Set order shape→policeable→signature is the one that carries the refusal-at-the-sale, and its proto package is named for the product state not the RPC), rebase it over 542e296, and land it as slice 0 of Pro (C.2) — it is Pro, not MVP, because MVP is the airgap posture and the fact-in-bundle path (B.4 rule 2) is what makes it airgap-safe, and that path is not written on either branch.

C. THE MVP LINE

C.1 What is settled (READ, do not re-argue)

• MVP = holger SLIMMED: mvp-server = ["mini","secure_update"], mini = ["auth-bearer","auth-mtls"]; rows mvp-server, mvp-server-musl, agent, mvp-bundle, mvp-verify, holger-mvp-appliance, holger-installer, holger-appliance-iso (holger-recipe/src/variants.rs:172-287; cargo xtask build --suite MVP --list = 8, re-measured 2026-09-20 in SUITES.md).
• Ruling 2026-09-19, "yes include in holger mvp" (SUITES.md:22): the WHOLE promote→attest→sync→verify chain, gate orchestration included. The argument that orchestration was ORIGINAL-shaped was put and overruled. Recorded.
• Ruling 2026-09-20 (this brief): the LAST MVP feature is holger in the cloud with repo A→B, then holger on-prem with repo C. Everything that does not fit is holger Pro.

C.2 ONE TABLE — every capability → MVP / Pro / neither

MVP's virtue is slimness. A row is MVP only if the last feature (A→B in the cloud, C on-prem receiving B) does not work without it. "Compiled in today" is not an argument — 17 backends and the marketplace are compiled into holger-mvp today and most of them should not be.

Headline: MVP = raw + rust, bearer/mTLS/passkey, RBAC, audit + QUERY, promote into a REAL served B with verifier gates and a VSA, signed repo metadata, bundle import, agent, appliance. Fifteen format backends, the marketplace, federation, OIDC, search, retention, metering, the web console are Pro. Three of MVP's rows are ABSENT today (served B, gate seam, audit query) and one is an open decision.

C.3 THE OPEN TENSION — do not read past this row

MEASURED: build-space/tests/auth_ship_small.rs:86-136 walks the REAL resolved tree (cargo tree -e normal, invoked via Command::new(env!("CARGO")) — a test process, and the one place holger's own law about shelling is bent) and fails if mini, embedded or holger-verify link reqwest/ureq/curl, with the non-vacuous anchor that full MUST. :293 proves the MVP appliance row links the passkey door and no HTTP client. The guard skips silently when cargo is absent (:117) — a cargo-less CI passes it vacuously.

And the last feature says C, on-prem, receives B. There is no holger-remote upstream type (0 hits), and the two ways C can receive are:

Both are coherent. They are different products. (1) is the Secure Update Gateway as sold; (2) is a mirror. The design doc chose (1) in words (§6a.2 "MVP transport is the carried bundle") and (2) in architecture (§5 "sync down, two holgers — the same function"). The brief's own C.4 ruling ("the upstream knows because IT SERVED THE FETCH") presumes (2). This is the owner's decision and this doc does not make it. What it does say: under (2) the egress guard must be rewritten to name tonic's client half explicitly as allowed to one configured peer or it is measuring the wrong thing; under (1) the "what C has" surface is C's audit log carried back, and the cloud UI must say bundled.

C.4 What MVP is MISSING to reach the last feature (MEASURED, each)

1. No holger-remote upstream. repository.rs:281-511 dispatches 21 string kinds; none is a holger. ReplicationService.Replicate is same-process (replication.rs:168). Needed under (2) only; under (1) the courier is the remote.
2. PromotionEngine::fetch has no non-test caller (promote/mod.rs:699; callers at :776…:1437, all #[cfg(test)]). The promoted store is write-only in production. Slice 3 of the design (make Holger::fetch consult it) is the smallest fix; §5's real fix (B is a real backend, the seal becomes a WriteOnce wrapper on put) is the right one.
3. to_repo is sanitized, never resolved (promote/mod.rs:294,537-545; grpc/services.rs:920 uses it only as ACL scope). A promotion into a repository that does not exist SUCCEEDS — the test crafted_to_repo_cannot_escape_prod_root (:812-826) asserts exactly that for "../../../../outside/pwn". Only the optional ladder refuses an undeclared rung (stages.rs:235-243, boot check lib.rs:520+); with no promotion: block "any hop is permitted" (lib.rs:1280). Fix: seal takes &Repository, not &str; the gRPC handler resolves through FastRoutes and answers NOT_FOUND by name.
4. The audit log has NO query surface. trait AuditLog is record + flush (audit/mod.rs:212-218); reads exist only offline (arrow_ipc.rs:299,377,539); proto/holger.proto has no Audit service; no /-/audit route. "What does C have" — under (2) — is AuditEvent{ts_nanos, ident, action: Download, repo, artifact, status, bytes} grouped by ident, filtered status == 200, over read_dir. Under (1) it is the same fold over C's own segments after the courier brings them back. Either way: AuditService.Query(ident?, repo?, action?, since) → rows, ADMIN-gated, MVP. The UI must say sent (a Download row with status 200 and the byte count equal to the artifact's size), never accepted: accepted is C's verify verdict, which the upstream does not have under either option, and the two differ exactly when C refused what B served.
5. The gate seam is a struct (PolicyGate, promote/mod.rs:66,122) — slice 4.
6. attest.rs is unwired to promote — no AttestationService, no AttestationGate — slice 7/8. And its DSSE verify needs znippy-common 0.9.15 published first (A.2) or the MVP clone does not build alone.
7. MVP has no signed time; every expires_at check is SystemTime. Flagged, not blocking (design §6b.4).

C.5 Sequence (DESIGNED — the order that keeps every step landable)

1. Owner rules C.3 (1) or (2). Nothing below changes except step 5.
2. Publish znippy-common 0.9.15 via dwarves crate-release; drop the patch at holger/Cargo.toml:113. (Standalone clone rule.)
3. seal(&Repository, …); promotion into an undeclared repo is NOT_FOUND; flip the :812 test's expectation. (C.4.3)
4. Holger::fetch serves the promoted store (slice 3); then B becomes a real backend with a WriteOnce wrapper (§5). (C.4.2)
5. AuditService.Query over read_dir, grouped by ident. (C.4.4)
6. Under (2): holger-remote backend + rewrite the egress guard to name the one allowed peer client. Under (1): nothing — bundle import writes the audit row; the cloud UI word is bundled.
7. trait Gate lifted to edda/crates/nornir-gate; holger's ScannerGate, DigestGate, PropertyGate, AttestationGate. (slices 4, 7, 8; VSA only)
8. holger.repo-metadata/v1 over update-bundle. (slice 9)
9. Make the 15 non-MVP backends and the marketplace #[cfg]-optional; mvp-server names raw+rust. Measure the binary before and after.
10. Pro slice 0: merge ONE of the two metering branches (B.5).

D. The five worst findings, ranked

1. A promotion to a repository that does not exist succeeds — and a test asserts it (promote/mod.rs:812-826); to_repo is a directory name, not a repository, and the promoted store has no reader outside tests (:699). The product's core verb writes into a side tree nothing serves. MEASURED.
2. The last MVP feature is undefined until C.3 is ruled, and the house's own documents have already taken both sides (design §5 vs §6a.2; the brief's "upstream served the fetch" presumes pull). Building before ruling builds the wrong product with a green egress guard. MEASURED + READ.
3. "What does C have" has no surface: the audit log is write-only over the wire (audit/mod.rs:212), no Audit RPC, no route. Under either C.3 option the answer is a fold nobody has written. MEASURED.
4. Two unmerged 2 300-line branches implement holger's monetize doors twice, one hour apart, different proto packages and RPC names (f0ce959 vs f6ff7ec), and main has neither — so monetize-product-holger refuses push_entitlement for a true reason. MEASURED.
5. The MVP binary is not slim: 17 format backends non-optional and pub mod marketplace unconditional (lib.rs:68) — Azure Marketplace fulfilment compiles into an airgap appliance; and holger refuses modgunn's default-on verifier (scan only) while re-implementing DSSE verification over a znippy-common that crates.io does not have (0.9.13 lacks sign). MEASURED.

Runner-up: holger-errcode 0.1.2 was published today from a commit (bb2b22e) that is not on main; the working tree says 0.1.1. The registry moved and the trunk did not.