novox/hq
7
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request 'To-be 46: an approved settings change is sent at once (issue 641, ADR 0344)' (#346) from design/641-an-approved-setting-is-sent into main

Browse Source
This commit was merged in pull request #346.
This commit is contained in:
mesh-admin
2026-10-13 15:27:03 +00:00
parent 471f99344b 732e8bd4d9
commit 0f5aab10b4
1 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/46-the-conversation-with-the-operator.md
+24 -2
View File
@@ -2,8 +2,9 @@
layer: to-be
status: in-progress
code: [mesh-controller, mesh-tools, mesh-sdk, mesh-catalog]
updated: 2026-10-12
updated: 2026-10-13
decisions:
- "ADR 0344"
- "ADR 0332"
- "ADR 0308"
- "ADR 0286"
@@ -431,11 +432,32 @@ the factors are the router's state.
| approve or reject a waiting retirement set (`retire approve` / `retire reject`) | approve |
| confirm a kept binding moves (`pin`, while `binding-kept` names it) | approve |
| end a stuck plan; send a machine its declaration by hand; reset a bus consumer; retry a healer | approve |
| set or clear a trusted setting an agent proposed (`settings propose`, ADR 0277) — bound to the exact values shown; the push stays a separate act | approve |
| set or clear a trusted setting an agent proposed (`settings propose`, ADR 0277) — bound to the exact values shown; the one Approve also sends it (ADR 0344) | approve |
| silence a condition | acknowledge |
| delete a retired consumer's data, one or by age (`cleanup delete`) | destroy |
| change the operator's identities, the away channel, or a factor's enrolment | destroy |
### An approved settings change takes effect (ADR 0344)
*2026-10-13, issue 641.* Approving a settings proposal is the act that makes it take effect. The
serving controller sets the layer and, in the same act, opens a **settings walk**: every machine
that runs the module and that the layer reaches, the control node last, each sent and its module
judged at the first-node gate before the next. A settings walk sends the layer and no build: every
module on the machine stays at the build it was last sent, so a build held for a person, or waiting
for a first-node gate, stays where it is. A send that would move a running module's data stops the
walk and names the `push --move` that sends it. The walk says its start and end like every walk, so
its end is told as every walk's is. A failure stops the walk and leaves the layer as approved; the
previous layer is in the settings history. The ask says all this before the Approve, and no longer
names a push. A layer set by hand still waits for a push.
A delivered file is not yet an applied one: a module whose program reads its settings only when it
starts applies them itself (a service's `restart-on`, or a tool of its own). Betterbird is such a
module; issue 643 makes it restart Betterbird at a quiet moment.
How it is checked: the controller's tests open the walk on the warrant, send one machine at a time
with every build kept and the module judged, stop before a data move and on a failure without
holding other walks back, and read the ask's words.
### Proofs and tiers
- **P1, a verified sender:** a Telegram tap from the operator's own account, through a holder placed