novox/hq
7
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request 'Fit design 57 to walks with no first-machine gate (ADR 0360, ADR 0362)' (#353) from design/57-adr-0360 into main

Browse Source
This commit was merged in pull request #353.
This commit is contained in:
mesh-admin
2026-10-14 18:15:22 +00:00
parent dcb5d5ce38 bafc7b7d05
commit 21b79a04a2
1 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/57-building-config-and-provisioning.md
+13 -8
View File
@@ -9,6 +9,8 @@ decisions:
- "ADR 0201"
- "ADR 0113"
- "ADR 0158"
- "ADR 0360"
- "ADR 0362"
---
# 57. Building config and provisioning
@@ -47,10 +49,12 @@ points at it.
**What a release costs.** A proof that is run live (dunst on a workstation, a secret reaching its file, a
database consumer connecting) is first seen in the lab rehearsal, and a fault found then holds the
release, not one package. A walk that fails fails every commit it carries (ADR 0276 §3), so a fault on
the release's first node holds all five; when mesh-delivery or a person stops a member, the others are walked
again without it, leaving out every merge that shares its modules (ADR 0299 §1, §2), which in this
release is most of them; the fix is a new merge into the release's branch, and the group is walked again.
release, not one package. A merge's builds go to every machine at once (ADR 0360), so the release has no
first node to hold it: after the pull requests' checks, the lab rehearsal is the only live check before it
reaches every node. A machine that fails to apply it, or whose provisioner reports a module's files failed
(ADR 0362), is named in the walk's end and raises apply-failing, and is fixed forward with a new pull
request into main; one that says nothing within fifteen minutes is named silent and gets its builds from
the backlog walk once it is heard from (ADR 0360 §10).
**Nothing breaks on the way.** ADR 0349 clause 17: each file is filled the old way or the new way, never
both, by the form of its manifest, and the old forms stay accepted until the last module has moved.
@@ -243,11 +247,12 @@ back on drift, removes a module's files and needs when it leaves, fills from cur
comes back. Its first owners are placement (from the declaration) and config (from
`mesh-config_resolved`). **Proof:** the client's test list in ADR 0349, against a real bus.
**P6 (issue 672) — The controller hands a module to the provisioner, and the gate waits for it.** *mesh-controller.
**P6 (issue 672) — The controller hands a module to the provisioner, and the walk waits for it.** *mesh-controller.
Two days.* For a module marked moved, the declaration carries placement, the templates' digest and the
filled-files list, and the controller runs no other filling pass for it; the first-node gate counts the
module healthy only after its node's `prov.applied` for the new build (`gateFacts`). dunst moves first.
**Proof:** composition and gate tests; dunst on the first workstation filled by the client, live.
filled-files list, and the controller runs no other filling pass for it; a walk counts the module applied
on a machine only after the node-engine's report and that node's `prov.applied` for the new build, and a
failed `prov.applied` is a failed apply (ADR 0362). dunst moves first. **Proof:** composition and walk
tests; dunst on the first workstation filled by the client, live.
**P7 (issue 673) — The node-engine stops writing placed files from the declaration.** *`mesh-host`. A day.* For a moved
module the engine writes its filled files only through P2, and removes as an orphan only what the verb