From c957fcc6d751ad25c5a5aa960cd69bf634970d05 Mon Sep 17 00:00:00 2001 From: mesh-admin Date: Wed, 14 Oct 2026 18:09:02 +0000 Subject: [PATCH 1/3] Fit design 57 to walks with no first-machine gate ADR 0360 sends a merge's builds to every machine at once, so release 57 has no first node to hold it and P6 can no longer wait at a gate. ADR 0362 moves the wait for the provisioner to the walk's end. Co-Authored-By: Claude Opus 5.5 --- .../57-building-config-and-provisioning.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/03-DESIGN/01-to-be/57-building-config-and-provisioning.md b/03-DESIGN/01-to-be/57-building-config-and-provisioning.md index 5872d227..6fabd6af 100644 --- a/03-DESIGN/01-to-be/57-building-config-and-provisioning.md +++ b/03-DESIGN/01-to-be/57-building-config-and-provisioning.md @@ -9,6 +9,7 @@ decisions: - "ADR 0201" - "ADR 0113" - "ADR 0158" + - "ADR 0362" --- # 57. Building config and provisioning @@ -47,10 +48,10 @@ points at it. **What a release costs.** A proof that is run live (dunst on a workstation, a secret reaching its file, a database consumer connecting) is first seen in the lab rehearsal, and a fault found then holds the -release, not one package. A walk that fails fails every commit it carries (ADR 0276 §3), so a fault on -the release's first node holds all five; when mesh-delivery or a person stops a member, the others are walked -again without it, leaving out every merge that shares its modules (ADR 0299 §1, §2), which in this -release is most of them; the fix is a new merge into the release's branch, and the group is walked again. +release, not one package. A merge's builds go to every machine at once (ADR 0360), so the release has no +first node to hold it: the lab rehearsal is the only check before it reaches every node. A machine that +fails to apply it, or whose provisioner reports a module's files failed (ADR 0362), is named in the walk's +end and raises apply-failing, and is fixed forward with a new merge into the release's branches. **Nothing breaks on the way.** ADR 0349 clause 17: each file is filled the old way or the new way, never both, by the form of its manifest, and the old forms stay accepted until the last module has moved. @@ -243,11 +244,12 @@ back on drift, removes a module's files and needs when it leaves, fills from cur comes back. Its first owners are placement (from the declaration) and config (from `mesh-config_resolved`). **Proof:** the client's test list in ADR 0349, against a real bus. -**P6 (issue 672) — The controller hands a module to the provisioner, and the gate waits for it.** *mesh-controller. +**P6 (issue 672) — The controller hands a module to the provisioner, and the walk waits for it.** *mesh-controller. Two days.* For a module marked moved, the declaration carries placement, the templates' digest and the -filled-files list, and the controller runs no other filling pass for it; the first-node gate counts the -module healthy only after its node's `prov.applied` for the new build (`gateFacts`). dunst moves first. -**Proof:** composition and gate tests; dunst on the first workstation filled by the client, live. +filled-files list, and the controller runs no other filling pass for it; a walk counts the module applied +on a machine only after the node-engine's report and that node's `prov.applied` for the new build, and a +failed `prov.applied` is a failed apply (ADR 0362). dunst moves first. **Proof:** composition and walk +tests; dunst on the first workstation filled by the client, live. **P7 (issue 673) — The node-engine stops writing placed files from the declaration.** *`mesh-host`. A day.* For a moved module the engine writes its filled files only through P2, and removes as an orphan only what the verb From 5e493934a58361309b4c7349117a1fa81dfadea3 Mon Sep 17 00:00:00 2001 From: mesh-admin Date: Wed, 14 Oct 2026 18:11:52 +0000 Subject: [PATCH 2/3] Say the rehearsal is the only live check, and that a fix goes into main The pull requests' checks still run before the walk, and by then the release's branches have reached main. Name the silent machine too, and list ADR 0360, which the passages rest on (review comment 12348). Co-Authored-By: Claude Opus 5.5 --- 03-DESIGN/01-to-be/57-building-config-and-provisioning.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/03-DESIGN/01-to-be/57-building-config-and-provisioning.md b/03-DESIGN/01-to-be/57-building-config-and-provisioning.md index 6fabd6af..b94668da 100644 --- a/03-DESIGN/01-to-be/57-building-config-and-provisioning.md +++ b/03-DESIGN/01-to-be/57-building-config-and-provisioning.md @@ -9,6 +9,7 @@ decisions: - "ADR 0201" - "ADR 0113" - "ADR 0158" + - "ADR 0360" - "ADR 0362" --- @@ -49,9 +50,10 @@ points at it. **What a release costs.** A proof that is run live (dunst on a workstation, a secret reaching its file, a database consumer connecting) is first seen in the lab rehearsal, and a fault found then holds the release, not one package. A merge's builds go to every machine at once (ADR 0360), so the release has no -first node to hold it: the lab rehearsal is the only check before it reaches every node. A machine that -fails to apply it, or whose provisioner reports a module's files failed (ADR 0362), is named in the walk's -end and raises apply-failing, and is fixed forward with a new merge into the release's branches. +first node to hold it: after the pull requests' checks, the lab rehearsal is the only live check before it +reaches every node. A machine that fails to apply it, or whose provisioner reports a module's files failed +(ADR 0362), is named in the walk's end and raises apply-failing, and one that says nothing within fifteen +minutes is named silent; either is fixed forward with a new pull request into main. **Nothing breaks on the way.** ADR 0349 clause 17: each file is filled the old way or the new way, never both, by the form of its manifest, and the old forms stay accepted until the last module has moved. From bafc7b7d05ddd2a31f02ca096c5f10a105880c61 Mon Sep 17 00:00:00 2001 From: mesh-admin Date: Wed, 14 Oct 2026 18:12:52 +0000 Subject: [PATCH 3/3] A silent machine is caught up by the backlog walk, not fixed forward A machine that says nothing is often asleep; its builds wait for the backlog walk (ADR 0360 clause 10), so no new pull request is needed. Co-Authored-By: Claude Opus 5.5 --- 03-DESIGN/01-to-be/57-building-config-and-provisioning.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/03-DESIGN/01-to-be/57-building-config-and-provisioning.md b/03-DESIGN/01-to-be/57-building-config-and-provisioning.md index b94668da..92365906 100644 --- a/03-DESIGN/01-to-be/57-building-config-and-provisioning.md +++ b/03-DESIGN/01-to-be/57-building-config-and-provisioning.md @@ -52,8 +52,9 @@ database consumer connecting) is first seen in the lab rehearsal, and a fault fo release, not one package. A merge's builds go to every machine at once (ADR 0360), so the release has no first node to hold it: after the pull requests' checks, the lab rehearsal is the only live check before it reaches every node. A machine that fails to apply it, or whose provisioner reports a module's files failed -(ADR 0362), is named in the walk's end and raises apply-failing, and one that says nothing within fifteen -minutes is named silent; either is fixed forward with a new pull request into main. +(ADR 0362), is named in the walk's end and raises apply-failing, and is fixed forward with a new pull +request into main; one that says nothing within fifteen minutes is named silent and gets its builds from +the backlog walk once it is heard from (ADR 0360 §10). **Nothing breaks on the way.** ADR 0349 clause 17: each file is filled the old way or the new way, never both, by the form of its manifest, and the old forms stay accepted until the last module has moved.