From 38020bee9a0c4370e60365807799c07fd44fb11d Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 21 Oct 2026 22:44:29 +0200 Subject: [PATCH] Name the accepted decisions 0480 to 0493 in design 47 and state in its prose what they changed, so the design matches what holds --- .../47-delivery-from-commit-to-delivered.md | 34 +++++++++++++++---- 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 100dfe00..24f1fe37 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -4,6 +4,16 @@ status: in-progress code: [mesh-controller, mesh-catalog modules/mesh-delivery, mesh-delivery, mesh-host, mesh-sdk] updated: 2026-10-21 decisions: + - "ADR 0493" + - "ADR 0491" + - "ADR 0488" + - "ADR 0487" + - "ADR 0486" + - "ADR 0485" + - "ADR 0484" + - "ADR 0483" + - "ADR 0482" + - "ADR 0480" - "ADR 0478" - "ADR 0477" - "ADR 0469" @@ -72,6 +82,8 @@ group merged in one pass on the operator's one Approve and delivered by one deli delivery). A design's milestones are features delivered one after another. The trunk is what runs; there is no "release branch"** (ADR 0401, ADR 0418 §1, ADR 0421 §2). +**From the delivery of issues 1781 to 1783, a milestone is a record of the issue tracker and the unit that is released.** Its issues are linked to it, and pull requests and commits to the issues, by the issue tracker's link verb, never matched from a description; a review is recorded by a verb of the delivery seat; the mesh builds and checks each pull request as it comes in, and asks the operator once to release the milestone when every issue is ready; its pull requests are the delivery group, in whatever repositories and on whatever branches, and nothing ships outside a released milestone (ADR 0493 §1 to §11). Until that delivery the branch-name rules in this design stay what runs, kept by hand (ADR 0493 §12). A change across any repositories, the mesh-sdk included, is one group whose developer orders no release (ADR 0482 §1). + **Every step starts on an event, and the state lives on the bus.** The forge's events, the controller's events and the nodes' reports move a delivery; the bus's own rules keep the queues, the merge window and the order of a plan's tiers, which only the module graph gives (ADR 0419); and one chain, from module to commit to build to rollout to assignment, is kept in the bus's @@ -97,10 +109,10 @@ source revision is derived from the keys: every **want** equals its module's **f - **The indexer** computes each module's fingerprint at the merge preview and writes the candidates of each group and the modules of the trunk. - **The builder** claims a build by creating its key, once per fingerprint, and builds it; the builder is made in R4c from - build-agent's code, and build-agent builds the builder's own module beside it until R4g, then leaves (ADR 0453 clause 5). + build-agent's code, and build-agent builds the builder's own module beside it until R4g, then leaves (ADR 0453 clause 5). The builder builds only on nodes given a capacity above zero, which two nodes have at first; a capacity of 0 means never chosen (ADR 0478 §3, ADR 0485). - **The checker** runs the merge check on built artifacts: a change's tests, through the build module of each module's language and by that language's convention, running only the packages whose inputs changed and - taking the kept verdict of the rest; it writes the change's one status (ADR 0444, ADR 0445, ADR 0447). + taking the kept verdict of the rest; it writes the change's one status (ADR 0444, ADR 0445, ADR 0447); it runs dark in R4c-5 (ADR 0484). - **The gate** merges a group's pull requests once check, review and the operator's Approve agree on the same heads, and then moves the mesh's source revision in one write. - **The teller** carries conditions and asks to the operator's phone and is the only writer of an ask's answer. @@ -112,7 +124,9 @@ source revision is derived from the keys: every **want** equals its module's **f grants, with the composition it sends with (ADR 0446). Its module is made in R4c for that check alone; its wants come in release 5. - **The node agent**, the node-engine's own process, applies its wants one module at a time, backs up a data - module first, and writes its haves. + module first, and writes its haves. A node's declaration is not bounded by one bus message: a file over 64 KiB + travels by digest in the bus's object store, in a bucket of that node's own that no other node can read, and a + condition warns before the limit (ADR 0486, ADR 0488). - **The watchman** turns the bus's connections into presence and mirrors every key whose next move a machine owes into a **pulse**, whose expiry is a stall. - **The status view** is the operator's command `mesh-delivery-cli` and a web view; it reads every bucket and @@ -290,6 +304,9 @@ commit on the SDK's trunk or the head of an SDK pull request the forge holds, op on the merge path, is published on the second stream; a request left behind on the third for a head and trunk commit already judged or running is acknowledged and dropped when taken, by reading the pull request's key. Nothing pauses the worker or deletes and republishes a request (issue 558). +- **A delivery builds first.** While a delivery builds, the build seat takes no new check or try, so an Approve ask + may come later; a check already running finishes, and the oldest waiting check that has waited 30 minutes + runs next, one at a time (ADR 0483, which changes ADR 0406 §3). - **A running check stops itself.** It watches its pull request's key and stops when the head or the trunk commit in it moves, without asking the forge (issue 726). An ended check delivers no verdict, so none of its builds is reused. @@ -343,7 +360,7 @@ From its delivery, a check is this: check. For a member of a delivery group it is the group's one verdict, the same on every member's head: every member's tests, read beside the others' heads, and one composition of all members' changes. It replaces `mesh/merge-gate` and `mesh/repo-check`; the forge requires it and the gate reads it from R4f, the delivery in which - the checker's line is the only one (ADR 0447 §5); the checker writes it unrequired from R4c (ADR 0453 clause 4). `mesh/delivery-group` stays the delivery's view, not a required check. Wherever + the checker's line is the only one (ADR 0447 §5); the checker writes it unrequired from R4c (ADR 0453 clause 4). ADR 0484 builds the dark half, the verdict, its line and its status, in R4c-5, in two deliveries, the shared library first and then one group with the checker and the build modules: the checker records the status as an act it owes in its own bucket and the forge bridge, the only part that calls the forge, performs it; the checker judges the head merged onto the trunk, for pull requests into the trunk named main only and for hq none, and until the isolated run step exists (issue 1309) it runs a change's code without the sandbox, as today's checks do (ADR 0484 §1 to §3, §5, §8, §11). `mesh/delivery-group` stays the delivery's view, not a required check. Wherever this design says both checks passed, they read this one status. - **What the status says.** Its line says the verdict, the tests run and kept at each level, the machines composed, and how long each part took: waiting in the queue, cloning, the unit level, the integration level's @@ -395,10 +412,14 @@ From its delivery, a check is this: verdict that names a trunk commit the trunk had already left raises no ask: mesh-delivery asks that head's check against the trunk's head, and its passing verdict raises the ask (ADR 0421 §1). - **A group is asked once.** One ask names every member and its head, once every member is `ready` and the - composed check passed at those heads; one Approve covers them all (ADR 0421 §2). + composed check passed at those heads; one Approve covers them all (ADR 0421 §2). From the delivery of issues 1781 to + 1783 the ask is the milestone's, made once when every one of its issues is ready, and a pull request linked to no + milestone is not asked (ADR 0493 §9, §11, which change ADR 0421 §1 and §2); the Approve it asks is also written + into the wait list of the session that opened the pull request (ADR 0491). - **The reviewer's verdict is attached, not a gate.** The review finishes before the push (playbook 07), and the session that opens a pull request gives its review record: who reviewed it, the commit the review approved and - the verdict. The ask carries it; with none, or one naming another commit, the ask says so in its first line and + the verdict; from the delivery of issue 1782 a verb of the delivery seat records it at the head it judged, and no + description is read (ADR 0493 §5, §6). The ask carries it; with none, or one naming another commit, the ask says so in its first line and the operator decides (ADR 0421 §5). - **The merge.** mesh-delivery merges through the forge's merge tool at the heads the Approve names, only while they are still the heads and both checks passed against the trunk's head. When the trunk moved, the merge tool @@ -528,6 +549,7 @@ delivery time. merge (ADR 0382 §3) is built and run as a second account of the Go build module, whose home, configuration and cache the build seat's account cannot write, so a check's script cannot change it. From R4f no judge is built from a change and the account is not made (ADR 0446 §5). +- **A module may ship its own Dockerfile.** A build module of its own builds the module's `image` artifact from it, rootless, with no root and no container runtime socket on the build node; a pull request's image is built and thrown away, and only a merged trunk commit's image reaches the registry, by digest. Until that module has taken over, build-agent builds images (ADR 0487). - **Every dependency comes by the version its lock file names**, checked against its checksum: the mesh's own code from the mesh's forge, its own packages from its package registry, any other from its public source. - **A builder fetches from the forge over SSH with a key of its own**, as the build seat's account, under a forge