diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index e3aa61da..5e0f6050 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -2460,17 +2460,17 @@ B0's own choices, each checked by the rows of *How it is checked* below: | Choice | Why | |---|---| -| A `run` ask no build module begins within the first tier's bound (*What ADR 0656 leaves to this design*) is put again once; when that one is not begun either, the check fails naming the missing job `run` | a build module on today's trunk drops an ask whose job it does not know from its work queue with a log line and writes no step key, so the checker would wait to its step bound in silence; the old build modules run beside the new checker until B0 reaches every build node, because `run` is a job inside the accepted kind `check`, not a served verb, and so no edge of the module graph orders the two. That gap of the build and delivery system is closed by milestone G's acting rule for the build step; in B0 it fails loudly instead | +| A `run` ask has a begin bound of 5 minutes per put, inside the first tier's 20 (*What ADR 0656 leaves to this design*): put once, put again after 5 minutes unbegun, and the check fails naming the missing job `run` after a second 5 minutes unbegun; a begun step keeps the first tier's bound | five minutes is long enough for a build node with a free slot to take an ask, and two puts still leave half the first tier's bound to the run itself; a build module on today's trunk drops an ask whose job it does not know from its work queue with a log line and writes no step key, so the checker would wait to its step bound in silence; the old build modules run beside the new checker until B0 reaches every build node, because `run` is a job inside the accepted kind `check`, not a served verb, and so no edge of the module graph orders the two. That gap of the build and delivery system is closed by milestone G's acting rule for the build step; in B0 it fails loudly instead | | A build module answers an ask whose job it does not know on its step key as refused, naming the job, never only in its log | the kind, not this instance: every ask a build module takes is answered, so no asker waits on an ask nobody will end | -| The build module's kept checking programs and composers are read, dropped and swept: a tool lists them (key, size, last use), a tool drops one, and old ones are swept as its workspaces are | with every check running the checking program, each merge into mesh-delivery or mesh-sdk adds one kept program per build node; a store nothing reads or empties fills the build node unseen, and a module's tools read all it holds and recover without help | -| The program's input (the facts it judges) and its answer (the seat list, the verdict) go by reference, by digest in the build seat's objects as a compose ask carries its manifests, and an input over its bound is refused before the ask, naming its size | a group's facts grow with its members, and an ask or a step key over the bus's size limits is lost or refused far from its cause; refused before asking, a group too large fails by name | +| The build module's kept checking programs and composers are read, dropped and swept: `build_go_kept` lists them (key, size, last use), `build_go_kept_drop` drops one and answers what it removed, and the sweep the build module's workspace cleaning runs removes one unused for 30 days; in milestone G a drop is written to the hand-act log with G's drop tools | the bound is not the workspace bound, because a workspace is held by one step while a kept program is reused by its key across checks, and 30 days keeps every program a check of the month's trunks asks again; with every check running the checking program, each merge into mesh-delivery or mesh-sdk adds one kept program per build node; a store nothing reads or empties fills the build node unseen, and a module's tools read all it holds and recover without help | +| The program's input (the facts it judges) and its answer (the seat list, the verdict) go by reference, by digest in the build seat's objects as a compose ask carries its manifests, and each referenced object is bounded by the bus's value limit of 256 KiB, the one this design already uses, an input over it refused before the ask, naming its size | a group's facts grow with its members, and an ask or a step key over the bus's size limits is lost or refused far from its cause; refused before asking, a group too large fails by name | | The `run` ask goes on the check stream under the grants check asks have today; the publish grant fixed to the checker's account and the step keys under the asker's name (*What ADR 0656 leaves to this design*) come with milestone G | B0 opens nothing a compose ask does not already allow, since any publisher of check asks can have a composer built and run at a commit today, and ADR 0644 limits B0 to what the running checker must run | -| The checking program's input form is versioned, and a program that does not read the version it is given fails the check, naming the version | milestone G's own check is run by B0's checker, so G's checking program reads the form B0 writes; that is the form, not an old one kept, and G adds the revision view to it | +| The checking program's input carries its version, and a program that does not read the version it is given fails the check, naming the version | B0's checker runs milestone G's checking programs, G's own check first, so G's checking program reads the form B0 writes; that is the form, not an old one kept, and G adds the revision view to it | - **Its tools.** The checker's read of a check names the checking program's build that judged it: its fingerprint and the heads it was built from, and the seat list it made with what it left out. The build module's step tools read a - `run` ask's step as they read every step, and its new tools read and drop its kept programs. Asking a check again - stays the checker's existing ask-again. + `run` ask's step as they read every step, and `build_go_kept` and `build_go_kept_drop` read and drop its kept + programs. Asking a check again stays the checker's existing ask-again. - **What it costs.** One more check, Approve and delivery before milestone G; milestone G then has one check, on its own checking program (ADR 0644, Consequences), and every check costs one more ask in the build seat, within the checker's step bound (ADR 0639 ยง5), the program built once per build and reused. @@ -2482,19 +2482,20 @@ B0's own choices, each checked by the rows of *How it is checked* below: - **The order inside milestone G is the module graph's**, never a delivery ahead: each acting part's new version acts first in its own step (ADR 0656; *Order without a person*); the node-engine handing the fingerprint composes the modules whose runtime reads it; the indexer's own steps keep *Taken in by the indexer it names*. -- **How it is checked.** Milestone G's group check runs on the checking program built from that group's own heads, - read from the check's record (live; ADR 0644, How it is checked). In the checker's whole-module test: a fixture - group whose checker change alters a rule is judged by its own checking program, which has no bus account; a lone - pull request and a carried verdict are each judged by the checking program, and the check's read names it; a - fixture group whose heads add a seat has that seat in the list both validators and the composer receive; a checking - program that does not build, or builds and does not answer, fails the check naming it; a fixture build module that - drops a `run` ask fails the check within the bound, naming the missing job; an input over its bound fails before - the ask, naming its size; and the check's read names the checking program's build, heads and seat list. In the - build module's tests: a `run` ask on a real bus is answered on its step key, a program that dials out fails, an ask - with a job it does not know is answered refused naming the job, a compose request's `seats` reaches the program - whole, and its tools list, drop and sweep kept programs (unit). Live, B0's own check passes on the running checker, - naming any module composed from its manifest; whole (gate, assigner), built with milestone G and run in its check, - a group changing the indexer, the checker and a module is delivered with no delivery ahead of it. +- **How it is checked.** Milestone G's group check runs on the checking program built from that group's own heads, read + from the check's record (live; ADR 0644, How it is checked). In the checker's whole-module test: a fixture group whose + checker change alters a rule is judged by its own checking program, which has no bus account; a lone pull request and + a carried verdict are each judged by the checking program, and the check's read names it; a fixture group whose heads + add a seat has that seat in the list both validators and the composer receive; a checking program that does not build, + or builds and does not answer, fails the check naming it; a fixture build module that drops a `run` ask is put again + after 5 minutes and fails the check after 10, naming the missing job; an input over its bound fails before the ask, + naming its size; and the check's read names the checking program's build, heads and seat list. In the build module's + tests: a `run` ask on a real bus is answered on its step key, a program that dials out fails, an ask with a job it + does not know is answered refused naming the job, a compose request's `seats` reaches the program whole, and + `build_go_kept` lists kept programs, `build_go_kept_drop` drops one saying what it removed, and the sweep removes one + unused for 30 days (unit). Live, B0's own check passes on the running checker, naming any module composed from its + manifest; whole (gate, assigner), built with milestone G and run in its check, a group changing the indexer, the + checker and a module is delivered with no delivery ahead of it. ## What is not decided here