Glossary and design 47: the release's new words and the L3-L7 homes as decided (ADR 0563-0571), so readers find where each controller job now lives
This commit is contained in:
+31
-6
@@ -242,7 +242,7 @@ every other domain has something to run on. **Recorded by** the controller and t
|
||||
**Purpose.** To decide, send and apply what each node runs, and to say why.
|
||||
**Recorded by** the controller's `inventory` database; from ADR 0567, by the seat `mesh-placement`, in its states on
|
||||
the bus. **Upstream of** Provisioning, Connectivity, Data
|
||||
and Health and repair. **Decided by** ADR 0100, 0126, 0176, 0181, 0207, 0221, 0252, 0261, 0411, 0539, 0549, 0559, 0567.
|
||||
and Health and repair. **Decided by** ADR 0100, 0126, 0176, 0181, 0207, 0221, 0252, 0261, 0411, 0539, 0549, 0559, 0567, 0571.
|
||||
**Uses:** node, machine, module, seat, manifest (Module), config value (Config), proposal (Operator and conversation).
|
||||
|
||||
- **assignment** — a module put on a node. Its config values on that node (module-assignment config,
|
||||
@@ -255,6 +255,10 @@ and Health and repair. **Decided by** ADR 0100, 0126, 0176, 0181, 0207, 0221, 02
|
||||
- **mesh-placement** — the seat, held once for the mesh by the assigner, that keeps placement: its states
|
||||
`placement`, `proposals` and `candidates`, and its seven verbs `placement`, `proposals`, `propose`, `withdraw`,
|
||||
`again`, `adopt` and `hand-back`. Only the holder writes its states (ADR 0567).
|
||||
- **seat holders** — the state `seat-holders` of the seat `mesh-placement`, written by its holder, the assigner: one
|
||||
key per seat naming each holder and its node, composed from placement and the manifests' claims as the indexer
|
||||
holds them, and rewritten only when a key differs. The tool runner and every other reader of who holds a seat
|
||||
read it there, never the controller (ADR 0571 §6, §7).
|
||||
- **placement proposal** — a change to placement put forward through the verb `propose`: the changes, the revision
|
||||
of each key they were laid over, the nodes' answers, the verdict and the ask. It takes effect only on the operator's
|
||||
Approve, and is discarded if declined, expired or withdrawn. A kind of *proposal* (Operator and conversation).
|
||||
@@ -389,7 +393,7 @@ and vault (Identity and access).
|
||||
**Purpose.** To issue, hold, rotate and check the credentials and grants by which modules, nodes, agents
|
||||
and the operator act. **Recorded by** the controller's `identity` and `licences` databases and the vault.
|
||||
**Upstream of** Provisioning, Delivery, and Operator and conversation.
|
||||
**Decided by** ADR 0085, 0113, 0183, 0225, 0234, 0386, 0387, 0388, 0411, 0413, 0414, 0550.
|
||||
**Decided by** ADR 0085, 0113, 0183, 0225, 0234, 0386, 0387, 0388, 0411, 0413, 0414, 0550, 0571.
|
||||
**Uses:** module, node, seat, tool (Module), operator, consumer and provision (Provisioning), agent and ask (Operator and conversation).
|
||||
|
||||
- **credential** — anything that proves an identity: a password, a key, a token. A **pair credential**
|
||||
@@ -427,7 +431,9 @@ and the operator act. **Recorded by** the controller's `identity` and `licences`
|
||||
- **root key** — the key at the top of the signed logins, which vouches for the signing keys: sealed in the
|
||||
vault and used only to replace them, on the operator's Approve (ADR 0388).
|
||||
- **bus account** and **membership** — a module's or a node's account on the bus, and the subjects it
|
||||
is issued. The bus server calls its accounts *users*; the mesh says bus account.
|
||||
is issued. The bus server calls its accounts *users*; the mesh says bus account. Each module's membership
|
||||
is kept in the grants part's state `memberships` (seat `mesh-grants`), one key `<node>.<module>` written
|
||||
only when it differs, and the runtime reads its membership there (ADR 0571 §10).
|
||||
- **rotate** — replacing a credential without a consumer holding one the provider does not know.
|
||||
- **licence** — a model-access account the licence manager holds and **binds** to a consumer, the
|
||||
coding agent on a node (ADR 0183).
|
||||
@@ -449,7 +455,7 @@ and the operator act. **Recorded by** the controller's `identity` and `licences`
|
||||
back when it fails. The domain is continuous integration and delivery, named **delivery**, and its parts live in
|
||||
the repository `mesh-delivery` (ADR 0429 §2). **Recorded by** the `mesh-delivery` module (deliveries) and the
|
||||
controller (the planner, the rollout) until release 6 of ADR 0429; from each release on, by the parts it builds. **Downstream of** Module, Core, Health and repair and Data.
|
||||
**Decided by** ADR 0162, 0218, 0236, 0237, 0238, 0239, 0250, 0267, 0270, 0276, 0323, 0401–0408, 0428, 0429, 0444–0447, 0524–0530, 0539, 0548, 0551.
|
||||
**Decided by** ADR 0162, 0218, 0236, 0237, 0238, 0239, 0250, 0267, 0270, 0276, 0323, 0401–0408, 0428, 0429, 0444–0447, 0524–0530, 0539, 0548, 0551, 0571.
|
||||
**Uses:** module, node, declaration and send (Placement), health (Health and repair), person.
|
||||
|
||||
- **merge check** — what a pull request carries before it may merge, judging the merge of its head into a
|
||||
@@ -497,6 +503,12 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
|
||||
- **build module** — the module of one language that does the build steps for it on a node (fetch, build, digest,
|
||||
test), claiming that language's build seat: `mesh-build-go`, `mesh-build-node` and `mesh-build-image`. It pulls the
|
||||
build requests of its language and writes each step's end on its own key (ADR 0525 §3, §6). Not the **builder**.
|
||||
- **build log** — the builder's own module log `build-log`, in ADR 0297's form, kept 30 days and keyed per
|
||||
module: one entry when a build of a fingerprint starts and one when it ends (the module, the fingerprint, the
|
||||
repository, the directory and the commit, the build node and the time, the build's manifest and its `against`,
|
||||
and at the end the outcome and each artifact's digest). A build's duration is read from its two entries, and no
|
||||
other part records durations; the builder's module tool `builder_builds_since` answers the builds a reader
|
||||
missed from it (ADR 0571 §1, §12).
|
||||
- **package** — what code resolves when it is **compiled**: an npm/cargo/pypi dependency, by **version**.
|
||||
Served by the **package-registry** (gitea). Only a build module talks to it.
|
||||
- **artifact** — anything a build produces and the mesh delivers to a node by **digest**: an `image`, a
|
||||
@@ -505,6 +517,13 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel
|
||||
(ADR 0156).
|
||||
An image is one kind of artifact, and a module is not an image. A package and an artifact are two
|
||||
protocols, not one store being weak (ADR 0075).
|
||||
- **artifact sweep** — letting go of the artifacts no one needs any more, the seat `mesh-artifact-sweep`, held
|
||||
once for the mesh by artifact-store-tools beside the artifact store (ADR 0571 §2 to §4; named `artifact-store`
|
||||
in the record before its progressive insight). Its keep set comes from the store's own listing, the wants and
|
||||
the build log: a digest a want names is kept however old, and so are each module's five newest builds
|
||||
(ADR 0526 §1). From the lease write it sweeps at each build's end and records each deletion in the hand-act
|
||||
log; until then the controller sweeps. Not the artifact store itself, nor the registry's own collection of
|
||||
unreferenced bytes (ADR 0189).
|
||||
- **build source** — the files one artifact is built from, in one or more repositories: for a Go program
|
||||
its import closure (the directories of its packages, its Go module files) and its recipe; for any other
|
||||
artifact the paths its manifest names, by default its module's own directory. Each artifact of a build
|
||||
@@ -662,6 +681,8 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564.
|
||||
- **probe** — one look at one thing's health, run by whoever owns the verdict; what a probe returns is a
|
||||
**finding**, before it becomes a condition. A finding is kept as a key `<scope>.<id>.<kind>` in its observer's
|
||||
bucket `findings` until it is no longer observed (ADR 0564 §2).
|
||||
- **node health report** — each node-engine's own report of its node's health, a key that node's engine writes
|
||||
and the watchman reads (ADR 0564, as its progressive insight of 2026-10-29 has it); its layout is mesh-sdk's.
|
||||
- **observer** — a part that writes findings for the condition keeper: the watchman, the self-check and the
|
||||
healers (ADR 0564 §2). An observer never writes a condition.
|
||||
- **condition keeper** — the module mesh-conditions, holder of the seat `mesh-conditions`: the one writer of the
|
||||
@@ -687,7 +708,7 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564.
|
||||
operator's decision (ADR 0259).
|
||||
Not a drill: nothing is broken.
|
||||
- **hand-act** — a repair a person made by hand, recorded so the mesh knows it happened. The **hand-act log**
|
||||
is the stream `acts` of the seat `mesh-hand-acts`, held once by the module mesh-hand-acts, which also records
|
||||
is the module's log in ADR 0297's form, the stream `acts` of the seat `mesh-hand-acts`, held once by the module mesh-hand-acts, which also records
|
||||
who chose an ask (`warranted`); every recorder calls it, and the controller's own log is read beside it
|
||||
until the lease write (ADR 0565 §10, §11).
|
||||
- **take-over** — the operator's approved switch of a job from the controller to the part that replaces it, with a
|
||||
@@ -702,7 +723,7 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564.
|
||||
|
||||
**Purpose.** To know every item of data a module holds, how precious it is, and to keep it recoverable.
|
||||
**Recorded by** the manifests' `data` declarations and every node's `node-backup` seat.
|
||||
**Upstream of** Delivery and Health and repair. **Decided by** ADR 0232, 0233, 0235.
|
||||
**Upstream of** Delivery and Health and repair. **Decided by** ADR 0232, 0233, 0235, 0571.
|
||||
**Uses:** module, node, provider and consumer (Provisioning), person.
|
||||
|
||||
- **data class** — how precious an item of data is, ranked by the operator: `irreplaceable`,
|
||||
@@ -712,6 +733,10 @@ becomes a message). **Decided by** ADR 0227, 0231, 0240, 0252, 0283, 0564.
|
||||
at one moment; **restore** — bringing it back beside the live data, never over it.
|
||||
- **stream snapshot** — the bus's own backup of each stream, taken by the module holding `mesh-broker`
|
||||
(ADR 0235).
|
||||
- **disk readings** — the size of each data item a node's modules declare, measured by its `measure` and kept
|
||||
with its largest size in seven days by disk-load on that node, in its own state, one key
|
||||
`<node>.<module>.<item>` written only when it changes; the holder of `node-backup`, mounts, nfs-server and the
|
||||
self-check read them there, never the controller (ADR 0571 §5).
|
||||
- **sticky binding** — a consumer's tie to the data a provider keeps for it, which moves only by a
|
||||
person (ADR 0232).
|
||||
|
||||
|
||||
@@ -2,11 +2,14 @@
|
||||
layer: to-be
|
||||
status: in-progress
|
||||
code: [mesh-controller, mesh-catalog modules/mesh-delivery-gate, mesh-delivery, mesh-host, mesh-sdk, mesh-vault, hq 00-META/checks]
|
||||
updated: 2026-10-28
|
||||
updated: 2026-10-29
|
||||
decisions:
|
||||
- "ADR 0571"
|
||||
- "ADR 0570"
|
||||
- "ADR 0567"
|
||||
- "ADR 0565"
|
||||
- "ADR 0564"
|
||||
- "ADR 0563"
|
||||
- "ADR 0559"
|
||||
- "ADR 0555"
|
||||
- "ADR 0551"
|
||||
@@ -182,8 +185,9 @@ source revision is derived from the keys: every **want** equals its module's **f
|
||||
list, alone and with no want (*The bus's user list*, below).
|
||||
- **The grants part** (module `mesh-grants`, holding the seat `mesh-grants`) composes who may say what on the bus
|
||||
with mesh-sdk's bus composer: each module's membership, the buckets, logs and streams a manifest declares, the
|
||||
bus's user list, and from ADR 0547's third milestone `grants.<module>.<fingerprint>` (ADR 0547 §5, §6). It publishes
|
||||
memberships from the first milestone; until the operator's `take-over` it keeps the bus's user list, the
|
||||
bus's user list, and `grants.<module>.<fingerprint>`, written from L7's delivery once the list the bus loaded
|
||||
carries that build's accounts (ADR 0547 §5, §6; ADR 0571 §9). It keeps each module's membership in its own state
|
||||
`memberships`, which the runtime reads, and publishes memberships from the first milestone (ADR 0571 §10); until the operator's `take-over` it keeps the bus's user list, the
|
||||
assertions and the grants in shadow, composing and comparing them with what the bus loaded and writing nothing
|
||||
of them that takes effect; its tools read all it holds and redo all it does.
|
||||
- **The watchman** turns the bus's connections into presence and mirrors every key whose next move a machine
|
||||
@@ -220,8 +224,11 @@ there is three milestones, one issuer of each key at every moment (ADR 0547 §11
|
||||
3. **Nothing is left with the controller** (issue 774; what remains of issue 1126, the homes of the controller's
|
||||
other jobs, carries into it by a note on 1126 and is not one of its issues): the vault mints bus accounts, the grants part
|
||||
writes grants, the try is the checker's own verb, placement is read from the seat `mesh-placement` alone (ADR 0567; ADR 0549 §5,
|
||||
§6), the vault signs with the mesh's signing key (ADR 0550 §2), and the controller's lease is handed to a holder that is no controller once every other job
|
||||
it keeps has a home by its own decision (research 072).
|
||||
§6), the vault signs with the mesh's signing key (ADR 0550 §2), each node-engine holds the node seat `node-engine`
|
||||
and asks the operator itself for a hand-over or an access act (ADR 0563), and the controller's lease is handed to a
|
||||
holder that is no controller once every other job it keeps has a home by its own decision (research 072): health
|
||||
(L4, ADR 0564), the control records (L5, ADR 0565), provisioning (L6, ADR 0570), and the history and records
|
||||
(L7, ADR 0571). The lease write waits until all four are delivered.
|
||||
|
||||
No machine is enrolled before the third milestone: until the vault mints enrolment tokens and node accounts,
|
||||
those are the controller's alone (ADR 0550 §6).
|
||||
@@ -258,9 +265,14 @@ The target (ADR 0547):
|
||||
plan, never sends to a machine and writes no composition (ADR 0539 §17).
|
||||
- **The controller** is no part of build and delivery (ADR 0547 §1). The jobs it still keeps outside them
|
||||
(nodes and adoption, identities, secrets and given values, licences, config moves, conditions and facts, ADR
|
||||
0429 §9) each move by a decision of their own under research 072 before it loses its lease. Two are decided, by
|
||||
the operator's answers of 2026-10-26 and 2026-10-28: placement lives on the bus, held by the seat `mesh-placement` (ADR 0567), and the mesh's signing key in
|
||||
the vault (ADR 0550 §2).
|
||||
0429 §9) each move by a decision of their own under research 072 before it loses its lease. All are decided:
|
||||
placement lives on the bus, held by the seat `mesh-placement` (ADR 0567); the mesh's signing key in the vault
|
||||
(ADR 0550 §2); a hand-over, an access act and the root-free judgement on each node's own seat `node-engine`
|
||||
(ADR 0563); health with the condition keeper, the watchman, the self-check and the healers (ADR 0564); the
|
||||
control records with mesh-config, the node agents, the assigner and the hand-act log's seat `mesh-hand-acts`
|
||||
(ADR 0565); provisioning with the seat `mesh-provisioner` (ADR 0570); and build history with the builder's
|
||||
build log, the artifact sweep with the seat `mesh-artifact-sweep`, disk readings with disk-load, and who holds
|
||||
which seat with the seat `mesh-placement`'s state `seat-holders` (ADR 0571).
|
||||
- **The vault** keeps every secret the mesh keeps (ADR 0550 §1): the mesh's signing key, licence grants and
|
||||
tokens, bus account passwords and module secrets; a holder gets a value only sealed to its own key, or asks the
|
||||
vault to act with it. It makes the mesh's signing key and signs enrolments and node certificates on request, by
|
||||
@@ -812,9 +824,11 @@ backup holder backs up nothing, and the have says so.
|
||||
seconds, so a list written and not loaded within a minute is stuck (ADR 0547 §7). Until the operator's
|
||||
`take-over` the grants part runs in shadow, and the bus node takes the list from the bus module's composition
|
||||
the running system writes for it, the user-list resource alone (ADR 0547 §8).
|
||||
- **Memberships and assertions.** The grants part publishes each module's membership on the assignments stream
|
||||
only when it differs from the one last published, and asserts every bucket, log and stream a manifest declares
|
||||
when a new manifest digest is registered, with its limits; memberships are published from the first milestone
|
||||
- **Memberships and assertions.** The grants part keeps each module's membership in its state `memberships`, one
|
||||
key `<node>.<module>` written only when it differs, where the runtime reads it from L7's delivery; it also
|
||||
publishes it on the assignments stream, read by no one from then, until the lease write (ADR 0571 §10). It
|
||||
asserts every bucket, log and stream a manifest declares when a new manifest digest is registered, with its
|
||||
limits; memberships are published from the first milestone
|
||||
(the operator's one grant, 22:31 on 2026-10-25), while before `take-over` assertions are composed and compared
|
||||
and nothing is asserted (ADR 0547 §5).
|
||||
- **The want names the build.** A want `want.<node>.<module>` names the fingerprint, the artifact's digest, the
|
||||
@@ -1240,12 +1254,12 @@ release reports the controller's code lines against research 063's baseline (acc
|
||||
| R6 | Each node applies from its wants the compositions its own node agent composes (ADR 0547 §2; as released it applied the controller's signed ones), a new version reaches the module's canary first and the rest once it is healthy there, a move a person must allow is asked before its want, the view says what is moving, settled, stuck and delivered, and the plans are deleted from the code; switched over by release 5's last plan (ADR 0539) | 18, 19, 20 | mesh-sdk, the node-engine (`mesh-host`: the node agent), mesh-controller (plans deleted; as released also compositions and credentials, which ADR 0547 moves to the node agents, the grants part and the vault), mesh-delivery (assigner, watchman, view), mesh-catalog (the gate, the messenger, the issue tracker, the backup holder), hq | 1942 (the planner puts the node-engine and the controller in one tier for the switch; delivered first), the bus's user list granting what release 6 uses (delivered first, under L1's issue), 1943 (mesh-sdk: the composition's layout and signature, the want's digest, `mesh-hand-compose`, the verb tables without the plan verbs), 1944 (the node agent), 1946 (the gate keeps the merge's states; the messenger and the issue tracker hear the view), 1906 (the assigner's seventh rule and its asks, the watchman's pulses for wants, the view's wants and events), 1130 (hq) |
|
||||
| L1 | The controller leaves build and delivery, first milestone: the bus node follows the user list alone, the grants part composes in shadow and the vault holds the bus accounts' hashes, so the operator's take-over can make the grants part's list the one loaded (ADR 0547 §8, §11; ADR 0550 §4) | — | mesh-controller, mesh-delivery, mesh-catalog (the vault, the grants part), the node-engine (`mesh-host`), mesh-sdk | 1945 |
|
||||
| L2 | Nodes compose: each node agent composes its own modules, and no node applies a composition made elsewhere but the bus's user list (ADR 0547 §11); where modules run is bus state held by the seat `mesh-placement` on the assigner, changed by a proposal the nodes answer and the operator approves, and no repository names a node or holds what one installation decides (ADR 0567) | — | the node-engine (`mesh-host`), mesh-sdk, mesh-delivery (the assigner as the seat's holder), mesh-catalog, mesh-controller (its pin only) | 1126 |
|
||||
| L3 | Nothing is left with the controller: the vault mints bus accounts and signs, the grants part writes grants, the try is the checker's own verb, placement is read from the seat `mesh-placement` alone, and the lease passes to a holder that is no controller (ADR 0547 §11, ADR 0549 §5, §6, ADR 0550 §2); the rest of the controller's code lines is the issue of L2 | — | mesh-controller, mesh-catalog (the vault, the grants part), mesh-delivery | 774 |
|
||||
| L3 | Nothing is left with the controller: the vault mints bus accounts and signs, the grants part writes grants, the try is the checker's own verb, placement is read from the seat `mesh-placement` alone, each node-engine holds the node seat `node-engine`, judges `root-free` for its node and asks the operator itself for a hand-over or an access act, acting on the warrant with nothing signed (ADR 0563), and, once L4 to L7 are delivered, the lease write passes the lease to a holder that is no controller, made right after the delivery that drops every listed read of the controller but the three ADR 0571 §13 keeps to the write itself (ADR 0547 §11, ADR 0549 §5, §6, ADR 0550 §2, ADR 0571 §13); the rest of the controller's code lines is the issue of L2 | — | mesh-controller, mesh-sdk, the node-engine (`mesh-host`), mesh-catalog (the vault, the grants part, the messenger), mesh-delivery | 774 |
|
||||
| M1 | A milestone is a record of the issue tracker: each row of a design's milestone table is a milestone record its issues are linked to by `issue-tracker.link`, an issue to at most one, and pull requests and commits to issues the same way; the knowledge base's `progress` reads the milestones from the tracker, not from this table (ADR 0493 §1 to §4) | — (ADR 0493 §13 in part) | hq, mesh-catalog (mesh-issues, mesh-knowledge) | 1781 |
|
||||
| L4 | Health leaves the controller: the condition keeper holds the seat `mesh-conditions` and keeps every open condition from the observers' findings, saying today's condition events; the watchman holds `mesh-watchdogs`, its watchdogs pulses, and keeps the dead letters from the lease write; `mesh-self-check` runs the probes and says `checked`; `mesh-healers` heals on events and acts only once the lease names no controller; `status` is the view's derivation; built dark, compared, then switched by the operator's take-over; the bus module gains a tool that removes one named consumer, which the lease write uses (ADR 0564, ADR 0547 §11) | — | mesh-sdk, mesh-catalog (mesh-conditions, mesh-self-check, mesh-healers, the router, mesh-watcher, nats), mesh-delivery (watchman, view, the grants part) | 1952 |
|
||||
| L4 | Health leaves the controller (ADR 0564): the condition keeper holds the seat `mesh-conditions` and keeps every open condition from the observers' findings, saying today's condition events; the watchman holds `mesh-watchdogs`, its watchdogs pulses, reads each node-engine's node health report, and keeps the dead letters from the lease write; `mesh-self-check` runs the probes, `root-free` among them from L7 (ADR 0571 §11), and says `checked`; `mesh-healers` heals on events and acts only once the lease names no controller; `status` is the view's derivation; built dark, compared, then switched by the operator's take-over; the bus module gains a tool that removes one named consumer, which the lease write uses (ADR 0547 §11) | — | mesh-sdk, mesh-catalog (mesh-conditions, mesh-self-check, mesh-healers, the router, mesh-watcher, nats), mesh-delivery (watchman, view, the grants part) | 1952 |
|
||||
| L5 | Control records leave the controller, and the controller is not changed (ADR 0565): mesh-config keeps each module's declared config in its state `declared` and publishes the predefined keys, which the indexer reads from the forge bridge's messages with each open pull request's config candidate; config switches to that source only on the operator's take-over, refused while `compare` shows a difference; each node agent writes its node's declared packages (the node seat `node-engine`, verb `packages`); the assigner holds the new seat `mesh-wants` with the upgrade policy a person chose and the bus step; the hand-act log (`hand-act`, `hand-acts`, `warranted`) is the stream of the new seat `mesh-hand-acts`, held by a new module in mesh-catalog, which every recorder calls from this delivery with no switch; the checker and the assigner's composition check read the held values of their pull requests from mesh-config's state `kept`; from the lease write a trusted config value is set only on the operator's Approve; `settings`, `move-config` and `move-placement` end with the lease and nothing replaces them. each person's six policy choices are set through `mesh-wants.upgrade` and recorded as hand acts, `upgrade compare` and the assigner's finding `policy-split` show any split, and the lease write waits for `compare` to be empty (ADR 0565 §8). One delivery group, built before the lease write of L3, which waits for the group delivered, the six choices set, mesh-config's `compare` empty and its take-over done, `mesh-wants.upgrade compare` empty, and the readings of ADR 0565 §12 (ADR 0565 §14; ADR 0348 §9, ADR 0502 §2, ADR 0539 §14, §15, ADR 0547 §11) | — | mesh-sdk, mesh-catalog (mesh-config, mesh-hand-acts, pacman, the forge module, claude-code, mesh-knowledge, mesh-conditions, mesh-healers), mesh-delivery (indexer, assigner, checker, grants part, forge bridge), the node-engine (`mesh-host`); mesh-controller is not a member | 1953 |
|
||||
| L6 | Provisioning leaves the controller: each node agent writes each handed module's provisioning plan on its own have key, which the vault, the node's provisioner client and every provider read through mesh-sdk instead of the controller's assignments; providers retire and clean up the consumers no plan names by themselves; `rotate` and `issued` are answered by the vault alone (a decision record first for the plan's home; ADR 0349 §10, §12, ADR 0230, ADR 0547 §11) | — | mesh-sdk, the node-engine (`mesh-host`), mesh-tools (the tool runner's provisioner client), mesh-catalog (the vault, the provisioner client, postgres, keycloak, gitea, route-adapter), mesh-controller | 1954 |
|
||||
| L7 | History and records leave the controller: builds, artifacts, durations and delivery history are read from the builder's keys and streams; the artifact store's sweep (`collect`, `held`, `mirrors`, `images`) is a seat's own; data readings are node-backup's own state; modules, seats and tools are read from the indexer, placement and the tool runner; no manifest but the controller's reads a controller bucket, so the lease write's check passes (a decision record first, under research 072; ADR 0189, ADR 0547 §11, ADR 0549 §6) | — | mesh-sdk, mesh-controller, mesh-delivery (builder, indexer, view), mesh-catalog (artifact-store-tools, the backup seat's holder, mounts, nfs-server, minio, mesh-watcher), mesh-tools (the tool runner) | 1955 |
|
||||
| L6 | Provisioning leaves the controller (ADR 0570): every provision is one key of the seat `mesh-provisioner`, held by mesh-provisioner, holding a reference and never a value, and each placed module's provisioning plan a key of its state `plans`, both composed from placement, the wants and the manifests on change events; each provider acts once all a provision depends on is provided; the assigner moves a want only once its build's provisions are provided; a provision no want needs is retiring, and its account or credential is removed only on the operator's Approve, its data never; the vault mints each provision's secret sealed to the consumer's and the provider's node, and the consumer's node-engine writes it; a wait for a person is a provision's state, which the watchman reads; bus permissions stay with the grants part (ADR 0349, ADR 0230, ADR 0547 §11) | — | mesh-sdk, the node-engine (`mesh-host`), mesh-tools (the tool runner's provisioner client), mesh-catalog (mesh-provisioner, the vault, the provisioner client, postgres, keycloak, gitea, route-adapter), mesh-delivery (assigner, watchman) | 1954 |
|
||||
| L7 | History and records leave the controller (ADR 0571): the builder keeps its build log, one entry at a build's start and one at its end, from which build history and durations are read and the module mesh-catalog asks the builds it missed; the artifact sweep is the seat `mesh-artifact-sweep`, held by artifact-store-tools beside the artifact store, its keep set from the store's own listing, the wants and the build log, sweeping at each build's end from the lease write and recording each deletion in the hand-act log; disk readings are disk-load's own state on every node; who holds which seat is the state `seat-holders` of the seat `mesh-placement`, and tools are found by the tool runners' announcements; what a node runs is its want and its have; the grants part writes `grants.<module>.<fingerprint>` and keeps memberships in its own state; root-free is a probe of the self-check; no manifest but the controller's reads, invokes or consumes `mesh-controller`, but a named list kept to the lease write, so the lease write's check passes (ADR 0189, ADR 0547 §11, ADR 0549 §6) | — | mesh-sdk, mesh-controller (its pin only), mesh-delivery (builder, indexer, assigner, grants part, view), mesh-catalog (artifact-store-tools, disk-load, the backup seat's holder, mounts, nfs-server, minio, mesh-watcher, the messenger, the self-check, the module mesh-catalog, docker), mesh-tools (the tool runner) | 1955 |
|
||||
|
||||
An issue is in one row only (ADR 0493 §2): where a row named an issue another row names too, the last row keeps it and the
|
||||
earlier row says so in words (the operator, 2026-10-26). Milestone M1 makes each row a record of the issue tracker
|
||||
@@ -1260,7 +1274,8 @@ other jobs, made milestones after L3 by the operator's yes on 2026-10-28, so the
|
||||
L3's lease write waits until all four are delivered (ADR 0547 §11), while the rest of L3 is delivered before them with
|
||||
its switches off. They are ordered health first, since every later part says its faults through the conditions; then the
|
||||
control records, provisioning, and the history and records, whose last step is the check that no reader is left. Each
|
||||
starts with its decision record (issues 1952 to 1955). Adoption's record is L3's (ADR 0561 §5), and the licences' move
|
||||
starts with its decision record (issues 1952 to 1955), and all four are decided: ADR 0564, ADR 0565, ADR 0570 and
|
||||
ADR 0571. Adoption's record is L3's (ADR 0561 §5), and the licences' move
|
||||
into the vault is decided by ADR 0550 §3 under issue 1126. Release 5 (the assigner's wants, compared only) is not a milestone of its own: ADR 0524 §1 folds it into R4g, whose row above holds
|
||||
it. Release 6 is milestone R6, prepared on 2026-10-24 with ADR 0539. Its prepare step found six repositories where its row first
|
||||
named three: the gate's code is in mesh-catalog, mesh-sdk holds the composition's layout and the seat verb tables, and hq the design
|
||||
|
||||
Reference in New Issue
Block a user