Renumber the gate's issues 285-287 (282 was taken on main); issue 288: the facts snapshot still names the installation

2026-10-07 02:04:46 +02:00
parent 41a0e77748
commit a9f396a0a0
4 changed files with 57 additions and 5 deletions
@@ -6,7 +6,7 @@ fixed-by: mesh-controller PR #104
 amended-design:
 ---

-# 282. The merge gate compared broken to broken, and passed
+# 285. The merge gate compared broken to broken, and passed

 ## Symptom

@@ -64,8 +64,8 @@ the snapshot now applies to resource names too) and the machine's bus membership

 ## How it is checked

-The controller's tests `TestIssue282AModuleOnTheBusComposesInTheGate` and
-`TestIssue282AMachineTheGateCannotRaiseIsAnErrorNeverAPass`: a module on the bus composes in the gate,
+The controller's tests `TestIssue285AModuleOnTheBusComposesInTheGate` and
+`TestIssue285AMachineTheGateCannotRaiseIsAnErrorNeverAPass`: a module on the bus composes in the gate,
 and a machine the gate cannot raise turns the verdict to `error`. `TestAWithheldPathIsStoodInForByAPath`
 and the facts package's `TestAWithheldPathStaysAPath` cover the path stand-ins.

@@ -6,7 +6,7 @@ fixed-by: mesh-controller PR #104, mesh-host PR #46
 amended-design:
 ---

-# 283. A merge check passed on an agent's machine and failed on the build seat
+# 286. A merge check passed on an agent's machine and failed on the build seat

 ## Symptom

@@ -6,7 +6,7 @@ fixed-by: mesh-tools PR #19
 amended-design:
 ---

-# 284. A seat and a module of one name were both unreachable
+# 287. A seat and a module of one name were both unreachable

 ## Symptom

@@ -0,0 +1,52 @@
+---
+status: located
+opened: 2026-10-07
+located-in: [mesh-controller internal/facts, mesh-controller cmd/mesh-controller]
+fixed-by: mesh-controller PR #105
+amended-design:
+---
+
+# 288. The facts snapshot still names the installation
+
+## Symptom
+
+The facts snapshot promises "no secret and no address": every machine's name, site, account and public
+domain is replaced wherever it appears, so a snapshot can be copied into a test, a replay or a pull
+request. Reading the live snapshot of 2026-10-06 while diagnosing issue 285 showed it does not keep that
+promise:
+
+1. **Repositories carried the forge's address.** Every module's `repository`, every `reads` entry and
+   every `sources` entry was the URL the mesh clones from: the forge's private host name and port, then
+   owner and name.
+2. **An owner is a person's login.** Repositories a person owns are named after the person's account
+   on the forge.
+3. **A login in a setting.** A machine's settings layer for two download modules sets `username` to
+   an account name. The key does not read as a secret, the value is not a registered machine, site or
+   account, and so it passed unchanged.
+4. **Manifests are carried whole.** Every module's manifest is kept as the mesh holds it. Some name
+   machines and the installation's domains in file names, paths, routes and descriptions. Only the
+   machines' own records are scrubbed, not the definitions.
+
+## Diagnosis
+
+The scrub (`internal/facts`) replaces registered names in text that passes through it: settings,
+problems, resource names. The repositories, the manifests and the module records were assembled
+straight from the store, without passing through it. Settings are scrubbed by key and by the shape of
+the value, and a login has neither.
+
+Not all of it can be scrubbed in place. A check matches a pull request to the modules it moves by the
+repository's owner and name, and composes the manifests as they are. A pseudonymised owner, or a
+rewritten manifest, would judge a different mesh.
+
+## Fix
+
+- **Repositories are named `owner/repository`**, without the forge's address. A check matches
+  repositories by owner and name, never by the address, so nothing it reads is lost (`RepositoryName`).
+
+## Left open
+
+- Owners and the manifests stay as they are, because a check reads them. If a snapshot is to be
+  public, it needs a consistent pseudonym applied to the pull request's owner too, and a manifest
+  scrub that leaves composition unchanged. That is a question for the design, not the scrub.
+- A login in a setting is caught only once the scrub knows the operator's logins on every machine,
+  not only the one the mesh records as its account.