diff --git a/04-ISSUES/282-the-merge-gate-compared-broken-to-broken-and-passed/00-report.md b/04-ISSUES/285-the-merge-gate-compared-broken-to-broken-and-passed/00-report.md similarity index 95% rename from 04-ISSUES/282-the-merge-gate-compared-broken-to-broken-and-passed/00-report.md rename to 04-ISSUES/285-the-merge-gate-compared-broken-to-broken-and-passed/00-report.md index 0c380f8e..ba4b15b2 100644 --- a/04-ISSUES/282-the-merge-gate-compared-broken-to-broken-and-passed/00-report.md +++ b/04-ISSUES/285-the-merge-gate-compared-broken-to-broken-and-passed/00-report.md @@ -6,7 +6,7 @@ fixed-by: mesh-controller PR #104 amended-design: --- -# 282. The merge gate compared broken to broken, and passed +# 285. The merge gate compared broken to broken, and passed ## Symptom @@ -64,8 +64,8 @@ the snapshot now applies to resource names too) and the machine's bus membership ## How it is checked -The controller's tests `TestIssue282AModuleOnTheBusComposesInTheGate` and -`TestIssue282AMachineTheGateCannotRaiseIsAnErrorNeverAPass`: a module on the bus composes in the gate, +The controller's tests `TestIssue285AModuleOnTheBusComposesInTheGate` and +`TestIssue285AMachineTheGateCannotRaiseIsAnErrorNeverAPass`: a module on the bus composes in the gate, and a machine the gate cannot raise turns the verdict to `error`. `TestAWithheldPathIsStoodInForByAPath` and the facts package's `TestAWithheldPathStaysAPath` cover the path stand-ins. diff --git a/04-ISSUES/283-a-merge-check-passed-on-an-agents-machine-and-failed-on-the-build-seat/00-report.md b/04-ISSUES/286-a-merge-check-passed-on-an-agents-machine-and-failed-on-the-build-seat/00-report.md similarity index 98% rename from 04-ISSUES/283-a-merge-check-passed-on-an-agents-machine-and-failed-on-the-build-seat/00-report.md rename to 04-ISSUES/286-a-merge-check-passed-on-an-agents-machine-and-failed-on-the-build-seat/00-report.md index c60a78c3..9f3bb1c1 100644 --- a/04-ISSUES/283-a-merge-check-passed-on-an-agents-machine-and-failed-on-the-build-seat/00-report.md +++ b/04-ISSUES/286-a-merge-check-passed-on-an-agents-machine-and-failed-on-the-build-seat/00-report.md @@ -6,7 +6,7 @@ fixed-by: mesh-controller PR #104, mesh-host PR #46 amended-design: --- -# 283. A merge check passed on an agent's machine and failed on the build seat +# 286. A merge check passed on an agent's machine and failed on the build seat ## Symptom diff --git a/04-ISSUES/284-a-seat-and-a-module-of-one-name-were-both-unreachable/00-report.md b/04-ISSUES/287-a-seat-and-a-module-of-one-name-were-both-unreachable/00-report.md similarity index 97% rename from 04-ISSUES/284-a-seat-and-a-module-of-one-name-were-both-unreachable/00-report.md rename to 04-ISSUES/287-a-seat-and-a-module-of-one-name-were-both-unreachable/00-report.md index 0a24a017..4a496d75 100644 --- a/04-ISSUES/284-a-seat-and-a-module-of-one-name-were-both-unreachable/00-report.md +++ b/04-ISSUES/287-a-seat-and-a-module-of-one-name-were-both-unreachable/00-report.md @@ -6,7 +6,7 @@ fixed-by: mesh-tools PR #19 amended-design: --- -# 284. A seat and a module of one name were both unreachable +# 287. A seat and a module of one name were both unreachable ## Symptom diff --git a/04-ISSUES/288-the-facts-snapshot-still-names-the-installation/00-report.md b/04-ISSUES/288-the-facts-snapshot-still-names-the-installation/00-report.md new file mode 100644 index 00000000..0298c2cd --- /dev/null +++ b/04-ISSUES/288-the-facts-snapshot-still-names-the-installation/00-report.md @@ -0,0 +1,52 @@ +--- +status: located +opened: 2026-10-07 +located-in: [mesh-controller internal/facts, mesh-controller cmd/mesh-controller] +fixed-by: mesh-controller PR #105 +amended-design: +--- + +# 288. The facts snapshot still names the installation + +## Symptom + +The facts snapshot promises "no secret and no address": every machine's name, site, account and public +domain is replaced wherever it appears, so a snapshot can be copied into a test, a replay or a pull +request. Reading the live snapshot of 2026-10-06 while diagnosing issue 285 showed it does not keep that +promise: + +1. **Repositories carried the forge's address.** Every module's `repository`, every `reads` entry and + every `sources` entry was the URL the mesh clones from: the forge's private host name and port, then + owner and name. +2. **An owner is a person's login.** Repositories a person owns are named after the person's account + on the forge. +3. **A login in a setting.** A machine's settings layer for two download modules sets `username` to + an account name. The key does not read as a secret, the value is not a registered machine, site or + account, and so it passed unchanged. +4. **Manifests are carried whole.** Every module's manifest is kept as the mesh holds it. Some name + machines and the installation's domains in file names, paths, routes and descriptions. Only the + machines' own records are scrubbed, not the definitions. + +## Diagnosis + +The scrub (`internal/facts`) replaces registered names in text that passes through it: settings, +problems, resource names. The repositories, the manifests and the module records were assembled +straight from the store, without passing through it. Settings are scrubbed by key and by the shape of +the value, and a login has neither. + +Not all of it can be scrubbed in place. A check matches a pull request to the modules it moves by the +repository's owner and name, and composes the manifests as they are. A pseudonymised owner, or a +rewritten manifest, would judge a different mesh. + +## Fix + +- **Repositories are named `owner/repository`**, without the forge's address. A check matches + repositories by owner and name, never by the address, so nothing it reads is lost (`RepositoryName`). + +## Left open + +- Owners and the manifests stay as they are, because a check reads them. If a snapshot is to be + public, it needs a consistent pseudonym applied to the pull request's owner too, and a manifest + scrub that leaves composition unchanged. That is a question for the design, not the scrub. +- A login in a setting is caught only once the scrub knows the operator's logins on every machine, + not only the one the mesh records as its account.