From cd9336d05acaa836956ef7aba1e03f81757efa03 Mon Sep 17 00:00:00 2001 From: jochen Date: Sun, 18 Oct 2026 17:48:15 +0200 Subject: [PATCH] Design 47 and glossary: review round 1 (the sections stay the design until their release, rule 4's step above zero, the Approve on the phone until issue 953, release of a milestone under The record) --- 00-META/glossary.md | 4 ++-- .../47-delivery-from-commit-to-delivered.md | 13 +++++++------ 03-DESIGN/01-to-be/49-the-mesh-in-domains.md | 2 +- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/00-META/glossary.md b/00-META/glossary.md index 20540749..fa00de67 100644 --- a/00-META/glossary.md +++ b/00-META/glossary.md @@ -525,7 +525,7 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel merge it answers, and its record is one key of the bus's rollouts bucket, a link of the chain (ADR 0408). A primitive the delivering stage asks for, not an object anyone manages. A **tier** is one step of a rollout: a module, then the modules built against it. The controller's verb `plans` lists the rollouts. A module is rolled out by its `roll` - policy. Rollouts and tiers go at release 6 of ADR 0429, replaced by wants and haves (§17). + policy. Rollouts and tiers go at release 6 of ADR 0429 (§8, §15), replaced by wants and haves (§17). *Not:* ~~walk~~ (hq) - **first-node gate** — the judgement on a delivery's first node: healthy three times, no witness put it back, no condition raised since the send (ADR 0236 §2). Not *the gate* bare (see [Homonyms](#homonyms)). @@ -848,7 +848,7 @@ renaming one sense, the old sense moves to a *Not:* line and becomes mechanical. | | a git push | **git push** | The record | | | a phone notification | **push notification** | Operator and conversation | | release | a person letting a held delivery go on | **release** | Delivery | -| | one milestone built, checked and delivered as one (playbook 07; releases 1 to 6 of ADR 0429) | **release** of a milestone | Delivery | +| | one milestone built, checked and delivered as one (playbook 07; releases 1 to 6 of ADR 0429) | **release** of a milestone | The record | | | taking a consumer off a licence | **unbind** (verb `release`, to rename) | Identity and access | | | a copy of a work an engine can fetch | **media release** | Media | | gate | the judgement on a delivery's first node | **first-node gate** | Delivery | diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 365ee2da..a670d726 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -84,7 +84,7 @@ source revision is derived from the keys: every **want** equals its module's **f - **The teller** carries conditions and asks to the operator's phone and is the only writer of an ask's answer. - **The assigner** writes which fingerprint each node should run, by six rules: the build is done, the fingerprint is not held, the node is the module's **canary** or the canary runs it healthy, at most `step` - other nodes are ahead, every provider runs healthy, and the module's credential for that fingerprint exists. + other nodes are ahead when `step` is above zero, every provider runs healthy, and the module's credential for that fingerprint exists. - **The node agent**, the node-engine's own process, applies its wants one module at a time, backs up a data module first, and writes its haves. - **The watchman** turns the bus's connections into presence and mirrors every key whose next move a machine @@ -97,8 +97,8 @@ repository is made by the forge module from its config (ADR 0428; issue 1128 mak node at once). The reviewer stays the review agent's session. It lands in six releases, each leaving the mesh working, each one milestone below (ADR 0429 §7). Until the -release that replaces it is delivered, each section from here to *The bootstrap* describes what runs today and -stays its rule (ADR 0429 §21); each is rewritten when the release that replaces it is prepared (issue 1130). +release that replaces it is delivered, each section from here to *The bootstrap* stays this design and its rule +(ADR 0429 §21); each is rewritten when the release that replaces it is prepared (issue 1130). ## The parts @@ -576,8 +576,9 @@ From ADR 0429 (research 063's done-when, and the live proof each of its releases 18. On the live mesh a milestone of three repositories reaches every node through the keys alone (research 063's scenario A), and the assigner replaced in the middle of it resumes with nothing lost or repeated (scenario D, once). -19. Plans, batches, the merge window, tiers, the plans hold and node declaration holds and the push of whole - declarations are deleted from the code, and no verb that starts, stops, retries or closes a plan remains. +19. Plans, batches, the merge window, tiers, the plans hold and node declaration holds, the push of whole + declarations, their retries, takeovers and healers, and the node-engine's handling of whole declarations are + deleted from the code, and no verb that starts, stops, retries or closes a plan remains. 20. Each release's pull request reports the controller's code lines against research 063's baseline (111,386 lines on 2026-10-18). @@ -619,7 +620,7 @@ release reports the controller's code lines against research 063's baseline (acc | 5b | Decided: building and delivering leave the controller for parts that watch and write keys in the repository `mesh-delivery`, landing in six releases (ADR 0429); the forge module makes that repository from its config, protected before any team reaches it (ADR 0428) | — (ADR 0429 names them: 13 to 20) | hq, mesh-catalog (gitea) | 1117, 1124, 1128 | | 6 | Folded into release 4 by ADR 0429 §10: installed toolchains, builders fetching over SSH with their own key, and an SDK change shipping with its users are built in the builder's new home, so the builder is changed once | (2, 4: proved by release 4) | — | 979, 971 (moved to release 4) | | R1–2 | The operator sees every module on every node, with its fingerprint, phase and health, in `mesh-delivery-cli` and its web view, and a part that stops moving is raised as a condition within two minutes without a timer | 13, 14 | mesh-delivery (view, watchman), the node-engine (`mesh-host`: have keys; its alive message deleted), mesh-sdk (key layouts), mesh-controller (its silence timers deleted), mesh-catalog (zsh's `nox-delivery`) | opened once confirmed | -| R3 | A group reaches the mesh as one source revision written by the gate, the operator's asks come through the teller and can be answered in the view, and today's module mesh-delivery is split into its parts and ends | 15 | mesh-delivery (forge bridge, gate, teller, indexer), mesh-catalog (mesh-delivery split), mesh-sdk | opened once confirmed | +| R3 | A group reaches the mesh as one source revision written by the gate, the operator's asks come through the teller and can be answered in the view, but for the merge's Approve, answered on the phone until its way in proves who answered (issue 953), and today's module mesh-delivery is split into its parts and ends | 15 | mesh-delivery (forge bridge, gate, teller, indexer), mesh-catalog (mesh-delivery split), mesh-sdk | opened once confirmed | | R4 | The controller asks no build: a build is keyed by its fingerprint, so a merge builds nothing its check built; with milestone 6, toolchains are installed, builders fetch over SSH, and an SDK change ships with its users | 16, 2, 4 | mesh-delivery (builder, checker), mesh-controller (build dispatch deleted; build-agent leaves), mesh-catalog (build modules, ssh-client, gitea), mesh-sdk | 979, 971; the rest opened once confirmed | | R5 | The assigner writes what each node should run by its six rules, compared with what the controller sends, and the view shows every difference | 17 | mesh-delivery (assigner), mesh-controller (grants keys) | opened once confirmed | | R6 | Each node applies from its wants, a new version reaches the module's canary first and the rest once it is healthy there, and the plans are deleted from the code | 18, 19 | the node-engine (`mesh-host`: the node agent), mesh-controller (plans deleted), mesh-delivery (the gate's delivery states go) | opened once confirmed | diff --git a/03-DESIGN/01-to-be/49-the-mesh-in-domains.md b/03-DESIGN/01-to-be/49-the-mesh-in-domains.md index c5a21623..f798c39a 100644 --- a/03-DESIGN/01-to-be/49-the-mesh-in-domains.md +++ b/03-DESIGN/01-to-be/49-the-mesh-in-domains.md @@ -32,7 +32,7 @@ shape — what each is for, where its records live, and how they depend on one a | **Placement** | to decide, send and apply what each node runs, and say why | the controller's `inventory` database | | **Provisioning** | to resolve which module serves a provision for which consumer, and wire the two | the controller | | **Identity and access** | to issue, hold, rotate and check credentials and grants | the controller's `identity` and `licences` databases, and the vault | -| **Delivery** | to take one commit from its pull request to every node that should run it, and put it back when it fails | the `mesh-delivery` module and the controller's planner and rollout today; the parts of the repository `mesh-delivery` from release 6 of ADR 0429 | +| **Delivery** | to take one commit from its pull request to every node that should run it, and put it back when it fails | the `mesh-delivery` module and the controller's planner and rollout today; from each release of ADR 0429 on, the parts of the repository `mesh-delivery` it builds | | **Health and repair** | to notice what is wrong, say it once, repair what may be repaired unattended, and record what was done by hand | the controller's condition store | | **Data** | to know every item of data a module holds, how precious it is, and keep it recoverable | the manifests' data declarations, and every node's `node-backup` seat | | **Connectivity** | to make every node and module reachable by name where it should be, and unreachable where it should not | the controller |