From f91a5a7c75e5f29374e99232c501bf3859f24868 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 4 Nov 2026 23:37:21 +0100 Subject: [PATCH] =?UTF-8?q?Name=20the=20composing=20program=20built=20from?= =?UTF-8?q?=20a=20change,=20a=20probe=20for=20one=20health=20check,=20and?= =?UTF-8?q?=20ADR=200579=20=C2=A72's=20whole=20case=20(review=201)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig --- 00-META/checks/words-allowed.md | 2 +- 00-META/glossary.md | 5 +++-- .../41-the-shell-and-the-accounts-environment.md | 4 ++-- .../01-to-be/47-delivery-from-commit-to-delivered.md | 10 +++++----- .../01-to-be/48-a-module-says-how-it-is-healthy.md | 2 +- .../01-to-be/51-the-registries-keep-what-is-named.md | 2 +- 6 files changed, 13 insertions(+), 12 deletions(-) diff --git a/00-META/checks/words-allowed.md b/00-META/checks/words-allowed.md index d794aada..00573fc1 100644 --- a/00-META/checks/words-allowed.md +++ b/00-META/checks/words-allowed.md @@ -19,7 +19,7 @@ which keeps a record's words as it was imported. | `04-ISSUES/353-the-controller-asked-before-the-bus-held-its-grant/00-report.md` | 2027-04-30 | history: the issue's narrative keeps the word of its day, "merge gate" (issue 1303); it is not rewritten | | `04-ISSUES/354-a-decided-rename-was-never-scheduled-and-the-operator-believed-it-live/01-diagnosis.md` | 2027-04-30 | history: the issue's narrative keeps the word of its day, "merge gate" (issue 1303); it is not rewritten | | `04-ISSUES/362-two-merges-seconds-apart-left-their-delivery-waiting-for-a-person/01-diagnosis.md` | 2027-04-30 | history: the issue's narrative keeps the word of its day, "merge gate" (issue 1303); it is not rewritten | -| `04-ISSUES/364-the-gate-refuses-a-module-that-uses-a-seat-another-module-declares/00-report.md` | 2027-04-30 | history: the issue's narrative keeps the word of its day, "merge gate" (issue 1303); it is not rewritten | +| `04-ISSUES/364-the-gate-refuses-a-module-that-uses-a-seat-another-module-declares/00-report.md` | 2027-04-30 | history: the issue's narrative keeps the words of its day, "merge gate" (issue 1303) and "judge" (the glossary's manifest validator retired the noun); it is not rewritten | | `04-ISSUES/286-a-merge-check-passed-on-an-agents-machine-and-failed-on-the-build-seat/00-report.md` | 2027-04-30 | history: the issue's narrative keeps the word of its day, "judge" (the composition check's program built from a change; the glossary's manifest validator retired the noun); it is not rewritten | | `04-ISSUES/306-a-check-on-the-control-node-ran-past-its-timeout/01-diagnosis.md` | 2027-04-30 | history: the issue's narrative keeps the word of its day, "judge" (the composition check's program built from a change; the glossary's manifest validator retired the noun); it is not rewritten | | `04-ISSUES/310-a-pull-request-ran-its-own-copy-of-its-check/00-report.md` | 2027-04-30 | history: the issue's narrative keeps the word of its day, "judge" (the composition check's program built from a change; the glossary's manifest validator retired the noun); it is not rewritten | diff --git a/00-META/glossary.md b/00-META/glossary.md index 1f1550c4..2ab58497 100644 --- a/00-META/glossary.md +++ b/00-META/glossary.md @@ -665,10 +665,11 @@ controller (the planner, the rollout) until release 6 of ADR 0429; from each rel decoding, the seat and namespace rules, the bus and stream limits and the whole-catalog checks. It refuses a manifest, sets one aside to wait when it uses a field the running validator does not know yet, or accepts it; a manifest it accepted before keeps that verdict when a newer validator finds problems in it, each written as a - warning (ADR 0578 §1, ADR 0579 §1, ADR 0601). Its verdict is the indexer's state, and every other part decodes a + warning (ADR 0578 §1, ADR 0579 §1, ADR 0601 §3). Its verdict is the indexer's state, and every other part decodes a manifest and takes that verdict, never judging it (ADR 0578 §3). There is one copy, a package of the indexer's module that only the indexer and the checker use, never mesh-sdk's (ADR 0578 §4, ADR 0593 §1): the merge check - runs the trunk's in its sandbox over the manifests a change touches, failing only on what the change alters, and + runs the trunk's in its sandbox over the manifests a change touches, failing only on a problem in a manifest the + change alters or one between manifests that an altered manifest takes part in, and a group that changes it runs the one built from its own head (ADR 0578 §2, ADR 0579 §2). *Not:* ~~the judge / a judge / its judge / no judge / judge's / own judge / whose judge / same judge / indexer's judge / trunk's judge / running judge / older judge / newer judge / stricter judge~~ (hq) - **fingerprint** — what identifies a module's build by its content: a hash over its source files, its diff --git a/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md b/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md index c660ec20..01fd2451 100644 --- a/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md +++ b/03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md @@ -262,7 +262,7 @@ group**: the lighting daemon's, the container runtime's, a serial port's. It dec │ node-engine usermod --append ── recorded on openrazer.account: "the mesh added openrazer" │ - account look database lists it? ── running manager holds it? ── no: relogin needed + account probe database lists it? ── running manager holds it? ── no: relogin needed │ (module openrazer, kind account) controller module.openrazer..unhealthy, cleared on the first look after a new login ``` @@ -280,7 +280,7 @@ group**: the lighting daemon's, the container runtime's, a serial port's. It dec when the resource is undeclared, is given back. It is not given back while another declared resource asks for it. The account is taken out of that one group (`gpasswd --delete`), read back, and a failure is said and is not fatal, as giving back a shell is (WP1). -- **The node-engine, looking.** An account look sits beside liveness and the failed-unit reading +- **The node-engine, looking.** An account probe sits beside liveness and the failed-unit reading (issue 315). On every look it reads, for each account a module puts in groups, the database's groups and the groups of the account's running manager, from that process's status file. It states each as the module's resource of kind `account`: healthy, or unhealthy with *not in the group* or *relogin needed*. diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 89cf16d0..5e92575c 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -592,7 +592,7 @@ From its delivery, a check is this: providers it alters; for a group, once over every member's change, read from the indexer's candidates of the group, and while the indexer holds none the group's check waits and says why. It composes with the function every node agent composes with, mesh-sdk's composition, so the two agree for one mesh-sdk version; its verdict - names the mesh-sdk version it composed with. No composition check is built from a change: a change to the + names the mesh-sdk version it composed with. No composing program is built from a change: a change to the composition is proved by its own tests, a field only a newer composition reads goes out as optional first, and the running composition refuses a manifest that uses a field it does not read, naming the field. What it fails on, and its warning past twelve rebuilt modules, are the composition check's, as they were the controller's composition check's (ADR 0446, ADR 0237 §2). The assigner writes the verdict under the checker's hash of the heads it judged, in its own bucket, and the checker reads it into the @@ -913,9 +913,9 @@ and `delivered` events. - **Builds and tests run directly**, as the build module's own account on its node, in no container. The build module of each module's language runs its tests by that language's convention; no repository's script or toolchain line decides it, hq's included (ADR 0527). -- **A composition check built from a change has an account of its own, until release 4 is delivered (R4f).** Until then, one built from a sibling's +- **A composing program built from a change has an account of its own, until release 4 is delivered (R4f).** Until then, one built from a sibling's merge (ADR 0382 §3) is built and run as a second account of the Go build module, whose home, configuration and - cache the build seat's account cannot write, so a check's script cannot change it. From R4f no composition check is + cache the build seat's account cannot write, so a check's script cannot change it. From R4f none is built from a change and the account is not made (ADR 0446 §5). - **A module may ship its own Dockerfile.** A build module of its own builds the module's `image` artifact from it, rootless, with no root and no container runtime socket on the build node; a pull request's image is built and thrown away, and only a merged trunk commit's image reaches the registry, by digest. From R4g that module is the only part that builds an image, and build-agent builds none (ADR 0487 §7, ADR 0524 §5); the other builds are Go and Node programs, which their build modules build. @@ -1207,9 +1207,9 @@ From ADR 0548 and ADR 0551 (issue 568): group's merges (ADR 0418 §1, §5, §6). - The controller's tables of builds, build requests, rollouts and their tiers, batches and merges, and assignments; the record mirrors, probe D17's audit and healer H6 for those kinds (ADR 0408). -- At release 4's deliveries (R4f for the composition check, the one built from a change and the two statuses; R4g for the scripts): `merge-check.sh` and its `# mesh-check-toolchain` line in every repository a module is +- At release 4's deliveries (R4f for the composition check, the composing program built from a change and the two statuses; R4g for the scripts): `merge-check.sh` and its `# mesh-check-toolchain` line in every repository a module is built from, hq's included once the delivery is done (ADR 0445 §6, ADR 0527 §3); the controller's composition check, composing every - machine from clones and throwaway stores (ADR 0446 §1, §6); the composition check built from a change and the Go build + machine from clones and throwaway stores (ADR 0446 §1, §6); the composing program built from a change and the Go build module's second account for it (ADR 0446 §5); and the two statuses `mesh/merge-gate` and `mesh/repo-check` (ADR 0447 §1, ADR 0527 §2). - At R4g's delivery (ADR 0524, ADR 0525): build-agent, its program, its module and its Dockerfile code; mesh-tools's toolchain diff --git a/03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md b/03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md index 0eeb7d8b..dfbbf22a 100644 --- a/03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md +++ b/03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md @@ -508,7 +508,7 @@ open: - **The look.** Every 30 s, on the liveness loop's tick. The resolvers are asked concurrently, three questions each, with a reply read over raw UDP so "no such name" and "none" are told apart. The tunnel is read with the tunnel tool's handshake and allowed-address listings, never its dump, which holds the - private key. The hub is the peer whose allowed addresses are a range. The node-engine's network look keeps nothing on disk. + private key. The hub is the peer whose allowed addresses are a range. The node-engine's network probe keeps nothing on disk. Its two looks start afresh when the engine starts. - **The statement.** A `network` beside `resources` in the health statement. The controller reads the statement leniently, so the engine rolls out first and the controller after, and an older controller diff --git a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md index 399d5e49..4e239566 100644 --- a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md +++ b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md @@ -211,7 +211,7 @@ the verb. the program, so the port is free when the program starts. **What a pull meets in the swap**: from the registry container's stop until the program listens on the port, the store answers nothing. On main, a failed pull fails that module's apply, and the node agent tries a failed apply again only on the next change of the module's want or - composition, on the node-engine's verb `compose` naming the module (by hand), or when its liveness look finds a + composition, on the node-engine's verb `compose` naming the module (by hand), or when its liveness probe finds a declared resource missing or down; only a failure of the bus itself is tried again on a clock (a bounded backoff, at most four times before the have says failed). So another module's apply whose pull falls in that window stays failed, its running containers kept, until one of those: its have says failed naming the image.