1635 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
jochen	79de22423d	ADR 0270: how a failed new-module build is said, a one-machine module is never covered, and which gate tests the forge module ... Decision 1 named S6 for a failed new-module build; S6 is a lost build ask. Such a build is said by one line in the controller's log until its module is assigned. A module on one machine never gets a 'rest' step, so covered never reaches it. The forge module's tests run in the catalogue's TypeScript check, #151.	2026-10-09 03:24:10 +02:00
jochen	b04498c01f	ADR 0270: the forge's ancestry decides covered, and say what covered means and does not (review of #241) ... Merge order on a protected trunk is kept only as the first filter; the forge's compare, through a new read-only tool, decides whether a later merge contains a held one. A merge held without a passing check is covered only by a later delivery whose own check passed. Covered says a later merge that contains it was delivered, not that the change runs: a revert in between stays possible. A delivery that only adds a module is delivered whatever its build does, and covered wins over go when a person's walk fails between two readings. The glossary gains covered beside superseded and delivered. ADR 0271 names the bus upgrade as the mesh call and says S17 clears once the step sent the new bus.	2026-10-09 02:58:36 +02:00
jochen	31e78d62d4	Name the pull requests that build ADR 0270 and 0271	2026-10-09 02:35:05 +02:00
jochen	6163a74bb2	ADR 0270 and 0271 (proposed): a held delivery whose change runs ends by itself; a send held for the bus's step is told at once ... Issues 319 and 316: fifteen held deliveries asked a person a question with no right answer, and stop, the only way out, records a delivered change as an error. ADR 0270 delivers a merge that moves nothing at once, adds the final state covered for a merge a later delivered walk of the same trunk carried, and lifts a group hold once its composed check passed. Issue 336: a send held for the bus's planned step raised nothing for 28 minutes. ADR 0271 adds row S17, said at the first refusal for the operator with the verb, keeps S3 from calling it lateness, and has the delivery plan say before the merge that a person's bus upgrade follows. Each issue's diagnosis says what the fix does and how to verify it once delivered.	2026-10-09 02:34:18 +02:00
jochen	9bd0dcc611	Merge remote-tracking branch 'origin/issues/336-a-send-held-for-the-bus-step-raises-nothing' into decision/0270-0271-held-deliveries-end-and-bus-step-said	2026-10-09 02:31:05 +02:00
mesh-admin	171ac2a163	Merge pull request 'ADR 0269: what the mesh's own declaration stopped is started again when it goes' (#238) from decision/0269-what-the-meshs-own-declaration-stopped-is-started-again into main	2026-10-09 00:20:32 +00:00
jochen	a11b14f7ae	ADR 0269 accepted: note the narrowing on ADR 0118, and give it a home in the node-engine's design ... The operator accepted ADR 0269 on 2026-10-09. ADR 0118 gets the dated note the README asks for where a later record narrows its mechanism. The node-engine's to-be design names the decision and says what it changes, which the cycle check requires of an accepted record.	2026-10-09 02:17:32 +02:00
jochen	1a813ba313	ADR 0269: the -- check covers the calls in internal/system that name a service resource's unit	2026-10-09 02:03:32 +02:00
mesh-admin	4b6642de5e	Merge pull request 'Issue 339: the merge order against mesh-host #61, used-as-found as a behaviour change, the review's follow-ups' (#236) from issues/339-review-follow-ups into main	2026-10-08 23:55:39 +00:00
jochen	61ab74c70e	ADR 0269: the catch-up happens when the timer's last run is more than a week back	2026-10-09 01:54:51 +02:00
jochen	2e2be955e9	ADR 0269: say that a unit stopped by hand while held cannot be told apart, that a restored Persistent timer catches up at once, and what is left alone ... Third review: a person's stopping a unit the mesh also held stopped leaves no trace, so it is started again on removal; the home server's restored weekly timer would start a scrub of about 46 hours at once. A masked or since-changed unit is left alone, and a failed restore waits.	2026-10-09 01:54:42 +02:00
jochen	68018c7c1b	ADR 0269 (proposed): what the mesh's own declaration stopped is started again when it goes ... Unassigning the zfs module would leave the home server's pool with no scrub schedule: ADR 0118 never starts a unit on the way out, so the distribution's timer the module held stopped would stay stopped. The host now records what it declared beside what it found, and gives back only what the mesh's own declaration stopped.	2026-10-09 01:45:40 +02:00
jochen	1d9d535912	Issue 339: an unmarked file counts as trusted, and the rollback hazard of the trusted field and its fix	2026-10-09 01:42:51 +02:00
mesh-admin	5b0b550157	Merge pull request 'Issue 319: why no walk opened, and four held deliveries closed with stop' (#237) from issues/319-diagnosis-held-deliveries-closed into main	2026-10-08 23:39:02 +00:00
jochen	a93ecf90ea	Issue 319: record why no walk opened, and the four held deliveries closed with stop ... A new module counts as something to move, so its delivery is held; a later walk reaches only the delivery whose merge is its commit. Four covered deliveries were stopped before this issue was found, and their merged pull requests now say error.	2026-10-09 01:38:02 +02:00
jochen	5d054b722d	Issue 339: the terminal's settings are derived from what a module serves and which files it trusts; a found directory is its own condition the gate never reads as a fault	2026-10-09 01:24:14 +02:00
jochen	5fbd89c062	Issue 339: the gate reads a directory used as found as a wait for a person; the trust anchors are the terminal's	2026-10-09 00:55:54 +02:00
mesh-admin	e62ab24658	Merge pull request 'ADR 0268: the login shell's execute is withheld on the control-node until a call to it needs a person's approval' (#235) from decision/0268-the-login-shells-execute-is-withheld-on-the-control-node into main	2026-10-08 22:30:08 +00:00
mesh-admin	ef2a38474f	Merge pull request 'Research 039: a tool or verb that needs a person's approval' (#233) from research/039-a-tool-that-needs-a-persons-approval into main	2026-10-08 22:30:03 +00:00
jochen	ab027691e1	Issue 339: name the merge order against mesh-host #61, record used-as-found as a behaviour change, and the review's follow-ups	2026-10-09 00:28:55 +02:00
mesh-admin	0f02ac47d4	Merge pull request 'Issue 339: any caller of the settings verb could have the node-engine hand a system directory to an account' (#234) from issues/339-a-verb-can-place-a-directory-at-the-machines-own into main	2026-10-08 22:21:03 +00:00
jochen	7bd868786f	ADR 0268: the login shell's execute is withheld on the control-node until a call to it needs a person's approval ... The operator's decision of 2026-10-09: execute runs any command as an account that can become root without a person, so the control-node stops offering it now, and every node marks it as needing approval once the mark exists. To-be 41 gains WP7 for the seat and the shell module.	2026-10-09 00:12:53 +02:00
jochen	ccb54450ea	Research 039: the login shell's execute is the first case, and narrow read tools must come first or approvals become noise	2026-10-09 00:01:47 +02:00
jochen	ac3a67ebab	Issue 339: any caller of the settings verb could have the node-engine hand a system directory to an account ... Located in the controller (places and accesses taken through every verb, no line-break check) and the node-engine (a found directory chowned as root, through a link too, and any path mounted). ADR 0266's boundary depends on the fix.	2026-10-09 00:00:04 +02:00
jochen	c31a76cac5	Research 039: a tool or verb that needs a person's approval, so an agent may ask but cannot act alone	2026-10-08 23:59:45 +02:00
mesh-admin	e2de8811a3	Merge pull request 'ADR 0267: an artifact is rebuilt only when its build source changes, and a module moves only along build dependencies on artifacts' (#232) from decision/0267-a-module-moves-when-its-build-source-changes into main	2026-10-08 21:13:14 +00:00
jochen	d2fe9bc870	Accept ADR 0267: the operator's word of 2026-10-08 ... Set its status to accepted and state the notes on ADR 0162, 0238 and 0236 as decided.	2026-10-08 23:11:35 +02:00
jochen	7d3f4407a7	ADR 0267 (proposed): an artifact is rebuilt only when its build source changes ... A merge to a shared repository moved every module that read it, in a gated tier each (issue 338). The operator's rule maps a change onto the artifacts whose build source it touches and adds only modules with a build dependency on a changed artifact; sharing a repository is no dependency. Supersedes in part ADR 0162 decision 1 (the packages kind) and ADR 0238 decision 3 (whole repository and context reads); adds build source to the glossary.	2026-10-08 23:05:51 +02:00
mesh-admin	d0be529194	Merge pull request 'Issue 337: the store's reader can read the controller's signing key (critical)' (#230) from issues/337-the-stores-reader-can-read-the-controllers-signing-key into main	2026-10-08 20:16:30 +00:00
jochen	7f78016f07	Issue 337: say that only what is gone is reported revoked, and that a grant the reader passed on is taken back with CASCADE	2026-10-08 22:11:16 +02:00
jochen	b17839a7db	Issue 337 after review: say control-node, drop the store's operational settings, and match the fix's revoke-by-grantor and read-back ... Adds what the fix cannot see (definer functions and views; the name check as a backstop) and, as a follow-up, that the reader's read-only session is a default a statement can turn off, so the missing write grants are the guard.	2026-10-08 22:02:30 +02:00
mesh-admin	4955a663d3	Merge pull request 'Issue 335: a build that passed its gate was failed and put back by the first machine's later reports' (#227) from issues/335-a-passed-gate-was-failed-by-later-reports into main	2026-10-08 19:51:27 +00:00
jochen	bbbaf943e8	Issue 335: resolved by mesh-controller#165 (8170fc5) with replay R335	2026-10-08 21:49:00 +02:00
jochen	6c297214ad	Issue 337: the store's reader could read the controller's signing key and every secret the store holds ... Opened and diagnosed: pg_read_all_data on the login the store seat's query runs as. Says what the store can and cannot tell about whether the key was read, why it should be rotated once the fix is taken, and that no rotation mechanism exists yet. The fix is mesh-catalog PR 143.	2026-10-08 21:46:01 +02:00
mesh-admin	a1c85c6de5	Merge pull request 'Design 52: until it is adopted, the workstation's fstab line still mounts at boot (review follow-up)' (#229) from fix/shares-review-followups into main	2026-10-08 19:37:03 +00:00
mesh-admin	ebffbaa17e	Merge pull request 'ADR 0264 and issue 330: a message a consumer gives up on is kept until a person delivers it again or drops it' (#223) from fix/330-a-message-given-up-on-is-kept into main	2026-10-08 19:26:57 +00:00
jochen	4dd52cace6	Design 52: say the workstation's fstab line still mounts at boot until it is adopted, and can hold the boot 30 s	2026-10-08 21:14:34 +02:00
jochen	6fdaeb79ba	Issue 334 and ADR 0264: an ask a seat gave up on can only be dropped for now ... The review refused a grant over every seat's queue, and a copy published again left the original stuck in it.	2026-10-08 21:08:12 +02:00
jochen	b0986e2ae0	Issue 330: name the installer's user list among its fixes	2026-10-08 21:08:12 +02:00
jochen	d1e0e121d6	ADR 0264 and issue 330: keep what a consumer gives up on until a person acts ... Design 25 promised a dead-letter stream nothing built; a message a consumer gave up on was lost after a week, silently once its condition cleared.	2026-10-08 21:08:12 +02:00
jochen	e6f0e7e359	Issue 336: a send held for the bus's planned step raises no condition, so the operator is never asked ... For 28 minutes on 2026-10-08 every send to the control-node waited for a bus upgrade only a person can start, and nothing but a walk's note said so. Located in the controller: the refusal is kept as the walk's note, S3 fires only past a 30-minute bound with generic words, and probe DB reads only a running step.	2026-10-08 20:58:44 +02:00
jochen	f346efb938	Issue 335: leave fixed-by for the merge, and call the put-back refusal a guard	2026-10-08 20:49:40 +02:00
mesh-admin	4eb8be9e66	Merge pull request 'ADR 0263 (accepted), research 038, design 52: a share is a provision, a node mounts it on demand' (#221) from feat/mounts-module into main	2026-10-08 18:39:59 +00:00
jochen	b409537dbc	Issue 335: a build that passed its gate was failed and put back by the first machine's later reports ... Recorded so the gate's verdict is known to be final, and the replay R335 holds it.	2026-10-08 20:27:36 +02:00
jochen	d05c9d7ca4	Name the safe order of taking shares into use without the retired word	2026-10-08 20:22:05 +02:00
jochen	bffd0f90d0	ADR 0263 and design 52 after review: what each export promises, per-node grants, refusals, not-built checks, and a read-only-first rollout	2026-10-08 20:21:48 +02:00
mesh-admin	0811b21be1	Merge pull request 'ADR 0265 and issue 327: a verb that reads is answered on the serving controller's own connection, and every connection says what it is' (#224) from fix/327-a-verb-reads-on-the-serving-connection into main	2026-10-08 18:21:28 +00:00
jochen	0a38d9b21d	ADR 0265: a panicking verb answers, and refused logins are not a reconnect loop	2026-10-08 20:04:19 +02:00
jochen	c3a0f7a595	ADR 0265 and issue 327: answer read verbs on the serving connection and name every connection ... Hundreds of short connections an hour, all named mesh-controller, hid any client reconnecting in a loop.	2026-10-08 20:04:19 +02:00
mesh-admin	8665027873	Merge pull request 'ADR 0262: a left-out module's data is backed up as this controller reads it, and an unplaceable line is listed' (#226) from fix/0262-backup-as-read into main	2026-10-08 16:41:31 +00:00