Build modules: a per-node processor cap, and each step's threads within it (issue 1806)

The operator's desktop slows while it builds (shanks at 92%, the Go build
runtime at 1650% of 24 processors). The build modules declare cpu-cap
(default shanks=50,g14=50,ace=75), which the composer turns into the runtime's
quota at idle priority; each step's go, node and buildah commands get
GOMAXPROCS and UV_THREADPOOL_SIZE for their part of it, and the status tools
show the limits and what the kernel holds the runtime to.

modules/mesh-build-go/cmd/mesh-build-go/build.go

@@ -183,12 +183,12 @@ func (m *Module) buildEnv(dir string) []string {
 	} else if modfile, ok := m.pinModfile(dir); ok {
 		mod += " -modfile=" + modfile // a pin on a pull request's head the fetch placed beside the workspace (pins.go)
 	}
-	return []string{
+	return append([]string{
 		"CGO_ENABLED=0",
 		"GOFLAGS=" + recipeFlags + " " + mod,
 		"GOTOOLCHAIN=local",
 		"GOMODCACHE=" + filepath.Join(m.Cache, "gomod"),
 		"GOCACHE=" + filepath.Join(m.Cache, "gobuild"),
 		"GOPROXY=off",
-	}
+	}, m.threadEnv()...)
 }

modules/mesh-build-go/cmd/mesh-build-go/cpu.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"git.novox.be/novox/mesh-sdk/go/buildcpu"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// The processors a step may take (novox/hq issue 1806). The kernel holds the module's runtime to idle priority and to
+// its node's share of the processors (the setting cpu-cap, written into its unit by the node-engine); inside that
+// bound a step starts no more threads than its part of it, so the steps running at once do not wait in the kernel's
+// throttle: GOMAXPROCS, which sets every go command's -p, the compiler's concurrency, a test binary's processors and
+// -parallel.
+
+// cpuLimits is what one step is held to now: the cap from the settings file, the machine's processors and the node's
+// capacity, read at every call like the capacity, so a change takes effect at the next step.
+func (m *Module) cpuLimits(say func(string, ...any)) buildcpu.Limits {
+	slots := 1
+	switch {
+	case m.Capacity != nil:
+		slots = m.Capacity()
+	case m.Settings != "":
+		slots = buildstep.NodeCapacity(m.Settings, buildstep.DefaultCapacities, m.Node, nil)()
+	}
+	if slots < 1 {
+		slots = 1
+	}
+	return buildstep.NodeLimits(m.Settings, m.Node, slots, say)
+}
+
+// threadEnv is the environment every go command of a step is given for its threads.
+func (m *Module) threadEnv() []string {
+	return buildcpu.Env(m.cpuLimits(nil).Threads)
+}
+
+// cpuStatus is what the status tool says of it: the limits a step is given, and what the kernel holds this runtime
+// to, read from its cgroup rather than assumed.
+func (m *Module) cpuStatus() map[string]any {
+	return map[string]any{"limits": m.cpuLimits(m.Say), "in-force": buildcpu.ReadInForce()}
+}

modules/mesh-build-go/cmd/mesh-build-go/fetch.go

@@ -292,7 +292,7 @@ func (m *Module) goEnv() []string {
 	if m.GoModCache != "" {
 		modcache = m.GoModCache
 	}
-	return []string{
+	return append([]string{
 		"GOTOOLCHAIN=local",
 		"GOFLAGS=-mod=mod",
 		"GOMODCACHE=" + modcache,
@@ -300,7 +300,7 @@ func (m *Module) goEnv() []string {
 		"GOPRIVATE=git.novox.be",
 		"GIT_TERMINAL_PROMPT=0",
 		"GIT_SSH_COMMAND=ssh -o BatchMode=yes",
-	}
+	}, m.threadEnv()...)
 }
 
 // goEnvFor is goEnv for a command run in dir: a directory that vendors (vendor/modules.txt) is read from its vendor

modules/mesh-build-go/cmd/mesh-build-go/installed_toolchain_test.go

@@ -5,10 +5,13 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"runtime"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/buildcpu"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 	"git.novox.be/novox/mesh-sdk/go/health"
@@ -41,6 +44,22 @@ func TestEveryStepEnvironmentSaysGotoolchainLocal(t *testing.T) {
 		if got := toolchainValues(env); len(got) != 1 || got[0] != "GOTOOLCHAIN=local" {
 			t.Errorf("%s: GOTOOLCHAIN settings %v, want exactly GOTOOLCHAIN=local", name, got)
 		}
+		// Issue 1806: and its threads, its part of the node's processor cap (probeEnv runs no build).
+		if procs := strings.Count(strings.Join(env, "\n"), "GOMAXPROCS="); name != "probeEnv" && procs != 1 {
+			t.Errorf("%s: GOMAXPROCS said %d times, want once: %v", name, procs, env)
+		}
+	}
+	// Three steps at once under shanks' default half of its processors share them: each gets a third of the half.
+	settings := filepath.Join(t.TempDir(), "settings.json")
+	os.WriteFile(settings, []byte(`{"capacity":"shanks=3","cpu-cap":"shanks=50"}`), 0o600)
+	m = &Module{Cache: t.TempDir(), Node: "shanks", Settings: settings}
+	l := m.cpuLimits(nil)
+	if want := buildcpu.Threads(50, runtime.NumCPU(), 3); l.Percent != 50 || l.Slots != 3 || l.Threads != want ||
+		!strings.Contains(strings.Join(m.goEnv(), " "), "GOMAXPROCS="+strconv.Itoa(want)) {
+		t.Errorf("limits %+v, goEnv %v; want %d threads", l, m.goEnv(), want)
+	}
+	if st := m.cpuStatus(); st["limits"].(buildcpu.Limits) != l {
+		t.Errorf("the status says %v", st)
 	}
 }
 

modules/mesh-build-go/cmd/mesh-build-go/isolate.go

@@ -40,7 +40,7 @@ func (m *Module) isolation(workspace string, write bool) buildstep.Isolation {
 		Workspace:   filepath.Join(m.Work, workspace),
 		Caches:      m.caches(),
 		WriteCaches: write,
-		Env:         []string{"PATH=" + path, "LC_ALL=C"},
+		Env:         append([]string{"PATH=" + path, "LC_ALL=C"}, m.threadEnv()...),
 	}
 }
 

modules/mesh-build-go/cmd/mesh-build-go/module.go

@@ -184,13 +184,14 @@ func (m *Module) Short(run func(ctx context.Context, args map[string]any) (any,
 }
 
 // Status is what the module reports of itself: the node, the recipe, the toolchain found and why it refuses, if it
-// does.
+// does, and the processors its steps may take (issue 1806).
 func (m *Module) Status(ctx context.Context) map[string]any {
 	err := m.Check(ctx)
 	installed, _ := m.Probe(ctx)
 	out := map[string]any{
 		"node": m.Node, "recipe": m.Recipe.Version(), "installed": installed,
 		"postgres-major": m.Recipe.PostgresMajor, "nats-server": m.Recipe.NatsServer, "refusing": err != nil,
+		"cpu": m.cpuStatus(),
 	}
 	if err != nil {
 		out["why"] = err.Error()

modules/mesh-build-go/files/settings.json

@@ -1,3 +1,4 @@
 {
-  "capacity": "shanks=3,ace=2,g14=0,novox=0"
+  "capacity": "shanks=3,ace=2,g14=0,novox=0",
+  "cpu-cap": "shanks=50,g14=50,ace=75"
 }

modules/mesh-build-go/go.mod

@@ -3,7 +3,7 @@ module meshbuildgo
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026095702-79649c3fa9f4
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026123700-04902ff24a0e
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0

modules/mesh-build-go/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026095702-79649c3fa9f4 h1:05sVel/UOvz4/g0dxrDOeVUL7BGakVrxPBlqRq02ZhM=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026095702-79649c3fa9f4/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026123700-04902ff24a0e h1:9Kwe61NVrT4NcNr6PZoupzsGuZCQ5WV+luqrxDV9frs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026123700-04902ff24a0e/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=

modules/mesh-build-go/module.json

@@ -29,6 +29,12 @@
       "description": "How many asks of the Go build seat this module runs at once on each node, as node=asks pairs separated by commas, such as shanks=3,ace=2 (novox/hq ADR 0525 §5); a node set to 0 pulls nothing, a node not named runs one at a time. The control-node and the laptop build nothing.",
       "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
       "default": "shanks=3,ace=2,g14=0,novox=0"
+    },
+    "cpu-cap": {
+      "type": "string",
+      "description": "The most of each node's processors this module's builds may take, as node=percent pairs separated by commas, such as shanks=50,ace=75 (novox/hq issue 1806); a node not named takes 50. The node-engine holds the module's runtime to it as a CPU quota, at idle priority, and each build step starts no more threads than its part of it.",
+      "pattern": "|[a-z0-9_-]+=([1-9]|[1-9][0-9]|100)%?(,[a-z0-9_-]+=([1-9]|[1-9][0-9]|100)%?)*",
+      "default": "shanks=50,g14=50,ace=75"
     }
   },
   "tools": [
@@ -106,7 +112,7 @@
       "path": "${dir:state}/settings.json",
       "mode": "0600",
       "owner": "mesh-build-go",
-      "takes-config": ["capacity"],
+      "takes-config": ["capacity", "cpu-cap"],
       "merge": "json",
       "template": "files/settings.json"
     },

modules/mesh-build-image/cmd/mesh-build-image/build_test.go

@@ -110,6 +110,9 @@ func TestBuildRunsBuildahRootlessAndAnswersTheDigest(t *testing.T) {
 		if !strings.Contains(env, "XDG_RUNTIME_DIR="+m.Store+"/xdg") {
 			t.Errorf("the environment of %q lacks the module's own runtime directory: %s", c.line, env)
 		}
+		if !strings.Contains(env, "GOMAXPROCS=") {
+			t.Errorf("the environment of %q gives buildah no thread limit (issue 1806): %s", c.line, env)
+		}
 	}
 	// The image is removed from the store once the digest is read, so the store does not grow with every build.
 	if len(f.called("rmi")) != 1 {

modules/mesh-build-image/cmd/mesh-build-image/cpu.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"git.novox.be/novox/mesh-sdk/go/buildcpu"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// The processors a step may take (novox/hq issue 1806). The kernel holds the module's runtime to idle priority and to
+// its node's share of the processors (the setting cpu-cap, written into its unit by the node-engine); inside that
+// bound a step starts no more threads than its part of it, so the steps running at once do not wait in the kernel's
+// throttle.
+
+// cpuLimits is what one step is held to now: the cap from the settings file, the machine's processors and the node's
+// capacity, read at every call like the capacity, so a change takes effect at the next step.
+func (m *Module) cpuLimits(say func(string, ...any)) buildcpu.Limits {
+	slots := 1
+	switch {
+	case m.Capacity != nil:
+		slots = m.Capacity()
+	case m.Settings != "":
+		slots = buildstep.NodeCapacity(m.Settings, buildstep.DefaultCapacities, m.Node, nil)()
+	}
+	if slots < 1 {
+		slots = 1
+	}
+	return buildstep.NodeLimits(m.Settings, m.Node, slots, say)
+}
+
+// threadEnv is the environment buildah is given for its threads (it is a Go program). What a build's RUN lines start
+// runs in the container's own environment, inside the runtime's cgroup: the quota and the nice level bind it.
+func (m *Module) threadEnv() []string {
+	return buildcpu.Env(m.cpuLimits(nil).Threads)
+}
+
+// cpuStatus is what the status tool says of it: the limits a step is given, and what the kernel holds this runtime
+// to, read from its cgroup rather than assumed.
+func (m *Module) cpuStatus() map[string]any {
+	return map[string]any{"limits": m.cpuLimits(m.Say), "in-force": buildcpu.ReadInForce()}
+}

modules/mesh-build-image/cmd/mesh-build-image/module.go

@@ -128,7 +128,8 @@ func (m *Module) Health(ctx context.Context) health.Answer {
 // Status is what the module reports of itself.
 func (m *Module) Status(ctx context.Context) map[string]any {
 	l, err := m.look(ctx)
-	out := map[string]any{"node": m.Node, "account": m.Account, "buildah": l.Buildah, "subuids": l.UIDs, "subgids": l.GIDs, "refusing": err != nil}
+	out := map[string]any{"node": m.Node, "account": m.Account, "buildah": l.Buildah, "subuids": l.UIDs, "subgids": l.GIDs, "refusing": err != nil,
+		"cpu": m.cpuStatus()}
 	if err != nil {
 		out["why"] = err.Error()
 	}

modules/mesh-build-image/cmd/mesh-build-image/probe.go

@@ -117,7 +117,7 @@ func (m *Module) storeFlags() []string {
 // error, and the next look refuses with it.
 func (m *Module) env() []string {
 	_ = m.ensureRuntimeDir()
-	return []string{"XDG_RUNTIME_DIR=" + m.runtimeDir()}
+	return append([]string{"XDG_RUNTIME_DIR=" + m.runtimeDir()}, m.threadEnv()...)
 }
 
 // runtimeDir is buildah's runtime directory, inside the store.

modules/mesh-build-image/files/settings.json

@@ -1,3 +1,4 @@
 {
-  "capacity": "shanks=3,ace=2,g14=0,novox=0"
+  "capacity": "shanks=3,ace=2,g14=0,novox=0",
+  "cpu-cap": "shanks=50,g14=50,ace=75"
 }

modules/mesh-build-image/go.mod

@@ -3,7 +3,7 @@ module meshbuildimage
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025175617-518dae5ec9c8
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026123700-04902ff24a0e
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-build-image/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025175617-518dae5ec9c8 h1:x4mvY7yiGTP5lnzxbiwyj1o24p05hAmzZP7xHg3XX2M=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261025175617-518dae5ec9c8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026123700-04902ff24a0e h1:9Kwe61NVrT4NcNr6PZoupzsGuZCQ5WV+luqrxDV9frs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026123700-04902ff24a0e/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-build-image/module.json

@@ -24,6 +24,12 @@
       "description": "How many asks of the image build seat this module runs at once on each node, as node=asks pairs separated by commas, such as shanks=3,ace=2 (novox/hq ADR 0525 §5); a node set to 0 pulls nothing, a node not named runs one at a time. The control-node and the laptop build nothing.",
       "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
       "default": "shanks=3,ace=2,g14=0,novox=0"
+    },
+    "cpu-cap": {
+      "type": "string",
+      "description": "The most of each node's processors this module's builds may take, as node=percent pairs separated by commas, such as shanks=50,ace=75 (novox/hq issue 1806); a node not named takes 50. The node-engine holds the module's runtime to it as a CPU quota, at idle priority, and each build step starts no more threads than its part of it.",
+      "pattern": "|[a-z0-9_-]+=([1-9]|[1-9][0-9]|100)%?(,[a-z0-9_-]+=([1-9]|[1-9][0-9]|100)%?)*",
+      "default": "shanks=50,g14=50,ace=75"
     }
   },
   "tools": [
@@ -77,7 +83,7 @@
       "path": "${dir:state}/settings.json",
       "mode": "0600",
       "owner": "mesh-build-image",
-      "takes-config": ["capacity"],
+      "takes-config": ["capacity", "cpu-cap"],
       "merge": "json",
       "template": "files/settings.json"
     },

modules/mesh-build-node/cmd/mesh-build-node/cpu.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"git.novox.be/novox/mesh-sdk/go/buildcpu"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+)
+
+// The processors a step may take (novox/hq issue 1806). The kernel holds the module's runtime to idle priority and to
+// its node's share of the processors (the setting cpu-cap, written into its unit by the node-engine); inside that
+// bound a step starts no more threads than its part of it, so the steps running at once do not wait in the kernel's
+// throttle.
+
+// cpuLimits is what one step is held to now: the cap from the settings file, the machine's processors and the node's
+// capacity, read at every call like the capacity, so a change takes effect at the next step.
+func (m *Module) cpuLimits(say func(string, ...any)) buildcpu.Limits {
+	slots := 1
+	switch {
+	case m.Capacity != nil:
+		slots = m.Capacity()
+	case m.Settings != "":
+		slots = buildstep.NodeCapacity(m.Settings, buildstep.DefaultCapacities, m.Node, nil)()
+	}
+	if slots < 1 {
+		slots = 1
+	}
+	return buildstep.NodeLimits(m.Settings, m.Node, slots, say)
+}
+
+// threadEnv is the environment every command of a step is given for its threads: GOMAXPROCS for esbuild and every Go
+// program, UV_THREADPOOL_SIZE for Node's worker pool.
+func (m *Module) threadEnv() []string {
+	return buildcpu.Env(m.cpuLimits(nil).Threads)
+}
+
+// cpuStatus is what the status tool says of it: the limits a step is given, and what the kernel holds this runtime
+// to, read from its cgroup rather than assumed.
+func (m *Module) cpuStatus() map[string]any {
+	return map[string]any{"limits": m.cpuLimits(m.Say), "in-force": buildcpu.ReadInForce()}
+}

modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -245,6 +246,11 @@ func TestNoCommandOfTheStepSeesATokenOfTheProcess(t *testing.T) {
 		if len(c.env) < 3 || !strings.HasPrefix(c.env[0], "PATH=") || !strings.HasPrefix(c.env[1], "HOME=") || c.env[2] != "LC_ALL=C" {
 			t.Errorf("%s was given %v, want PATH, HOME and the locale first", c.name, c.env)
 		}
+		// And its threads, its part of the node's processor cap (issue 1806).
+		if !slices.ContainsFunc(c.env, func(e string) bool { return strings.HasPrefix(e, "GOMAXPROCS=") }) ||
+			!slices.ContainsFunc(c.env, func(e string) bool { return strings.HasPrefix(e, "UV_THREADPOOL_SIZE=") }) {
+			t.Errorf("%s was given %v, without its threads", c.name, c.env)
+		}
 	}
 	// The runner main wires: what it hands a command is exactly what the step gave.
 	ran := forgekey.ExecRunnerClean(10*time.Second)(context.Background(), append(m.baseEnv(), "ONLY=this"), "env")

modules/mesh-build-node/cmd/mesh-build-node/isolate.go

@@ -35,7 +35,7 @@ func (m *Module) isolation(root string, write bool) buildstep.Isolation {
 		ReadOnly:    []string{m.toolchainDir()},
 		Caches:      []string{m.npmCache()},
 		WriteCaches: write,
-		Env:         []string{"PATH=" + pathOrDefault(), "LC_ALL=C"},
+		Env:         append([]string{"PATH=" + pathOrDefault(), "LC_ALL=C"}, m.threadEnv()...),
 	}
 }
 

modules/mesh-build-node/cmd/mesh-build-node/module.go

@@ -202,7 +202,8 @@ func (m *Module) Status(ctx context.Context) map[string]any {
 	err := m.Check(ctx)
 	installed, _ := m.Probe(ctx)
 	r := m.recipe()
-	out := map[string]any{"node": m.Node, "recipe": r.Version(), "installed": installed, "refusing": err != nil}
+	out := map[string]any{"node": m.Node, "recipe": r.Version(), "installed": installed, "refusing": err != nil,
+		"cpu": m.cpuStatus()}
 	if m.Toolchain != nil {
 		out["toolchain-dir"] = m.Toolchain.Paths.Dir(r.Version())
 		out["toolchain-installed"] = m.Toolchain.Present(r.Version())
@@ -227,7 +228,7 @@ const defaultPath = "/usr/local/bin:/usr/bin:/bin"
 // files and git configuration) and a fixed locale. A command is given these and its own words, never this process's
 // environment, which holds the module's bus credentials (ADR 0466 §4).
 func (m *Module) baseEnv() []string {
-	return []string{"PATH=" + pathOrDefault(), "HOME=" + m.Toolchain.homeOrEmpty(), "LC_ALL=C"}
+	return append([]string{"PATH=" + pathOrDefault(), "HOME=" + m.Toolchain.homeOrEmpty(), "LC_ALL=C"}, m.threadEnv()...)
 }
 
 func pathOrDefault() string {

modules/mesh-build-node/files/settings.json

@@ -1,3 +1,4 @@
 {
-  "capacity": "shanks=3,ace=2,g14=0,novox=0"
+  "capacity": "shanks=3,ace=2,g14=0,novox=0",
+  "cpu-cap": "shanks=50,g14=50,ace=75"
 }

modules/mesh-build-node/go.mod

@@ -3,7 +3,7 @@ module meshbuildnode
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026095702-79649c3fa9f4
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026123700-04902ff24a0e
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-build-node/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026095702-79649c3fa9f4 h1:05sVel/UOvz4/g0dxrDOeVUL7BGakVrxPBlqRq02ZhM=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026095702-79649c3fa9f4/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026123700-04902ff24a0e h1:9Kwe61NVrT4NcNr6PZoupzsGuZCQ5WV+luqrxDV9frs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026123700-04902ff24a0e/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=

modules/mesh-build-node/module.json

@@ -25,6 +25,12 @@
       "description": "How many asks of the Node build seat this module runs at once on each node, as node=asks pairs separated by commas, such as shanks=3,ace=2 (novox/hq ADR 0525 §5); a node set to 0 pulls nothing, a node not named runs one at a time. The control-node and the laptop build nothing.",
       "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
       "default": "shanks=3,ace=2,g14=0,novox=0"
+    },
+    "cpu-cap": {
+      "type": "string",
+      "description": "The most of each node's processors this module's builds may take, as node=percent pairs separated by commas, such as shanks=50,ace=75 (novox/hq issue 1806); a node not named takes 50. The node-engine holds the module's runtime to it as a CPU quota, at idle priority, and each build step starts no more threads than its part of it.",
+      "pattern": "|[a-z0-9_-]+=([1-9]|[1-9][0-9]|100)%?(,[a-z0-9_-]+=([1-9]|[1-9][0-9]|100)%?)*",
+      "default": "shanks=50,g14=50,ace=75"
     }
   },
   "tools": [
@@ -99,7 +105,7 @@
       "path": "${dir:state}/settings.json",
       "mode": "0600",
       "owner": "mesh-build-node",
-      "takes-config": ["capacity"],
+      "takes-config": ["capacity", "cpu-cap"],
       "merge": "json",
       "template": "files/settings.json"
     },