From b771794f1c865d389d84545312b2ccf6836d3fd5 Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 15 Oct 2026 18:33:22 +0200 Subject: [PATCH] issue 800: keep notify's health as unit; the gate refuses a one-process module judged only by its own tool ADR 0227 rule 8 / ADR 0240 rule 2 refuse a module with no health check of another kind beside a tool check. mesh-mail-notifier has one process (notify); wiring mail_notifier_health as its manifest health, as the review note's wording suggested (mirroring mesh-mail's watch/mail_health), trips that rule because mesh-mail also has keep (kind unit) beside watch. mail_notifier_health stays built, tested and callable; notify's manifest health stays kind unit until the lead decides how a one-process module gets this automatically. --- modules/mesh-mail-notifier/README.md | 2 +- .../cmd/mesh-mail-notifier/health.go | 13 +++++++++++-- modules/mesh-mail-notifier/module.json | 7 +------ 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/modules/mesh-mail-notifier/README.md b/modules/mesh-mail-notifier/README.md index 2ce347ac..a711efff 100644 --- a/modules/mesh-mail-notifier/README.md +++ b/modules/mesh-mail-notifier/README.md @@ -37,4 +37,4 @@ accounts it announces, in mesh-mail's trusted setting `grants` (`mail-store`'s s | tool | does | |---|---| | `mail-notifier.status` | every account it is granted, when it last showed each one a notice, and any notice still failing to send (its count, last error, since when). Read-only | -| `mail_notifier_health` | how it is: unhealthy once a notice has failed to show for more than ten minutes, healthy otherwise, even mid-retry. Read-only | +| `mail_notifier_health` | how it is: unhealthy once a notice has failed to show for more than ten minutes, healthy otherwise, even mid-retry. Not (yet) the node-engine's own check of `notify` — one process cannot be judged only by its own tool (ADR 0227 rule 8); `notify`'s manifest health stays `unit` until the lead decides how a one-process module gets this automatically. Read-only | diff --git a/modules/mesh-mail-notifier/cmd/mesh-mail-notifier/health.go b/modules/mesh-mail-notifier/cmd/mesh-mail-notifier/health.go index 324b6af2..1ace5050 100644 --- a/modules/mesh-mail-notifier/cmd/mesh-mail-notifier/health.go +++ b/modules/mesh-mail-notifier/cmd/mesh-mail-notifier/health.go @@ -3,11 +3,20 @@ package main // mesh-mail-notifier's own health (review round 1 of issue 800, which added this tool beside mail-notifier's // seat verb status, as mesh-mail's own health tool is mail_health beside its seat tools). A notice that fails // to send stays pending and is retried, at most once a minute (Flush, notifier.go); the account's -// failing-since stays in the Store, so this tool — its own process, asked separately by the node-engine — -// sees the same account the live notifier does, with no state of its own to lose between asks. +// failing-since stays in the Store, so this tool — its own process, asked separately by the node-engine or by +// mesh_call — sees the same account the live notifier does, with no state of its own to lose between asks. // // Unhealthy once an account's notice has failed to show for more than UnhealthyAfter; healthy otherwise, even // while a notice is mid-retry. +// +// STOP (review round 1 of issue 800, not decided by its note): this tool is served and tested, but module.json +// does not name it as the notify process's own health check — mesh-mail-notifier has one process (notify), and +// the catalogue's gate refuses a module judged only by its own tool, with no check of another kind beside it +// (ADR 0227 rule 8, ADR 0240 rule 2; internal/catalogue/health.go ~297 in mesh-controller). mesh-mail avoids +// this because it has two processes — keep (kind unit) beside watch (kind tool, mail_health); mesh-mail-notifier +// has only notify, so wiring this tool the same way trips the gate. notify's health stays kind unit (liveness, +// as it was before this round) until the lead decides how a one-process module gets an automatic, node-engine +// enforced health of this kind: a second process judged some other way, or a change to the gate's rule. import ( "fmt" diff --git a/modules/mesh-mail-notifier/module.json b/modules/mesh-mail-notifier/module.json index 15dbd40a..1aa8910a 100644 --- a/modules/mesh-mail-notifier/module.json +++ b/modules/mesh-mail-notifier/module.json @@ -58,12 +58,7 @@ "notify" ], "health": { - "kind": "tool", - "tool": "mail_notifier_health", - "interval": "60s", - "timeout": "10s", - "looks": 2, - "grace": "120s" + "kind": "unit" } } ],