1138 Commits

Include renames

Author	SHA1	Message	Date
jochen	13cd710071	mesh-mail: add mail_send, asked and sent once on the operator's Approve (issue 790)	2026-10-15 13:57:47 +02:00
jochen	b5417c28d0	Merge remote-tracking branch 'origin/main' into adr-359-mesh-mail-733	2026-10-15 10:44:37 +02:00
mesh-tools	5f6a41146c	Merge pull request 'mesh-mail: the operator's mail accounts, watched and said on the bus — stage 1, own server read-only (hq ADR 0359)' (#300) from adr-359-mesh-mail into main	2026-10-15 08:44:07 +00:00
mesh-toolsandClaude	2e32f47e45	Read branch protection as the forge's administrator, so builds register again ... The forge answers a repository's protection rules to its administrator alone, and the tools' account no longer is one (ADR 0365), so every delivery building a module failed at the controller's build-source check with a 403. gitea_branch_protection_get now reads the rules with the administrator account (ADR 0375); it only reads, and the protection set and every write stay refused to the tools' account. Issue 772. Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-15 00:18:39 +00:00
mesh-admin	9492278d93	Merge pull request 'Make the forge's tools act as an account of their own, not the administrator' (#311) from 365-forge-identities into main	2026-10-14 22:51:36 +00:00
jschoubben	373f339750	Give a walk the word of a stopped delivery that waits for it (hq issue 753) ... A delivery its group stopped for a member delivered since waits for a later walk of its repository that contains its merge (issue 747). When that walk carried no living delivery, nothing gave it its word and it waited forever. The delivery now takes its turn on the walk that answers its merge, in its group's order. A walk owed such a word stays under the orphans' timer, so past the grace without it `stalled` lists it with why (held, or the controller's refusal), and a walk no living delivery holds names the ended deliveries it carries.	2026-10-15 00:30:26 +02:00
mesh-adminandClaude Opus 5.5	48f0662fde	Make the forge's tools act as an account of their own, not the administrator (issue 469, ADR 0365 clause 2) ... The tools' token reached everything the administrator may do, so their boundary rested on their own guards. The gitea module now makes a plain account, mesh-tools, with the admin login, gives it write on code, issues and pull requests of every novox repository through one team, and mints the tools' token for it; the admin's old token goes only after the new one is kept. The Go forge bundle sends that token, never the admin login. The forge shows protection rules only to a repository administrator, so every check reads a branch's protection from the branch. mesh-admin stays a ready author, so marks made before the move keep counting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 22:28:25 +00:00
mesh-admin	7913b56d66	Merge pull request 'Add the kernel module: transparent huge pages set per machine (hq issue 746, ADR 0369)' (#310) from fix/746-huge-pages-madvise into main	2026-10-14 21:52:49 +00:00
jschoubben	ab1811d003	Reload, not restart, the huge pages unit when the setting changes (hq issue 746) ... A restart ran restore then apply, so every change passed back through the found mode and rotated the journal again. Reload applies the new value directly; restore also drops its state; no rotation while the machine boots; the unit is sandboxed.	2026-10-14 23:42:49 +02:00
mesh-admin	c79337579d	Merge pull request 'Make the forge's webhook a system one, and say whether its events are heard (hq issue 729)' (#309) from fix/729-the-forge-events-are-heard-or-said into main	2026-10-14 21:40:44 +00:00
jschoubben	3a84044ece	Add the kernel module: transparent huge pages set per machine (hq issue 746) ... With THP 'always' journald's mmapped journal files sit in 2 MiB folios, so each small journal write dirties and writes back 2 MiB; on the control node that saturated the root mirror holding the bus store and the store, and the controller lost its lease. The module sets the mode from a per-machine setting (default always, the kernel's own, so assigning it changes nothing until a machine sets madvise), verifies it took, rotates the journal once so new files are mapped under the new mode, gives back what it found when stopped, and serves kernel_huge_pages to measure file_thp per unit.	2026-10-14 23:31:13 +02:00
jschoubben	2833a049aa	Make the forge's webhook a system one, and say whether its events are heard (hq issue 729) ... POST /admin/hooks on gitea 1.27.3 makes a default webhook unless config.is_system_webhook is "true": a default webhook fires for no existing repository, and the system listing does not name it, so every start made another and no event reached the receiver. Its edit never changes a secret or a kind, so the new system webhook is made first and read back, then every other hook at the receiver is deleted: system, default, and each repository's copy of a default one, which would send its events twice. gitea_events says where the receiver listens, the hook as ensured and what it replaced, the verified and refused deliveries and the polls' pace. When nothing verified for ten minutes, since the start or the last delivery, while the poll found two heads or merges no event said, it is logged loudly once per silent spell and answered unhealthy; so are deliveries refused since the last verified one.	2026-10-14 23:28:41 +02:00
jschoubben	6f7f07635e	Cover a failed or stopped delivery once a later finished walk contains it (hq issue 747) ... A group member whose walk failed in an outage stayed failed after a later walk of its repository, containing its merge, was done; its group then stopped every later walk of the other repository, and the catalogue could deliver nothing. A failed or stopped delivery now reads covered when a done walk of its repository, made after its merge, whose commit contains it (the forge's word, as issue 362's containment), built every module it moves. A group counts it as delivered, and a member the group stopped for it no longer holds a walk back: the group stops a walk only for a member whose change is still undelivered. A stop covered under issue 480 now likewise makes its group read reached, not stopped. While the forge is asked, the walk is held back rather than stopped, for at most ten minutes from the first ask: a forge that keeps erroring or cannot say then lets the walk be asked to leave the stopped merge out, as before. The hold is said by waits, stalled and stalled walks. The pass reads kept walks each tick, so today's stuck deliveries clear after a restart.	2026-10-14 23:19:06 +02:00
jschoubben	d1debdcce8	Clear a forge token name held twice, and mint one process at a time (hq issue 740) ... The runtime starts the watcher and the tools as two processes over one kept token. Both minted at once on 2026-10-14 and left two tokens named mesh-tools; gitea refuses a delete by a name held twice, so every mint failed and every forge tool with it. A replace now deletes each token by the name by its id, from the account's whole list, and a mint holds a lock file beside the kept token and reuses what another process minted.	2026-10-14 22:38:38 +02:00
mesh-admin	0e7d9e74d2	Merge pull request 'Say every forge event on the bus through a signed system webhook (hq issue 729)' (#304) from feat/729-the-forge-says-every-event-on-the-bus into main	2026-10-14 20:28:01 +00:00
jochen	be53f5167a	mesh-mail: bound a fetch by bytes, show mail_accounts only to its grantees, say why grants are unread, judge a secret without reading it (hq issue 733) ... The review of #300 found a batch of 25 whole messages could hold a gigabyte, mail_accounts told ungranted callers folder names, counts and server errors, an unreadable grants setting was refused without its reason, and the watch read the password only to learn it was there.	2026-10-14 22:24:11 +02:00
jschoubben	1d8a244ba4	Say every forge event on the bus through a signed system webhook, and announce a head or merge at once (novox/hq issue 729) ... The gitea module keeps one system webhook for every event family, made or corrected at start with the admin account (POST /admin/hooks, forge 1.27.3) and a secret it mints and keeps. Its receiver, at the docker bridge's gateway, refuses an unsigned request before reading it, a body over 5 MB, and a signature that does not verify; it answers a verified delivery at once, drops one already heard by its delivery id, and publishes each as forge.<kind>.<action> on the module's events (its own stream, ADR 0363, follows issue 725). A pull request opened, pushed to or merged is announced at once. The polls look every five minutes only while deliveries arrive, and every 30 s again, saying so loudly, when one finds what no event said or ten minutes pass without a delivery. The announced records keep both paths from announcing twice.	2026-10-14 22:21:22 +02:00
mesh-admin	2edef5a00a	Merge pull request 'Build build-agent and route-proxy without a build ID (hq issue 721)' (#301) from fix/a-module-moves-only-when-its-program-changes into main	2026-10-14 20:21:12 +00:00
jochen	2130f99612	mesh-mail: say mail events on its own stream MAIL, granted per account by grants (hq ADR 0363) ... ADR 0359 asked for a stream of its own and a bus grant from the module's grants; ADR 0363 built both. The events leave the shared EVENTS stream, and one family pattern per change replaces the literal per-account emits, so a new account changes no manifest.	2026-10-14 22:17:09 +02:00
jochen	ed5690cee4	Merge remote-tracking branch 'origin/main' into adr-359-mesh-mail	2026-10-14 22:16:50 +02:00
mesh-admin	fadf5025cc	Merge pull request 'Merge a pull request marked ready at its head once its checks pass (issue 722)' (#303) from feat/merge-on-ready into main	2026-10-14 19:57:00 +00:00
jschoubben	baa5ef802e	Name the keys gitea's mergeable config takes: none (ADR 0326) ... gitea now declares a setting, so every mergeable file of it must name its keys; the runtime config reads no setting, and ready-authors reaches its own file.	2026-10-14 21:50:05 +02:00
jschoubben	5b20e419ec	Count a ready mark only from a listed account, after the last push and the label (issue 722) ... Review of #303: anyone who can comment could turn a stale label into a mark, and a long thread hid the newest comment. The forge now reads the pull request's whole timeline and takes a "ready at" comment only from the accounts in the trusted setting ready-authors (default the mesh's own forge account and the operator's), written after the label was last added and after the last push; any other author is ignored and said in the log.	2026-10-14 21:45:39 +02:00
mesh-admin	7e3e62062b	Merge pull request 'mesh-catalog: hear the build seat that builds now (hq issue 712)' (#298) from fix-712-catalogue-hears-build-agent into main	2026-10-14 19:35:13 +00:00
jschoubben	7e0001e304	Merge a pull request marked ready at its head once its checks pass (issue 722) ... The operator wants a reviewed pull request merged without a session calling the merge tool again after every recheck. The reviewer marks it ready (label mesh/ready and a comment "ready at <full head sha>"); the forge's open-pulls read carries the mark, and mesh-delivery merges through gitea_merge_pull_request at that head, in a group's order once its composed check passed. A push after the mark clears it; a failed check is said on the pull request and as a stalled line.	2026-10-14 21:23:26 +02:00
jschoubben	d94764f001	Build build-agent and route-proxy without a build ID (hq issue 721) ... Go's build ID hashes every input package, so a change mesh-builder never reaches still changed its bytes; without it, a rebuild of the same program is the same file, and the check can say the module is unchanged.	2026-10-14 21:07:26 +02:00
mesh-admin	482232e8c5	Merge pull request 'Give the build agent a judge cache of its own (issue 704, ADR 0358)' (#297) from fix/704-release-branch-judge into main	2026-10-14 18:19:31 +00:00
jochen	70c1110c53	Add mesh-mail: watch the operator's own mailbox read-only and say each mail on the bus ... ADR 0359 decided one module holds the operator's mail accounts. This is its first stage: an imap adapter that keeps IDLE on the inbox and polls the other folders read-only, indexes each message in its own database, keeps each attachment once by its SHA-256 in its bucket, and says every added, changed or removed message as a metadata-only event. Bodies and attachments are served only by its tools, to callers the trusted setting grants names. Its health waits for the account's own secret until it is given at the desk (issue 710).	2026-10-14 20:14:42 +02:00
jochen	dbe2949f84	mesh-catalog: pass over a build off its repository's trunk, as the controller does (ADR 0238) ... A branch built through the build verb is a real build, and placing it would make it the catalogue's current version though the controller never registers it. Say which of the controller's rules are mirrored and which need its records.	2026-10-14 20:09:39 +02:00
jschoubben	b7d9590fdc	An answered ask keeps its question whole, its answer below it (issue 714) ... Issue 372's fix with issue 639's one line edited an answered ask down to 'You chose X at HH:MM · headline', so the operator could not read back what they approved. The headline stays the title, the summary, points, link and Details stay the body, and how it ended and who acts on it become the note. Telegram cuts the body from its end past 4096 characters, never the title or the note.	2026-10-14 20:06:24 +02:00
jochen	7ee2869d60	mesh-catalog: narrow the placing by a string, which the check's non-strict compile can follow	2026-10-14 20:04:37 +02:00
jochen	0b74c04aa8	mesh-catalog: hear the build seat that builds now, so a merged build is registered when it is built (hq issue 712) ... Since the build role moved to node-build-agent (ADR 0190), the catalogue consumed only the retired mesh-build-machine.built, so builds reached it only through the replay it asks for at its start: mailu e1c8965d, built two minutes after the last replay, was never registered. Consume node-build-agent.built, and pass over the seat's merge checks, tries, dry runs and failures, which the old seat never said.	2026-10-14 20:03:25 +02:00
mesh-admin	e1c8965ddb	Merge pull request 'mailu: declare its unhealthy urgent (hq ADR 0355 §5, issue 691)' (#296) from adr-355-mailu-urgent into main	2026-10-14 17:01:22 +00:00
mesh-adminandClaude Opus 5.5	47ef2644ac	Give the build agent a judge cache of its own, and prove a release branch's move puts its verdicts out of date ... Every merge check's judge is built where no pull request can reach (hq ADR 0358 §6, issue 704): the build agent needs a directory beside its workspace, mounted at the same path, that only judge builds mount. ADR 0358 §5 already holds in the forge's holder; this test keeps it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 13:48:30 +00:00
jochen	8e821ef449	Say mail's failure urgently, on every channel ... A broken mailu was a warning, said only on the desk; refused or stuck mail must reach the operator wherever they are (ADR 0355 §5, issue 691).	2026-10-14 15:37:08 +02:00
jochen	07b9bd0ed4	Ban clients that try to log in on mail port 25 ... Port 25 takes no login, so a client that tries is guessing passwords; mailu's jail only matched Dovecot's failures and never banned them (issue 708). Relay attempts stay unbanned: postfix already refuses them.	2026-10-14 15:34:55 +02:00
jochen	8661bcfa22	Declare mailu's tools, so the controller knows the one its check asks	2026-10-14 15:21:39 +02:00
jochen	6049537655	Judge mailu's deferred queue by this side's faults, not one dead recipient ... A message to a far host that is down stays deferred for up to five days, and mailu's unhealthy now pages the operator, so one dead recipient would page for days. Overdue deferred mail is unhealthy only when a lookup failed here (a name-service failure, as in issue 687) or when it reaches three or more domains; one or two far domains are said in the answer, not alarmed.	2026-10-14 15:19:08 +02:00
jochen	bf3e801f67	Judge mailu by whether mail flows, not only by its parts ... On 2026-10-14 every mailu container read healthy while postfix could not resolve a name: inbound mail was refused with 450 and outbound mail sat in the deferred queue for days (issue 690). The smtp container is now judged by a tool check, mailu_health, asked inside it: postfix runs (the image's own check, kept), no message waits deferred longer than 30 minutes, and a public mail host resolves through the resolver postfix is given.	2026-10-14 15:14:51 +02:00
mesh-admin	50861c74f8	Merge pull request 'mailu: judge the front by SMTP and its certificate, not only its web health (hq issue 688)' (#285) from fix-688-mailu-health into main	2026-10-14 13:06:45 +00:00
mesh-admin	b15846dd6e	Merge pull request 'mailu: move the resolver to Mailu 2024.06.63, which follows the root key change (hq issue 687)' (#284) from fix-687-mailu-resolver into main	2026-10-14 12:32:36 +00:00
mesh-admin	a44d490d97	Merge pull request 'Five postgres consumers say which provision their check exercises (hq issue 145, to-be 48 Phase E)' (#289) from fix/145-a-consumer-is-held-under-its-provider into main	2026-10-14 05:26:47 +00:00
mesh-admin	af5cf53a34	Merge pull request 'lab: name the base image's age, refuse a stale one, and rebuild it (issue 698)' (#288) from fix/698-the-lab-names-its-base-age into main	2026-10-14 05:12:37 +00:00
jochen	2bb5d344f6	Hold umami's check to the share route's own 404, so an unknown route cannot pass it (hq issue 145, review 262) ... Any route umami does not serve answers 404 too, as an HTML page. The share route answers JSON with code not-found only after the database was asked; with the database down it answers 500.	2026-10-14 07:07:11 +02:00
jochen	0fcc560fec	lab: one job at a time with no await between check and start, and no rebuild left holding anything (issue 698, review 256) ... A run and a rebuild each asked the package registry between checking for the other and writing their status, so both could start and a bed could raise machines from an image being replaced. The registry is asked first now. A hard-killed rebuild's credential is cleaned like a run's; a job that never recorded its process is lost rather than blocking every run; and lab_check reports a missing or unreadable base image.	2026-10-14 03:34:46 +02:00
jochen	acf8a76646	lab: read the suite's verdict only after its recorded line, NOT REACHED in any case (issue 693, review 254) ... A test's own output, printed before the suite reports, could carry a line shaped like the suite's NOT PASSED or skipped line and stand for its verdict.	2026-10-14 03:28:20 +02:00
jochen	b62bb15839	Say which provision five consumers' checks exercise, so a database down is one condition (hq issue 145) ... gitea, nextcloud, umami and n8n gain an http check that reaches their database through their own endpoint; mesh-knowledge's watch already asks the database and now names it. While postgres is unhealthy, their findings are held under its condition instead of raising one each.	2026-10-14 03:21:53 +02:00
jochen	ff9d3ee6a0	lab: name the base image's age, refuse a stale one, and rebuild it (issue 698) ... A bed machine carries the package database its base image was built with, and the mirrors stop serving it within weeks: genesis-keeps-its-bus failed on a 404 from an image 44 days old, with nothing saying its age and no mesh tool to rebuild it. lab_check and lab_run now say the age, lab_run refuses an image older than 14 days and names the remedy, and lab_base reads the image and rebuilds it with mesh-lab's base build when asked.	2026-10-14 03:21:23 +02:00
jochen	c8255eb15d	lab: a run whose suite proved nothing reads as failed, with its skips (issue 693) ... lab_status took the suite's exit as the verdict, and the runner exits 0 when every test skipped: a genesis bed that skipped its only test as NOT REACHED was recorded as passed. A run that ended now has its outcome read from its log and kept in its status - totals, each skip with its reason, and why it did not pass - and one whose exit said 0 while no test passed reads as failed. Read from the lab's own lines when it prints them, from the runner's summary for a lab of before.	2026-10-14 03:14:06 +02:00
jochen	4ded07bc63	Judge mailu's front by what mail needs, not only its web health ... The image's own check asks nginx's /health and that dovecot runs, so the front stayed healthy while mail could not flow (issue 688). It now also needs port 25 to greet over SMTP and the served certificate to hold for 14 more days; certbot renews at 30, so a renewal stuck for two weeks is said long before the certificate expires.	2026-10-14 02:19:54 +02:00