1236 Commits

Include renames

Author	SHA1	Message	Date
mesh-tools	3a2560dc51	One forge user, nox-agent, for every machine's agents' SSH pushes, each machine's key titled by machine (issue 991, ADR 0410)	2026-10-17 00:46:43 +00:00
mesh-tools	661b83249c	Give the forge an ssh name of its own, so it no longer merges with the operator's entry for its machine (issue 955, ADR 0409)	2026-10-17 00:01:42 +00:00
mesh-tools	b159efd656	Keep gitea's forge-account provider running when a watch is refused, so a later grant is picked up (issue 955)	2026-10-16 23:26:01 +00:00
mesh-tools	065ecd85f5	Let gitea's forge-account provider read the assignments it learns its consumers from (issue 955)	2026-10-16 23:05:10 +00:00
mesh-tools	ae9cda8531	Hand ssh-client's forge files to the provisioner client (issue 955)	2026-10-16 22:05:52 +00:00
jschoubben	6f45570d4c	Do not remove keys or entries before the machines' keys are read (issue 955 F)	2026-10-16 22:54:31 +02:00
jschoubben	6fdf3629d3	Remove a machine's mesh keys and entry when its key is no longer reported (issue 955 F)	2026-10-16 22:53:22 +02:00
jschoubben	896f1d2854	Merge feat/agents-write-git-ssh into feat/agents-write-git-ssh-f (issue 955 F)	2026-10-16 22:48:06 +02:00
jschoubben	5c64b71cd7	Test the forge-account provider whole against a real bus and a fake forge (issue 955 F5)	2026-10-16 22:47:59 +02:00
jschoubben	1081a5f3ea	Declare the forge-account provision, its provider bundle, its fact and the keys it reads (issue 955 F4)	2026-10-16 22:46:27 +02:00
jschoubben	c346bba34e	Add the forge-account provider: an agent account, its team and its machine key per consumer (issue 955 F3)	2026-10-16 22:45:51 +02:00
fix-955-ssh	165cbcb35f	Merge branch 'feat/agents-write-git-ssh' into feat/agents-write-git-ssh-s	2026-10-16 22:44:43 +02:00
fix-955-ssh	9cb615f121	Prove the forge key process over a real bus in the merge check (issue 955 S4)	2026-10-16 22:44:36 +02:00
fix-955-ssh	ad5a0f8e44	Place the forge's known host, SSH Host and git rewrite (issue 955 S3)	2026-10-16 22:43:51 +02:00
fix-955-ssh	a4cdd05cb2	Declare ssh-client's keys state and its forge-account requirement (issue 955 S2)	2026-10-16 22:43:29 +02:00
fix-955-ssh	b2009f1bb5	Keep the machine's forge SSH key and its keys entry (issue 955 S1)	2026-10-16 22:43:18 +02:00
jschoubben	8131c13634	Register and prune an agent account's mesh SSH keys through the forge API (issue 955 F2)	2026-10-16 22:42:04 +02:00
jschoubben	c8dfbdc813	Lift the agent account code into internal/forgeaccount for the forge-account provider (issue 955 F1)	2026-10-16 22:41:11 +02:00
lead-57	deb2020bd4	Serve postgres's consumers the port its server is published on, not the container's 5432 (issue 957) ... On novox postgres is published 6852:5432; handed 5432, gitea and keycloak reached nothing once their files were filled from postgres's entry.	2026-10-16 21:56:15 +02:00
fix-deliv-awg@novox	9acd1f51c5	Merge branch 'feat/agents-write-git' into feat/agents-write-git-d	2026-10-16 21:36:10 +02:00
fix-deliv-awg@novox	4cccd817a0	End a group's ask and Approve when any member is pushed (issue 948, ADR 0398 §3)	2026-10-16 21:36:06 +02:00
fix-forge-awg	3cdea45f90	Keep main's rule right at every start and copy a covering glob's checks (issue 948, review round 1)	2026-10-16 21:35:51 +02:00
lead-57	4215b40547	Read the whole plan the controller writes: at, from, as, names and credential-tool (issue 954) ... The client decodes a plan strictly, and since the controller carries these fields (issues 923 and 928) it refused the plans of gitea, keycloak and claude-code.	2026-10-16 21:32:13 +02:00
fix-deliv-awg@novox	0bfece71da	Merge branch 'feat/agents-write-git' into feat/agents-write-git-d	2026-10-16 21:29:58 +02:00
fix-deliv-awg@novox	f61e00aeaa	Ask the operator to Approve a merge into main and merge only on the warrant (issue 948, ADR 0398 §3)	2026-10-16 21:29:55 +02:00
fix-forge-awg	789aa0133f	Keep the guard's push wording for main (issue 948)	2026-10-16 21:28:49 +02:00
fix-forge-awg	7807135a1b	Main takes no push and only mesh-tools merges, set by setup and guarded (issue 948, ADR 0398 §2)	2026-10-16 21:28:43 +02:00
fix-deliv-awg@novox	417f69567c	Merge only into main: a ready mark on another base is left to its author (issue 948, ADR 0398 §4)	2026-10-16 21:26:53 +02:00
fix-forge-awg	b0f86671b6	Give the agent's token write scopes and the agents write team (issue 948, ADR 0398 §1)	2026-10-16 21:25:59 +02:00
lead-57	d2992f81d1	Take mesh-sdk a4e7f48 in the modules that use its provider helper (issues 825, 849, 945) ... postgres, keycloak, mesh-provisioner-client, route-proxy and route-adapter now build against the feature's mesh-sdk: the harness package, the vault-name key and the helper's fixes.	2026-10-16 20:59:14 +02:00
fix-cat-pas@novox	dcedd8d2b2	Give the route plan entries their credential-form, and read the entry's vault-name in the route providers' tests (issues 923, 945)	2026-10-16 19:44:19 +02:00
fix-cat-pas@novox	302eab1431	Restore the test that both keycloak paths leave the same client, over the SDK's moved path (issue 849)	2026-10-16 19:37:54 +02:00
fix-cat-pas@novox	b0dc3323c9	Run keycloak on the SDK's harness and moved path, dropping its copies (issue 849)	2026-10-16 19:36:02 +02:00
fix-cat-pas@novox	33759f8b57	Run postgres on the SDK's harness and moved path, dropping its copies (issue 849)	2026-10-16 19:35:22 +02:00
fix-vault-pas@novox	2f09dd8501	Merge branch 'feat/providers-after-switch-on' into feat/providers-after-switch-on-v	2026-10-16 19:34:15 +02:00
fix-vault-pas@novox	5a00596908	Make the vault ask a software-issuing provider's tool itself for holders that hold nothing (issue 928)	2026-10-16 19:34:11 +02:00
fix-cat-pas@novox	a51e2c0fb4	Pin route-proxy's acme templates beside its manifest (issue 849)	2026-10-16 19:32:20 +02:00
fix-vault-pas@novox	044a548cee	Pin that the client asks a refused or not-yet secret again (issue 928)	2026-10-16 19:31:40 +02:00
fix-vault-pas@novox	0dab4475cd	Answer an unreadable assignment as not yet, never a refusal (issue 928)	2026-10-16 19:30:15 +02:00
fix-cat-pas@novox	0b056edaaa	Prove the client fills gitea's origins and keycloak's hostname from route-proxy's entry for a controller-shaped plan entry (issue 923)	2026-10-16 19:29:30 +02:00
fix-cat-pas@novox	cc9e7a72ee	Name the vault's credential vault-name in the client's bound-entry fixtures (issue 945)	2026-10-16 19:29:30 +02:00
mesh-tools	6005c6001e	Ask the plans again when the moved path starts before its runtime answers (issue 943) ... postgres and keycloak start their moved path beside Serve, and a watch asked before Serve runs is refused by the runtime. Run returned on that refusal and main only logged it, so a start that lost the race left the provider answering nobody and retiring nothing until its next restart: postgres on novox at 16:52, 18:29 and 18:48, on ace at 16:22, which kept issue 937's retirement condition on novox from clearing. Run now asks again, the wait doubling from a second to a minute, until the runtime answers or its context ends.	2026-10-16 16:52:52 +00:00
mesh-tools	d7a880a608	Say once after a restart that nothing waits, so an old retirement condition clears (issue 937) ... The controller clears a provider's retire-waiting condition only on its settled word, and a provider says settled only for a set its own memory held. A provider restarted after the set stopped waiting (here: the delivery of the grant-file fix) never says it, so the condition kept asking the operator to approve retiring what nobody waits on. The first pass of a process that finds every consumer asked now says settled once, with no set; the controller clears both conditions on it.	2026-10-16 16:42:39 +00:00
mesh-tools	3ee754eb3b	Merge pull request 'Keep serving the consumers postgres's grant file gives on its moved path (issue 937)' (#334) from fix/937-postgres-grants-on-moved-path into main	2026-10-16 16:32:21 +00:00
mesh-tools	41cdd03208	Keep serving the consumers postgres's grant file gives on its moved path (issue 937) ... Only a moved consumer's plan names postgres, so on the moved path every consumer still given by the controller's grant file was counted unasked and offered for retirement (ace 5 of 5, novox 7 of 9), and could have been retired unasked where the bound allowed. The moved path now reads MESH_RECEIVES again: its logins are asked, the ones no plan names are made and checked by the harness's grant pass until R1 (issue 682), and an unreadable grant file retires nothing (issue 241). The harness's grant pass becomes apply, identically in keycloak's copy.	2026-10-16 16:25:52 +00:00
jschoubben	77d751fe83	Test the router whole over the real bus: a held ask is offered when a channel can carry it (issue 926, ADR 0397)	2026-10-16 17:57:52 +02:00
jschoubben	c211762813	Hold an ask no channel can carry now and offer it when one can; show held and why (issue 926, ADR 0397) ... The router refused such an ask with 'no channel', so the asker waited for an Approve nobody saw. It is now held as an open ask with the per-kind reason, judged again when the kinds or a channel's standing change and every minute, and the knowledge base says held and why.	2026-10-16 17:51:32 +02:00
jschoubben	d4a9260847	Merge remote-tracking branch 'origin/main' into feat/900-node-files	2026-10-16 16:15:45 +02:00
jschoubben	5d98bcc0db	mesh-files: the holder of node-files, reads and writes with trash, owned paths and an act log, so file work on a node needs no shell (issue 900, ADR 0394)	2026-10-16 14:50:03 +02:00
jschoubben	2d1b20364f	mesh-delivery: an empty-head ready mark is cleared only after a minute, and not right after mark-ready; clearer wording (issue 913, issue 873)	2026-10-16 14:35:58 +02:00