1456 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
mesh-adminandClaude Opus 5.5	47ef2644ac	Give the build agent a judge cache of its own, and prove a release branch's move puts its verdicts out of date ... Every merge check's judge is built where no pull request can reach (hq ADR 0358 §6, issue 704): the build agent needs a directory beside its workspace, mounted at the same path, that only judge builds mount. ADR 0358 §5 already holds in the forge's holder; this test keeps it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 13:48:30 +00:00
mesh-admin	cb7bf94a77	Merge pull request 'mailu: ban clients that try to log in on port 25 (hq issue 708)' (#295) from fix-708-mailu-jail-port25 into main	2026-10-14 13:39:51 +00:00
jochen	07b9bd0ed4	Ban clients that try to log in on mail port 25 ... Port 25 takes no login, so a client that tries is guessing passwords; mailu's jail only matched Dovecot's failures and never banned them (issue 708). Relay attempts stay unbanned: postfix already refuses them.	2026-10-14 15:34:55 +02:00
mesh-admin	02427a60ef	Merge pull request 'mailu: judge the smtp container by whether mail flows (hq issue 690)' (#294) from fix-690-mail-flows into main	2026-10-14 13:29:25 +00:00
jochen	8661bcfa22	Declare mailu's tools, so the controller knows the one its check asks	2026-10-14 15:21:39 +02:00
jochen	6049537655	Judge mailu's deferred queue by this side's faults, not one dead recipient ... A message to a far host that is down stays deferred for up to five days, and mailu's unhealthy now pages the operator, so one dead recipient would page for days. Overdue deferred mail is unhealthy only when a lookup failed here (a name-service failure, as in issue 687) or when it reaches three or more domains; one or two far domains are said in the answer, not alarmed.	2026-10-14 15:19:08 +02:00
jochen	bf3e801f67	Judge mailu by whether mail flows, not only by its parts ... On 2026-10-14 every mailu container read healthy while postfix could not resolve a name: inbound mail was refused with 450 and outbound mail sat in the deferred queue for days (issue 690). The smtp container is now judged by a tool check, mailu_health, asked inside it: postfix runs (the image's own check, kept), no message waits deferred longer than 30 minutes, and a public mail host resolves through the resolver postfix is given.	2026-10-14 15:14:51 +02:00
mesh-admin	50861c74f8	Merge pull request 'mailu: judge the front by SMTP and its certificate, not only its web health (hq issue 688)' (#285) from fix-688-mailu-health into main	2026-10-14 13:06:45 +00:00
mesh-admin	b15846dd6e	Merge pull request 'mailu: move the resolver to Mailu 2024.06.63, which follows the root key change (hq issue 687)' (#284) from fix-687-mailu-resolver into main	2026-10-14 12:32:36 +00:00
mesh-admin	a44d490d97	Merge pull request 'Five postgres consumers say which provision their check exercises (hq issue 145, to-be 48 Phase E)' (#289) from fix/145-a-consumer-is-held-under-its-provider into main	2026-10-14 05:26:47 +00:00
mesh-admin	af5cf53a34	Merge pull request 'lab: name the base image's age, refuse a stale one, and rebuild it (issue 698)' (#288) from fix/698-the-lab-names-its-base-age into main	2026-10-14 05:12:37 +00:00
jochen	2bb5d344f6	Hold umami's check to the share route's own 404, so an unknown route cannot pass it (hq issue 145, review 262) ... Any route umami does not serve answers 404 too, as an HTML page. The share route answers JSON with code not-found only after the database was asked; with the database down it answers 500.	2026-10-14 07:07:11 +02:00
mesh-admin	e846c289c8	Merge pull request 'lab: a run whose suite proved nothing reads as failed, with its skips (issue 693)' (#287) from fix/693-a-run-that-proved-nothing-is-not-passed into main	2026-10-14 05:05:40 +00:00
jochen	0fcc560fec	lab: one job at a time with no await between check and start, and no rebuild left holding anything (issue 698, review 256) ... A run and a rebuild each asked the package registry between checking for the other and writing their status, so both could start and a bed could raise machines from an image being replaced. The registry is asked first now. A hard-killed rebuild's credential is cleaned like a run's; a job that never recorded its process is lost rather than blocking every run; and lab_check reports a missing or unreadable base image.	2026-10-14 03:34:46 +02:00
jochen	acf8a76646	lab: read the suite's verdict only after its recorded line, NOT REACHED in any case (issue 693, review 254) ... A test's own output, printed before the suite reports, could carry a line shaped like the suite's NOT PASSED or skipped line and stand for its verdict.	2026-10-14 03:28:20 +02:00
jochen	b62bb15839	Say which provision five consumers' checks exercise, so a database down is one condition (hq issue 145) ... gitea, nextcloud, umami and n8n gain an http check that reaches their database through their own endpoint; mesh-knowledge's watch already asks the database and now names it. While postgres is unhealthy, their findings are held under its condition instead of raising one each.	2026-10-14 03:21:53 +02:00
jochen	ff9d3ee6a0	lab: name the base image's age, refuse a stale one, and rebuild it (issue 698) ... A bed machine carries the package database its base image was built with, and the mirrors stop serving it within weeks: genesis-keeps-its-bus failed on a 404 from an image 44 days old, with nothing saying its age and no mesh tool to rebuild it. lab_check and lab_run now say the age, lab_run refuses an image older than 14 days and names the remedy, and lab_base reads the image and rebuilds it with mesh-lab's base build when asked.	2026-10-14 03:21:23 +02:00
jochen	c8255eb15d	lab: a run whose suite proved nothing reads as failed, with its skips (issue 693) ... lab_status took the suite's exit as the verdict, and the runner exits 0 when every test skipped: a genesis bed that skipped its only test as NOT REACHED was recorded as passed. A run that ended now has its outcome read from its log and kept in its status - totals, each skip with its reason, and why it did not pass - and one whose exit said 0 while no test passed reads as failed. Read from the lab's own lines when it prints them, from the runner's summary for a lab of before.	2026-10-14 03:14:06 +02:00
jochen	4ded07bc63	Judge mailu's front by what mail needs, not only its web health ... The image's own check asks nginx's /health and that dovecot runs, so the front stayed healthy while mail could not flow (issue 688). It now also needs port 25 to greet over SMTP and the served certificate to hold for 14 more days; certbot renews at 30, so a renewal stuck for two weeks is said long before the certificate expires.	2026-10-14 02:19:54 +02:00
jochen	054dc9618c	Move mailu's resolver to Mailu 2024.06.63, which follows the root key change ... The root zone signs with KSK-2024 since 2026-10-11. The pinned resolver image (2024.06.59) trusted only KSK-2017 and kept its anchor inside the container, so every lookup failed with SERVFAIL and mail was refused or stuck (issue 687). 2024.06.63 refreshes the anchor with unbound-anchor at every start and fails its health check on SERVFAIL, which the old 'dig @127.0.0.1' never did (issue 688).	2026-10-14 02:17:25 +02:00
mesh-admin	ebf7f3773d	Merge pull request 'build-agent: declare busy, so a replaced agent finishes the check it runs (issue 594, hq ADR 0335)' (#283) from feat/335-the-build-agent-declares-busy into main	2026-10-13 22:39:50 +00:00
jschoubben	c876ad4a83	Merge remote-tracking branch 'origin/main' into feat/335-the-build-agent-declares-busy ... # Conflicts: # modules/build-agent/README.md	2026-10-14 00:11:50 +02:00
jschoubben	12a5e7be73	build-agent: name mesh-builder by its path in busy, as its health does (review of #260)	2026-10-14 00:07:42 +02:00
mesh-admin	23a2e1e204	Merge pull request 'mesh-delivery: a closed pull request's check builds go, and a walk says what each build did (ADR 0350, issue 649)' (#282) from feat/350-one-build-per-change into main	2026-10-13 21:30:30 +00:00
jschoubben	66d22dd53e	Let a closed pull request's check builds go, and show what each walk build did ... A check's builds for its merge have no taker once the pull request closes unmerged, and the delivery should say whether a module was reused from the check or built, and why (novox/hq ADR 0350 §4, §5).	2026-10-13 23:04:41 +02:00
mesh-admin	7ed119995f	Merge pull request 'gitea serves the registry's public root; the lab trusts a tarball only there or at the forge's own origin (issue 624, ADR 0346)' (#280) from fix/624-the-forge-serves-its-public-root into main	2026-10-13 19:52:05 +00:00
mesh-admin	faebc3569a	Merge pull request 'An ask reads at a glance on the phone: a headline, a summary and its points, the rest in a note (issues 383 and 639)' (#278) from fix/383-an-ask-reads-at-a-glance into main	2026-10-13 19:02:21 +00:00
jochen	1faee6e279	lab: a forge setting that is not http(s) is never a trusted origin (hq issue 624, review 222)	2026-10-13 20:33:13 +02:00
jochen	6f7d06726c	gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624) ... The forge writes every tarball at its public name and the lab reaches it at a private address, so npm 12 refused every locked @novox package. The public name now comes from the mesh's own composition of the forge's route, through the lab's binding, and the lab compares scheme, host and port.	2026-10-13 20:33:02 +02:00
jochen	f09daabec3	A withheld change line in the note keeps its key's name; SDK at 5933eb7 (the review of mesh-controller #304) ... The router's fallback said a refused note line as "(a line carrying … is withheld here)", so the operator could not tell which setting held a value they were not shown. A change's line now keeps its key; any other line, or one whose key is refused too, is said withheld whole. The SDK pin moves to mesh-sdk 5933eb7, where no two asks digest the same.	2026-10-13 20:32:50 +02:00
jochen	bb5a342863	Every value an approval sets is in the note, whole where the sender is proven; the note is kept whole (issue 383) ... The review of mesh-controller #304: a proposal of more than three keys showed only the names of the rest, and its Details could carry no value, so Approve bound values the operator never saw. The router now shows an ask's WholeDetails in the note in place of its Details on a kind that proves who answers, held to the secret rule alone, and refuses an ask whose whole details carry a secret's shape. Telegram keeps the note whole when a message is too long, cutting the body first and saying so, and escapes the note as every other part. SDK at mesh-sdk f474544.	2026-10-13 17:16:50 +02:00
jochen	eadf301f9f	An ask reads at a glance on the phone: a headline, a summary and its points, the rest in a note (issues 383 and 639) ... The operator would not read the Telegram ask for ADR 0343: thirty plain lines, every clause on one, no bold, no summary. A settings proposal was the same wall of text, its values masked so the approval was blind. - messenger: an ask's message is the asker's headline and explanation alone; who asked and when, what each answer does, the expiry, where else it is answered and the asker's Details travel as the message's note (asks.Message.Note). Answered, the message is one line, "You chose Approve at 16:06 on Telegram · <headline>". An explanation that does not read at a glance (asks.Glance) is shown and logged. On a kind that proves who answers, an ask's values are shown whole (asks.Ask.Whole), held to the secret rule alone (from the earlier work on issue 383, #178). - telegram: every message in HTML, never reworded: the title bold, a key line monospace, the note apart in a collapsed blockquote; markup escaped. A tap is compared by its words, whitespace aside, and a message shown before is still compared by the digest it was kept under. - desk-channel: the note follows the body. - mesh-knowledge: a record that needs the operator carries a brief (headline, summary, at most three points), the 30th per-record rule; its ask shows the brief and never the clauses. An ask made before is composed again as it was asked (form), so its warrant still holds. - claude-code: an instructions proposal's explanation is one summary line (the proposer's, or the module's), its text in the Details; a question's context is at most 300 characters and its recommendation one point. Older proposals and questions keep their form. The SDK is pinned at mesh-sdk 9588871 (fix/639-an-ask-reads-at-a-glance), which adds Message.Note and asks.Glance.	2026-10-13 17:16:50 +02:00
mesh-admin	9c166398f2	Merge pull request 'Revert #277: no showmissed lock in betterbird's policy (issue 640)' (#281) from fix/640-revert-the-showmissed-lock into main	2026-10-13 15:06:09 +00:00
mesh-admin	e209d46faf	Merge pull request 'claude-code: the memory watch only notes a change, so it starts on a node with hundreds of files (issue 367)' (#279) from fix/367-memory-watch-takes-fast into main	2026-10-13 14:58:35 +00:00
jochen	f1f866050e	Revert the showmissed lock of #277: the operator wants no special handling in betterbird's config (hq issue 640) ... The fix is the approved settings layer (proposal s09bf8c99da7ac8b9: calendar.alarms.showmissed false), pushed to g14 and shanks.	2026-10-13 16:54:51 +02:00
mesh-admin	4d15a155e6	Merge pull request 'betterbird: a passed meeting's reminder does not come back at every Owl reload (issue 640)' (#277) from fix/640-a-dismissed-reminder-stays-dismissed into main	2026-10-13 14:47:58 +00:00
jschoubben	e46eeb8298	claude-code: the memory watch only notes a change, so it starts on a node with hundreds of files (issue 367) ... The runtime hands a watch its current values one at a time and gives them ten seconds. The handler read the state, waited for a running look and wrote files for each value, so with about 450 memory values the watch never started on g14 or shanks, and a file written on g14 never reached shanks. The handler now notes each key's newest revision and returns; a worker applies what was noted at the state's current version.	2026-10-13 16:40:41 +02:00
mesh-admin	5f491e0c09	Merge pull request 'lab: name the package registry by the address it names itself by, so npm 12 installs locked @novox packages (issue 624)' (#275) from fix/624-lab-names-the-registry-as-it-names-itself into main	2026-10-13 14:35:04 +00:00
jochen	73404a3c3f	betterbird: lock the missed-reminder pass off, so a passed meeting's reminder does not come back (hq issue 640) ... With calendar.alarms.showmissed on, Betterbird's alarm service fires every reminder of the past month that carries no later acknowledgement at each load of a calendar. Owl never sends a dismissal to Exchange and keeps it only in Betterbird's local cache, so on g14 September's Exchange meetings came back about every ten minutes, Dismiss or not. The policy now locks the pass off whatever the setting or profile says, and betterbird_check says when the running Betterbird still has it on beside an Owl calendar.	2026-10-13 16:32:17 +02:00
mesh-admin	305c2ba247	Merge pull request 'claude-code: a session's memory follows the operator to every node (issue 367, ADR 0343)' (#276) from fix/367-memory-follows-the-operator into main	2026-10-13 14:26:59 +00:00
jochen	8ad121d5c3	lab: take the registry's address only from the forge's own host, built from the parsed URL (hq issue 624, review of #275) ... What the registry answers may come over plain HTTP, so it must not choose where packages come from, nor reach the run's npm configuration as a raw string.	2026-10-13 16:26:48 +02:00
jschoubben	305601d25e	claude-code: memory carrying never leaves a memory folder, never takes the unreadable for gone, and screens every write (issue 367, review of #276) ... A value in the state could name a project such as ../../.. and be written outside the memory folder; a file or folder that could not be read was carried as a removal; text kept over a removal or merged in a conflict reached the state unscreened; and a conflict whose file could not be written was merged into the state again on every look. Names are judged before any file is touched, what cannot be read is kept and listed, every state write is screened, a conflict is written to the file before the state and warns once when it cannot be, a file changed between reading and writing is not written over, non-UTF-8 text is not carried, and a node that was away takes a removal it holds no change against (ADR 0343 §9, as clarified).	2026-10-13 16:20:02 +02:00
jschoubben	910bc58fe0	claude-code: keep two memory versions too large for one file in two, and say a text that cannot fit one value (issue 367) ... A merged file could exceed the state's 256 KiB value; the newer now stays in the file and the older is written beside it, each carried. A node that was away takes the newest version when its own file holds no uncarried change (tested).	2026-10-13 16:03:37 +02:00
jschoubben	0096beeff9	claude-code: say a memory conflict in the operator's plain words, and skip a look the state does not answer (issue 367) ... The warning now opens with what the operator is needed for and names no path, agent or session (ADR 0253's plain rule); clause references follow ADR 0343 as reviewed.	2026-10-13 16:01:16 +02:00
jschoubben	6aa30eae66	claude-code: carry each project's memory folder between nodes (issue 367, ADR 0343) ... A session started on another node began without what the sessions elsewhere had learned, because Claude Code keeps project memory on one node. The module's own process now carries the memory folders through its kept memory state: a change is written elsewhere only over the version it replaced, a file changed on two nodes keeps both (newer first) with a warning, and every replaced or removed version is kept. No tool writes memory.	2026-10-13 15:57:44 +02:00
jochen	bb60de6d61	lab: name the package registry by the address it names itself by, so npm 12 installs locked @novox packages (hq issue 624) ... npm 12 installs a locked tarball only from its configured registry; the forge writes every tarball URL, and so every lock file, at its public address, and the lab named the registry by its forge setting's address. Every run stopped at mesh-tools' install with EALLOWREMOTE.	2026-10-13 15:25:41 +02:00
mesh-admin	a84d0094a0	Merge pull request 'lab: read the bound forge credential through the tools bundle's env, and check in a fresh directory each time (issue 624)' (#274) from fix/624-lab-check-in-a-fresh-directory into main	2026-10-13 12:58:15 +00:00
jochen	dd39d4ace7	lab: name the bound credential in the tools bundle's env, and skip the locked-tree test as root (hq issue 624, reviews 198, 199) ... The lab's tools read their bound npm-package-registry credential, root's at 0600 on the machine. The controller gives the runtime's account exactly the files a tools bundle names in its env (ADR 0192), as gitea and umami are given theirs, so the bundle now names the credential and its binding there, and no other credential changes hands. The merge check runs as root, where no directory mode stops a removal: the test that makes an unremovable tree now skips there before it makes anything, and a second test clears leftovers whoever runs it.	2026-10-13 14:51:18 +02:00
jochen	5bd40fa406	lab_check: work in a fresh directory each time, and name what an earlier check left (hq issue 624) ... lab_check cloned into one fixed path, <work>/check, after an rm -rf whose result it ignored; a tree an earlier check left that the lab's account could not remove made every check fail on "destination path already exists". Each check now works in a fresh check-* directory it removes when done, and clears what earlier checks left, naming any path it could not remove.	2026-10-13 14:40:06 +02:00
mesh-admin	0d723484a8	Merge pull request 'lab: clone the forge with the credential the mesh binds and seals to the lab (issue 624)' (#272) from fix/624-lab-reads-the-forge-with-its-credential into main	2026-10-13 12:07:06 +00:00