1423 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
mesh-admin	9c166398f2	Merge pull request 'Revert #277: no showmissed lock in betterbird's policy (issue 640)' (#281) from fix/640-revert-the-showmissed-lock into main	2026-10-13 15:06:09 +00:00
mesh-admin	e209d46faf	Merge pull request 'claude-code: the memory watch only notes a change, so it starts on a node with hundreds of files (issue 367)' (#279) from fix/367-memory-watch-takes-fast into main	2026-10-13 14:58:35 +00:00
jochen	f1f866050e	Revert the showmissed lock of #277: the operator wants no special handling in betterbird's config (hq issue 640) ... The fix is the approved settings layer (proposal s09bf8c99da7ac8b9: calendar.alarms.showmissed false), pushed to g14 and shanks.	2026-10-13 16:54:51 +02:00
mesh-admin	4d15a155e6	Merge pull request 'betterbird: a passed meeting's reminder does not come back at every Owl reload (issue 640)' (#277) from fix/640-a-dismissed-reminder-stays-dismissed into main	2026-10-13 14:47:58 +00:00
jschoubben	e46eeb8298	claude-code: the memory watch only notes a change, so it starts on a node with hundreds of files (issue 367) ... The runtime hands a watch its current values one at a time and gives them ten seconds. The handler read the state, waited for a running look and wrote files for each value, so with about 450 memory values the watch never started on g14 or shanks, and a file written on g14 never reached shanks. The handler now notes each key's newest revision and returns; a worker applies what was noted at the state's current version.	2026-10-13 16:40:41 +02:00
mesh-admin	5f491e0c09	Merge pull request 'lab: name the package registry by the address it names itself by, so npm 12 installs locked @novox packages (issue 624)' (#275) from fix/624-lab-names-the-registry-as-it-names-itself into main	2026-10-13 14:35:04 +00:00
jochen	73404a3c3f	betterbird: lock the missed-reminder pass off, so a passed meeting's reminder does not come back (hq issue 640) ... With calendar.alarms.showmissed on, Betterbird's alarm service fires every reminder of the past month that carries no later acknowledgement at each load of a calendar. Owl never sends a dismissal to Exchange and keeps it only in Betterbird's local cache, so on g14 September's Exchange meetings came back about every ten minutes, Dismiss or not. The policy now locks the pass off whatever the setting or profile says, and betterbird_check says when the running Betterbird still has it on beside an Owl calendar.	2026-10-13 16:32:17 +02:00
mesh-admin	305c2ba247	Merge pull request 'claude-code: a session's memory follows the operator to every node (issue 367, ADR 0343)' (#276) from fix/367-memory-follows-the-operator into main	2026-10-13 14:26:59 +00:00
jochen	8ad121d5c3	lab: take the registry's address only from the forge's own host, built from the parsed URL (hq issue 624, review of #275) ... What the registry answers may come over plain HTTP, so it must not choose where packages come from, nor reach the run's npm configuration as a raw string.	2026-10-13 16:26:48 +02:00
jschoubben	305601d25e	claude-code: memory carrying never leaves a memory folder, never takes the unreadable for gone, and screens every write (issue 367, review of #276) ... A value in the state could name a project such as ../../.. and be written outside the memory folder; a file or folder that could not be read was carried as a removal; text kept over a removal or merged in a conflict reached the state unscreened; and a conflict whose file could not be written was merged into the state again on every look. Names are judged before any file is touched, what cannot be read is kept and listed, every state write is screened, a conflict is written to the file before the state and warns once when it cannot be, a file changed between reading and writing is not written over, non-UTF-8 text is not carried, and a node that was away takes a removal it holds no change against (ADR 0343 §9, as clarified).	2026-10-13 16:20:02 +02:00
jschoubben	910bc58fe0	claude-code: keep two memory versions too large for one file in two, and say a text that cannot fit one value (issue 367) ... A merged file could exceed the state's 256 KiB value; the newer now stays in the file and the older is written beside it, each carried. A node that was away takes the newest version when its own file holds no uncarried change (tested).	2026-10-13 16:03:37 +02:00
jschoubben	0096beeff9	claude-code: say a memory conflict in the operator's plain words, and skip a look the state does not answer (issue 367) ... The warning now opens with what the operator is needed for and names no path, agent or session (ADR 0253's plain rule); clause references follow ADR 0343 as reviewed.	2026-10-13 16:01:16 +02:00
jschoubben	6aa30eae66	claude-code: carry each project's memory folder between nodes (issue 367, ADR 0343) ... A session started on another node began without what the sessions elsewhere had learned, because Claude Code keeps project memory on one node. The module's own process now carries the memory folders through its kept memory state: a change is written elsewhere only over the version it replaced, a file changed on two nodes keeps both (newer first) with a warning, and every replaced or removed version is kept. No tool writes memory.	2026-10-13 15:57:44 +02:00
jochen	bb60de6d61	lab: name the package registry by the address it names itself by, so npm 12 installs locked @novox packages (hq issue 624) ... npm 12 installs a locked tarball only from its configured registry; the forge writes every tarball URL, and so every lock file, at its public address, and the lab named the registry by its forge setting's address. Every run stopped at mesh-tools' install with EALLOWREMOTE.	2026-10-13 15:25:41 +02:00
mesh-admin	a84d0094a0	Merge pull request 'lab: read the bound forge credential through the tools bundle's env, and check in a fresh directory each time (issue 624)' (#274) from fix/624-lab-check-in-a-fresh-directory into main	2026-10-13 12:58:15 +00:00
jochen	dd39d4ace7	lab: name the bound credential in the tools bundle's env, and skip the locked-tree test as root (hq issue 624, reviews 198, 199) ... The lab's tools read their bound npm-package-registry credential, root's at 0600 on the machine. The controller gives the runtime's account exactly the files a tools bundle names in its env (ADR 0192), as gitea and umami are given theirs, so the bundle now names the credential and its binding there, and no other credential changes hands. The merge check runs as root, where no directory mode stops a removal: the test that makes an unremovable tree now skips there before it makes anything, and a second test clears leftovers whoever runs it.	2026-10-13 14:51:18 +02:00
jochen	5bd40fa406	lab_check: work in a fresh directory each time, and name what an earlier check left (hq issue 624) ... lab_check cloned into one fixed path, <work>/check, after an rm -rf whose result it ignored; a tree an earlier check left that the lab's account could not remove made every check fail on "destination path already exists". Each check now works in a fresh check-* directory it removes when done, and clears what earlier checks left, naming any path it could not remove.	2026-10-13 14:40:06 +02:00
mesh-admin	0d723484a8	Merge pull request 'lab: clone the forge with the credential the mesh binds and seals to the lab (issue 624)' (#272) from fix/624-lab-reads-the-forge-with-its-credential into main	2026-10-13 12:07:06 +00:00
jochen	8d8dcd5ebb	lab: a read-only forge account of its own, and no credential left on disk after a stop (hq issue 624, review 196) ... The lab's credential came from the package team, which also writes the @novox packages, and the branches a run clones are not reviewed yet. The lab now contributes {"access": "read"} to its npm-package-registry requirement, and gitea's provisioner puts such a consumer on a team of its own, readers: code read on the org's repositories, package read, no write, and off the package team. The build agent, which publishes, stays on packages. A stop's SIGTERM to the run's process group killed the wrapper before it removed the credential file. The run's script now removes it as soon as its clones are done and traps every way it ends, and a run's start and lab_check remove what a crash or a reboot left.	2026-10-13 14:00:59 +02:00
mesh-admin	cd23928320	Merge pull request 'licence manager: say what moved a binding, why, and who asked (issue 625)' (#270) from fix/625-a-licence-move-says-what-why-and-who into main	2026-10-13 11:59:02 +00:00
mesh-admin	8922c89059	Merge pull request 'dev-tools: give every node the toolchains to build and test the mesh's code (issue 626)' (#269) from fix/626-every-node-has-the-dev-tools into main	2026-10-13 11:56:18 +00:00
jochen	789d2d9d64	lab: clone the forge with the credential the mesh binds and seals to the lab (hq issue 624) ... mesh-tools-go is private, and the lab cloned over HTTP with no credential: a run failed at its checkout, "could not read Username". The lab now requires the package registry, as the build agent does; the forge's provisioner binds it an account and seals that account's password, and a run offers them to the forge's own origin through git's credential store, from a file beside the run and removed when it ends: never in a URL, the run's script, an argument or the log. lab_check reads every repository a run clones with that same credential and names one it cannot read.	2026-10-13 13:54:16 +02:00
mesh-admin	1725ffc799	licence manager: a login's adoption is said beside the bindings it made, not first (issue 625) ... The bindings a login makes are now announced as licence.bound before the adoption's own event, so the test asks for each event rather than for adoption to come first.	2026-10-13 11:49:30 +00:00
mesh-admin	a72eb3dbb2	licence manager: say what moved a binding, why, and who asked (issue 625) ... A switch of g14 back to another licence on 2026-10-13 left no trace: the manager logged no line and sent no event for bind, switch or release, and its audit kept only the verb's name. Every change of what a consumer holds now goes to the journal, the audit and a licence.<what> event with the same fields: consumer, licence before and after, generation, why (the verb or the rule) and by (the caller the runtime proved, or the manager itself). The node is told why in the bindings state and says it when it applies. The audit and binding tables become readable through the store's reader. The SDK moves to the version that proves the caller (issue 365).	2026-10-13 11:45:52 +00:00
mesh-admin	c0726ac264	dev-tools: give every node the toolchains to build and test the mesh's code (issue 626) ... Every node is a development machine: an agent builds a change and runs its tests there before opening a pull request, and the lab tests it afterwards as QA. No module declared Go or npm, so no node could do the first part.	2026-10-13 11:42:12 +00:00
mesh-admin	19ecad261c	Merge pull request 'lab: install each checkout where its lock file is, check out mesh-tools-go, and have lab_check catch both (issue 624)' (#268) from fix/624-lab-run-installs-what-each-checkout-has into main	2026-10-13 11:11:58 +00:00
jochen	c6a9c52dc7	Install each lab checkout where its lock file is, check out mesh-tools-go, and have lab_check catch both (hq issue 624) ... lab_run ran npm ci at the root of mesh-sdk, mesh-tools and mesh-lab; mesh-tools keeps its package in node-tools/ with no lock file at its root, so every run failed at its setup in nine seconds. A run now installs (and, for the SDK and the base, builds) where a package-lock.json is: the root, or each directory one level down; a package.json with no lock file fails the run naming it. It checks out mesh-tools-go, which genesis builds since issue 616, and tells the beds where its checkouts are (MESH_LAB_REPOS). lab_check asks the forge for every repository a run clones and applies the same install rule to the ones it installs, so a run's setup failure is found before a run.	2026-10-13 11:55:01 +02:00
mesh-admin	45d01e77c2	Merge pull request 'fail2ban: know the own-addresses list in the form fail2ban prints it (hq issue 238)' (#267) from fix/238-fail2bans-own-file-form into main	2026-10-13 09:18:26 +00:00
jochen	c78d0a0134	fail2ban: know the own-addresses list in the form fail2ban prints it (hq issue 238) ... fail2ban reads the ignoreip entry file:/var/lib/... and prints it back as file://var/lib/..., in get <jail> ignoreip and in its "Ignore ... by ..." log lines alike. The watch compared the text, so on ace it said every jail lacked the list while each held it, failing fail2ban's health and its walk; and it would never have counted a failure from the operator's own address. Compare the path instead, with a test on fail2ban's real form.	2026-10-13 11:14:24 +02:00
mesh-admin	f35b067504	Merge pull request 'fail2ban: never ban the operator's own addresses, and say a failure from one (hq issue 238, ADR 0339)' (#266) from fix/238-the-operators-own-addresses into main	2026-10-13 09:05:49 +00:00
jochen	93d58f3740	fail2ban: never ban the operator's own addresses, and say a failure from one (hq issue 238, ADR 0339) ... An agent polling the forge from the operator's home got that home banned for a day and then four weeks, and nothing in the house reached the control-node. Every jail spared only private ranges. The mesh-wide setting own-addresses reaches the machine as a mergeable file whose own content is the empty list, so the module composes while it is unset. A new watch process (root) writes its entries into a list every jail's base ignoreip names as file:, which fail2ban reloads without a restart; it checks every jail names that list and keeps each failure a jail ignored because of it for a day. The new fail2ban_health tool judges the watch, so the controller raises a warning naming node, jail, address and count. The ban verb refuses an address on the setting or on the jail's ignore list before the daemon is asked.	2026-10-13 10:54:49 +02:00
mesh-admin	5cd608ba88	Merge pull request 'Deliver a merge whose walk said its modules matched what runs, instead of stopping it as stranded (hq issue 611)' (#265) from fix/611-an-unchanged-build-is-delivered into main	2026-10-13 08:25:47 +00:00
jochen	2f5e97030a	Deliver a merge whose walk said its modules matched what runs, instead of stopping it as stranded (hq issue 611) ... A walk that moved nothing because every module's recorded build source held none of the changed files now says so per module (delivery.unchanged). Such a merge moves nothing (ADR 0270 §1): it is delivered, naming the modules, not stopped 20 minutes later with the operator asked about a change already on every machine. A module the walk neither built nor said unchanged still stops it (issue 474).	2026-10-13 08:18:25 +02:00
mesh-admin	bc3b59227f	Merge pull request 'A password, token or API key is the vault's, never a setting (hq issue 342)' (#264) from fix/342-a-secret-is-never-a-setting into main	2026-10-13 05:52:05 +00:00
jochen	eb42806379	Make grafana prefer the vault's password, and let the secrets list only shrink (hq issue 342) ... grafana's client logged in with a token setting ahead of the vault's admin password, and its runtime config let a layer set token. The token setting is now ignored and said, token is protected, and the vault's password comes first. checks/secrets/known could gain a line hiding a newly unprotected key. merge-check.sh now judges it against the trunk's copy at the merge base, and refuses an added line.	2026-10-13 07:43:08 +02:00
jochen	fe2040c65e	Keep every password, token and API key the vault's, never a setting (hq issue 342) ... A setting outranked the vault: baserow, grafana, letta and unifi merged a layer's password over the ${secret:...} in their runtime config, and the gitea, home-assistant, icecast, influxdb, mailu and nextcloud clients read the settings file before the vault's file. A secret in a setting cannot be rotated and is read back by the settings verb. The four files now keep their password protected, so the controller refuses a setting of it. The six clients ignore a secret in the settings file and say so once, by key and never with the value; icecast reads its admin password from the vault's file. checks/secrets refuses a mergeable file whose secret a layer could replace; searxng's nested server.secret_key is listed as known until the controller protects a nested key.	2026-10-13 07:32:19 +02:00
mesh-admin	53e5186496	Merge pull request 'build-agent: the package registry is optional, and genesis hands it the forge it raised (hq issue 121, ADR 0336)' (#263) from fix/121-genesis-package-registry into main	2026-10-13 03:37:08 +00:00
jochen	e0bc919d49	Let genesis assign the build agent before the package registry exists (hq issue 121, ADR 0336) ... build-agent's npm-package-registry becomes optional, so genesis's step 13 is no longer refused with 'nothing provides npm-package-registry'. Until gitea is assigned, the agent on genesis's node reads the genesis-package-registry own-secret the installer seals at the packages step; it is issued outside the mesh, so no other machine is given one. The binding and its credential are composed only while bound (ADR 0330 §6), and no file names them otherwise.	2026-10-13 02:50:39 +02:00
mesh-admin	f88e3452f8	Merge pull request 'betterbird: own Betterbird's whole configuration as settings, shown without a credential (hq issue 586, ADR 0329)' (#262) from fix/586-betterbird-owns-its-configuration into main	2026-10-13 00:25:41 +00:00
mesh-admin	827b89dbf1	Merge pull request 'Mark grafana's and home-assistant's soft requirements optional (hq issue 166, ADR 0330)' (#259) from fix/166-optional-requirements into main	2026-10-13 00:22:35 +00:00
jochen	c9a711c259	betterbird: write the account lists only while the profile is closed, and never propose over an unreadable layer (hq issue 586, review 121) ... writeAccountLists checked only for a running Betterbird and wrote without a sync; it now waits for the profile's lock too and writes atomically. readLayer read any answer that was not JSON as an empty layer, and a proposal replaces the layer whole, so a changed wording would have dropped accounts; it now refuses. The README says the rollout order that leaves no node on Betterbird's defaults.	2026-10-13 02:12:06 +02:00
jochen	1835f0efad	betterbird: own Betterbird's whole configuration as settings, shown without a credential (hq issue 586, ADR 0329) ... The module owned only the accounts' server fields, so identities, signatures, calendars, address books, filters and tags could differ between desktop nodes unseen, and the operator's own preferences were shipped in the catalogue. prefs becomes one entry per preference (a node's layer overrides one key) and the defaults file keeps no value of the operator's; identities, calendars, address-books, filters and tags become settings, adopted like accounts, filters owned whole per account, and what Betterbird rewrites written only while it is closed. New tools list each kind, derive the layers from every desktop node and propose one at a time, and show drift; every answer passes a credential check.	2026-10-13 02:03:04 +02:00
mesh-admin	39e7a06e62	Merge pull request 'lab: runs name the one genesis bundle (issue 146)' (#261) from fix/146-lab-names-the-one-bundle into main	2026-10-12 23:22:05 +00:00
jochen	84911b94f3	Give the lab's runs the one genesis bundle (hq issue 146, ADR 0331) ... mesh-host now carries one genesis bundle, foundation-first-node.lock; the -nats one the lab's runs named is deleted, so every run would have raised from a file that is gone.	2026-10-13 01:18:08 +02:00
jochen	4193eacec4	Mark grafana's and home-assistant's soft requirements optional (hq issue 166, ADR 0330) ... grafana runs without influxdb and home-assistant without the Servarr apps or a broker, yet a mesh without them could not assign either. Their requirements are now optional: bound when a provider runs, absent otherwise, with nothing installed for them. grafana's data source and its credential are delivered only while influxdb-api is bound, into directories it mounts, so an absent file never becomes a directory docker made in its place.	2026-10-13 00:41:30 +02:00
mesh-admin	8f80cd4716	Merge pull request 'Name the setting keys searxng, keycloak and betterbird files take (hq issue 168, ADR 0326)' (#252) from fix/168-files-name-the-settings-they-take into main	2026-10-12 22:37:05 +00:00
mesh-admin	43a9155d5a	Merge pull request 'claude-code: a session asks the operator on Telegram and reads the answer by a key (issue 589, hq ADR 0332)' (#258) from fix/589-a-session-asks-the-operator into main	2026-10-12 21:30:22 +00:00
jochen	c4eebce598	Keep a question's slot until it expires while the router has not recorded it (issue 589, review 107) ... Freeing the slot two minutes after asking could let a backlogged router still show the question after the session read it as ended, and let a third question in. The seat's queue offers work again after an error and the router drops a cancel of an ask it has not recorded, so a cancel cannot take it back; once expired, the router refuses it if taken late. The slot test now uses a stale revision, so a plain write in place of the compare-and-set fails it.	2026-10-12 23:24:41 +02:00
jochen	14999f1d3e	Keep no secret-shaped question, and hold the two-question cap across nodes (issue 589, review 105) ... A question was kept on the bus before the router judged its words, so a token in it reached a bucket every node reads: every word, the options' too, is now held to the secret shapes and invisible characters before anything is kept, and a refused question keeps none of its words. The cap was check-then-create and failed open: each open question now holds one of two slot keys taken by create or compare-and-set, refusing when a slot cannot be read. A question the router never recorded frees its slot after two minutes instead of at expiry. by is required; wording matches ADR 0332.	2026-10-12 23:15:05 +02:00
jochen	e4e0ce7619	Say the router's refusal of a proposal only once its discard is kept (issue 589) ... The refusal test failed on a loaded build agent: Propose returned on hearing the refusal before HeardEnd had written the discard, so a reader right after saw nothing decided. The question path keeps the same order.	2026-10-12 22:51:21 +02:00