Commit Graph
2831 Commits
Author SHA1 Message Date
jschoubben aa0a472b29 mesh-conditions: the keeper reads zfs's findings (A-32)
The group's check failed TestEveryControllerKindHasItsHome: the reader zfs's findings are not read by the keeper.

Builds: design 42 zfs-owns-zfs §27, A-32
2026-11-13 03:12:09 +01:00
jschoubben d15502f365 zfs: declare health on the four running services, README says hand acts answer started
mesh/delivery-group group feature/1979-zfs-owns-zfs rejected: composed together: the checker's verdict at the members' heads (03f2ebff6ed0): unit: mesh-conditi…
mesh/delivery closed: a newer head of the same pull request
mesh/check failed (9): unit: mesh-conditions/cmd/mesh-conditions.TestEveryControllerKindHasItsHome: the rea…; and 8 more | d15502f3650d on 117f933dacf0
Builds: design 42 zfs-owns-zfs §13, §24, lead answers A-45, A-43
2026-11-13 02:01:06 +01:00
jschoubben 58664eee60 zfs: the hand acts answer started at once and the manifest asks stream-publish, bus-state-calls and ledger-calls (A-43, A-44)
Removes streamHear, HandPoll, HandWait and the stream mark; keeps toolEmit.

Builds: design 42 zfs-owns-zfs §24, §25, lead answers A-43, A-44
2026-11-13 01:52:50 +01:00
jschoubben 1ff904f101 zfs: the tools say events with mesh/stream.publish and a hand act hears its event on the events stream (A-42, A-12)
The tools say every event of §25 (snapshot.taken.person, scrub.requested and the others) with mesh/stream.publish on the
stream events, never stdio.Emit; the hand acts' 30 s wait reads the mark (stream.fill) before the act starts, then
stream.read from the next sequence, for at most HandWait.

Builds: design 42 zfs-owns-zfs §25, §24, lead answers A-42, A-12
2026-11-13 01:50:27 +01:00
jschoubben 2d592c63c1 zfs: a keeper that does not answer is warned once, and RunKeeper closes its second connection (review round 2 finding 2, A-37)
A failed keeper call in a root process (hand acts, forget, Paused, every call) now adds one warning that the bus is
taken as down, instead of being dropped silently. RunKeeper closes the connection acct.Dial opens when the keeper
stops; the message id's comment says it is nanotime-pid.

Builds: design 42 zfs-owns-zfs A-37
2026-11-13 01:45:19 +01:00
jschoubben 87f8c30a09 zfs: the keeper publishes events with an acknowledged JetStream publish on mesh.bus.zfs.events.<kind> (review finding 1, A-41)
Builds: design 42 zfs-owns-zfs A-41, §25
2026-11-13 01:31:08 +01:00
jschoubben e79392d666 zfs: a follower reaches the keeper's socket on every call, so a keeper up later is used (A-37, reviewer's note)
Builds: design 42 zfs-owns-zfs A-37
2026-11-13 01:29:15 +01:00
jschoubben 5f372ac63a zfs: read an unwritten ledger instance as state null and sequence 0, pass every error up (review finding 2, A-40)
Builds: design 42 zfs-owns-zfs A-40
2026-11-13 01:28:51 +01:00
jschoubben 008e02afbd zfs: take out the events stream's max-mib, a bound no design line gives (review finding 3)
Builds: design 42 zfs-owns-zfs §25
2026-11-13 01:28:51 +01:00
jschoubben 605c1b1ca0 Z19 the budget test does not match its own text
Builds: design 42 zfs-owns-zfs §31
2026-11-13 01:09:16 +01:00
jschoubben 7831f14a6e Z19 zfs-readme-budget: the README says what the module owns and how it is checked, and the test budget is a test
Builds: design 42 zfs-owns-zfs §31, §7, §19, §23
2026-11-13 01:06:04 +01:00
jschoubben 8927d68900 Z4 zfs-manifest-bus: the events stream, states and ledger by template, the keeper as the module's one process bus account
The three root processes declare no bus and reach the keeper's socket; the module invokes the service manager's start. The judge refuses the keeper's bus emits and state until the validator accepts what the module asks for in requires (A-38).

Builds: design 42 zfs-owns-zfs §25, §26, §27, §28, A-6, A-19, A-36, A-37, A-38
2026-11-13 01:05:19 +01:00
jschoubben ec27f12524 A-37 the keeper: the module's one process bus account, a socket only root opens, and the root processes' bus through it
Builds: design 42 zfs-owns-zfs §18, §20, §26, §27, A-6, A-20, A-37
2026-11-13 01:04:41 +01:00
jschoubben c6844fc951 Z11 Z12 Z15 the ledger is one instance per dataset and kind, its state a map taken keyed by the ZFS snapshot's name
Builds: design 42 zfs-owns-zfs §21, §22, §26, §28, A-36 (corrects A-30)
2026-11-13 01:03:17 +01:00
jschoubben 9116067e11 Z18 zfs-callsite: the call-site test pins every form of ADR 0679 whole
Renamed TestTheBundleRunsOnlyTheFormsOfADR0679: each root form is held to its whole argument list, no verb the decision never allows, zgenhostid only with the parsed hostid, a device only as cache or log.

Builds: design 42 zfs-owns-zfs §19
2026-11-13 01:01:35 +01:00
jschoubben 5ab8bb7e62 Z1 Z2 Z3 zfs-manifest: packages and values, files and units, the apply and the run in the declared order
The manifest declares zfs-utils and zfs-dkms, renames scrub-pool to pool, and declares every new value not managed until set; its config file is ${config-json}, the options file, ZED's folder, rc, functions, handlers and drop-in each under their condition, the three ZFS units, the apply (run-once, restarted by its config file) and the run before the distribution's scrub and trim timers. One commit: the three subtasks change the one file module.json.

Builds: design 42 zfs-owns-zfs §6, §7, §8, §9, §11, §12, §13, §14, §15, §18, §20, A-1, A-2, A-3, A-7, A-14, A-15, A-16, A-23
2026-11-13 01:00:42 +01:00
jschoubben 97bdb7d656 Z16 zfs-health: a refused or failed command in the applied state is unhealthy naming its key, and the module's own warnings
Builds: design 42 zfs-owns-zfs §29, §15, A-35
2026-11-13 00:55:17 +01:00
jschoubben c0067e77fc Z15 zfs-tools: zfs_config, zfs_snapshots_schedule, zfs_module_events, zfs_snapshots_check and zfs_findings read what the module owns, keeps and says
zfs_config also says what the module says before it leaves a node (Z17): the next load of the kernel module uses ZFS's defaults, the three units and /etc/hostid stay.

Builds: design 42 zfs-owns-zfs §28, §30, §10, A-31, A-35
2026-11-13 00:54:06 +01:00
jschoubben 8aad282e6c Z10 Z12 trim without day or time refused, keep count 0 removes nothing
A trim schedule of weekly or monthly with no trim-day or trim-time is one refused value naming it; a keep count of 0 is that kind's none: the existing scheduled ZFS snapshots are kept and a warning names them.

Builds: design 42 zfs-owns-zfs §20, §21, §22, A-33, A-35
2026-11-13 00:51:11 +01:00
jschoubben dd1a4e083c Z14 zfs-follower: the follower starts the apply on the events that end a wait and keeps its findings in its own state
Builds: design 42 zfs-owns-zfs §18, §27, A-10, A-16, A-32
2026-11-13 00:49:01 +01:00
jschoubben 23256413de Z12 zfs-snapshots-remove: the run removes surplus scheduled ZFS snapshots only by their own record
Builds: design 42 zfs-owns-zfs §22, §26, A-30, A-31
2026-11-13 00:44:07 +01:00
jschoubben a357a85faa Z11 zfs-snapshots-take: the run takes its due ZFS snapshots per filesystem and records each in the ledger
Builds: design 42 zfs-owns-zfs §21, §26, A-19, A-20, A-30, A-31
2026-11-13 00:43:09 +01:00
jschoubben 316039ca95 Z13 zfs-hand-acts: hand acts write their key and start the run; zfs_snapshot keeps a person's snapshots apart
Builds: design 42 zfs-owns-zfs §23, §24, A-12, A-17, A-18
2026-11-13 00:41:21 +01:00
jschoubben 06d83912cd Z10 zfs-run: the scheduled run takes the lock, starts a due scrub and trim without waiting, and acts on hand acts
Builds: design 42 zfs-owns-zfs §20, §24, A-17
2026-11-13 00:38:17 +01:00
jschoubben 1bea6edcb8 Z9 zfs-apply-run: the apply holds the lock, waits on a scrub or an unimported pool, and converges the node's id, ARC and pool
Builds: design 42 zfs-owns-zfs §15, §18, A-8, A-16, A-29
2026-11-13 00:34:58 +01:00
jschoubben 2fb1e5c4ea Z8 zfs-apply-devices: cache and log devices converged by their stable names, after their checks
Builds: design 42 zfs-owns-zfs §17
2026-11-13 00:32:06 +01:00
jschoubben a10bf45ed9 Z7 zfs-apply-properties: pool and dataset properties converged, read back and said
Builds: design 42 zfs-owns-zfs §10, §16
2026-11-13 00:27:31 +01:00
jschoubben 0fa4b5d8e7 Z6 zfs-events-state: each change, refusal and wait said as its event and kept in the state applied
Builds: design 42 zfs-owns-zfs §25, §26, A-19
2026-11-13 00:26:32 +01:00
jschoubben 3cb2b83a15 Z5 zfs-config-parse: the config file's values each read in their fixed form
A value of another form is refused before anything is written or run; absent and empty are not managed.

Builds: design 42 zfs-owns-zfs §9, §11, A-15, A-23
2026-11-13 00:25:48 +01:00
jschoubben 2b699d4046 Z0 pacman-config-first: the pacman module declares its config file before its package
The apply stops at the first failure and the package fails while the config file is missing (A-26).

Builds: design 42 zfs-owns-zfs §1, A-26
2026-11-13 00:23:56 +01:00
jschoubben bb96fbbb3c zfs: the scheduled run names its minutes, so its timer starts (issue 1979)
mesh/delivery merged: source.main moved to novox/mesh-catalog@117f933dacf0
mesh/check checking bb96fbbb3c45 on 117f933dacf0
The node-engine writes a cron step (*/15) as a calendar systemd refuses, so
zfs-mesh-scrub.timer never started and the pool had no scrub schedule. A list
of minutes is written as *-*-* *:0,15,30,45:00, which systemd takes.

Builds: design 42 zfs-owns-zfs §18. Tests: 1979/AC1.
2026-11-12 23:07:55 +01:00
jschoubben c100e16ba0 kernel: declare amd-ucode only (issue 1977, L10)
mesh/delivery merged: source.main moved to novox/mesh-catalog@e271757db78b
mesh/check checking c100e16ba0af on e271757db78b
intel-ucode failed an apply on a stale package database and stopped the delivery; an Intel machine
fails the unit by the image check and gets intel-ucode in the change that adds it. Tests: 1977/AC1
and the pinned order string adjusted.

Builds: L10 (issue 1977 note 6)
2026-11-12 21:49:30 +01:00
jschoubben f7616c6a9b kernel: the initramfs script takes over a default-config preset and checks each image (issue 1977, L7-L9)
mesh/delivery merged: source.main moved to novox/mesh-catalog@b9abfde492b2
mesh/check checking f7616c6a9bd4 on b9abfde492b2
Before mkinitcpio -P, a preset naming ALL_config="/etc/mkinitcpio.conf" is copied to the state's
taken-over/ and loses that line (another ALL_config is left and named); after it, an image without
kernel/x86/microcode/ in its first 64 KiB fails the unit and records nothing. The unit may write
/etc/mkinitcpio.d. The README names no node. Tests: 1977/AC7, 1977/AC8; AC3/AC4 fixtures write images.

Builds: L7, L8, L9 (issue 1977 note 4)
2026-11-12 21:31:05 +01:00
jschoubben 62c0eb90cb kernel: kernel_boot reads microcode from each initramfs image (issue 1977, L6)
Replaces the state record read (root's 0700) with images_with_microcode per /boot/initramfs-*.img:
true when the first 64 KiB hold a path under kernel/x86/microcode/; an unreadable image goes to
image_errors with its error. Test: 1977/AC5.

Builds: L6 (issue 1977 note 3)
2026-11-12 20:54:34 +01:00
jschoubben 5795f4d230 kernel: microcode in every initramfs through mkinitcpio's microcode hook (issue 1977)
Declares amd-ucode and intel-ucode, the drop-in /etc/mkinitcpio.conf.d/mesh-microcode.conf, the
initramfs script and mesh-kernel-initramfs.service; kernel_boot answers the running revision and
whether the images were built with the drop-in. Tests: 1977/AC1-AC5.

Builds: L1, L2, L3, L4, L5 (issue 1977 note 2)
2026-11-12 20:52:21 +01:00
mesh-tools a60728e6f0 Merge pull request 'systemd-resolved: the own resolver's file waits 3 s a try (issue 1748, ADR 0678)' (#671) from fix/1748-resolver-wait into main 2026-11-12 17:52:35 +00:00
mesh-tools 792a79720b Merge pull request 'mesh-vault: secret_holders lists every record of the vault's store by name and fingerprint (issue 1409)' (#670) from fix/1409-store-records-listed into main 2026-11-12 17:51:18 +00:00
jschoubben d22a7f3a41 fix-1748-own-resolver-wait: the own resolver's file waits 3 s a try
mesh/delivery merged: source.main moved to novox/mesh-catalog@a60728e6f09d
mesh/delivery-group group fix/1748-resolver-wait merged: every member is merged
mesh/check checking d22a7f3a412f on a60728e6f09d | novox/mesh-catalog#671 in group fix/1748-resolver-wait
The resolver file of systemd-resolved (resolvers and kept facts) carries options timeout:3 attempts:2 edns0 in place of timeout:1; manifest test asserts both facts, guard test's literal follows.

Builds: design 50 resolver-wait §1, §4 (and §2 of the main file, line 73)
2026-11-12 18:09:17 +01:00
jschoubben 45b0779b68 mesh-vault: a store file that is not a record is listed by name with its error (issue 1409, V10)
mesh/delivery merged: source.main moved to novox/mesh-catalog@792a79720b30
mesh/check checking 45b0779b6801 on 792a79720b30
Store.ListReadable lists every record and, beside them, each file it cannot read
by name with its error; RecordsHeld lists those as rows with an error and goes
on. recordsError stays for a store that cannot be listed at all. Store.List and
ListPrefix keep their behaviour for their other callers.

Builds: design 39 bus-and-switch §20; design 39 parts §12. Lead answers (issue 1409): V9 (keep recordsCount and recordsError), V10.
2026-11-12 17:41:39 +01:00
jschoubben 52572698cb mesh-vault: secret_holders lists every record of the vault's store by name and fingerprint (issue 1409)
S1 vault-licence-secrets-listed. secret_holders answers `records` and
`recordsCount` beside holders, count and enrolments: each store record's name,
generation, since, changed, changedBy/changedVia, origin, length and the vault's
own fingerprint of the whole value, plus key and part for licence.<key>.<part>.
A record the vault cannot open stays listed with an error. Never a value.

Builds: design 39 bus-and-switch §20, §15; design 39 parts §12 (D1); design 24 Every secret lives in the vault, Beyond generate and hold; as-is 06 The vault, as it runs.
Lead answers (issue 1409 note 11): V1, V-thorough, V2-V8. V3 drops the map's
tokenFingerprint and AC5; V-thorough widens the licence.-prefix list to every record.
2026-11-12 17:34:00 +01:00
jschoubben 700b37890b node-uplink links answers each link's mac, master and parent (S1a links-mac, issue 1965)
mesh/delivery merged: source.main moved to novox/mesh-catalog@0ec8347786f4
mesh/check checking 700b37890bfd on 0ec8347786f4
Both holders' uplink-tools copies read address, master, link and
link_index/link_netnsid from the existing ip -j address show call. Fields
are left out where a link has none (L3); a parent in another namespace is
{index, namespace} (L2); the form lives in uplink.go only (L4); only the
tool description changes, not seat.json (L5); bridge fdb MACs are not
answered (L6); names mac, master, parent (L1).

Builds: design 48 10, design 08 code:, issue 1965 note 11 L1-L6
2026-11-12 17:30:17 +01:00
mesh-tools 836fcd81f6 Merge pull request 'mesh-files: find writes the NUL itself, so a list or search through root runs at all (issue 1409)' (#668) from fix/1409-root-list-nul into main 2026-11-12 15:39:51 +00:00
mesh-tools 8484ab0032 Merge pull request 'A step answer over the steps state's bound is kept without its taken versions, said, not lost' (#667) from fix/step-answer-over-bound into main 2026-11-12 15:37:54 +00:00
jschoubben c29ef0d95e mesh-files: find writes the NUL itself, so a list or search through root runs at all (issue 1409)
mesh/delivery merged: source.main moved to novox/mesh-catalog@836fcd81f65b
mesh/check checking c29ef0d95ea7 on 836fcd81f65b
Live on novox 2026-11-12: node-files.list of a root-only directory answered
'fork/exec /usr/bin/sudo: invalid argument'. The kernel refuses a program
argument that holds a NUL byte, and listAsRoot's -printf format and
searchBelowAsRoot's ended in a literal \x00 since 5d98bcc0 (2026-10-16), so
no list or search through root ever ran on a node. find writes \0 itself.
The stand-in root in the tests refuses an argument holding a NUL, as exec
does, so every root call is held to it; it found the search's instance.

Builds: design 39 parts §15 and the lead's answer D3 (list through root of a place a secret is kept).
2026-11-12 16:34:24 +01:00
mesh-tools c0d666fdcf Merge pull request 'The provisioner's retiring asks get a bounded id, and a refused one is said (issue 1966)' (#666) from fix/1966-unpublished-placed-module into main 2026-11-12 15:34:21 +00:00
jschoubben 22bbb9c2c0 Keep a check's answer within the steps state: leave out the taken versions
mesh/delivery merged: source.main moved to novox/mesh-catalog@8484ab0032a5
mesh/check checking 22bbb9c2c09f on 8484ab0032a5
A catalog check's answer of 264712 bytes was refused by the steps state
(256 KiB per value) and its end written failed without it, so the checker
lost the biggest member's answer and could not preview it. When a passed
or failed end is refused as too large, finish writes it once more without
the fetch's taken versions (fetch.packages, which no reader judges), the
step's reason saying how many were left out, why, and that the module's
journal names each; still too large, it ends failed as before.

Quick fix for issue 1921 (note 91); the thorough fix is design 47 G A-290
(an answer over the bound kept as the object output.<ask>).

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
2026-11-12 16:32:48 +01:00
mesh-tools 7b50628627 Merge pull request 'node-files lists a place a secret is kept, entries without content, and stat says a missing path is missing (issue 1409)' (#665) from fix/1409-list-secret-place into main 2026-11-12 15:28:22 +00:00
mesh-tools 23a280a664 Merge pull request 'licences_switches answers switches carried from the old database with their licence and consumer (issue 1409)' (#664) from fix/1409-carried-switches into main 2026-11-12 15:27:13 +00:00
jschoubben 3bb8ace833 U6, U7 provisioner: a bounded retiring ask id, a refused ask said, the Composition comment corrected
mesh/delivery merged: source.main moved to novox/mesh-catalog@c0d666fdcf55
mesh/delivery-group group fix/1966-unpublished-placed-module merged: every member is merged
mesh/check checking 3bb8ace833d1 on c0d666fdcf55 | novox/mesh-catalog#666 in group fix/1966-unpublished-placed-module
The retiring ask's id is made from the key's digest and the time (at most 64 characters),
so a long key is asked. An ask the router's rules refuse is said in the key's why and in
provisioner_health. The Composition comment says what the code does: an unpublished
module keeps only its own plan and keys.

Builds: design 47 fix-unpublished-placed-module U6, U7, ADR 0593 §8
2026-11-12 16:01:25 +01:00
jschoubben ab1eb0cb47 Review 1 of S1: the served-text row finds the list tool by its full name; list's text is the contract's word for word
mesh/delivery merged: source.main moved to novox/mesh-catalog@7b5062862758
mesh/delivery-group group fix/1409-list-secret-place merged: every member is merged
mesh/check checking ab1eb0cb4781 on 7b5062862758 | novox/mesh-catalog#665 in group fix/1409-list-secret-place
Builds: design 39 parts D3 (§15), bullets 2 and 4.
2026-11-12 15:52:34 +01:00