1120 Commits

Include renames

Author	SHA1	Message	Date
jochen	be53f5167a	mesh-mail: bound a fetch by bytes, show mail_accounts only to its grantees, say why grants are unread, judge a secret without reading it (hq issue 733) ... The review of #300 found a batch of 25 whole messages could hold a gigabyte, mail_accounts told ungranted callers folder names, counts and server errors, an unreadable grants setting was refused without its reason, and the watch read the password only to learn it was there.	2026-10-14 22:24:11 +02:00
jochen	2130f99612	mesh-mail: say mail events on its own stream MAIL, granted per account by grants (hq ADR 0363) ... ADR 0359 asked for a stream of its own and a bus grant from the module's grants; ADR 0363 built both. The events leave the shared EVENTS stream, and one family pattern per change replaces the literal per-account emits, so a new account changes no manifest.	2026-10-14 22:17:09 +02:00
jochen	ed5690cee4	Merge remote-tracking branch 'origin/main' into adr-359-mesh-mail	2026-10-14 22:16:50 +02:00
mesh-admin	fadf5025cc	Merge pull request 'Merge a pull request marked ready at its head once its checks pass (issue 722)' (#303) from feat/merge-on-ready into main	2026-10-14 19:57:00 +00:00
jschoubben	baa5ef802e	Name the keys gitea's mergeable config takes: none (ADR 0326) ... gitea now declares a setting, so every mergeable file of it must name its keys; the runtime config reads no setting, and ready-authors reaches its own file.	2026-10-14 21:50:05 +02:00
jschoubben	5b20e419ec	Count a ready mark only from a listed account, after the last push and the label (issue 722) ... Review of #303: anyone who can comment could turn a stale label into a mark, and a long thread hid the newest comment. The forge now reads the pull request's whole timeline and takes a "ready at" comment only from the accounts in the trusted setting ready-authors (default the mesh's own forge account and the operator's), written after the label was last added and after the last push; any other author is ignored and said in the log.	2026-10-14 21:45:39 +02:00
mesh-admin	7e3e62062b	Merge pull request 'mesh-catalog: hear the build seat that builds now (hq issue 712)' (#298) from fix-712-catalogue-hears-build-agent into main	2026-10-14 19:35:13 +00:00
jschoubben	7e0001e304	Merge a pull request marked ready at its head once its checks pass (issue 722) ... The operator wants a reviewed pull request merged without a session calling the merge tool again after every recheck. The reviewer marks it ready (label mesh/ready and a comment "ready at <full head sha>"); the forge's open-pulls read carries the mark, and mesh-delivery merges through gitea_merge_pull_request at that head, in a group's order once its composed check passed. A push after the mark clears it; a failed check is said on the pull request and as a stalled line.	2026-10-14 21:23:26 +02:00
mesh-admin	482232e8c5	Merge pull request 'Give the build agent a judge cache of its own (issue 704, ADR 0358)' (#297) from fix/704-release-branch-judge into main	2026-10-14 18:19:31 +00:00
jochen	70c1110c53	Add mesh-mail: watch the operator's own mailbox read-only and say each mail on the bus ... ADR 0359 decided one module holds the operator's mail accounts. This is its first stage: an imap adapter that keeps IDLE on the inbox and polls the other folders read-only, indexes each message in its own database, keeps each attachment once by its SHA-256 in its bucket, and says every added, changed or removed message as a metadata-only event. Bodies and attachments are served only by its tools, to callers the trusted setting grants names. Its health waits for the account's own secret until it is given at the desk (issue 710).	2026-10-14 20:14:42 +02:00
jochen	dbe2949f84	mesh-catalog: pass over a build off its repository's trunk, as the controller does (ADR 0238) ... A branch built through the build verb is a real build, and placing it would make it the catalogue's current version though the controller never registers it. Say which of the controller's rules are mirrored and which need its records.	2026-10-14 20:09:39 +02:00
jschoubben	b7d9590fdc	An answered ask keeps its question whole, its answer below it (issue 714) ... Issue 372's fix with issue 639's one line edited an answered ask down to 'You chose X at HH:MM · headline', so the operator could not read back what they approved. The headline stays the title, the summary, points, link and Details stay the body, and how it ended and who acts on it become the note. Telegram cuts the body from its end past 4096 characters, never the title or the note.	2026-10-14 20:06:24 +02:00
jochen	7ee2869d60	mesh-catalog: narrow the placing by a string, which the check's non-strict compile can follow	2026-10-14 20:04:37 +02:00
jochen	0b74c04aa8	mesh-catalog: hear the build seat that builds now, so a merged build is registered when it is built (hq issue 712) ... Since the build role moved to node-build-agent (ADR 0190), the catalogue consumed only the retired mesh-build-machine.built, so builds reached it only through the replay it asks for at its start: mailu e1c8965d, built two minutes after the last replay, was never registered. Consume node-build-agent.built, and pass over the seat's merge checks, tries, dry runs and failures, which the old seat never said.	2026-10-14 20:03:25 +02:00
mesh-admin	e1c8965ddb	Merge pull request 'mailu: declare its unhealthy urgent (hq ADR 0355 §5, issue 691)' (#296) from adr-355-mailu-urgent into main	2026-10-14 17:01:22 +00:00
mesh-adminandClaude Opus 5.5	47ef2644ac	Give the build agent a judge cache of its own, and prove a release branch's move puts its verdicts out of date ... Every merge check's judge is built where no pull request can reach (hq ADR 0358 §6, issue 704): the build agent needs a directory beside its workspace, mounted at the same path, that only judge builds mount. ADR 0358 §5 already holds in the forge's holder; this test keeps it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 13:48:30 +00:00
jochen	8e821ef449	Say mail's failure urgently, on every channel ... A broken mailu was a warning, said only on the desk; refused or stuck mail must reach the operator wherever they are (ADR 0355 §5, issue 691).	2026-10-14 15:37:08 +02:00
jochen	07b9bd0ed4	Ban clients that try to log in on mail port 25 ... Port 25 takes no login, so a client that tries is guessing passwords; mailu's jail only matched Dovecot's failures and never banned them (issue 708). Relay attempts stay unbanned: postfix already refuses them.	2026-10-14 15:34:55 +02:00
jochen	8661bcfa22	Declare mailu's tools, so the controller knows the one its check asks	2026-10-14 15:21:39 +02:00
jochen	6049537655	Judge mailu's deferred queue by this side's faults, not one dead recipient ... A message to a far host that is down stays deferred for up to five days, and mailu's unhealthy now pages the operator, so one dead recipient would page for days. Overdue deferred mail is unhealthy only when a lookup failed here (a name-service failure, as in issue 687) or when it reaches three or more domains; one or two far domains are said in the answer, not alarmed.	2026-10-14 15:19:08 +02:00
jochen	bf3e801f67	Judge mailu by whether mail flows, not only by its parts ... On 2026-10-14 every mailu container read healthy while postfix could not resolve a name: inbound mail was refused with 450 and outbound mail sat in the deferred queue for days (issue 690). The smtp container is now judged by a tool check, mailu_health, asked inside it: postfix runs (the image's own check, kept), no message waits deferred longer than 30 minutes, and a public mail host resolves through the resolver postfix is given.	2026-10-14 15:14:51 +02:00
mesh-admin	50861c74f8	Merge pull request 'mailu: judge the front by SMTP and its certificate, not only its web health (hq issue 688)' (#285) from fix-688-mailu-health into main	2026-10-14 13:06:45 +00:00
mesh-admin	b15846dd6e	Merge pull request 'mailu: move the resolver to Mailu 2024.06.63, which follows the root key change (hq issue 687)' (#284) from fix-687-mailu-resolver into main	2026-10-14 12:32:36 +00:00
mesh-admin	a44d490d97	Merge pull request 'Five postgres consumers say which provision their check exercises (hq issue 145, to-be 48 Phase E)' (#289) from fix/145-a-consumer-is-held-under-its-provider into main	2026-10-14 05:26:47 +00:00
mesh-admin	af5cf53a34	Merge pull request 'lab: name the base image's age, refuse a stale one, and rebuild it (issue 698)' (#288) from fix/698-the-lab-names-its-base-age into main	2026-10-14 05:12:37 +00:00
jochen	2bb5d344f6	Hold umami's check to the share route's own 404, so an unknown route cannot pass it (hq issue 145, review 262) ... Any route umami does not serve answers 404 too, as an HTML page. The share route answers JSON with code not-found only after the database was asked; with the database down it answers 500.	2026-10-14 07:07:11 +02:00
jochen	0fcc560fec	lab: one job at a time with no await between check and start, and no rebuild left holding anything (issue 698, review 256) ... A run and a rebuild each asked the package registry between checking for the other and writing their status, so both could start and a bed could raise machines from an image being replaced. The registry is asked first now. A hard-killed rebuild's credential is cleaned like a run's; a job that never recorded its process is lost rather than blocking every run; and lab_check reports a missing or unreadable base image.	2026-10-14 03:34:46 +02:00
jochen	acf8a76646	lab: read the suite's verdict only after its recorded line, NOT REACHED in any case (issue 693, review 254) ... A test's own output, printed before the suite reports, could carry a line shaped like the suite's NOT PASSED or skipped line and stand for its verdict.	2026-10-14 03:28:20 +02:00
jochen	b62bb15839	Say which provision five consumers' checks exercise, so a database down is one condition (hq issue 145) ... gitea, nextcloud, umami and n8n gain an http check that reaches their database through their own endpoint; mesh-knowledge's watch already asks the database and now names it. While postgres is unhealthy, their findings are held under its condition instead of raising one each.	2026-10-14 03:21:53 +02:00
jochen	ff9d3ee6a0	lab: name the base image's age, refuse a stale one, and rebuild it (issue 698) ... A bed machine carries the package database its base image was built with, and the mirrors stop serving it within weeks: genesis-keeps-its-bus failed on a 404 from an image 44 days old, with nothing saying its age and no mesh tool to rebuild it. lab_check and lab_run now say the age, lab_run refuses an image older than 14 days and names the remedy, and lab_base reads the image and rebuilds it with mesh-lab's base build when asked.	2026-10-14 03:21:23 +02:00
jochen	c8255eb15d	lab: a run whose suite proved nothing reads as failed, with its skips (issue 693) ... lab_status took the suite's exit as the verdict, and the runner exits 0 when every test skipped: a genesis bed that skipped its only test as NOT REACHED was recorded as passed. A run that ended now has its outcome read from its log and kept in its status - totals, each skip with its reason, and why it did not pass - and one whose exit said 0 while no test passed reads as failed. Read from the lab's own lines when it prints them, from the runner's summary for a lab of before.	2026-10-14 03:14:06 +02:00
jochen	4ded07bc63	Judge mailu's front by what mail needs, not only its web health ... The image's own check asks nginx's /health and that dovecot runs, so the front stayed healthy while mail could not flow (issue 688). It now also needs port 25 to greet over SMTP and the served certificate to hold for 14 more days; certbot renews at 30, so a renewal stuck for two weeks is said long before the certificate expires.	2026-10-14 02:19:54 +02:00
jochen	054dc9618c	Move mailu's resolver to Mailu 2024.06.63, which follows the root key change ... The root zone signs with KSK-2024 since 2026-10-11. The pinned resolver image (2024.06.59) trusted only KSK-2017 and kept its anchor inside the container, so every lookup failed with SERVFAIL and mail was refused or stuck (issue 687). 2024.06.63 refreshes the anchor with unbound-anchor at every start and fails its health check on SERVFAIL, which the old 'dig @127.0.0.1' never did (issue 688).	2026-10-14 02:17:25 +02:00
jschoubben	c876ad4a83	Merge remote-tracking branch 'origin/main' into feat/335-the-build-agent-declares-busy ... # Conflicts: # modules/build-agent/README.md	2026-10-14 00:11:50 +02:00
jschoubben	12a5e7be73	build-agent: name mesh-builder by its path in busy, as its health does (review of #260)	2026-10-14 00:07:42 +02:00
jschoubben	66d22dd53e	Let a closed pull request's check builds go, and show what each walk build did ... A check's builds for its merge have no taker once the pull request closes unmerged, and the delivery should say whether a module was reused from the check or built, and why (novox/hq ADR 0350 §4, §5).	2026-10-13 23:04:41 +02:00
mesh-admin	7ed119995f	Merge pull request 'gitea serves the registry's public root; the lab trusts a tarball only there or at the forge's own origin (issue 624, ADR 0346)' (#280) from fix/624-the-forge-serves-its-public-root into main	2026-10-13 19:52:05 +00:00
jochen	1faee6e279	lab: a forge setting that is not http(s) is never a trusted origin (hq issue 624, review 222)	2026-10-13 20:33:13 +02:00
jochen	6f7d06726c	gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624) ... The forge writes every tarball at its public name and the lab reaches it at a private address, so npm 12 refused every locked @novox package. The public name now comes from the mesh's own composition of the forge's route, through the lab's binding, and the lab compares scheme, host and port.	2026-10-13 20:33:02 +02:00
jochen	f09daabec3	A withheld change line in the note keeps its key's name; SDK at 5933eb7 (the review of mesh-controller #304) ... The router's fallback said a refused note line as "(a line carrying … is withheld here)", so the operator could not tell which setting held a value they were not shown. A change's line now keeps its key; any other line, or one whose key is refused too, is said withheld whole. The SDK pin moves to mesh-sdk 5933eb7, where no two asks digest the same.	2026-10-13 20:32:50 +02:00
jochen	bb5a342863	Every value an approval sets is in the note, whole where the sender is proven; the note is kept whole (issue 383) ... The review of mesh-controller #304: a proposal of more than three keys showed only the names of the rest, and its Details could carry no value, so Approve bound values the operator never saw. The router now shows an ask's WholeDetails in the note in place of its Details on a kind that proves who answers, held to the secret rule alone, and refuses an ask whose whole details carry a secret's shape. Telegram keeps the note whole when a message is too long, cutting the body first and saying so, and escapes the note as every other part. SDK at mesh-sdk f474544.	2026-10-13 17:16:50 +02:00
jochen	eadf301f9f	An ask reads at a glance on the phone: a headline, a summary and its points, the rest in a note (issues 383 and 639) ... The operator would not read the Telegram ask for ADR 0343: thirty plain lines, every clause on one, no bold, no summary. A settings proposal was the same wall of text, its values masked so the approval was blind. - messenger: an ask's message is the asker's headline and explanation alone; who asked and when, what each answer does, the expiry, where else it is answered and the asker's Details travel as the message's note (asks.Message.Note). Answered, the message is one line, "You chose Approve at 16:06 on Telegram · <headline>". An explanation that does not read at a glance (asks.Glance) is shown and logged. On a kind that proves who answers, an ask's values are shown whole (asks.Ask.Whole), held to the secret rule alone (from the earlier work on issue 383, #178). - telegram: every message in HTML, never reworded: the title bold, a key line monospace, the note apart in a collapsed blockquote; markup escaped. A tap is compared by its words, whitespace aside, and a message shown before is still compared by the digest it was kept under. - desk-channel: the note follows the body. - mesh-knowledge: a record that needs the operator carries a brief (headline, summary, at most three points), the 30th per-record rule; its ask shows the brief and never the clauses. An ask made before is composed again as it was asked (form), so its warrant still holds. - claude-code: an instructions proposal's explanation is one summary line (the proposer's, or the module's), its text in the Details; a question's context is at most 300 characters and its recommendation one point. Older proposals and questions keep their form. The SDK is pinned at mesh-sdk 9588871 (fix/639-an-ask-reads-at-a-glance), which adds Message.Note and asks.Glance.	2026-10-13 17:16:50 +02:00
mesh-admin	9c166398f2	Merge pull request 'Revert #277: no showmissed lock in betterbird's policy (issue 640)' (#281) from fix/640-revert-the-showmissed-lock into main	2026-10-13 15:06:09 +00:00
mesh-admin	e209d46faf	Merge pull request 'claude-code: the memory watch only notes a change, so it starts on a node with hundreds of files (issue 367)' (#279) from fix/367-memory-watch-takes-fast into main	2026-10-13 14:58:35 +00:00
jochen	f1f866050e	Revert the showmissed lock of #277: the operator wants no special handling in betterbird's config (hq issue 640) ... The fix is the approved settings layer (proposal s09bf8c99da7ac8b9: calendar.alarms.showmissed false), pushed to g14 and shanks.	2026-10-13 16:54:51 +02:00
mesh-admin	4d15a155e6	Merge pull request 'betterbird: a passed meeting's reminder does not come back at every Owl reload (issue 640)' (#277) from fix/640-a-dismissed-reminder-stays-dismissed into main	2026-10-13 14:47:58 +00:00
jschoubben	e46eeb8298	claude-code: the memory watch only notes a change, so it starts on a node with hundreds of files (issue 367) ... The runtime hands a watch its current values one at a time and gives them ten seconds. The handler read the state, waited for a running look and wrote files for each value, so with about 450 memory values the watch never started on g14 or shanks, and a file written on g14 never reached shanks. The handler now notes each key's newest revision and returns; a worker applies what was noted at the state's current version.	2026-10-13 16:40:41 +02:00
mesh-admin	5f491e0c09	Merge pull request 'lab: name the package registry by the address it names itself by, so npm 12 installs locked @novox packages (issue 624)' (#275) from fix/624-lab-names-the-registry-as-it-names-itself into main	2026-10-13 14:35:04 +00:00
jochen	73404a3c3f	betterbird: lock the missed-reminder pass off, so a passed meeting's reminder does not come back (hq issue 640) ... With calendar.alarms.showmissed on, Betterbird's alarm service fires every reminder of the past month that carries no later acknowledgement at each load of a calendar. Owl never sends a dismissal to Exchange and keeps it only in Betterbird's local cache, so on g14 September's Exchange meetings came back about every ten minutes, Dismiss or not. The policy now locks the pass off whatever the setting or profile says, and betterbird_check says when the running Betterbird still has it on beside an Owl calendar.	2026-10-13 16:32:17 +02:00
jochen	8ad121d5c3	lab: take the registry's address only from the forge's own host, built from the parsed URL (hq issue 624, review of #275) ... What the registry answers may come over plain HTTP, so it must not choose where packages come from, nor reach the run's npm configuration as a raw string.	2026-10-13 16:26:48 +02:00