9 Commits

Include renames

Author	SHA1	Message	Date
jochen	1faee6e279	lab: a forge setting that is not http(s) is never a trusted origin (hq issue 624, review 222)	2026-10-13 20:33:13 +02:00
jochen	6f7d06726c	gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624) ... The forge writes every tarball at its public name and the lab reaches it at a private address, so npm 12 refused every locked @novox package. The public name now comes from the mesh's own composition of the forge's route, through the lab's binding, and the lab compares scheme, host and port.	2026-10-13 20:33:02 +02:00
jochen	8ad121d5c3	lab: take the registry's address only from the forge's own host, built from the parsed URL (hq issue 624, review of #275) ... What the registry answers may come over plain HTTP, so it must not choose where packages come from, nor reach the run's npm configuration as a raw string.	2026-10-13 16:26:48 +02:00
jochen	bb60de6d61	lab: name the package registry by the address it names itself by, so npm 12 installs locked @novox packages (hq issue 624) ... npm 12 installs a locked tarball only from its configured registry; the forge writes every tarball URL, and so every lock file, at its public address, and the lab named the registry by its forge setting's address. Every run stopped at mesh-tools' install with EALLOWREMOTE.	2026-10-13 15:25:41 +02:00
jochen	dd39d4ace7	lab: name the bound credential in the tools bundle's env, and skip the locked-tree test as root (hq issue 624, reviews 198, 199) ... The lab's tools read their bound npm-package-registry credential, root's at 0600 on the machine. The controller gives the runtime's account exactly the files a tools bundle names in its env (ADR 0192), as gitea and umami are given theirs, so the bundle now names the credential and its binding there, and no other credential changes hands. The merge check runs as root, where no directory mode stops a removal: the test that makes an unremovable tree now skips there before it makes anything, and a second test clears leftovers whoever runs it.	2026-10-13 14:51:18 +02:00
jochen	5bd40fa406	lab_check: work in a fresh directory each time, and name what an earlier check left (hq issue 624) ... lab_check cloned into one fixed path, <work>/check, after an rm -rf whose result it ignored; a tree an earlier check left that the lab's account could not remove made every check fail on "destination path already exists". Each check now works in a fresh check-* directory it removes when done, and clears what earlier checks left, naming any path it could not remove.	2026-10-13 14:40:06 +02:00
jochen	8d8dcd5ebb	lab: a read-only forge account of its own, and no credential left on disk after a stop (hq issue 624, review 196) ... The lab's credential came from the package team, which also writes the @novox packages, and the branches a run clones are not reviewed yet. The lab now contributes {"access": "read"} to its npm-package-registry requirement, and gitea's provisioner puts such a consumer on a team of its own, readers: code read on the org's repositories, package read, no write, and off the package team. The build agent, which publishes, stays on packages. A stop's SIGTERM to the run's process group killed the wrapper before it removed the credential file. The run's script now removes it as soon as its clones are done and traps every way it ends, and a run's start and lab_check remove what a crash or a reboot left.	2026-10-13 14:00:59 +02:00
jochen	789d2d9d64	lab: clone the forge with the credential the mesh binds and seals to the lab (hq issue 624) ... mesh-tools-go is private, and the lab cloned over HTTP with no credential: a run failed at its checkout, "could not read Username". The lab now requires the package registry, as the build agent does; the forge's provisioner binds it an account and seals that account's password, and a run offers them to the forge's own origin through git's credential store, from a file beside the run and removed when it ends: never in a URL, the run's script, an argument or the log. lab_check reads every repository a run clones with that same credential and names one it cannot read.	2026-10-13 13:54:16 +02:00
jochen	c6a9c52dc7	Install each lab checkout where its lock file is, check out mesh-tools-go, and have lab_check catch both (hq issue 624) ... lab_run ran npm ci at the root of mesh-sdk, mesh-tools and mesh-lab; mesh-tools keeps its package in node-tools/ with no lock file at its root, so every run failed at its setup in nine seconds. A run now installs (and, for the SDK and the base, builds) where a package-lock.json is: the root, or each directory one level down; a package.json with no lock file fails the run naming it. It checks out mesh-tools-go, which genesis builds since issue 616, and tells the beds where its checkouts are (MESH_LAB_REPOS). lab_check asks the forge for every repository a run clones and applies the same install rule to the ones it installs, so a run's setup failure is found before a run.	2026-10-13 11:55:01 +02:00