7 Commits

Include renames

Author	SHA1	Message	Date
fix-cat-pas@novox	33759f8b57	Run postgres on the SDK's harness and moved path, dropping its copies (issue 849)	2026-10-16 19:35:22 +02:00
mesh-tools	41cdd03208	Keep serving the consumers postgres's grant file gives on its moved path (issue 937) ... Only a moved consumer's plan names postgres, so on the moved path every consumer still given by the controller's grant file was counted unasked and offered for retirement (ace 5 of 5, novox 7 of 9), and could have been retired unasked where the bound allowed. The moved path now reads MESH_RECEIVES again: its logins are asked, the ones no plan names are made and checked by the harness's grant pass until R1 (issue 682), and an unreadable grant file retires nothing (issue 241). The harness's grant pass becomes apply, identically in keycloak's copy.	2026-10-16 16:25:52 +00:00
mesh-tools	0260ae92f6	Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main	2026-10-16 09:42:45 +00:00
jochen	4f44bf1eb5	Give the store's reader only the columns a module declares readable, never a secret, so a query cannot read the controller's signing key (hq issue 337) ... mesh_store_reader held pg_read_all_data, so every caller of mesh-store.query and postgres_query could read every column the store holds: the signing key nodes trust, sealed secrets, password hashes. The reader now holds no role; each minute, on every database, its memberships are revoked and its grants brought to what the consumer's contribution lists under readable, minus any column or table whose name says it holds a secret. Before a statement runs, the reader's own session is asked which secret columns it can read and the statement is refused if any; a statement naming a known secret table is refused before it is sent.	2026-10-08 21:43:15 +02:00
jochen	e68ef88333	Retire a consumer the mesh stops asking for, and delete only on a person's word (hq ADR 0230) ... The hourly release of ADR 0229's brake still ended in the mesh acting alone on a mistake. A consumer now stays active until the same unasked set holds for five passes, waits for a person past three or half of those held, is disabled and marked rather than withdrawn, comes back as it was when asked again, and is deleted only through the provider's delete tool. The backend keeps the mark, so a restart forgets nothing and finds what was withdrawn before.	2026-10-06 13:54:10 +02:00
jochen	6f1e2f5a0d	postgres: announce a consumer failed for minutes, and its recovery ... A provider failed every consumer for a day and said so only in its journal (hq issue 179). The provisioner loop now emits provisioner.failing after five minutes without a success — create, check or secret — and repeats it every fifteen; provisioner.recovered on the next success, on withdrawal, and on the first success after a restart, so the controller can name it in status (hq ADR 0224).	2026-10-06 00:13:42 +02:00
jochen	d8b4d20886	Port postgres to Go and install the extensions a consumer asks for ... letta crash-loops on 'type "vector" does not exist': pgvector is not a trusted extension, so only the provider's superuser can create it, and the provisioner never did. A contribution may now name extensions; the provider creates each (IF NOT EXISTS, available ones only) in the consumer's database on every pass. Go per the standing rule for a TypeScript module that changes. letta asks for vector.	2026-10-05 23:29:55 +02:00