5 Commits

Include renames

Author	SHA1	Message	Date
jochen	8d8dcd5ebb	lab: a read-only forge account of its own, and no credential left on disk after a stop (hq issue 624, review 196) ... The lab's credential came from the package team, which also writes the @novox packages, and the branches a run clones are not reviewed yet. The lab now contributes {"access": "read"} to its npm-package-registry requirement, and gitea's provisioner puts such a consumer on a team of its own, readers: code read on the org's repositories, package read, no write, and off the package team. The build agent, which publishes, stays on packages. A stop's SIGTERM to the run's process group killed the wrapper before it removed the credential file. The run's script now removes it as soon as its clones are done and traps every way it ends, and a run's start and lab_check remove what a crash or a reboot left.	2026-10-13 14:00:59 +02:00
jochen	bd7b757dd9	gitea: give the controller what it maps a pull request onto the graph with; set both check statuses; protect a branch by tool (hq ADR 0237) ... The controller now decides what a pull request's check runs from the mesh's module graph, so the announcement carries the changed directories that hold a module at the head and whether the head has a merge-check.sh. A verdict sets mesh/merge-gate (the gate, with the modules it judged) and mesh/repo-check (the repository's own tests). gitea_branch_protection_get/set let the operator's agent make those statuses required. The catalogue's merge-check.sh leaves the gate to the build seat and keeps its own layer: every manifest through module check, and the touched Go modules' tests.	2026-10-06 21:56:04 +02:00
jschoubben	ed094031fd	The forge mints its own API token with the admin account the vault delivers ... The runtime beside the forge served 0 tools: GiteaClient.fromEnv required a token (settings or MESH_GITEA_TOKEN), nobody had one to give — the mesh raised the forge — and putting one in settings would store a secret in plaintext in the inventory. So the fifteen tools registered nothing and the watcher logged "not watching". What the mesh does deliver is the admin account: a login the manifest names and a password the vault minted and the host unsealed into a file (ADR 0086). That is enough to mint a token, so the module does (hq issue 100, the forge's tools): POST /users/{admin}/tokens over basic auth, scoped to write:repository and write:issue — the least the tools and the repo watcher need — kept at 0600 in the module's own state (/var/lib/mesh/gitea/state, a new directory resource the runtime mounts writable), read back on the next start, and minted afresh when the forge answers 401 to it or the kept file is gone. A forge whose data came from the predecessor has no mesh-admin: that is reported in plain words on every poll until it clears, once per reason, not crash-looped. A configured token still wins and is never minted over. The mint happens on the first call, not at registration: a contributor is synchronous, and a forge not yet answering must not keep the runtime from serving. One source per kept file in a process, or the watcher and the tools would each renew on a 401 and drop the other's token by name.	2026-09-23 23:48:36 +02:00
jschoubben	065ddd6d69	gitea provides the package registry; the builder gets its npm credential ... gitea gains the package-registry provision: serves/receives/grants, an admin own-secret, a postgres-shaped build, and a provisioner that creates a gitea user per consumer with the mesh-minted password and seals nothing (hq ADR 0048). The builder takes its registry credential as an own-secret rather than a resolved provision, because gitea-as-module needs the base to build its provisioner and so cannot resolve before the base — a cycle the own-secret avoids. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx	2026-09-16 10:27:26 +02:00
jschoubben	259c3721b5	gitea: full nox module — client, tools and events (ADR 0044/0046) ... Git hosting. 15 tools (repos, issues, PRs, labels, api passthrough) moved out of the shared sdk. Emits repo.created (from a light poll, catching repos born of git push or the web UI), issue.opened and pull.merged (from the tools at the moment of the action) — the poll owns repo.created alone so it is never announced twice. Typechecks; manifest parses.	2026-09-04 02:30:40 +02:00