Review round 3 (issue 1954): the node-engine of today writes ${secret:} as given and the new one fills only
provision keys, so the client fills secrets this release; plans exist only for modules with a want, so a
module without a seat plan is read from the controller's assignment and never leaves for want of one, and
the holder composes held modules at the build they run; the SDK's provider lets go only on "yes".
After a restart the forge-account provider returned a plain error, which the helper writes as failed
with its values cleared, so every consumer lost its forge entry until the keys loaded. provider.ErrNotReady
keeps the entry serving, in waits (issue 1954).
ADR 0570 clauses 2 and 5: gitea, keycloak, postgres and route-adapter read mesh-provisioner.plans and
.provisions instead of the controller's assignments. postgres hands the database to a keeper and drops the
login; keycloak replaces the client's secret and keeps the client, so the data stays (issue 1954, V4).
Its registry row and test rows are already in f7f02abb; this is the probe they call. Each KV_<module>_<name> and
LOG_<module>_<name> stream is said filling at three quarters of its max_bytes, and kept while a finding is written
until under seven tenths. One read of every stream, so the bus module not answering is the probe failing to run, which
clears nothing; bucket-or-log-unread is not raised.
The agent account a machine names comes from placement; the engine's verdicts on it from its health report
(mesh-host.health, NodeHealth.Root and Contract); whether that verdict is on now from the watchman's presence, since
the report is written on a change only. The judgement is the controller's: no report, not heard, an engine older than
the judging, no verdict, or any verdict not healthy is not confined; a verdict waiting for the setuid search is quiet
for twelve hours from when this self-check first saw it waiting. machine.<node>.agent-root, urgent, the controller's
words. Rows in TestTheBusProbes; pins mesh-sdk f3677eb.
ADR 0570 clauses 1, 2 and 6 move the plan to mesh-provisioner_plans, fold needs into the seat and give
the node-engine the secret's fill, so the client no longer holds a value (issue 1954, V3).
The mesh's own addresses come from placement (each node's private address and its endpoint); who holds
node-intrusion-prevention, from seat-holders; who is heard, from the watchman's presence. Each heard holder is asked
seat:node-intrusion-prevention.banned@<node>, all at once. The finding is the controller's: machine.<node>.bans-the-mesh,
urgent, the same summary and words. A heard holder that does not answer makes the probe fail to run, never pass.
Rows in TestTheBusProbes; the manifest reads and invokes what the code does.
Each outcome names the value by the vault's own name and generation, never the value; held is provided, issued or given waits, an entry goes only on a retiring key's Approve. The vault no longer reads the controller's assignments, so it leaves the list of their readers. Pins mesh-sdk 6b8c694.
A login per consumer is pair (postgres, keycloak's client, gitea's npm registry, the vault's secret); an offer whose consumers present none is none (gitea's git and forge account, route-adapter's route).
jschoubben