Stacked on the count PR; must not merge before mesh-host #50 and mesh-controller #110 are merged and live. Until then mesh/merge-gate is expected RED: the running controller passes health through and the node-engine's validator refuses it (a container does not use "health") — the gate is protecting exactly the case that would refuse whole declarations on today's engines. Re-run the check once #110 is live.
First batch (93 → 70 undeclared):
Image checks adopted by name (kind: runtime) — each verified (healthy) on the live mesh today (docker ps on novox/ace):
mailu: resolver, admin, imap, smtp, antispam, webmail, webdav, fetchmail, front (9). Not antivirus (its image's start period is 360 s, past the 5-minute grace+looks bound — a bound change, per to-be 48 'not decided') and not redis (its image ships no check).
step-ca server; baserow server; supabase db, meta, kong, studio (studio's HOSTNAME fix of 2026-10-05 is what makes it healthy); nodered server (settings-path fix of 2026-09-30); matrix element.
(plex: mesh-media-catalog PR.)
Endpoints they already declare, looked at from the machine: tcp — postgres database, redis cache, mongodb database, mosquitto mqtt; http / — website web, grafana web. Each verified answering on its machine's published port now (website 200, grafana 302, tcp connects).
Consequence on rollout: adopting a runtime check sets the container's check flags, which is part of the container spec → the 17 adopted containers are recreated once when a Phase-B engine first receives this (mail, the database suite, step-ca, …). http/tcp recreate nothing.
The bed (mesh-lab #56) run by hand over this tree: mosquitto proved; baserow does not stay up alone (needs its data mount) → left to the first machine's gate; the other images could not be pulled from g14 at the time (the laptop's VPN had replaced its resolver) — the build seat pulls them.
module check with the Phase B controller: all pass, count 70 as kept. check-here: repo-check PASS; merge-gate FAIL as explained above.
**Stacked on the count PR; must not merge before mesh-host #50 and mesh-controller #110 are merged and live.** Until then `mesh/merge-gate` is expected RED: the running controller passes `health` through and the node-engine's validator refuses it (`a container does not use "health"`) — the gate is protecting exactly the case that would refuse whole declarations on today's engines. Re-run the check once #110 is live.
First batch (93 → 70 undeclared):
**Image checks adopted by name (`kind: runtime`)** — each verified `(healthy)` on the live mesh today (`docker ps` on novox/ace):
- mailu: resolver, admin, imap, smtp, antispam, webmail, webdav, fetchmail, front (9). **Not** antivirus (its image's start period is 360 s, past the 5-minute grace+looks bound — a bound change, per to-be 48 'not decided') and **not** redis (its image ships no check).
- step-ca server; baserow server; supabase db, meta, kong, studio (studio's HOSTNAME fix of 2026-10-05 is what makes it healthy); nodered server (settings-path fix of 2026-09-30); matrix element.
- (plex: mesh-media-catalog PR.)
**Endpoints they already declare, looked at from the machine:** tcp — postgres `database`, redis `cache`, mongodb `database`, mosquitto `mqtt`; http `/` — website `web`, grafana `web`. Each verified answering on its machine's published port now (website 200, grafana 302, tcp connects).
**Consequence on rollout:** adopting a runtime check sets the container's check flags, which is part of the container spec → the 17 adopted containers are recreated once when a Phase-B engine first receives this (mail, the database suite, step-ca, …). http/tcp recreate nothing.
The bed (mesh-lab #56) run by hand over this tree: mosquitto proved; baserow does not stay up alone (needs its data mount) → left to the first machine's gate; the other images could not be pulled from g14 at the time (the laptop's VPN had replaced its resolver) — the build seat pulls them.
module check with the Phase B controller: all pass, count 70 as kept. check-here: repo-check PASS; merge-gate FAIL as explained above.
Deliverynovox/mesh-catalog@f87f4cdfe5fd — delivered since 2026-10-07T17:00:43Z
Delivery plan — builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus step; 3 wait(s) for a person
composed together: pass — every machine composes with the change as it did without (4 of 4 compose)
Machines
baserow on ace: passed — healthy 3 times over 3m6s
grafana on ace: passed — judged with baserow: healthy 3 times over 3m6s
matrix on ace: passed — judged with baserow: healthy 3 times over 3m6s
mosquitto on ace: passed — judged with baserow: healthy 3 times over 3m6s
nodered on ace: passed — judged with baserow: healthy 3 times over 3m6s
redis on ace: passed — judged with baserow: healthy 3 times over 3m6s
supabase on ace: passed — judged with baserow: healthy 3 times over 3m6s
mailu on novox: passed — healthy 3 times over 4m24s
step-ca on novox: passed — judged with mailu: healthy 3 times over 4m24s
website on novox: passed — judged with mailu: healthy 3 times over 4m24s
baserow on the rest running it: sent
grafana on the rest running it: sent
matrix on the rest running it: sent
mosquitto on the rest running it: sent
nodered on the rest running it: sent
redis on the rest running it: sent
supabase on the rest running it: sent
mailu on the rest running it: sent
step-ca on the rest running it: sent
website on the rest running it: sent
Transitions
2026-10-07 16:48 (new) → proposed (announced): novox/mesh-catalog#104's head announced
2026-10-07 16:51 proposed → checked (checked): the verdict names this commit
2026-10-07 16:51 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-07 16:54 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-07 16:54 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
2026-10-07 17:00 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-catalog@f87f4cdfe5fd` — **delivered** since 2026-10-07T17:00:43Z
**Delivery plan** — builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus step; 3 wait(s) for a person
- tier 0: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
- ace: receives baserow, grafana, matrix, mosquitto, nodered, redis, supabase; waits for a person: postgres
- novox: receives mailu, step-ca, website; waits for a person: mongodb, postgres
- baserow keeps data (ADR 0233): what it holds is backed up before it moves
- grafana keeps data (ADR 0233): what it holds is backed up before it moves
- mailu provides smtp: its consumers are sent again after it
- mailu keeps data (ADR 0233): what it holds is backed up before it moves
- matrix keeps data (ADR 0233): what it holds is backed up before it moves
- mongodb waits for a person: its policy records (module)
- mongodb provides mongodb-database: its consumers are sent again after it
- mongodb keeps data (ADR 0233): what it holds is backed up before it moves
- mosquitto provides mqtt-topic: its consumers are sent again after it
- mosquitto keeps data (ADR 0233): what it holds is backed up before it moves
- nodered keeps data (ADR 0233): what it holds is backed up before it moves
- postgres waits for a person: its policy records (module)
- postgres provides postgres-database: its consumers are sent again after it
- postgres keeps data (ADR 0233): what it holds is backed up before it moves
- redis provides redis-cache: its consumers are sent again after it
- redis keeps data (ADR 0233): what it holds is backed up before it moves
- step-ca provides internal-acme-ca: its consumers are sent again after it
- step-ca keeps data (ADR 0233): what it holds is backed up before it moves
- supabase keeps data (ADR 0233): what it holds is backed up before it moves
**Group** `feat/health-the-first-declarations`, in order: novox/mesh-catalog@f87f4cdfe5fd → novox/mesh-media-catalog@b5499af2d1fd
- composed together: pass — every machine composes with the change as it did without (4 of 4 compose)
**Machines**
- baserow on ace: passed — healthy 3 times over 3m6s
- grafana on ace: passed — judged with baserow: healthy 3 times over 3m6s
- matrix on ace: passed — judged with baserow: healthy 3 times over 3m6s
- mosquitto on ace: passed — judged with baserow: healthy 3 times over 3m6s
- nodered on ace: passed — judged with baserow: healthy 3 times over 3m6s
- redis on ace: passed — judged with baserow: healthy 3 times over 3m6s
- supabase on ace: passed — judged with baserow: healthy 3 times over 3m6s
- mailu on novox: passed — healthy 3 times over 4m24s
- step-ca on novox: passed — judged with mailu: healthy 3 times over 4m24s
- website on novox: passed — judged with mailu: healthy 3 times over 4m24s
- baserow on the rest running it: sent
- grafana on the rest running it: sent
- matrix on the rest running it: sent
- mosquitto on the rest running it: sent
- nodered on the rest running it: sent
- redis on the rest running it: sent
- supabase on the rest running it: sent
- mailu on the rest running it: sent
- step-ca on the rest running it: sent
- website on the rest running it: sent
**Transitions**
- 2026-10-07 16:48 (new) → proposed (announced): novox/mesh-catalog#104's head announced
- 2026-10-07 16:51 proposed → checked (checked): the verdict names this commit
- 2026-10-07 16:51 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-07 16:54 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-07 16:54 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
- 2026-10-07 17:00 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh/merge-gate: FAIL — 2 problem(s) the change brings; the first: holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — resource "postgres.server": a container does not use "health", and it is set. Refused rather than ignored (modules: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website)
mesh/repo-check: PASS — its merge-check.sh passed
Change plan — builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus step; 3 wait(s) for a person
ace: receives baserow, grafana, matrix, mosquitto, nodered, redis, supabase; waits for a person: postgres
novox: receives mailu, step-ca, website; waits for a person: mongodb, postgres
baserow keeps data (ADR 0233): what it holds is backed up before it moves
grafana keeps data (ADR 0233): what it holds is backed up before it moves
mailu provides smtp: its consumers are sent again after it
mailu keeps data (ADR 0233): what it holds is backed up before it moves
matrix keeps data (ADR 0233): what it holds is backed up before it moves
mongodb waits for a person: its policy records (module)
mongodb provides mongodb-database: its consumers are sent again after it
mongodb keeps data (ADR 0233): what it holds is backed up before it moves
mosquitto provides mqtt-topic: its consumers are sent again after it
mosquitto keeps data (ADR 0233): what it holds is backed up before it moves
nodered keeps data (ADR 0233): what it holds is backed up before it moves
postgres waits for a person: its policy records (module)
postgres provides postgres-database: its consumers are sent again after it
postgres keeps data (ADR 0233): what it holds is backed up before it moves
redis provides redis-cache: its consumers are sent again after it
redis keeps data (ADR 0233): what it holds is backed up before it moves
step-ca provides internal-acme-ca: its consumers are sent again after it
step-ca keeps data (ADR 0233): what it holds is backed up before it moves
supabase keeps data (ADR 0233): what it holds is backed up before it moves
read by no module's build: health-undeclared, merge-check.sh
Run by the build seat on novox as build-1791382694945479783 (builds --log build-1791382694945479783).
--- the gate: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
baserow: ok, keeps data (valuable)
grafana: ok, keeps data (valuable)
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache)
matrix: ok, keeps db (valuable)
mongodb: ok, keeps data (valuable), dumps (rebuildable)
mosquitto: ok, keeps data (rebuildable)
nodered: ok, keeps data (valuable)
postgres: ok, keeps store (valuable), dumps (rebuildable)
redis: ok, keeps data (cache)
step-ca: ok, keeps home (valuable)
supabase: ok, keeps db (valuable), dumps (rebuildable), storage (valuable), functions (valuable), db-config (rebuildable)
website: ok
12 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 12 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T13:56:37Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 2 problem(s) the change brings; the first: holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — resource "postgres.server": a container does not use "health", and it is set. Refused rather than ignored
judged by controller development build against the facts of 2026-10-07T13:56:37Z
fails:
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — resource "postgres.server": a container does not use "health", and it is set. Refused rather than ignored
- holds mesh-dns-resolver (idt): nothing could be sent to it with this change — resource "postgres.server": a container does not use "health", and it is set. Refused rather than ignored
modules the change moves:
- baserow (changed)
- grafana (changed)
- mailu (changed)
- matrix (changed)
- mongodb (changed)
- mosquitto (changed)
- nodered (changed)
- postgres (changed)
- redis (changed)
- step-ca (changed)
- supabase (changed)
- website (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): does not compose
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose
- a machine (yvbpsm): composes
a merge would rebuild 12 module(s) in 1 tier(s): baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
notes:
- health-undeclared and merge-check.sh read by no module's build, and rebuild nothing (issue 280)
mesh-controller: the change fails the merge gate
--- its merge-check.sh (go toolchain)
NOT COUNTED: the controller the mesh runs is older than the count of resources without health (ADR 0240 Phase B)
NOT TESTED HERE: modules/baserow is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/grafana is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mailu is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mongodb is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mosquitto is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/nodered is TypeScript; the gate judges its manifest
testing modules/postgres
ok postgres/cmd/postgres-provider 2.235s
NOT TESTED HERE: modules/redis is TypeScript; the gate judges its manifest
**Merge check** at `84345359`
- `mesh/merge-gate`: **FAIL** — 2 problem(s) the change brings; the first: holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — resource "postgres.server": a container does not use "health", and it is set. Refused rather than ignored (modules: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Change plan** — builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus step; 3 wait(s) for a person
- tier 0: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
- ace: receives baserow, grafana, matrix, mosquitto, nodered, redis, supabase; waits for a person: postgres
- novox: receives mailu, step-ca, website; waits for a person: mongodb, postgres
- baserow keeps data (ADR 0233): what it holds is backed up before it moves
- grafana keeps data (ADR 0233): what it holds is backed up before it moves
- mailu provides smtp: its consumers are sent again after it
- mailu keeps data (ADR 0233): what it holds is backed up before it moves
- matrix keeps data (ADR 0233): what it holds is backed up before it moves
- mongodb waits for a person: its policy records (module)
- mongodb provides mongodb-database: its consumers are sent again after it
- mongodb keeps data (ADR 0233): what it holds is backed up before it moves
- mosquitto provides mqtt-topic: its consumers are sent again after it
- mosquitto keeps data (ADR 0233): what it holds is backed up before it moves
- nodered keeps data (ADR 0233): what it holds is backed up before it moves
- postgres waits for a person: its policy records (module)
- postgres provides postgres-database: its consumers are sent again after it
- postgres keeps data (ADR 0233): what it holds is backed up before it moves
- redis provides redis-cache: its consumers are sent again after it
- redis keeps data (ADR 0233): what it holds is backed up before it moves
- step-ca provides internal-acme-ca: its consumers are sent again after it
- step-ca keeps data (ADR 0233): what it holds is backed up before it moves
- supabase keeps data (ADR 0233): what it holds is backed up before it moves
- read by no module's build: health-undeclared, merge-check.sh
Run by the build seat on novox as `build-1791382694945479783` (`builds --log build-1791382694945479783`).
```
--- the gate: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
baserow: ok, keeps data (valuable)
grafana: ok, keeps data (valuable)
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache)
matrix: ok, keeps db (valuable)
mongodb: ok, keeps data (valuable), dumps (rebuildable)
mosquitto: ok, keeps data (rebuildable)
nodered: ok, keeps data (valuable)
postgres: ok, keeps store (valuable), dumps (rebuildable)
redis: ok, keeps data (cache)
step-ca: ok, keeps home (valuable)
supabase: ok, keeps db (valuable), dumps (rebuildable), storage (valuable), functions (valuable), db-config (rebuildable)
website: ok
12 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 12 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T13:56:37Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 2 problem(s) the change brings; the first: holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — resource "postgres.server": a container does not use "health", and it is set. Refused rather than ignored
judged by controller development build against the facts of 2026-10-07T13:56:37Z
fails:
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — resource "postgres.server": a container does not use "health", and it is set. Refused rather than ignored
- holds mesh-dns-resolver (idt): nothing could be sent to it with this change — resource "postgres.server": a container does not use "health", and it is set. Refused rather than ignored
modules the change moves:
- baserow (changed)
- grafana (changed)
- mailu (changed)
- matrix (changed)
- mongodb (changed)
- mosquitto (changed)
- nodered (changed)
- postgres (changed)
- redis (changed)
- step-ca (changed)
- supabase (changed)
- website (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): does not compose
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose
- a machine (yvbpsm): composes
a merge would rebuild 12 module(s) in 1 tier(s): baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
notes:
- health-undeclared and merge-check.sh read by no module's build, and rebuild nothing (issue 280)
mesh-controller: the change fails the merge gate
--- its merge-check.sh (go toolchain)
NOT COUNTED: the controller the mesh runs is older than the count of resources without health (ADR 0240 Phase B)
NOT TESTED HERE: modules/baserow is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/grafana is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mailu is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mongodb is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mosquitto is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/nodered is TypeScript; the gate judges its manifest
testing modules/postgres
ok postgres/cmd/postgres-provider 2.235s
NOT TESTED HERE: modules/redis is TypeScript; the gate judges its manifest
```
Seven modules' images ship a check the mesh never read. Adopted by name where
it says healthy on the live mesh today: nine of mail's containers (not its
antivirus, whose six-minute start is past the five-minute bound, nor its cache,
whose image ships none), the certificate authority, the spreadsheet app, four
of the database suite's (the studio among them, with the address it binds
fixed), the flow editor and the chat client. And the endpoints four services
already declare, looked at from the machine: tcp on the database, the cache,
the document store and the broker; http on the website and the dashboards.
The count of undeclared falls from 93 to 70.
mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website)
mesh/repo-check: PASS — its merge-check.sh passed
Change plan — builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus step; 3 wait(s) for a person
ace: receives baserow, grafana, matrix, mosquitto, nodered, redis, supabase; waits for a person: postgres
novox: receives mailu, step-ca, website; waits for a person: mongodb, postgres
baserow keeps data (ADR 0233): what it holds is backed up before it moves
grafana keeps data (ADR 0233): what it holds is backed up before it moves
mailu provides smtp: its consumers are sent again after it
mailu keeps data (ADR 0233): what it holds is backed up before it moves
matrix keeps data (ADR 0233): what it holds is backed up before it moves
mongodb waits for a person: its policy records (module)
mongodb provides mongodb-database: its consumers are sent again after it
mongodb keeps data (ADR 0233): what it holds is backed up before it moves
mosquitto provides mqtt-topic: its consumers are sent again after it
mosquitto keeps data (ADR 0233): what it holds is backed up before it moves
nodered keeps data (ADR 0233): what it holds is backed up before it moves
postgres waits for a person: its policy records (module)
postgres provides postgres-database: its consumers are sent again after it
postgres keeps data (ADR 0233): what it holds is backed up before it moves
redis provides redis-cache: its consumers are sent again after it
redis keeps data (ADR 0233): what it holds is backed up before it moves
step-ca provides internal-acme-ca: its consumers are sent again after it
step-ca keeps data (ADR 0233): what it holds is backed up before it moves
supabase keeps data (ADR 0233): what it holds is backed up before it moves
read by no module's build: health-undeclared
Run by the build seat on novox as build-1791391711658573413 (builds --log build-1791391711658573413).
--- the gate: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
baserow: ok, keeps data (valuable), ready: server by its image's own check every 30s
grafana: ok, keeps data (valuable), ready: server by http / on web every 30s
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
matrix: ok, keeps db (valuable), ready: element by its image's own check every 30s; WARNING: homeserver stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mongodb: ok, keeps data (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
mosquitto: ok, keeps data (rebuildable), ready: server by tcp on mqtt every 30s
nodered: ok, keeps data (valuable), ready: server by its image's own check every 30s
postgres: ok, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
redis: ok, keeps data (cache), ready: server by tcp on cache every 30s
step-ca: ok, keeps home (valuable), ready: server by its image's own check every 30s
supabase: ok, keeps db (valuable), dumps (rebuildable), storage (valuable), functions (valuable), db-config (rebuildable), ready: db by its image's own check every 30s; kong by its image's own check every 30s; meta by its image's own check every 30s; studio by its image's own check every 30s; WARNING: vector, analytics, auth, rest, realtime, imgproxy, storage-api, edge-functions, pooler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
website: ok, ready: server by http / on web every 30s
long-running resources without health: 13
12 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 12 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T16:43:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T16:43:39Z
modules the change moves:
- baserow (changed)
- grafana (changed)
- mailu (changed)
- matrix (changed)
- mongodb (changed)
- mosquitto (changed)
- nodered (changed)
- postgres (changed)
- redis (changed)
- step-ca (changed)
- supabase (changed)
- website (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 12 module(s) in 1 tier(s): baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
notes:
- health-undeclared read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
long-running resources without health: 70, as kept
NOT TESTED HERE: modules/baserow is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/grafana is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mailu is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mongodb is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mosquitto is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/nodered is TypeScript; the gate judges its manifest
testing modules/postgres
ok postgres/cmd/postgres-provider 1.396s
NOT TESTED HERE: modules/redis is TypeScript; the gate judges its manifest
**Merge check** at `f87f4cdf`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Change plan** — builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus step; 3 wait(s) for a person
- tier 0: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
- ace: receives baserow, grafana, matrix, mosquitto, nodered, redis, supabase; waits for a person: postgres
- novox: receives mailu, step-ca, website; waits for a person: mongodb, postgres
- baserow keeps data (ADR 0233): what it holds is backed up before it moves
- grafana keeps data (ADR 0233): what it holds is backed up before it moves
- mailu provides smtp: its consumers are sent again after it
- mailu keeps data (ADR 0233): what it holds is backed up before it moves
- matrix keeps data (ADR 0233): what it holds is backed up before it moves
- mongodb waits for a person: its policy records (module)
- mongodb provides mongodb-database: its consumers are sent again after it
- mongodb keeps data (ADR 0233): what it holds is backed up before it moves
- mosquitto provides mqtt-topic: its consumers are sent again after it
- mosquitto keeps data (ADR 0233): what it holds is backed up before it moves
- nodered keeps data (ADR 0233): what it holds is backed up before it moves
- postgres waits for a person: its policy records (module)
- postgres provides postgres-database: its consumers are sent again after it
- postgres keeps data (ADR 0233): what it holds is backed up before it moves
- redis provides redis-cache: its consumers are sent again after it
- redis keeps data (ADR 0233): what it holds is backed up before it moves
- step-ca provides internal-acme-ca: its consumers are sent again after it
- step-ca keeps data (ADR 0233): what it holds is backed up before it moves
- supabase keeps data (ADR 0233): what it holds is backed up before it moves
- read by no module's build: health-undeclared
Run by the build seat on novox as `build-1791391711658573413` (`builds --log build-1791391711658573413`).
```
--- the gate: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
baserow: ok, keeps data (valuable), ready: server by its image's own check every 30s
grafana: ok, keeps data (valuable), ready: server by http / on web every 30s
mailu: ok, keeps mail (valuable), dkim (valuable), data (valuable), dav (valuable), webmail (valuable), queue (valuable), filter (rebuildable), certs (rebuildable), automx (rebuildable), fetchmail (rebuildable), clamav (cache), redis (cache), ready: resolver by its image's own check every 30s; admin by its image's own check every 30s; imap by its image's own check every 30s; smtp by its image's own check every 30s; antispam by its image's own check every 30s; webmail by its image's own check every 30s; webdav by its image's own check every 30s; fetchmail by its image's own check every 30s; front by its image's own check every 30s; WARNING: redis, antivirus, automx stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
matrix: ok, keeps db (valuable), ready: element by its image's own check every 30s; WARNING: homeserver stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mongodb: ok, keeps data (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
mosquitto: ok, keeps data (rebuildable), ready: server by tcp on mqtt every 30s
nodered: ok, keeps data (valuable), ready: server by its image's own check every 30s
postgres: ok, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
redis: ok, keeps data (cache), ready: server by tcp on cache every 30s
step-ca: ok, keeps home (valuable), ready: server by its image's own check every 30s
supabase: ok, keeps db (valuable), dumps (rebuildable), storage (valuable), functions (valuable), db-config (rebuildable), ready: db by its image's own check every 30s; kong by its image's own check every 30s; meta by its image's own check every 30s; studio by its image's own check every 30s; WARNING: vector, analytics, auth, rest, realtime, imgproxy, storage-api, edge-functions, pooler stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
website: ok, ready: server by http / on web every 30s
long-running resources without health: 13
12 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 12 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T16:43:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T16:43:39Z
modules the change moves:
- baserow (changed)
- grafana (changed)
- mailu (changed)
- matrix (changed)
- mongodb (changed)
- mosquitto (changed)
- nodered (changed)
- postgres (changed)
- redis (changed)
- step-ca (changed)
- supabase (changed)
- website (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 12 module(s) in 1 tier(s): baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website
notes:
- health-undeclared read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
long-running resources without health: 70, as kept
NOT TESTED HERE: modules/baserow is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/grafana is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mailu is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mongodb is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/mosquitto is TypeScript; the gate judges its manifest
NOT TESTED HERE: modules/nodered is TypeScript; the gate judges its manifest
testing modules/postgres
ok postgres/cmd/postgres-provider 1.396s
NOT TESTED HERE: modules/redis is TypeScript; the gate judges its manifest
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Stacked on the count PR; must not merge before mesh-host #50 and mesh-controller #110 are merged and live. Until then
mesh/merge-gateis expected RED: the running controller passeshealththrough and the node-engine's validator refuses it (a container does not use "health") — the gate is protecting exactly the case that would refuse whole declarations on today's engines. Re-run the check once #110 is live.First batch (93 → 70 undeclared):
Image checks adopted by name (
kind: runtime) — each verified(healthy)on the live mesh today (docker pson novox/ace):Endpoints they already declare, looked at from the machine: tcp — postgres
database, rediscache, mongodbdatabase, mosquittomqtt; http/— websiteweb, grafanaweb. Each verified answering on its machine's published port now (website 200, grafana 302, tcp connects).Consequence on rollout: adopting a runtime check sets the container's check flags, which is part of the container spec → the 17 adopted containers are recreated once when a Phase-B engine first receives this (mail, the database suite, step-ca, …). http/tcp recreate nothing.
The bed (mesh-lab #56) run by hand over this tree: mosquitto proved; baserow does not stay up alone (needs its data mount) → left to the first machine's gate; the other images could not be pulled from g14 at the time (the laptop's VPN had replaced its resolver) — the build seat pulls them.
module check with the Phase B controller: all pass, count 70 as kept. check-here: repo-check PASS; merge-gate FAIL as explained above.
eb7f194da5to84345359d7Delivery
novox/mesh-catalog@f87f4cdfe5fd— delivered since 2026-10-07T17:00:43ZDelivery plan — builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus step; 3 wait(s) for a person
Group
feat/health-the-first-declarations, in order: novox/mesh-catalog@f87f4cdfe5 → novox/mesh-media-catalog@b5499af2d1Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
84345359mesh/merge-gate: FAIL — 2 problem(s) the change brings; the first: holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — resource "postgres.server": a container does not use "health", and it is set. Refused rather than ignored (modules: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website)mesh/repo-check: PASS — its merge-check.sh passedChange plan — builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus step; 3 wait(s) for a person
Run by the build seat on novox as
build-1791382694945479783(builds --log build-1791382694945479783).84345359d7tof87f4cdfe5Merge check at
f87f4cdfmesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website)mesh/repo-check: PASS — its merge-check.sh passedChange plan — builds baserow, grafana, mailu, matrix, mongodb, mosquitto, nodered, postgres, redis, step-ca, supabase, website → ace, novox; no bus step; 3 wait(s) for a person
Run by the build seat on novox as
build-1791391711658573413(builds --log build-1791391711658573413).