gitea: npm package retention — keep what is named and the newest five (hq ADR 0251 §4) #124

2026-10-08T10:01:06Z

mesh-admin commented

2026-10-08 10:01:06 +00:00

hq ADR 0251 §4 and to-be 51, "The package registry" (hq PR #200).

This adds a Go bundle cmd/npm-registry beside the module's TypeScript bundle. The TypeScript is untouched. It serves two tools:

npm_packages (r): every npm package of the registry's owner. Each version is listed newest first, with when it was published, its size, and what keeps it.
npm_retention (a): what retention would delete, and the bytes. It is a dry run unless dry_run is false. A real run needs why, and it deletes nothing at all while any repository or file on the forge could not be read.

A version is kept when one of these holds:

a lockfile on a repository's default branch names it (package-lock, shrinkwrap, yarn classic and berry, pnpm);
it is the highest version satisfying a range that a package.json there names;
a dist-tag names it;
it is among the newest keep of its package (default 5; pre-releases count).

If a range cannot be read, its package keeps every version.

The bundle reaches the forge as the admin account, with basic authentication. It uses the same password file the TypeScript bundle mints its token with, and it mints and keeps nothing. The manifest deliberately lists no tools, because a claim without serves would offer them as verbs of both of the module's seats. The README says why, and a test holds the names together.

Checked locally: gofmt, go vet, and go test -race. merge-check.sh passes with MESH_GATE set to a controller built from main ("long-running resources without health: 70, as kept").

hq ADR 0251 §4 and to-be 51, "The package registry" (hq PR #200). This adds a Go bundle `cmd/npm-registry` beside the module's TypeScript bundle. The TypeScript is untouched. It serves two tools: - `npm_packages` (r): every npm package of the registry's owner. Each version is listed newest first, with when it was published, its size, and what keeps it. - `npm_retention` (a): what retention would delete, and the bytes. It is a dry run unless `dry_run` is false. A real run needs `why`, and it deletes nothing at all while any repository or file on the forge could not be read. A version is kept when one of these holds: - a lockfile on a repository's default branch names it (package-lock, shrinkwrap, yarn classic and berry, pnpm); - it is the highest version satisfying a range that a package.json there names; - a dist-tag names it; - it is among the newest `keep` of its package (default 5; pre-releases count). If a range cannot be read, its package keeps every version. The bundle reaches the forge as the admin account, with basic authentication. It uses the same password file the TypeScript bundle mints its token with, and it mints and keeps nothing. The manifest deliberately lists no `tools`, because a claim without `serves` would offer them as verbs of both of the module's seats. The README says why, and a test holds the names together. Checked locally: gofmt, go vet, and `go test -race`. merge-check.sh passes with MESH_GATE set to a controller built from main ("long-running resources without health: 70, as kept").

mesh-admin added 1 commit 2026-10-08 10:01:06 +00:00

gitea: say what keeps each npm version and delete only what nothing names (hq ADR 0251)

mesh/merge-gate pass: builds gitea → novox; no bus step; every machine composes with the change as it did without (4 of 4 compose)

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery superseded: a newer delivery to the same trunk took over its walk

Details

8059f35d17

Every publish added a version and nothing removed one. A Go bundle beside the
TypeScript one keeps what a lockfile or a range on the forge names, what a
dist-tag names and the newest five; a dry run unless asked with a why, and
nothing deleted while any repository is unread.

mesh-admin commented

2026-10-08 10:01:18 +00:00

Delivery novox/mesh-catalog@8059f35d17f9 — superseded since 2026-10-08T11:07:03Z

Delivery plan — builds gitea → novox; no bus step

tier 0: gitea
novox: receives gitea
gitea provides npm-package-registry, git: its consumers are sent again after it
gitea keeps data (ADR 0233): what it holds is backed up before it moves

Machines

docker on ace: judging — carried by plan-1791457567454314915

Transitions

2026-10-08 10:01 (new) → proposed (announced): novox/mesh-catalog#124's head announced
2026-10-08 10:02 proposed → checked (checked): the verdict names this commit
2026-10-08 10:02 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-08 11:07 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-08 11:07 published → superseded (superseded): a newer delivery to the same trunk took over its walk

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@8059f35d17f9` — **superseded** since 2026-10-08T11:07:03Z **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - docker on ace: judging — carried by plan-1791457567454314915 **Transitions** - 2026-10-08 10:01 (new) → proposed (announced): novox/mesh-catalog#124's head announced - 2026-10-08 10:02 proposed → checked (checked): the verdict names this commit - 2026-10-08 10:02 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-08 11:07 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-08 11:07 published → superseded (superseded): a newer delivery to the same trunk took over its walk The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented

2026-10-08 10:02:54 +00:00

Merge check at 8059f35d

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea)
mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds gitea → novox; no bus step

tier 0: gitea
novox: receives gitea
gitea provides npm-package-registry, git: its consumers are sent again after it
gitea keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on shanks as build-1791453670432059700 (builds --log build-1791453670432059700).

--- the gate: gitea
gitea: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T09:54:03Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-08T09:54:03Z

modules the change moves:
  - gitea (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 1 resource(s) and removes 0 (+archive:gitea.bundle-npm-registry)
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): gitea
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 29053 strings of 538 files
long-running resources without health: 70, as kept
testing modules/gitea
ok  	gitea/cmd/npm-registry	1.064s

**Merge check** at `8059f35d` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on shanks as `build-1791453670432059700` (`builds --log build-1791453670432059700`). ``` --- the gate: gitea gitea: ok, keeps data (valuable); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T09:54:03Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-08T09:54:03Z modules the change moves: - gitea (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 1 resource(s) and removes 0 (+archive:gitea.bundle-npm-registry) - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): gitea --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 29053 strings of 538 files long-running resources without health: 70, as kept testing modules/gitea ok gitea/cmd/npm-registry 1.064s ```

mesh-admin merged commit c78b5fc9f5 into main

2026-10-08 11:06:14 +00:00

mesh-admin deleted branch feat/npm-retention

2026-10-08 11:06:14 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#124