57/K2: The list of predefined keys, and a merge check refusing a key removed while a module names it (issue 661) #291

Merged

mesh-admin merged 2 commits from pkg/57-k2-predefined-keys into feat/57-config-and-provisioning 2026-10-14 06:52:29 +00:00

Conversation 1 Commits 2 Files Changed 5

+285

mesh-admin commented 2026-10-14 05:52:42 +00:00

Contributor

Copy Link

Copy Source

Package K2 of design 57 (ADR 0348 clause 7), the catalogue's half. The controller's half is mesh-controller#323 (merge it first: it reads, judges against and publishes this list).

What changed

• predefined.json at the root: font-size (number, points, minimum 6, maximum 72) and agent-managed-settings (object, trusted). Mesh config and node config may hold values only for these keys (ADR 0348 clause 7).
• checks/predefined and step 7 of merge-check.sh: a change to predefined.json that removes a key a manifest still names ("predefined": "<key>" under config or its alias settings) is refused, naming each module; judged against the trunk's list at the merge base (origin/${MESH_CHECK_BASE:-main}), a trunk without the file counting as an empty list. Removing the file whole is a removal of every key.

What it cannot know

Whether a removed key still holds a value at the mesh or a node: the values live in mesh-config (package K3), and this check reads no store. A removal no module names passes and says so. Left to K3 with a note on issue 662.

How it is proven

• checks/predefined TestARemovalOfAKeyAModuleStillNamesIsRefused (the planted removal), TestTheFileRemovedWholeIsARemovalOfEveryKey, TestARemovalNobodyNamesPassesAndSaysWhatItCannotKnow, TestAListUnchangedOrGrownPasses, TestNamedReadsBothForms.
• A planted removal through merge-check.sh itself: on a scratch branch, dunst's font-size named "predefined": "font-size" and the next commit removed the key; merge-check.sh exited 1 with predefined.json: the key "font-size" is removed and still named by dunst.

Checks run

MESH_CHECK_BASE=feat/57-config-and-provisioning MESH_GATE=<controller> sh merge-check.sh, exit 0, with two controllers as MESH_GATE:

• today's controller (mesh-controller main 3479a35, which knows nothing of the list): passes; it ignores a root file it does not know, and no manifest names a key yet. Long-running resources without health: 66, as kept.
• the K2 controller (mesh-controller#323 at fbcf447): passes; it reads and validates this predefined.json.

The forge's own checks are reported on this pull request once the build seat has run them.

Reviewer's checklist

1. The file with the first two keys and the merge-check rule, as issue 661 and design 57 K2 say; nothing else.
2. The planted removal is refused (test and merge-check.sh run above).
3. No manifest changes: nothing composes differently on any node.
4. No secret; no database.
5. The controller that reads predefined.json strictly is mesh-controller#323; today's controller ignores the file.
6. gofmt/go vet/go test of checks/predefined and merge-check.sh as above.
7. Glossary words (predefined key, config value).

Package K2 of design 57 (ADR 0348 clause 7), the catalogue's half. The controller's half is mesh-controller#323 (merge it first: it reads, judges against and publishes this list). ## What changed - **`predefined.json` at the root**: `font-size` (number, points, minimum 6, maximum 72) and `agent-managed-settings` (object, trusted). Mesh config and node config may hold values only for these keys (ADR 0348 clause 7). - **`checks/predefined`** and step 7 of `merge-check.sh`: a change to `predefined.json` that removes a key a manifest still names (`"predefined": "<key>"` under `config` or its alias `settings`) is refused, naming each module; judged against the trunk's list at the merge base (`origin/${MESH_CHECK_BASE:-main}`), a trunk without the file counting as an empty list. Removing the file whole is a removal of every key. ## What it cannot know Whether a removed key still holds a value at the mesh or a node: the values live in mesh-config (package K3), and this check reads no store. A removal no module names passes and says so. Left to K3 with a note on issue 662. ## How it is proven - `checks/predefined` `TestARemovalOfAKeyAModuleStillNamesIsRefused` (the planted removal), `TestTheFileRemovedWholeIsARemovalOfEveryKey`, `TestARemovalNobodyNamesPassesAndSaysWhatItCannotKnow`, `TestAListUnchangedOrGrownPasses`, `TestNamedReadsBothForms`. - A planted removal through `merge-check.sh` itself: on a scratch branch, dunst's `font-size` named `"predefined": "font-size"` and the next commit removed the key; `merge-check.sh` exited 1 with `predefined.json: the key "font-size" is removed and still named by dunst`. ## Checks run `MESH_CHECK_BASE=feat/57-config-and-provisioning MESH_GATE=<controller> sh merge-check.sh`, exit 0, with two controllers as `MESH_GATE`: - **today's controller** (mesh-controller main 3479a35, which knows nothing of the list): passes; it ignores a root file it does not know, and no manifest names a key yet. Long-running resources without health: 66, as kept. - **the K2 controller** (mesh-controller#323 at fbcf447): passes; it reads and validates this `predefined.json`. The forge's own checks are reported on this pull request once the build seat has run them. ## Reviewer's checklist 1. [x] The file with the first two keys and the merge-check rule, as issue 661 and design 57 K2 say; nothing else. 2. [x] The planted removal is refused (test and merge-check.sh run above). 3. [x] No manifest changes: nothing composes differently on any node. 4. [x] No secret; no database. 5. [x] The controller that reads `predefined.json` strictly is mesh-controller#323; today's controller ignores the file. 6. [x] `gofmt`/`go vet`/`go test` of checks/predefined and merge-check.sh as above. 7. [x] Glossary words (predefined key, config value).

mesh-admin added 2 commits 2026-10-14 05:52:42 +00:00

Add the list of predefined keys, and refuse removing a key a module still names ... 9ae9e321a8

Mesh and node config may hold values only for keys on a fixed, reviewed list (hq ADR 0348 clause 7, design 57 package K2, issue 661). predefined.json at the root starts with font-size (a number of points, 6 to 72) and agent-managed-settings (a trusted object). The merge check refuses a change that removes a key a manifest still names, against the trunk's list at the merge base; whether a removed key still holds a value is mesh-config's to refuse (package K3). Part 1 of 2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Check that a change to predefined.json removes no key a module still names ... ff3f8ca192

Part 2 of 2: the check merge-check.sh runs, and its tests with a planted removal (hq ADR 0348 clause 7, issue 661).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mesh-admin commented 2026-10-14 05:52:51 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-catalog@ff3f8ca192a4 — delivered since 2026-10-14T06:52:43Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Group pkg/57-k2-predefined-keys, in order: novox/mesh-catalog@ff3f8ca192 → novox/mesh-controller@197e60c97b

• composed together: pass — the change touches no module of the mesh's graph

Transitions

• 2026-10-14 05:52 (new) → proposed (announced): novox/mesh-catalog#291's head announced
• 2026-10-14 05:53 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-14 05:53 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-14 06:52 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-14 06:52 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@ff3f8ca192a4` — **delivered** since 2026-10-14T06:52:43Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Group** `pkg/57-k2-predefined-keys`, in order: novox/mesh-catalog@ff3f8ca192a4 → novox/mesh-controller@197e60c97bcc - composed together: pass — the change touches no module of the mesh's graph **Transitions** - 2026-10-14 05:52 (new) → proposed (announced): novox/mesh-catalog#291's head announced - 2026-10-14 05:53 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-14 05:53 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-14 06:52 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-14 06:52 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin reviewed 2026-10-14 06:07:35 +00:00

mesh-admin left a comment

Author

Contributor

Copy Link

Copy Source

Verdict: APPROVE at ff3f8ca192

Independent review of K2 (issue 661, ADR 0348 clause 7), catalogue half. Nothing must change.

What I ran in my own worktree of ff3f8ca:

• gofmt -l and go vet of checks/predefined: clean. go test: ok.
• MESH_CHECK_BASE=feat/57-config-and-provisioning sh merge-check.sh, once with MESH_GATE set to mesh-controller#323 (fbcf447) and once to main (3479a35): exit 0 both times, "predefined.json: 2 key(s), none removed that a module names", 66 resources without health, as kept.
• A planted removal: dunst names font-size and font-size is removed. checks/predefined exited 1 with the key "font-size" is removed and still named by dunst.
• A planted unknown field ("unit") in predefined.json: the #323 controller's module check refused all 128 manifests, naming the field. main's controller passed it.

Findings:

1. For information, matters for the release: the forge did not judge this pull request with the group's controller. mesh/merge-gate passed with "the change touches no module of the mesh's graph", so no gate ran and none judged "self". mesh/repo-check ran the base's merge-check.sh ("THE CHANGE ALTERS ITS OWN CHECK … feat/57-config-and-provisioning's version judged it"), with the controller the mesh runs beside it: mesh-controller 2959c81 on main, which ignores predefined.json. No composed check of the group ran; the group is "rejected" because #323's own check failed. So until the mesh runs a controller that has K2, nothing at the forge validates predefined.json. This pull request's strict read was proven only by hand (above).
2. Should: the group's order is catalogue then controller, with no pair and no reason given (mesh-delivery.groups). The body says to merge the controller first. Both go into feat/57, so it is harmless now. Declare the order if it is meant to hold.
3. Nit: the mktemp file for the trunk's list (merge-check.sh:62) is never removed; the trap only covers $deps.
4. The removal check reads modules/*/module.json only, which is where all 128 manifests are today. A key still holding a value is left to mesh-config (K3, noted on issue 662), as the body says.

Verdict: APPROVE at ff3f8ca192a45b655d7034ae7c41ea65ec2ef8f5 Independent review of K2 (issue 661, ADR 0348 clause 7), catalogue half. Nothing must change. What I ran in my own worktree of ff3f8ca: - `gofmt -l` and `go vet` of checks/predefined: clean. `go test`: ok. - `MESH_CHECK_BASE=feat/57-config-and-provisioning sh merge-check.sh`, once with MESH_GATE set to mesh-controller#323 (fbcf447) and once to main (3479a35): exit 0 both times, "predefined.json: 2 key(s), none removed that a module names", 66 resources without health, as kept. - A planted removal: dunst names font-size and font-size is removed. checks/predefined exited 1 with `the key "font-size" is removed and still named by dunst`. - A planted unknown field ("unit") in predefined.json: the #323 controller's module check refused all 128 manifests, naming the field. main's controller passed it. Findings: 1. **For information, matters for the release:** the forge did not judge this pull request with the group's controller. `mesh/merge-gate` passed with "the change touches no module of the mesh's graph", so no gate ran and none judged "self". `mesh/repo-check` ran the base's merge-check.sh ("THE CHANGE ALTERS ITS OWN CHECK … feat/57-config-and-provisioning's version judged it"), with the controller the mesh runs beside it: mesh-controller 2959c81 on main, which ignores predefined.json. No composed check of the group ran; the group is "rejected" because #323's own check failed. So until the mesh runs a controller that has K2, nothing at the forge validates predefined.json. This pull request's strict read was proven only by hand (above). 2. **Should:** the group's order is catalogue then controller, with no pair and no reason given (mesh-delivery.groups). The body says to merge the controller first. Both go into feat/57, so it is harmless now. Declare the order if it is meant to hold. 3. **Nit:** the `mktemp` file for the trunk's list (merge-check.sh:62) is never removed; the trap only covers `$deps`. 4. The removal check reads modules/*/module.json only, which is where all 128 manifests are today. A key still holding a value is left to mesh-config (K3, noted on issue 662), as the body says.

mesh-admin merged commit b807b1d211 into feat/57-config-and-provisioning 2026-10-14 06:52:29 +00:00

mesh-admin deleted branch pkg/57-k2-predefined-keys 2026-10-14 06:52:29 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

mesh-admin

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jschoubben miel.truyen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#291