Read branch protection as the forge's administrator, so builds register again (issue 772, ADR 0375) #313

Merged

mesh-tools merged 1 commits from 772-protection-read-as-admin into main 2026-10-15 00:22:49 +00:00

Conversation 2 Commits 1 Files Changed 3

+78 -7

mesh-tools commented 2026-10-15 00:18:52 +00:00

Member

Copy Link

Copy Source

Critical: since #311 (issue 469) was delivered at 00:58, every walk that builds a module fails at the controller's build-source check, because gitea_branch_protection_get got a 403 for the rules' list (administrators only). Seen on plan-1792019685173332639 (mesh-controller #342).

gitea_branch_protection_get now reads the rules with the forge's administrator account, as ADR 0375 (accepted) decides. It only reads; gitea_branch_protection_set and every write stay on the tools' non-administrator account and keep being refused by the forge.

Test: modules/gitea/test/protection-read.test.ts (a fake forge answering the rules to the admin only): get with and without a branch answers, set still gets the 403, no admin write. It fails without the change.

Independent review (local, Sonnet): APPROVE at 385667e6: only modules/gitea, the admin client only in that read, answer shape unchanged for the controller's parser, no password in logs or errors, merge-check-typescript.sh 125/125. This forge commit 2e32f47e has the same tree as 385667e6 (aad467c6), on main 9492278d.

After delivery: retry plan-1792019685173332639 and see mesh-controller registered.

Critical: since #311 (issue 469) was delivered at 00:58, every walk that builds a module fails at the controller's build-source check, because gitea_branch_protection_get got a 403 for the rules' list (administrators only). Seen on plan-1792019685173332639 (mesh-controller #342). gitea_branch_protection_get now reads the rules with the forge's administrator account, as ADR 0375 (accepted) decides. It only reads; gitea_branch_protection_set and every write stay on the tools' non-administrator account and keep being refused by the forge. Test: modules/gitea/test/protection-read.test.ts (a fake forge answering the rules to the admin only): get with and without a branch answers, set still gets the 403, no admin write. It fails without the change. Independent review (local, Sonnet): APPROVE at 385667e6: only modules/gitea, the admin client only in that read, answer shape unchanged for the controller's parser, no password in logs or errors, merge-check-typescript.sh 125/125. This forge commit 2e32f47e has the same tree as 385667e6 (aad467c6), on main 9492278d. After delivery: retry plan-1792019685173332639 and see mesh-controller registered.

mesh-tools added 1 commit 2026-10-15 00:18:52 +00:00

Read branch protection as the forge's administrator, so builds register again ... 2e32f47e45

The forge answers a repository's protection rules to its administrator
alone, and the tools' account no longer is one (ADR 0365), so every
delivery building a module failed at the controller's build-source check
with a 403. gitea_branch_protection_get now reads the rules with the
administrator account (ADR 0375); it only reads, and the protection set
and every write stay refused to the tools' account. Issue 772.

Co-Authored-By: Claude <noreply@anthropic.com>

mesh-tools commented 2026-10-15 00:18:55 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@2e32f47e4596 — failed since 2026-10-15T00:23:45Z

Delivery plan — builds gitea → novox; no bus step

• tier 0: gitea
• novox: receives gitea
• gitea provides npm-package-registry, git: its consumers are sent again after it
• gitea keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

• 2026-10-15 00:18 (new) → proposed (announced): novox/mesh-catalog#313's head announced
• 2026-10-15 00:21 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-15 00:21 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-15 00:22 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-15 00:22 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-15 00:23 delivering → failed (failed): its walk failed, carrying its own commit: a gate on a first machine (what it carried put back), a build, a machine

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@2e32f47e4596` — **failed** since 2026-10-15T00:23:45Z **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-15 00:18 (new) → proposed (announced): novox/mesh-catalog#313's head announced - 2026-10-15 00:21 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-15 00:21 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-15 00:22 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-15 00:22 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-15 00:23 delivering → failed (failed): its walk failed, carrying its own commit: a gate on a first machine (what it carried put back), a build, a machine The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented 2026-10-15 00:21:23 +00:00

Author

Member

Copy Link

Copy Source

Merge check at 2e32f47e
Judged: head 2e32f47e4596 merged into trunk 9492278d934b; read beside it: mesh-controller 4cc6b6c566a5, mesh-controller-main 0b7e740b299c, mesh-host 198fd34ec497, mesh-tools 5d70eb3e35a9

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds gitea → novox; no bus step

• tier 0: gitea
• novox: receives gitea
• gitea provides npm-package-registry, git: its consumers are sent again after it
• gitea keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on shanks as build-1792023533382097029 (builds --log build-1792023533382097029).

  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): gitea
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 47569 strings of 727 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.014s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 62, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.204s
testing modules/gitea
ok  	gitea/cmd/forge	1.494s
ok  	gitea/cmd/npm-registry	1.850s
?   	gitea/internal/forgehttp	[no test files]
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/gitea (TypeScript)
testing modules/gitea (TypeScript)
✔ a pull request opened after the margin is looked at, by its own update time (13.188581ms)
✔ every open pull request is read with what its base requires and what its head has (gitea_open_pulls) (55.470535ms)
✔ a pull request or issue number that is not one is refused before the forge is asked (1.592644ms)
✔ a merged pull request whose branch was deleted is announced with its branch, not its pull ref (16.212377ms)
✔ a pull request's ready mark is read: the label and the head the newest listed ready comment names (21.176332ms)
✔ a ready comment by an account not listed is ignored, and said (0.568619ms)
✔ a ready comment older than the latest push, or than the label, never counts (45.827518ms)
[gitea] f cannot be read (gone); only mesh-tools, mesh-admin may mark a pull request ready
[gitea] f names no account that may mark a pull request ready; only mesh-tools, mesh-admin may
✔ a long thread hides nothing: every page of the timeline is read (14.783065ms)
✔ the accounts that may mark are the setting's, and only the mesh's own when it cannot be read (0.772672ms)
✔ the newest status of each context is kept, with what it said, when and by whom (20.138127ms)
✔ a commit merges only when every required status is a success; a warning blocks (0.709771ms)
✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.291204ms)
✔ a commit is contained in another when the compare finds nothing on it the other lacks (1.053776ms)
✔ a note line is appended once, as the forge's user, in its own repository (9.14135ms)
✔ a note that cannot be written is said, never read as written (0.390666ms)
✔ one view per pull request, found by its marker; only the mesh's statuses (0.547938ms)
✔ a build machine taking the check is said on the head: building on which machine, since the local time (20.478822ms)
✔ the verdict heard while a 'building' write is in flight lands last and stays (8.085173ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ the verdict written while a start's read of the forge is in flight stays the newest status (0.933684ms)
✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (0.555049ms)
✔ a start heard after the verdict writes nothing (0.456797ms)
✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.537318ms)
✔ an old run's verdict redelivered after a recheck's pending is not written over it (0.762162ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (2.504658ms)
✔ a rechecked head says where its new run is: building on which machine (0.804412ms)
✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.764991ms)
✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.540899ms)
✔ a recheck the forge does not take fails its caller, and the head is as it was (0.64668ms)
✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (4.664151ms)
✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.507838ms)
✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (0.487157ms)
✔ a repository as the mesh clones it is told from another (0.332005ms)
✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (7.425233ms)
✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (54.735374ms)
✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (22.732756ms)
✔ gitea_api still writes what an author writes (9.887391ms)
✔ gitea_branch_protection_set only strengthens (20.554983ms)
✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (47.214849ms)
✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (153.06179ms)
✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (16.823926ms)
✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (14.071274ms)
✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (26.413092ms)
✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (54.548791ms)
✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (19.726351ms)
✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.959336ms)
✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (5.502304ms)
✔ a rule named for a branch is not made weaker than the glob rule that guards it now (11.875062ms)
✔ a repository owner or name is never another path (0.193093ms)
✔ the judges, without a forge (0.313705ms)
✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.324725ms)
✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.109782ms)
✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (3.438833ms)
✔ every page of a pull request's files is read, though the forge caps a page at fifty (28.626126ms)
✔ a pass asks only the repositories that moved since the last look, every one before the first (0.441976ms)
✔ the directories above a merge's files that hold a module at the commit are said, the root never (12.138565ms)
✔ a lookup the forge refuses is thrown, not read as no module (3.488973ms)
✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (4.646651ms)
✔ a new head beyond the newest 20 open pull requests is announced, exactly once (63.011799ms)
✔ a pass pages until it reaches back past its floor, and no further (32.462864ms)
✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (23.349846ms)
✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (5.196149ms)
✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (3.843949ms)
✔ the statuses asked for replace the rule's, and an empty list requires none (10.853626ms)
✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.366465ms)
✔ each open pull request's new head is announced once, and nothing closed or merged (12.796665ms)
✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.015776ms)
✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.786542ms)
✔ no verdict sets warning on a required check; only a person's decision fails (1.208909ms)
✔ a commit status is set on the commit, under the merge check's context (46.734352ms)
✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.594299ms)
✔ a head announced is pending in the build queue, since the local time it was announced (0.356265ms)
✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.896564ms)
✔ a consumer that asks nothing, or write, publishes: the package team (1.468562ms)
✔ a consumer that asks to read joins the readers, who write no package (0.374366ms)
✔ a reader is made, put on the readers team, and taken off the package team (0.422456ms)
✔ a publisher is made and put on the package team, as before (0.179323ms)
✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (43.29741ms)
✔ second start: reuses the kept token, mints nothing (33.443279ms)
✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (30.823919ms)
✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (26.762568ms)
✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (26.795928ms)
✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (22.899258ms)
✔ concurrent first calls share one mint (13.558427ms)
✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (15.371955ms)
✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (86.579029ms)
✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (7.115058ms)
✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (15.185921ms)
✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.773162ms)
✔ a second process finds the token the first renewed, and reuses it instead of minting over it (20.810937ms)
✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.208433ms)
✔ nothing to mint with and no token: the client says what is missing (0.166762ms)
[gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-77HJxh/state/token
✔ the tools register once there is a way to a token, and the first call mints it (26.363281ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-1W6sAU/state/token
✔ a pull request can be closed, read and cleaned up through the tools (33.878396ms)
[gitea] no token kept — minting one
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-Aa8aIo/state/token
✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (54.037693ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-CrLmwe/state/token
✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (39.686254ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-OtwKlB/state/token
✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (37.589082ms)
[gitea] the kept token was minted with other scopes than the tools take now — minting one with them
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-201fZH/state/token
[gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now
✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (33.256116ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-W0SNJU/state/token
✔ a tools' account someone made an administrator is made a plain account again at the next mint (26.669116ms)
✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.830603ms)
✔ the manifest hands the tools their account, and the merge-ready authors name it rather than the administrator (0.893013ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-RBPgJe/state/token
✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (28.525524ms)
[gitea] no token kept — minting one
✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (15.430545ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-TRs8cz/state/token
[gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"}
✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (35.258636ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-rQbWWZ/state/token
✔ a team another process made between the look and the create is found, not a failure (27.496508ms)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (1.563404ms)
✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (0.990835ms)
✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (4.712222ms)
✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.399496ms)
✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.598299ms)
✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.356376ms)
✔ a verdict that landed out of date keeps its account on the pull request (0.331545ms)
✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.562819ms)
✔ a signed event is published on the bus and acted on once (62.278949ms)
✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (28.994732ms)
✔ an event and the poll seeing the same head announce it once (0.439937ms)
✔ each forge event is named in the module's stream and trimmed (0.70995ms)
✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.533413ms)
✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.413472ms)
✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (4.694232ms)
✔ a forge that makes no system webhook is said, never taken as heard (0.994225ms)
✔ the receiver tells what it verified and what it refused (10.715013ms)
✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.420042ms)
✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.609609ms)
✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.344575ms)
✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.213453ms)
ℹ tests 125
ℹ suites 0
ℹ pass 125
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 660.423345

**Merge check** at `2e32f47e` Judged: head `2e32f47e4596` merged into trunk `9492278d934b`; read beside it: mesh-controller `4cc6b6c566a5`, mesh-controller-main `0b7e740b299c`, mesh-host `198fd34ec497`, mesh-tools `5d70eb3e35a9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on shanks as `build-1792023533382097029` (`builds --log build-1792023533382097029`). ``` - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): gitea --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 47569 strings of 727 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.014s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 62, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.204s testing modules/gitea ok gitea/cmd/forge 1.494s ok gitea/cmd/npm-registry 1.850s ? gitea/internal/forgehttp [no test files] --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/gitea (TypeScript) testing modules/gitea (TypeScript) ✔ a pull request opened after the margin is looked at, by its own update time (13.188581ms) ✔ every open pull request is read with what its base requires and what its head has (gitea_open_pulls) (55.470535ms) ✔ a pull request or issue number that is not one is refused before the forge is asked (1.592644ms) ✔ a merged pull request whose branch was deleted is announced with its branch, not its pull ref (16.212377ms) ✔ a pull request's ready mark is read: the label and the head the newest listed ready comment names (21.176332ms) ✔ a ready comment by an account not listed is ignored, and said (0.568619ms) ✔ a ready comment older than the latest push, or than the label, never counts (45.827518ms) [gitea] f cannot be read (gone); only mesh-tools, mesh-admin may mark a pull request ready [gitea] f names no account that may mark a pull request ready; only mesh-tools, mesh-admin may ✔ a long thread hides nothing: every page of the timeline is read (14.783065ms) ✔ the accounts that may mark are the setting's, and only the mesh's own when it cannot be read (0.772672ms) ✔ the newest status of each context is kept, with what it said, when and by whom (20.138127ms) ✔ a commit merges only when every required status is a success; a warning blocks (0.709771ms) ✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.291204ms) ✔ a commit is contained in another when the compare finds nothing on it the other lacks (1.053776ms) ✔ a note line is appended once, as the forge's user, in its own repository (9.14135ms) ✔ a note that cannot be written is said, never read as written (0.390666ms) ✔ one view per pull request, found by its marker; only the mesh's statuses (0.547938ms) ✔ a build machine taking the check is said on the head: building on which machine, since the local time (20.478822ms) ✔ the verdict heard while a 'building' write is in flight lands last and stays (8.085173ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ the verdict written while a start's read of the forge is in flight stays the newest status (0.933684ms) ✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (0.555049ms) ✔ a start heard after the verdict writes nothing (0.456797ms) ✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.537318ms) ✔ an old run's verdict redelivered after a recheck's pending is not written over it (0.762162ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (2.504658ms) ✔ a rechecked head says where its new run is: building on which machine (0.804412ms) ✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.764991ms) ✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.540899ms) ✔ a recheck the forge does not take fails its caller, and the head is as it was (0.64668ms) ✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (4.664151ms) ✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.507838ms) ✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (0.487157ms) ✔ a repository as the mesh clones it is told from another (0.332005ms) ✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (7.425233ms) ✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (54.735374ms) ✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (22.732756ms) ✔ gitea_api still writes what an author writes (9.887391ms) ✔ gitea_branch_protection_set only strengthens (20.554983ms) ✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (47.214849ms) ✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (153.06179ms) ✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (16.823926ms) ✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (14.071274ms) ✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (26.413092ms) ✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (54.548791ms) ✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (19.726351ms) ✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.959336ms) ✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (5.502304ms) ✔ a rule named for a branch is not made weaker than the glob rule that guards it now (11.875062ms) ✔ a repository owner or name is never another path (0.193093ms) ✔ the judges, without a forge (0.313705ms) ✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.324725ms) ✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.109782ms) ✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (3.438833ms) ✔ every page of a pull request's files is read, though the forge caps a page at fifty (28.626126ms) ✔ a pass asks only the repositories that moved since the last look, every one before the first (0.441976ms) ✔ the directories above a merge's files that hold a module at the commit are said, the root never (12.138565ms) ✔ a lookup the forge refuses is thrown, not read as no module (3.488973ms) ✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (4.646651ms) ✔ a new head beyond the newest 20 open pull requests is announced, exactly once (63.011799ms) ✔ a pass pages until it reaches back past its floor, and no further (32.462864ms) ✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (23.349846ms) ✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (5.196149ms) ✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (3.843949ms) ✔ the statuses asked for replace the rule's, and an empty list requires none (10.853626ms) ✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.366465ms) ✔ each open pull request's new head is announced once, and nothing closed or merged (12.796665ms) ✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.015776ms) ✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.786542ms) ✔ no verdict sets warning on a required check; only a person's decision fails (1.208909ms) ✔ a commit status is set on the commit, under the merge check's context (46.734352ms) ✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.594299ms) ✔ a head announced is pending in the build queue, since the local time it was announced (0.356265ms) ✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.896564ms) ✔ a consumer that asks nothing, or write, publishes: the package team (1.468562ms) ✔ a consumer that asks to read joins the readers, who write no package (0.374366ms) ✔ a reader is made, put on the readers team, and taken off the package team (0.422456ms) ✔ a publisher is made and put on the package team, as before (0.179323ms) ✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (43.29741ms) ✔ second start: reuses the kept token, mints nothing (33.443279ms) ✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (30.823919ms) ✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (26.762568ms) ✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (26.795928ms) ✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (22.899258ms) ✔ concurrent first calls share one mint (13.558427ms) ✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (15.371955ms) ✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (86.579029ms) ✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (7.115058ms) ✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (15.185921ms) ✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.773162ms) ✔ a second process finds the token the first renewed, and reuses it instead of minting over it (20.810937ms) ✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.208433ms) ✔ nothing to mint with and no token: the client says what is missing (0.166762ms) [gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-77HJxh/state/token ✔ the tools register once there is a way to a token, and the first call mints it (26.363281ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-1W6sAU/state/token ✔ a pull request can be closed, read and cleaned up through the tools (33.878396ms) [gitea] no token kept — minting one [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-Aa8aIo/state/token ✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (54.037693ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-CrLmwe/state/token ✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (39.686254ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-OtwKlB/state/token ✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (37.589082ms) [gitea] the kept token was minted with other scopes than the tools take now — minting one with them [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-201fZH/state/token [gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now ✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (33.256116ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-W0SNJU/state/token ✔ a tools' account someone made an administrator is made a plain account again at the next mint (26.669116ms) ✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.830603ms) ✔ the manifest hands the tools their account, and the merge-ready authors name it rather than the administrator (0.893013ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-RBPgJe/state/token ✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (28.525524ms) [gitea] no token kept — minting one ✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (15.430545ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-TRs8cz/state/token [gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"} ✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (35.258636ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-rQbWWZ/state/token ✔ a team another process made between the look and the create is found, not a failure (27.496508ms) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (1.563404ms) ✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (0.990835ms) ✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (4.712222ms) ✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.399496ms) ✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.598299ms) ✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.356376ms) ✔ a verdict that landed out of date keeps its account on the pull request (0.331545ms) ✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.562819ms) ✔ a signed event is published on the bus and acted on once (62.278949ms) ✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (28.994732ms) ✔ an event and the poll seeing the same head announce it once (0.439937ms) ✔ each forge event is named in the module's stream and trimmed (0.70995ms) ✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.533413ms) ✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.413472ms) ✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (4.694232ms) ✔ a forge that makes no system webhook is said, never taken as heard (0.994225ms) ✔ the receiver tells what it verified and what it refused (10.715013ms) ✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.420042ms) ✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.609609ms) ✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.344575ms) ✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.213453ms) ℹ tests 125 ℹ suites 0 ℹ pass 125 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 660.423345 ```

mesh-tools merged commit c71c513027 into main 2026-10-15 00:22:49 +00:00

mesh-tools deleted branch 772-protection-read-as-admin 2026-10-15 00:22:49 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jschoubben mesh-tools miel.truyen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#313