mesh-mail: a send ask the operator channel can carry (issue 868) #326

Merged

mesh-tools merged 2 commits from fix/868-a-send-ask-the-channel-can-carry into main 2026-10-16 00:08:22 +00:00

Conversation 2 Commits 2 Files Changed 6

+644 -22

mesh-tools commented 2026-10-16 00:05:15 +00:00

Member

Copy Link

Copy Source

Issue 868 (playbook 08). mail_send's ask named the recipient's mail address; messenger's content rule (ADR 0253 §3) refuses every ask that carries one, so no send could ever be approved. Now the ask names a recipient that is one of the operator's own accounts by its name ('your account mesh'), says any other without address or host ('j… at example com', 'and N more'), masks addresses and links in the subject and first lines, judges its whole text (Headline, Explanation, OnExpiry, options) with a run-time copy of messenger's content rule (pinned byte-identical), and if it would still be refused leaves the subject and first lines to Details, so a send ask always reaches the operator. The mail itself is unchanged.

Tests run the real rule on asks for own, outside and many recipients and on subjects holding an address, a link, an IP, a two-slash date and a hex hash; each failed before the change.

Reviewed locally: round 1 changes, round 2 approved at b0e4a12. merge-check.sh green with MESH_GATE from mesh-controller main.

Issue 868 (playbook 08). mail_send's ask named the recipient's mail address; messenger's content rule (ADR 0253 §3) refuses every ask that carries one, so no send could ever be approved. Now the ask names a recipient that is one of the operator's own accounts by its name ('your account mesh'), says any other without address or host ('j… at example com', 'and N more'), masks addresses and links in the subject and first lines, judges its whole text (Headline, Explanation, OnExpiry, options) with a run-time copy of messenger's content rule (pinned byte-identical), and if it would still be refused leaves the subject and first lines to Details, so a send ask always reaches the operator. The mail itself is unchanged. Tests run the real rule on asks for own, outside and many recipients and on subjects holding an address, a link, an IP, a two-slash date and a hex hash; each failed before the change. Reviewed locally: round 1 changes, round 2 approved at b0e4a12. merge-check.sh green with MESH_GATE from mesh-controller main.

mesh-tools added 2 commits 2026-10-16 00:05:16 +00:00

mail_send's ask names recipients and masks addresses so the operator channel can carry it (issue 868) ... a76b0742ff

messenger's content rule (ADR 0253 §3) refuses any message carrying a mail address, so mail_send's ask
never reached the operator: no send could ever be approved. A recipient that is one of the operator's own
mesh-mail accounts is now named by that account's name; any other loses its address and host; the subject
and body's first lines have every address and link masked before they reach the ask. The mail itself is
sent unchanged.

Tests run messenger's real content rule against the asks mail_send builds (content.go copied verbatim as
content_test.go, pinned byte-identical by copies_test.go, since messenger's package main cannot be
imported from another module).

mail_send's ask: judge messenger's real words, carry the content rule at run time, match display-name recipients (issue 868, review round 1) ... b0e4a12c88

Review round 1: the test judged Headline+Explanation+Details, but messenger refuses an ask as a whole on
Headline, Explanation, OnExpiry and each option's Label and Does alone (asks.go's TakeAsk); Details is
filtered line by line instead (holder.go's sayOn). send.go's Ask() now builds that exact judged text and
checks it with messenger's real content rule, carried at run time as content_rule.go (messenger's
content.go, renamed, byte-identical, pinned by copies_test.go) rather than only in a test copy. When a
subject or first line the masking does not catch (an IP, a hardware address, a path-shaped reference, a
hex hash, ...) would still refuse the whole ask, the Explanation drops the subject and first lines and
points at Details instead, so the ask always reaches the operator. A recipient written with a display
name ('Name <addr>') is now matched against the operator's own accounts, and masked, by its address alone
(net/mail.ParseAddress).

mesh-tools commented 2026-10-16 00:05:24 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@b0e4a12c8840 — delivered since 2026-10-16T00:09:54Z

Delivery plan — builds mesh-mail → novox; no bus step

• tier 0: mesh-mail
• novox: receives mesh-mail

Machines

• mesh-mail on every machine running it: sent

Transitions

• 2026-10-16 00:05 (new) → proposed (announced): novox/mesh-catalog#326's head announced
• 2026-10-16 00:08 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-16 00:08 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-16 00:08 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-16 00:08 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-16 00:09 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@b0e4a12c8840` — **delivered** since 2026-10-16T00:09:54Z **Delivery plan** — builds mesh-mail → novox; no bus step - tier 0: mesh-mail - novox: receives mesh-mail **Machines** - mesh-mail on every machine running it: sent **Transitions** - 2026-10-16 00:05 (new) → proposed (announced): novox/mesh-catalog#326's head announced - 2026-10-16 00:08 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-16 00:08 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-16 00:08 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-16 00:08 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-16 00:09 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented 2026-10-16 00:08:02 +00:00

Author

Member

Copy Link

Copy Source

Merge check at b0e4a12c
Judged: head b0e4a12c8840 merged into trunk 21a499ba5976; read beside it: mesh-controller a47976be4e69, mesh-controller-main a47976be4e69, mesh-host 198fd34ec497, mesh-tools 6b3e15042fee

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-mail)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-mail → novox; no bus step

• tier 0: mesh-mail
• novox: receives mesh-mail
• read by no module's build: modules/mesh-mail/cmd/mesh-mail/ask_test.go, modules/mesh-mail/cmd/mesh-mail/copies_test.go, modules/mesh-mail/cmd/mesh-mail/send_test.go

Run by the build seat on shanks as build-1792109117235354615 (builds --log build-1792109117235354615).

--- the gate: mesh-mail
note: mesh-mail uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here
mesh-mail: ok, 10 tool(s), keeps state sends, ready: keep by unit every 30s; watch by its tool mail_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-15T23:56:51Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-15T23:56:51Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-mail

notes:
  - modules/mesh-mail/cmd/mesh-mail/ask_test.go, modules/mesh-mail/cmd/mesh-mail/copies_test.go and modules/mesh-mail/cmd/mesh-mail/send_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 48965 strings of 749 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.014s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.010s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.013s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 62, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.215s
testing modules/mesh-mail
ok  	mesh-mail/cmd/mesh-mail	3.226s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `b0e4a12c` Judged: head `b0e4a12c8840` merged into trunk `21a499ba5976`; read beside it: mesh-controller `a47976be4e69`, mesh-controller-main `a47976be4e69`, mesh-host `198fd34ec497`, mesh-tools `6b3e15042fee` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-mail) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-mail → novox; no bus step - tier 0: mesh-mail - novox: receives mesh-mail - read by no module's build: modules/mesh-mail/cmd/mesh-mail/ask_test.go, modules/mesh-mail/cmd/mesh-mail/copies_test.go, modules/mesh-mail/cmd/mesh-mail/send_test.go Run by the build seat on shanks as `build-1792109117235354615` (`builds --log build-1792109117235354615`). ``` --- the gate: mesh-mail note: mesh-mail uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here mesh-mail: ok, 10 tool(s), keeps state sends, ready: keep by unit every 30s; watch by its tool mail_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-15T23:56:51Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-15T23:56:51Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-mail notes: - modules/mesh-mail/cmd/mesh-mail/ask_test.go, modules/mesh-mail/cmd/mesh-mail/copies_test.go and modules/mesh-mail/cmd/mesh-mail/send_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 48965 strings of 749 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.014s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/secrets 0.013s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 62, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.215s testing modules/mesh-mail ok mesh-mail/cmd/mesh-mail 3.226s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit 0fdacb9839 into main 2026-10-16 00:08:22 +00:00

mesh-tools deleted branch fix/868-a-send-ask-the-channel-can-carry 2026-10-16 00:08:22 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jschoubben mesh-tools miel.truyen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#326