novox/mesh-catalog
13
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Feature providers-after-switch-on, step 1: providers answer after the switch-on (issues 923, 928, 849, 945, 825) #337

Merged
mesh-tools merged 12 commits from feat/providers-after-switch-on into main 2026-10-16 19:13:02 +00:00
Conversation 3 Commits 12 Files Changed 55
+781 -5757
mesh-tools commented 2026-10-16 19:00:55 +00:00
Member
Copy Link
Copy Source

Feature providers-after-switch-on, step 1 (hq playbook 07), one delivery group with mesh-sdk and mesh-controller (same branch name).

  • Issue 928 (0dab4475, 044a548c, 5a005969): the vault asks a software-issuing provider's tool itself for every holder that holds nothing (ADR 0349 clause 10), by the plan's credential-tool; an unreadable assignment is "not yet", never a refusal; the client's re-ask after a refusal is pinned by tests.
  • Issue 923 (0b056eda, dcedd8d2): a test proving route-proxy and the client fill gitea's origins and keycloak's hostname.env from a controller-shaped plan entry (the cause was in mesh-controller).
  • Issue 849 (33759f8b, b0dc3323, 302eab14, a51e2c0f): postgres and keycloak run on mesh-sdk's harness and moved path, their copies removed (~2,800 lines each); route-proxy's pin covers its acme templates.
  • Issue 945 (cc9e7a72, dcedd8d2): fixtures and route tests use vault-name.
  • The pin (d2992f81): postgres, keycloak, mesh-provisioner-client, route-proxy and route-adapter require mesh-sdk a4e7f48 (this group's mesh-sdk head).

Reviewed locally by review-pas@novox (larger model), three rounds, approved. Unit tests green with GOWORK=off.

Acceptance: on novox the provisioner client fills gitea's origins and keycloak's hostname.env, postgres writes gitea's and keycloak's bound entries, and claude-code's gitea-read.secret is filled on every machine by the vault itself.

Per ADR 0398 the merge into main waits for the operator's approval.

Feature providers-after-switch-on, step 1 (hq playbook 07), one delivery group with mesh-sdk and mesh-controller (same branch name). - **Issue 928** (0dab4475, 044a548c, 5a005969): the vault asks a software-issuing provider's tool itself for every holder that holds nothing (ADR 0349 clause 10), by the plan's `credential-tool`; an unreadable assignment is "not yet", never a refusal; the client's re-ask after a refusal is pinned by tests. - **Issue 923** (0b056eda, dcedd8d2): a test proving route-proxy and the client fill gitea's origins and keycloak's hostname.env from a controller-shaped plan entry (the cause was in mesh-controller). - **Issue 849** (33759f8b, b0dc3323, 302eab14, a51e2c0f): postgres and keycloak run on mesh-sdk's harness and moved path, their copies removed (~2,800 lines each); route-proxy's pin covers its acme templates. - **Issue 945** (cc9e7a72, dcedd8d2): fixtures and route tests use `vault-name`. - **The pin** (d2992f81): postgres, keycloak, mesh-provisioner-client, route-proxy and route-adapter require mesh-sdk a4e7f48 (this group's mesh-sdk head). Reviewed locally by review-pas@novox (larger model), three rounds, approved. Unit tests green with GOWORK=off. Acceptance: on novox the provisioner client fills gitea's origins and keycloak's hostname.env, postgres writes gitea's and keycloak's bound entries, and claude-code's gitea-read.secret is filled on every machine by the vault itself. Per ADR 0398 the merge into main waits for the operator's approval.
mesh-tools added 12 commits 2026-10-16 19:00:55 +00:00
Name the vault's credential vault-name in the client's bound-entry fixtures (issue 945) cc9e7a72ee
Prove the client fills gitea's origins and keycloak's hostname from route-proxy's entry for a controller-shaped plan entry (issue 923) 0b056edaaa
Answer an unreadable assignment as not yet, never a refusal (issue 928) 0dab4475cd
Pin that the client asks a refused or not-yet secret again (issue 928) 044a548cee
Pin route-proxy's acme templates beside its manifest (issue 849) a51e2c0fb4
Make the vault ask a software-issuing provider's tool itself for holders that hold nothing (issue 928) 5a00596908
Merge branch 'feat/providers-after-switch-on' into feat/providers-after-switch-on-v 2f09dd8501
Run postgres on the SDK's harness and moved path, dropping its copies (issue 849) 33759f8b57
Run keycloak on the SDK's harness and moved path, dropping its copies (issue 849) b0dc3323c9
Restore the test that both keycloak paths leave the same client, over the SDK's moved path (issue 849) 302eab1431
Give the route plan entries their credential-form, and read the entry's vault-name in the route providers' tests (issues 923, 945) dcedd8d2b2
Take mesh-sdk a4e7f48 in the modules that use its provider helper (issues 825, 849, 945)
mesh/merge-gate head d2992f81d17f merged into trunk 3817099b2ca2 beside mesh-controller#363@df5f01bf — pass: builds keycloak, mesh-provisioner-client, mesh…
Details
mesh/repo-check head d2992f81d17f merged into trunk 3817099b2ca2 beside mesh-controller#363@df5f01bf — pass: its merge-check.sh passed, each part in its to…
Details
mesh/delivery delivered
Details
mesh/delivery-group group feat/providers-after-switch-on delivered: every member is delivered
Details
d2992f81d1 
postgres, keycloak, mesh-provisioner-client, route-proxy and route-adapter now
build against the feature's mesh-sdk: the harness package, the vault-name key
and the helper's fixes.
mesh-tools commented 2026-10-16 19:01:01 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-catalog@d2992f81d17f — delivered since 2026-10-16T19:29:28Z

Delivery plan — builds keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy → ace, g14, novox, shanks; no bus step; 3 wait(s) for a person

  • tier 0: keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy
  • ace: receives mesh-provisioner-client, route-proxy; waits for a person: postgres
  • g14: receives mesh-provisioner-client
  • novox: receives mesh-provisioner-client, mesh-vault, route-proxy; waits for a person: keycloak, postgres
  • shanks: receives mesh-provisioner-client
  • keycloak waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
  • keycloak provides oidc-client: its consumers are sent again after it
  • keycloak keeps data (ADR 0233): what it holds is backed up before it moves
  • mesh-vault provides secret: its consumers are sent again after it
  • mesh-vault keeps data (ADR 0233): what it holds is backed up before it moves
  • postgres waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
  • postgres provides postgres-database: its consumers are sent again after it
  • postgres keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client, route-proxy is judged on its first machine

Group feat/providers-after-switch-on, in order: novox/mesh-controller@df5f01bfa1 → novox/mesh-catalog@d2992f81d1 → novox/mesh-sdk@a4e7f480b3

Machines

  • keycloak on every machine running it: sent
  • mesh-provisioner-client on every machine running it: sent
  • mesh-sdk on every machine running it: sent
  • mesh-vault on every machine running it: sent
  • postgres on every machine running it: sent
  • route-proxy on every machine running it: sent
  • mesh-tools on every machine running it: sent
  • audit-logger on every machine running it: sent
  • baserow on every machine running it: sent
  • bazarr on every machine running it: sent
  • bookshelf on every machine running it: sent
  • confluence on every machine running it: sent
  • gitea on every machine running it: sent
  • gitlab on every machine running it: sent
  • grafana on every machine running it: sent
  • home-assistant on every machine running it: sent
  • icecast on every machine running it: sent
  • influxdb on every machine running it: sent
  • jackett on every machine running it: sent
  • jira on every machine running it: sent
  • kometa on every machine running it: sent
  • lab on every machine running it: sent
  • letta on every machine running it: sent
  • lidarr on every machine running it: sent
  • mesh-catalog on every machine running it: sent
  • model-usage on every machine running it: sent
  • mosquitto on every machine running it: sent
  • netcheck on every machine running it: sent
  • nextcloud on every machine running it: sent
  • nodered on every machine running it: sent
  • ombi on every machine running it: sent
  • openai-consumer on every machine running it: sent
  • radarr on every machine running it: sent
  • redis on every machine running it: sent
  • route-adapter on every machine running it: sent
  • searxng on every machine running it: sent
  • showcase on every machine running it: sent
  • sonarr on every machine running it: sent
  • tautulli on every machine running it: sent
  • umami on every machine running it: sent
  • unifi on every machine running it: sent
  • zsh on every machine running it: sent

Transitions

  • 2026-10-16 19:00 (new) → proposed (announced): novox/mesh-catalog#337's head announced
  • 2026-10-16 19:05 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-16 19:05 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-16 19:17 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-16 19:18 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-16 19:29 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@d2992f81d17f` — **delivered** since 2026-10-16T19:29:28Z **Delivery plan** — builds keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy → ace, g14, novox, shanks; no bus step; 3 wait(s) for a person - tier 0: keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy - ace: receives mesh-provisioner-client, route-proxy; waits for a person: postgres - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client, mesh-vault, route-proxy; waits for a person: keycloak, postgres - shanks: receives mesh-provisioner-client - keycloak waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - keycloak provides oidc-client: its consumers are sent again after it - keycloak keeps data (ADR 0233): what it holds is backed up before it moves - mesh-vault provides secret: its consumers are sent again after it - mesh-vault keeps data (ADR 0233): what it holds is backed up before it moves - postgres waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - postgres provides postgres-database: its consumers are sent again after it - postgres keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client, route-proxy is judged on its first machine **Group** `feat/providers-after-switch-on`, in order: novox/mesh-controller@df5f01bfa1ee → novox/mesh-catalog@d2992f81d17f → novox/mesh-sdk@a4e7f480b3b0 - novox/mesh-controller@df5f01bfa1ee before novox/mesh-catalog@d2992f81d17f: built by - novox/mesh-controller@df5f01bfa1ee before novox/mesh-sdk@a4e7f480b3b0: built by - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - keycloak on every machine running it: sent - mesh-provisioner-client on every machine running it: sent - mesh-sdk on every machine running it: sent - mesh-vault on every machine running it: sent - postgres on every machine running it: sent - route-proxy on every machine running it: sent - mesh-tools on every machine running it: sent - audit-logger on every machine running it: sent - baserow on every machine running it: sent - bazarr on every machine running it: sent - bookshelf on every machine running it: sent - confluence on every machine running it: sent - gitea on every machine running it: sent - gitlab on every machine running it: sent - grafana on every machine running it: sent - home-assistant on every machine running it: sent - icecast on every machine running it: sent - influxdb on every machine running it: sent - jackett on every machine running it: sent - jira on every machine running it: sent - kometa on every machine running it: sent - lab on every machine running it: sent - letta on every machine running it: sent - lidarr on every machine running it: sent - mesh-catalog on every machine running it: sent - model-usage on every machine running it: sent - mosquitto on every machine running it: sent - netcheck on every machine running it: sent - nextcloud on every machine running it: sent - nodered on every machine running it: sent - ombi on every machine running it: sent - openai-consumer on every machine running it: sent - radarr on every machine running it: sent - redis on every machine running it: sent - route-adapter on every machine running it: sent - searxng on every machine running it: sent - showcase on every machine running it: sent - sonarr on every machine running it: sent - tautulli on every machine running it: sent - umami on every machine running it: sent - unifi on every machine running it: sent - zsh on every machine running it: sent **Transitions** - 2026-10-16 19:00 (new) → proposed (announced): novox/mesh-catalog#337's head announced - 2026-10-16 19:05 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-16 19:05 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-16 19:17 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-16 19:18 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-16 19:29 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools commented 2026-10-16 19:05:38 +00:00
Author
Member
Copy Link
Copy Source

Merge check at d2992f81
Judged: head d2992f81d17f merged into trunk 3817099b2ca2; read beside it: mesh-controller 9b5ea50e1764, mesh-controller-main c7cb9f0a2cd3, mesh-host cd13f7726ef0, mesh-tools 7412c5b6c9c5
Siblings read beside it: novox/mesh-controller#363 df5f01bfa1ee merged onto c7cb9f0a2cd3 (main); judged by sibling novox/mesh-controller#363 merge 9b5ea50e1764

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy)
  • mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy → ace, g14, novox, shanks; no bus step; 3 wait(s) for a person

  • tier 0: keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy
  • ace: receives mesh-provisioner-client, route-proxy; waits for a person: postgres
  • g14: receives mesh-provisioner-client
  • novox: receives mesh-provisioner-client, mesh-vault, route-proxy; waits for a person: keycloak, postgres
  • shanks: receives mesh-provisioner-client
  • keycloak waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
  • keycloak provides oidc-client: its consumers are sent again after it
  • keycloak keeps data (ADR 0233): what it holds is backed up before it moves
  • mesh-vault provides secret: its consumers are sent again after it
  • mesh-vault keeps data (ADR 0233): what it holds is backed up before it moves
  • postgres waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
  • postgres provides postgres-database: its consumers are sent again after it
  • postgres keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client, route-proxy is judged on its first machine
  • read by no module's build: modules/keycloak/cmd/keycloak-provider/admin_test.go, modules/keycloak/cmd/keycloak-provider/early_test.go, modules/keycloak/cmd/keycloak-provider/harness_same_test.go, modules/keycloak/cmd/keycloak-provider/harness_test.go, modules/keycloak/cmd/keycloak-provider/moved_test.go, modules/keycloak/cmd/keycloak-provider/oidc_test.go, modules/keycloak/cmd/keycloak-provider/retirement_test.go, modules/keycloak/cmd/keycloak-provider/standing_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asked_again_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_entry_keys_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-vault/cmd/mesh-vault/notyet_test.go, modules/mesh-vault/cmd/mesh-vault/own_issue_test.go, modules/mesh-vault/cmd/mesh-vault/pair_test.go, modules/postgres/cmd/postgres-provider/early_test.go, modules/postgres/cmd/postgres-provider/grants_moved_test.go, modules/postgres/cmd/postgres-provider/harness_same_test.go, modules/postgres/cmd/postgres-provider/harness_test.go, modules/postgres/cmd/postgres-provider/live_test.go, modules/postgres/cmd/postgres-provider/moved_test.go, modules/postgres/cmd/postgres-provider/retire_pg_test.go, modules/postgres/cmd/postgres-provider/retirement_test.go, modules/postgres/cmd/postgres-provider/standing_test.go, modules/route-proxy/cmd/route-provider/provider_test.go

Run by the build seat on shanks as build-1792177260799107661 (builds --log build-1792177260799107661).

--- the gate: keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy
keycloak: ok, keeps state bound, reads mesh-controller.assignments; WARNING: runtime-config ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
mesh-provisioner-client: ok, ready: client by unit every 30s
mesh-vault: ok, 12 tool(s), reads mesh-controller.assignments, keeps state (valuable), ledger (valuable), root (valuable), store (valuable), ready: mesh-vault.own-runtime by its tool vault_health every 1m0s
postgres: ok, keeps state bound, reads mesh-controller.assignments, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
route-adapter: ok, keeps state bound, reads mesh-controller.assignments; WARNING: config ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339)
route-proxy: ok, keeps state bound, reads mesh-controller.assignments, keeps acme (rebuildable), ca (cache), ready: server by tcp on http every 10s
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 2
6 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-16T17:04:22Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-16T17:04:22Z

modules the change moves:
  - route-adapter (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 6 module(s) in 1 tier(s): keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy

notes:
  - modules/keycloak/cmd/keycloak-provider/admin_test.go, modules/keycloak/cmd/keycloak-provider/early_test.go, modules/keycloak/cmd/keycloak-provider/harness_same_test.go, modules/keycloak/cmd/keycloak-provider/harness_test.go, modules/keycloak/cmd/keycloak-provider/moved_test.go, modules/keycloak/cmd/keycloak-provider/oidc_test.go, modules/keycloak/cmd/keycloak-provider/retirement_test.go, modules/keycloak/cmd/keycloak-provider/standing_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asked_again_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_entry_keys_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-vault/cmd/mesh-vault/notyet_test.go, modules/mesh-vault/cmd/mesh-vault/own_issue_test.go, modules/mesh-vault/cmd/mesh-vault/pair_test.go, modules/postgres/cmd/postgres-provider/early_test.go, modules/postgres/cmd/postgres-provider/grants_moved_test.go, modules/postgres/cmd/postgres-provider/harness_same_test.go, modules/postgres/cmd/postgres-provider/harness_test.go, modules/postgres/cmd/postgres-provider/live_test.go, modules/postgres/cmd/postgres-provider/moved_test.go, modules/postgres/cmd/postgres-provider/retire_pg_test.go, modules/postgres/cmd/postgres-provider/retirement_test.go, modules/postgres/cmd/postgres-provider/standing_test.go and modules/route-proxy/cmd/route-provider/provider_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 53012 strings of 798 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.013s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.009s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.014s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.263s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.016s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.012s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.231s
testing modules/keycloak
ok  	keycloak/cmd/keycloak-provider	1.122s
testing modules/mesh-provisioner-client
ok  	mesh-provisioner-client/cmd/mesh-provisioner-client	13.241s
testing modules/mesh-vault
ok  	mesh-vault/cmd/mesh-vault	16.483s
testing modules/postgres
ok  	postgres/cmd/postgres-provider	1.105s
testing modules/route-adapter
ok  	route-adapter/cmd/route-provider	1.013s
testing modules/route-proxy
ok  	route-proxy/cmd/route-provider	1.014s
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/route-adapter (TypeScript)
testing modules/route-adapter (TypeScript)
✔ it writes one route file per contribution, in the predecessor's own shape (7.953172ms)
✔ it removes the file it wrote when that contribution goes (2.8691ms)
✔ it never touches a file it did not write (4.179418ms)
✔ the target port follows what the contributor publishes (2.214401ms)
✔ a contributor on another node is reached at the address the mesh gave it (1.835126ms)
✔ a node's settings are laid over the module's defaults, and nothing else changes (1.416719ms)
✔ a contribution it cannot act on is skipped and named (0.285124ms)
✔ a contribution the file shape cannot say is skipped and says which part (0.270454ms)
✔ it refuses when the predecessor's directory is not there, and says why (1.639493ms)
✔ a body limit is written as the predecessor's buffering middleware (1.953337ms)
✔ a body limit that is not a whole number of bytes is skipped and named (0.316994ms)
ℹ tests 11
ℹ suites 0
ℹ pass 11
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 127.085721
**Merge check** at `d2992f81` Judged: head `d2992f81d17f` merged into trunk `3817099b2ca2`; read beside it: mesh-controller `9b5ea50e1764`, mesh-controller-main `c7cb9f0a2cd3`, mesh-host `cd13f7726ef0`, mesh-tools `7412c5b6c9c5` Siblings read beside it: novox/mesh-controller#363 `df5f01bfa1ee` merged onto `c7cb9f0a2cd3` (main); judged by sibling novox/mesh-controller#363 merge 9b5ea50e1764 - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy → ace, g14, novox, shanks; no bus step; 3 wait(s) for a person - tier 0: keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy - ace: receives mesh-provisioner-client, route-proxy; waits for a person: postgres - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client, mesh-vault, route-proxy; waits for a person: keycloak, postgres - shanks: receives mesh-provisioner-client - keycloak waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - keycloak provides oidc-client: its consumers are sent again after it - keycloak keeps data (ADR 0233): what it holds is backed up before it moves - mesh-vault provides secret: its consumers are sent again after it - mesh-vault keeps data (ADR 0233): what it holds is backed up before it moves - postgres waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - postgres provides postgres-database: its consumers are sent again after it - postgres keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client, route-proxy is judged on its first machine - read by no module's build: modules/keycloak/cmd/keycloak-provider/admin_test.go, modules/keycloak/cmd/keycloak-provider/early_test.go, modules/keycloak/cmd/keycloak-provider/harness_same_test.go, modules/keycloak/cmd/keycloak-provider/harness_test.go, modules/keycloak/cmd/keycloak-provider/moved_test.go, modules/keycloak/cmd/keycloak-provider/oidc_test.go, modules/keycloak/cmd/keycloak-provider/retirement_test.go, modules/keycloak/cmd/keycloak-provider/standing_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asked_again_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_entry_keys_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-vault/cmd/mesh-vault/notyet_test.go, modules/mesh-vault/cmd/mesh-vault/own_issue_test.go, modules/mesh-vault/cmd/mesh-vault/pair_test.go, modules/postgres/cmd/postgres-provider/early_test.go, modules/postgres/cmd/postgres-provider/grants_moved_test.go, modules/postgres/cmd/postgres-provider/harness_same_test.go, modules/postgres/cmd/postgres-provider/harness_test.go, modules/postgres/cmd/postgres-provider/live_test.go, modules/postgres/cmd/postgres-provider/moved_test.go, modules/postgres/cmd/postgres-provider/retire_pg_test.go, modules/postgres/cmd/postgres-provider/retirement_test.go, modules/postgres/cmd/postgres-provider/standing_test.go, modules/route-proxy/cmd/route-provider/provider_test.go Run by the build seat on shanks as `build-1792177260799107661` (`builds --log build-1792177260799107661`). ``` --- the gate: keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy keycloak: ok, keeps state bound, reads mesh-controller.assignments; WARNING: runtime-config ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) mesh-provisioner-client: ok, ready: client by unit every 30s mesh-vault: ok, 12 tool(s), reads mesh-controller.assignments, keeps state (valuable), ledger (valuable), root (valuable), store (valuable), ready: mesh-vault.own-runtime by its tool vault_health every 1m0s postgres: ok, keeps state bound, reads mesh-controller.assignments, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s route-adapter: ok, keeps state bound, reads mesh-controller.assignments; WARNING: config ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339) route-proxy: ok, keeps state bound, reads mesh-controller.assignments, keeps acme (rebuildable), ca (cache), ready: server by tcp on http every 10s long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 2 6 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-16T17:04:22Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-16T17:04:22Z modules the change moves: - route-adapter (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 6 module(s) in 1 tier(s): keycloak, mesh-provisioner-client, mesh-vault, postgres, route-adapter, route-proxy notes: - modules/keycloak/cmd/keycloak-provider/admin_test.go, modules/keycloak/cmd/keycloak-provider/early_test.go, modules/keycloak/cmd/keycloak-provider/harness_same_test.go, modules/keycloak/cmd/keycloak-provider/harness_test.go, modules/keycloak/cmd/keycloak-provider/moved_test.go, modules/keycloak/cmd/keycloak-provider/oidc_test.go, modules/keycloak/cmd/keycloak-provider/retirement_test.go, modules/keycloak/cmd/keycloak-provider/standing_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asked_again_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_entry_keys_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-vault/cmd/mesh-vault/notyet_test.go, modules/mesh-vault/cmd/mesh-vault/own_issue_test.go, modules/mesh-vault/cmd/mesh-vault/pair_test.go, modules/postgres/cmd/postgres-provider/early_test.go, modules/postgres/cmd/postgres-provider/grants_moved_test.go, modules/postgres/cmd/postgres-provider/harness_same_test.go, modules/postgres/cmd/postgres-provider/harness_test.go, modules/postgres/cmd/postgres-provider/live_test.go, modules/postgres/cmd/postgres-provider/moved_test.go, modules/postgres/cmd/postgres-provider/retire_pg_test.go, modules/postgres/cmd/postgres-provider/retirement_test.go, modules/postgres/cmd/postgres-provider/standing_test.go and modules/route-proxy/cmd/route-provider/provider_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 53012 strings of 798 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.013s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.009s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/secrets 0.014s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.263s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.016s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.012s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.231s testing modules/keycloak ok keycloak/cmd/keycloak-provider 1.122s testing modules/mesh-provisioner-client ok mesh-provisioner-client/cmd/mesh-provisioner-client 13.241s testing modules/mesh-vault ok mesh-vault/cmd/mesh-vault 16.483s testing modules/postgres ok postgres/cmd/postgres-provider 1.105s testing modules/route-adapter ok route-adapter/cmd/route-provider 1.013s testing modules/route-proxy ok route-proxy/cmd/route-provider 1.014s --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/route-adapter (TypeScript) testing modules/route-adapter (TypeScript) ✔ it writes one route file per contribution, in the predecessor's own shape (7.953172ms) ✔ it removes the file it wrote when that contribution goes (2.8691ms) ✔ it never touches a file it did not write (4.179418ms) ✔ the target port follows what the contributor publishes (2.214401ms) ✔ a contributor on another node is reached at the address the mesh gave it (1.835126ms) ✔ a node's settings are laid over the module's defaults, and nothing else changes (1.416719ms) ✔ a contribution it cannot act on is skipped and named (0.285124ms) ✔ a contribution the file shape cannot say is skipped and says which part (0.270454ms) ✔ it refuses when the predecessor's directory is not there, and says why (1.639493ms) ✔ a body limit is written as the predecessor's buffering middleware (1.953337ms) ✔ a body limit that is not a whole number of bytes is skipped and named (0.316994ms) ℹ tests 11 ℹ suites 0 ℹ pass 11 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 127.085721 ```
mesh-tools added the mesh/ready label 2026-10-16 19:12:12 +00:00
mesh-tools commented 2026-10-16 19:12:12 +00:00
Author
Member
Copy Link
Copy Source

ready at d2992f81d1

Reviewed by review-pas@novox: approved by review-pas (rounds 1-3, the pin in round 3), both checks green; the operator approved the merge into main in the terminal at 21:10 (ADR 0398). Marked through mesh-delivery.mark-ready (novox/hq issue 913).

ready at d2992f81d17f290b6df5c1bec5c107f6df041890 Reviewed by review-pas@novox: approved by review-pas (rounds 1-3, the pin in round 3), both checks green; the operator approved the merge into main in the terminal at 21:10 (ADR 0398). Marked through mesh-delivery.mark-ready (novox/hq issue 913).
mesh-tools merged commit 8d012fe4e2 into main 2026-10-16 19:13:02 +00:00
mesh-tools deleted branch feat/providers-after-switch-on 2026-10-16 19:13:02 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels mesh/ready
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-catalog#337