Write a provisioner client's files only on a change over the bus, never on a timer (issue 1129, ADR 0430) #366

2026-10-18T16:14:05Z

mesh-tools commented

2026-10-18 16:14:05 +00:00

Fixes issue 1129: the provisioner client's drift pass rewrote every file it owns every minute, unchanged (about 75 files a minute on g14), and the CPU burst ran the laptop's fan.

What changes (modules/mesh-provisioner-client)

The drift pass is gone: no Drift field, no --drift flag, no ticker in Run, no force in reconcile. The client writes on a change it watches over the bus and when its node comes back (ADR 0349 clause 4), never on a timer (ADR 0430 clause 1).
Every fill of a module asks the node-engine to write every one of its files; the node-engine compares and corrects an owned file that differs (ADR 0430 clause 2). The written skip map is removed.
README and the header comment say so.

Acceptance criteria (issue 1129 note 2), each cited by its test: 1129/AC1 TestNatsWithNothingOverTheBusItAsksForNoWriteNoSecretAndNoReport; 1129/AC2 and AC3 TestNatsAnOwnedFileIsWrittenBackASeedLeftAndAManagedFileKeepsTheProgramsLines; 1129/AC4 TestNatsARefusalFailsTheModuleWithTheVaultsReasonAndIsNotAskedEveryPass; 1129/AC5 the removed field, flag and ticker, and drift_integration_test.go (the client started whole through serve against a real bus fills once, then writes nothing for three seconds).

Checks: unit suite green locally (64 tests, also with -race); mesh-controller.try build-1792339970252135657 passed on main 4301da630d in 51 s.

Opened from the review, outside this fix: issue 1143 (the no-timer tests catch only a timer shorter than their window).

Reviewed-by: review-1129@g14 at e7ff7c3045

Fixes issue 1129: the provisioner client's drift pass rewrote every file it owns every minute, unchanged (about 75 files a minute on g14), and the CPU burst ran the laptop's fan. **What changes** (modules/mesh-provisioner-client) - The drift pass is gone: no `Drift` field, no `--drift` flag, no ticker in `Run`, no `force` in `reconcile`. The client writes on a change it watches over the bus and when its node comes back (ADR 0349 clause 4), never on a timer (ADR 0430 clause 1). - Every fill of a module asks the node-engine to write every one of its files; the node-engine compares and corrects an owned file that differs (ADR 0430 clause 2). The `written` skip map is removed. - README and the header comment say so. **Acceptance criteria** (issue 1129 note 2), each cited by its test: 1129/AC1 `TestNatsWithNothingOverTheBusItAsksForNoWriteNoSecretAndNoReport`; 1129/AC2 and AC3 `TestNatsAnOwnedFileIsWrittenBackASeedLeftAndAManagedFileKeepsTheProgramsLines`; 1129/AC4 `TestNatsARefusalFailsTheModuleWithTheVaultsReasonAndIsNotAskedEveryPass`; 1129/AC5 the removed field, flag and ticker, and `drift_integration_test.go` (the client started whole through `serve` against a real bus fills once, then writes nothing for three seconds). **Checks**: unit suite green locally (64 tests, also with -race); `mesh-controller.try` build-1792339970252135657 passed on main 4301da630d82 in 51 s. **Opened from the review**, outside this fix: issue 1143 (the no-timer tests catch only a timer shorter than their window). Reviewed-by: review-1129@g14 at e7ff7c3045fccd8ed74b0fbddbea7a0d9ad892fb

mesh-tools added 1 commit 2026-10-18 16:14:05 +00:00

Write a provisioner client's files only on a change over the bus, never on a timer (issue 1129, ADR 0349 clause 4)

mesh/merge-gate head e7ff7c3045fc merged into trunk afb94d925e94 — pass: builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step; every machi…

Details

mesh/repo-check head e7ff7c3045fc merged into trunk afb94d925e94 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…

Details

mesh/delivery delivered

Details

e7ff7c3045

mesh-tools commented

2026-10-18 16:14:14 +00:00

Delivery novox/mesh-catalog@e7ff7c3045fc — delivered since 2026-10-18T17:04:01Z

Delivery plan — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step

tier 0: mesh-provisioner-client
ace: receives mesh-provisioner-client
g14: receives mesh-provisioner-client
novox: receives mesh-provisioner-client
shanks: receives mesh-provisioner-client
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine

Machines

mesh-provisioner-client on every machine running it: sent

Transitions

2026-10-18 16:24 ready → proposed (trunk moved): out of date: judged against trunk 4301da630d, the trunk is now 72ad5ad138ce; judged again on a recheck or when it is merged
2026-10-18 16:28 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-18 16:28 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-18 16:35 ready → proposed (recheck): Approved at 16:24:59Z; its merge was tried at 16:28:34.237Z, a moment before the forge's statuses turned success, and refused; no retry came in seven minutes and nothing else asks the merge again (issue 1144). A new verdict makes the merge be asked again under the standing Approve (ADR 0421 §12).
2026-10-18 16:39 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-18 16:39 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-18 16:52 ready → proposed (trunk moved): out of date: judged against trunk 72ad5ad138, the trunk is now afb94d925e94; judged again on a recheck or when it is merged
2026-10-18 16:56 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-18 16:56 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-18 16:58 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-18 16:58 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-18 17:04 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@e7ff7c3045fc` — **delivered** since 2026-10-18T17:04:01Z **Delivery plan** — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step - tier 0: mesh-provisioner-client - ace: receives mesh-provisioner-client - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client - shanks: receives mesh-provisioner-client - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine **Machines** - mesh-provisioner-client on every machine running it: sent **Transitions** - 2026-10-18 16:24 ready → proposed (trunk moved): out of date: judged against trunk 4301da630d82, the trunk is now 72ad5ad138ce; judged again on a recheck or when it is merged - 2026-10-18 16:28 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-18 16:28 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-18 16:35 ready → proposed (recheck): Approved at 16:24:59Z; its merge was tried at 16:28:34.237Z, a moment before the forge's statuses turned success, and refused; no retry came in seven minutes and nothing else asks the merge again (issue 1144). A new verdict makes the merge be asked again under the standing Approve (ADR 0421 §12). - 2026-10-18 16:39 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-18 16:39 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-18 16:52 ready → proposed (trunk moved): out of date: judged against trunk 72ad5ad138ce, the trunk is now afb94d925e94; judged again on a recheck or when it is merged - 2026-10-18 16:56 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-18 16:56 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-18 16:58 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-18 16:58 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-18 17:04 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-18 16:17:08 +00:00

Merge check at e7ff7c30
Judged: head e7ff7c3045fc merged into trunk 4301da630d82; read beside it: mesh-controller 48e9656c670b, mesh-controller-main 48e9656c670b, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step

tier 0: mesh-provisioner-client
ace: receives mesh-provisioner-client
g14: receives mesh-provisioner-client
novox: receives mesh-provisioner-client
shanks: receives mesh-provisioner-client
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine
read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go

Run by the build seat on ace as build-1792340048846772167 (builds --log build-1792340048846772167).

--- the gate: mesh-provisioner-client
mesh-provisioner-client: ok, ready: client by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T15:23:47Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-18T15:23:47Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client

notes:
  - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.012s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.008s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.015s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.007s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.013s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.222s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.013s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.010s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.194s
testing modules/mesh-provisioner-client
ok  	mesh-provisioner-client/cmd/mesh-provisioner-client	18.958s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `e7ff7c30` Judged: head `e7ff7c3045fc` merged into trunk `4301da630d82`; read beside it: mesh-controller `48e9656c670b`, mesh-controller-main `48e9656c670b`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step - tier 0: mesh-provisioner-client - ace: receives mesh-provisioner-client - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client - shanks: receives mesh-provisioner-client - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine - read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go Run by the build seat on ace as `build-1792340048846772167` (`builds --log build-1792340048846772167`). ``` --- the gate: mesh-provisioner-client mesh-provisioner-client: ok, ready: client by unit every 30s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T15:23:47Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-18T15:23:47Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client notes: - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.012s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.008s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.015s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.007s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.013s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.222s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.013s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.010s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.194s testing modules/mesh-provisioner-client ok mesh-provisioner-client/cmd/mesh-provisioner-client 18.958s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools commented

2026-10-18 16:28:34 +00:00

Merge check at e7ff7c30
Judged: head e7ff7c3045fc merged into trunk 72ad5ad138ce; read beside it: mesh-controller 48e9656c670b, mesh-controller-main 48e9656c670b, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step

tier 0: mesh-provisioner-client
ace: receives mesh-provisioner-client
g14: receives mesh-provisioner-client
novox: receives mesh-provisioner-client
shanks: receives mesh-provisioner-client
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine
read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go

Run by the build seat on shanks as build-1792340700924634871 (builds --log build-1792340700924634871).

--- the gate: mesh-provisioner-client
mesh-provisioner-client: ok, ready: client by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:13:47Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-18T16:13:47Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client

notes:
  - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.013s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.009s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.019s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.009s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.014s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.271s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.015s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.012s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.231s
testing modules/mesh-provisioner-client
ok  	mesh-provisioner-client/cmd/mesh-provisioner-client	19.185s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `e7ff7c30` Judged: head `e7ff7c3045fc` merged into trunk `72ad5ad138ce`; read beside it: mesh-controller `48e9656c670b`, mesh-controller-main `48e9656c670b`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step - tier 0: mesh-provisioner-client - ace: receives mesh-provisioner-client - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client - shanks: receives mesh-provisioner-client - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine - read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go Run by the build seat on shanks as `build-1792340700924634871` (`builds --log build-1792340700924634871`). ``` --- the gate: mesh-provisioner-client mesh-provisioner-client: ok, ready: client by unit every 30s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:13:47Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-18T16:13:47Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client notes: - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.013s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.009s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.019s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.009s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.014s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.271s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.015s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.012s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.231s testing modules/mesh-provisioner-client ok mesh-provisioner-client/cmd/mesh-provisioner-client 19.185s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools commented

2026-10-18 16:39:00 +00:00

Merge check at e7ff7c30
Judged: head e7ff7c3045fc merged into trunk 72ad5ad138ce; read beside it: mesh-controller 48e9656c670b, mesh-controller-main 48e9656c670b, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step

tier 0: mesh-provisioner-client
ace: receives mesh-provisioner-client
g14: receives mesh-provisioner-client
novox: receives mesh-provisioner-client
shanks: receives mesh-provisioner-client
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine
read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go

Run by the build seat on ace as build-1792341363034038305 (builds --log build-1792341363034038305).

--- the gate: mesh-provisioner-client
mesh-provisioner-client: ok, ready: client by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:33:47Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-18T16:33:47Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client

notes:
  - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.010s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.008s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.014s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.007s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.011s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.219s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.013s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.011s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.192s
testing modules/mesh-provisioner-client
ok  	mesh-provisioner-client/cmd/mesh-provisioner-client	18.958s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `e7ff7c30` Judged: head `e7ff7c3045fc` merged into trunk `72ad5ad138ce`; read beside it: mesh-controller `48e9656c670b`, mesh-controller-main `48e9656c670b`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step - tier 0: mesh-provisioner-client - ace: receives mesh-provisioner-client - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client - shanks: receives mesh-provisioner-client - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine - read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go Run by the build seat on ace as `build-1792341363034038305` (`builds --log build-1792341363034038305`). ``` --- the gate: mesh-provisioner-client mesh-provisioner-client: ok, ready: client by unit every 30s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:33:47Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-18T16:33:47Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client notes: - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.010s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.008s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.014s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.007s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.011s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.219s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.013s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.011s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.192s testing modules/mesh-provisioner-client ok mesh-provisioner-client/cmd/mesh-provisioner-client 18.958s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools commented

2026-10-18 16:39:34 +00:00

Merge check at e7ff7c30
Judged: head e7ff7c3045fc merged into trunk 72ad5ad138ce; read beside it: mesh-controller 48e9656c670b, mesh-controller-main 48e9656c670b, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step

tier 0: mesh-provisioner-client
ace: receives mesh-provisioner-client
g14: receives mesh-provisioner-client
novox: receives mesh-provisioner-client
shanks: receives mesh-provisioner-client
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine
read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go

Run by the build seat on shanks as build-1792341360985772028 (builds --log build-1792341360985772028).

--- the gate: mesh-provisioner-client
mesh-provisioner-client: ok, ready: client by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:33:47Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-18T16:33:47Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client

notes:
  - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.014s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.010s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.018s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.009s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.014s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.278s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.017s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.014s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.007s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.253s
testing modules/mesh-provisioner-client
ok  	mesh-provisioner-client/cmd/mesh-provisioner-client	19.427s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `e7ff7c30` Judged: head `e7ff7c3045fc` merged into trunk `72ad5ad138ce`; read beside it: mesh-controller `48e9656c670b`, mesh-controller-main `48e9656c670b`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step - tier 0: mesh-provisioner-client - ace: receives mesh-provisioner-client - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client - shanks: receives mesh-provisioner-client - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine - read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go Run by the build seat on shanks as `build-1792341360985772028` (`builds --log build-1792341360985772028`). ``` --- the gate: mesh-provisioner-client mesh-provisioner-client: ok, ready: client by unit every 30s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:33:47Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-18T16:33:47Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client notes: - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.014s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.018s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.009s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.014s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.278s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.017s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.014s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.007s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.253s testing modules/mesh-provisioner-client ok mesh-provisioner-client/cmd/mesh-provisioner-client 19.427s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools commented

2026-10-18 16:41:54 +00:00

Merge check at e7ff7c30
Judged: head e7ff7c3045fc merged into trunk 72ad5ad138ce; read beside it: mesh-controller 48e9656c670b, mesh-controller-main 48e9656c670b, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step

tier 0: mesh-provisioner-client
ace: receives mesh-provisioner-client
g14: receives mesh-provisioner-client
novox: receives mesh-provisioner-client
shanks: receives mesh-provisioner-client
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine
read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go

Run by the build seat on ace as build-1792341483029211981 (builds --log build-1792341483029211981).

--- the gate: mesh-provisioner-client
mesh-provisioner-client: ok, ready: client by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:33:47Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-18T16:33:47Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client

notes:
  - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.012s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.008s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.014s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.007s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.234s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.016s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.010s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.210s
testing modules/mesh-provisioner-client
ok  	mesh-provisioner-client/cmd/mesh-provisioner-client	18.998s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `e7ff7c30` Judged: head `e7ff7c3045fc` merged into trunk `72ad5ad138ce`; read beside it: mesh-controller `48e9656c670b`, mesh-controller-main `48e9656c670b`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step - tier 0: mesh-provisioner-client - ace: receives mesh-provisioner-client - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client - shanks: receives mesh-provisioner-client - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine - read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go Run by the build seat on ace as `build-1792341483029211981` (`builds --log build-1792341483029211981`). ``` --- the gate: mesh-provisioner-client mesh-provisioner-client: ok, ready: client by unit every 30s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:33:47Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-18T16:33:47Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client notes: - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.012s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.008s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.014s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.007s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.234s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.016s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.010s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.210s testing modules/mesh-provisioner-client ok mesh-provisioner-client/cmd/mesh-provisioner-client 18.998s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools commented

2026-10-18 16:56:32 +00:00

Merge check at e7ff7c30
Judged: head e7ff7c3045fc merged into trunk afb94d925e94; read beside it: mesh-controller 48e9656c670b, mesh-controller-main 48e9656c670b, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step

tier 0: mesh-provisioner-client
ace: receives mesh-provisioner-client
g14: receives mesh-provisioner-client
novox: receives mesh-provisioner-client
shanks: receives mesh-provisioner-client
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine
read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go

Run by the build seat on shanks as build-1792342332134236204 (builds --log build-1792342332134236204).

--- the gate: mesh-provisioner-client
mesh-provisioner-client: ok, ready: client by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:33:47Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-18T16:33:47Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client

notes:
  - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.013s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.009s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.019s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.008s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.014s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.269s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.015s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.012s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.228s
testing modules/mesh-provisioner-client
ok  	mesh-provisioner-client/cmd/mesh-provisioner-client	19.352s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `e7ff7c30` Judged: head `e7ff7c3045fc` merged into trunk `afb94d925e94`; read beside it: mesh-controller `48e9656c670b`, mesh-controller-main `48e9656c670b`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step - tier 0: mesh-provisioner-client - ace: receives mesh-provisioner-client - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client - shanks: receives mesh-provisioner-client - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine - read by no module's build: modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go Run by the build seat on shanks as `build-1792342332134236204` (`builds --log build-1792342332134236204`). ``` --- the gate: mesh-provisioner-client mesh-provisioner-client: ok, ready: client by unit every 30s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-18T16:33:47Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-18T16:33:47Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client notes: - modules/mesh-provisioner-client/README.md, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/asks_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bars_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/client_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_select_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/collect_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/drift_integration_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/ended_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/environment_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/i3_golden_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_collectors_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/pulled_in_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go, modules/mesh-provisioner-client/cmd/mesh-provisioner-client/secrets_test.go and modules/mesh-provisioner-client/cmd/mesh-provisioner-client/xorg_golden_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 53939 strings of 811 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.013s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.009s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.019s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.008s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.014s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.269s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.015s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.012s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.228s testing modules/mesh-provisioner-client ok mesh-provisioner-client/cmd/mesh-provisioner-client 19.352s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit a6295d6b98 into main

2026-10-18 16:56:33 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#366