Merge a group whole or not at all, and say loudly when it cannot (issues 1275, 1276) #375

Merged

mesh-tools merged 3 commits from fix/1275-group-merges-whole-or-not into main 2026-10-19 18:45:31 +00:00

Conversation 3 Commits 3 Files Changed 11

+689 -70

mesh-tools commented 2026-10-19 18:33:41 +00:00

Member

Copy Link

Copy Source

Issue 1275 (the operator, 2026-10-19: a failing merge should not be possible, and if it happens it alerts loudly), and 1276's part in mesh-delivery. Seen live: an approved group (mesh-catalog #374, mesh-delivery #5) had #374 refused by the merge tool (its mesh/repo-check missing) and #5 merged one second later; the refusal was a log line only.

• 1275/AC2: before merging any member of an approved group, every member's required statuses are read again at the approved head; if any is not a success, nothing merges and the group is held (read again after 30 s).
• 1275/AC3: the members merge in one pass, stopping at the first refusal; no member after it merges. (A group has no merge order by design, ADR 0418, issue 978: the pass follows the delivery ids' sort; the delivery's order comes from the module graph and its plan waits for every member.)
• 1275/AC4: a held or half-merged group is said as an urgent stalled line (naming the group, the member, the forge's words and what is needed) until every member is merged; one line per member.
• 1275/AC1: no Approve is asked while a member's required status is not a success; the group says which.
• 1275/AC5: a non-success merge-check status arriving for a head an unanswered ask covers withdraws the ask at the router; a late answer merges nothing (head changes were already withdrawn).
• 1276/AC1: a refusal naming the member's own status as missing (not only pending) asks the member's own check, not the composed one.

Tests in modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go, each failed first on an assertion; group_test.go's test that asserted both members asked in one pass despite a refusal is rewritten to AC3. Review round 1: the bus test's fake forge did not answer the status read (the first merge check failed on it), fixed in 301cd228. The urgent severity reaches the operator only once mesh-controller #399 (issue 1278) is delivered too; the narrowing of the one-pass rule is ADR 0441 (proposed). Merge check passed at 301cd228 (18:43 UTC). Its delivery moves mesh-delivery on novox.

Reviewed-by: review-1275@shanks at 301cd2287f

Issue 1275 (the operator, 2026-10-19: a failing merge should not be possible, and if it happens it alerts loudly), and 1276's part in mesh-delivery. Seen live: an approved group (mesh-catalog #374, mesh-delivery #5) had #374 refused by the merge tool (its mesh/repo-check missing) and #5 merged one second later; the refusal was a log line only. - 1275/AC2: before merging any member of an approved group, every member's required statuses are read again at the approved head; if any is not a success, nothing merges and the group is held (read again after 30 s). - 1275/AC3: the members merge in one pass, stopping at the first refusal; no member after it merges. (A group has no merge order by design, ADR 0418, issue 978: the pass follows the delivery ids' sort; the delivery's order comes from the module graph and its plan waits for every member.) - 1275/AC4: a held or half-merged group is said as an urgent stalled line (naming the group, the member, the forge's words and what is needed) until every member is merged; one line per member. - 1275/AC1: no Approve is asked while a member's required status is not a success; the group says which. - 1275/AC5: a non-success merge-check status arriving for a head an unanswered ask covers withdraws the ask at the router; a late answer merges nothing (head changes were already withdrawn). - 1276/AC1: a refusal naming the member's own status as missing (not only pending) asks the member's own check, not the composed one. Tests in modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go, each failed first on an assertion; group_test.go's test that asserted both members asked in one pass despite a refusal is rewritten to AC3. Review round 1: the bus test's fake forge did not answer the status read (the first merge check failed on it), fixed in 301cd228. The urgent severity reaches the operator only once mesh-controller #399 (issue 1278) is delivered too; the narrowing of the one-pass rule is ADR 0441 (proposed). Merge check passed at 301cd228 (18:43 UTC). Its delivery moves mesh-delivery on novox. Reviewed-by: review-1275@shanks at 301cd2287f5fa66cc0823e258be2d080687ada34

mesh-tools added 2 commits 2026-10-19 18:33:41 +00:00

Merge a group whole or not at all: re-read every required status first, stop at the first refusal, say a held or half merged group urgent (issue 1275, 1276) ... 6e6d1f3e47

An approved group was merged member by member, each on its own, so a refusal of the first
did not stop the second. A group now merges in one pass in its order, after every member's
required statuses are read again at its head, and a held or half merged group stays raised.
A refusal naming the member's own repository check as missing asks that check (issue 1276).

Ask a group's Approve only when every member may merge, and withdraw the ask when a required status turns (issue 1275) ... 524e3405e5

An Approve given hours after its ask must not rest on a check made at the ask: a required status
that turns not a success while the ask waits takes the ask back, and its late answer merges nothing.

mesh-tools commented 2026-10-19 18:33:52 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@301cd2287f5f — delivered since 2026-10-19T18:47:15Z

Delivery plan — builds mesh-delivery → novox; no bus step

• tier 0: mesh-delivery
• novox: receives mesh-delivery

Machines

• mesh-delivery on every machine running it: sent

Transitions

• 2026-10-19 18:40 (new) → proposed (announced): novox/mesh-catalog#375's head announced
• 2026-10-19 18:43 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-19 18:43 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-19 18:45 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-19 18:45 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-19 18:47 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@301cd2287f5f` — **delivered** since 2026-10-19T18:47:15Z **Delivery plan** — builds mesh-delivery → novox; no bus step - tier 0: mesh-delivery - novox: receives mesh-delivery **Machines** - mesh-delivery on every machine running it: sent **Transitions** - 2026-10-19 18:40 (new) → proposed (announced): novox/mesh-catalog#375's head announced - 2026-10-19 18:43 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-19 18:43 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-19 18:45 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-19 18:45 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-19 18:47 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben added 1 commit 2026-10-19 18:39:13 +00:00

Answer gitea_commit_statuses in the bus test's runtime, and say a held, refused member once (issue 1275, review round 1) 301cd2287f

mesh-tools commented 2026-10-19 18:40:06 +00:00

Author

Member

Copy Link

Copy Source

Merge check at 524e3405
Judged: head 524e3405e517 merged into trunk eda55ceb9e1b; read beside it: mesh-controller fdfda0e839e9, mesh-controller-main fdfda0e839e9, mesh-host 2474bf28330f, mesh-tools 7412c5b6c9c5

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery)
• mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestAGroupOfTwoWithGreenChecksGetsOneAskAndOnItsApproveBothMergeInOnePassOverARealBus (11.63s)

Delivery plan — builds mesh-delivery → novox; no bus step

• tier 0: mesh-delivery
• novox: receives mesh-delivery
• read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go

Run by the build seat on ace as build-1792434828323907202 (builds --log build-1792434828323907202).

--- the gate: mesh-delivery
note: mesh-delivery uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here
mesh-delivery: ok, 1 tool(s), invokes seat:mesh-controller.delivery-plan, seat:mesh-controller.delivery-check, seat:mesh-controller.deliver, seat:mesh-controller.delivery-backups-again, seat:mesh-controller.delivery-stop, seat:mesh-controller.delivery-walks, seat:mesh-controller.forget-checks, gitea.gitea_note_append, gitea.gitea_delivery_view, gitea.gitea_commit_status, gitea.gitea_commit_statuses, gitea.gitea_contains, gitea.gitea_open_pulls, gitea.gitea_merge_pull_request, gitea.gitea_add_comment, seat:operator-channel.notify, keeps state deliveries, groups, asked, pulls
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-19T18:28:58Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-19T18:28:58Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-delivery

notes:
  - modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go and modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 54473 strings of 814 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.011s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.009s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.014s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.007s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.013s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.241s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.013s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.009s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.217s
testing modules/mesh-delivery
--- FAIL: TestAGroupOfTwoWithGreenChecksGetsOneAskAndOnItsApproveBothMergeInOnePassOverARealBus (11.63s)
    bus_test.go:147: bundle: [mesh-delivery] read back 0 delivery(ies) and 0 group(s)
    bus_test.go:147: bundle: [mesh-delivery] listening: gitea.pull.updated, gitea.pull.merged, gitea.pull.closed, gitea.forge.status, gitea.forge.pull-request.edited, gitea.forge.pull-request.closed, mesh-controller.checked, mesh-controller.plan-moved
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: (new) → proposed (announced): novox/mesh-controller#1's head announced
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: (new) → proposed (announced): novox/mesh-catalog#2's head announced
    bus_test.go:147: bundle: [mesh-delivery] group feat/x: novox/mesh-catalog@d2d2d2d2d2d2, novox/mesh-controller@c1c1c1c1c1c1
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: its checks passed; the operator's Approve of its merge into main is asked once it may merge
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2 waits: its group feat/x is checking: 2 of 2 member(s) ready
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: its checks passed; the operator's Approve of its merge into main is asked once it may merge
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1 waits: its group feat/x is checking: 2 of 2 member(s) ready
    bus_test.go:147: bundle: [mesh-delivery] group feat/x composed: pass — both compose
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2 passed its checks: the operator is asked to Approve its merge into main (merge-2-d2d2d2d2d2d2-1, ask 1)
    bus_test.go:147: bundle: [mesh-delivery] group feat/x: the required statuses cannot be read, so the operator is not asked yet: the runtime answers no ask gitea.gitea_commit_statuses in this test
    bus_test.go:557: within 10s: the operator to be asked once for the group did not happen
FAIL
FAIL	mesh-delivery/cmd/mesh-delivery	19.906s
FAIL
--- what failed, picked from the whole of its output (the whole is in the build's log)
--- FAIL: TestAGroupOfTwoWithGreenChecksGetsOneAskAndOnItsApproveBothMergeInOnePassOverARealBus (11.63s)
    bus_test.go:147: bundle: [mesh-delivery] read back 0 delivery(ies) and 0 group(s)
    bus_test.go:147: bundle: [mesh-delivery] listening: gitea.pull.updated, gitea.pull.merged, gitea.pull.closed, gitea.forge.status, gitea.forge.pull-request.edited, gitea.forge.pull-request.closed, mesh-controller.checked, mesh-controller.plan-moved
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: (new) → proposed (announced): novox/mesh-controller#1's head announced
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: (new) → proposed (announced): novox/mesh-catalog#2's head announced
    bus_test.go:147: bundle: [mesh-delivery] group feat/x: novox/mesh-catalog@d2d2d2d2d2d2, novox/mesh-controller@c1c1c1c1c1c1
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: its checks passed; the operator's Approve of its merge into main is asked once it may merge
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2 waits: its group feat/x is checking: 2 of 2 member(s) ready
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: its checks passed; the operator's Approve of its merge into main is asked once it may merge
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1 waits: its group feat/x is checking: 2 of 2 member(s) ready
    bus_test.go:147: bundle: [mesh-delivery] group feat/x composed: pass — both compose
    bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2 passed its checks: the operator is asked to Approve its merge into main (merge-2-d2d2d2d2d2d2-1, ask 1)
    bus_test.go:147: bundle: [mesh-delivery] group feat/x: the required statuses cannot be read, so the operator is not asked yet: the runtime answers no ask gitea.gitea_commit_statuses in this test
    bus_test.go:557: within 10s: the operator to be asked once for the group did not happen
FAIL	mesh-delivery/cmd/mesh-delivery	19.906s

**Merge check** at `524e3405` Judged: head `524e3405e517` merged into trunk `eda55ceb9e1b`; read beside it: mesh-controller `fdfda0e839e9`, mesh-controller-main `fdfda0e839e9`, mesh-host `2474bf28330f`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestAGroupOfTwoWithGreenChecksGetsOneAskAndOnItsApproveBothMergeInOnePassOverARealBus (11.63s) **Delivery plan** — builds mesh-delivery → novox; no bus step - tier 0: mesh-delivery - novox: receives mesh-delivery - read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go Run by the build seat on ace as `build-1792434828323907202` (`builds --log build-1792434828323907202`). ``` --- the gate: mesh-delivery note: mesh-delivery uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here mesh-delivery: ok, 1 tool(s), invokes seat:mesh-controller.delivery-plan, seat:mesh-controller.delivery-check, seat:mesh-controller.deliver, seat:mesh-controller.delivery-backups-again, seat:mesh-controller.delivery-stop, seat:mesh-controller.delivery-walks, seat:mesh-controller.forget-checks, gitea.gitea_note_append, gitea.gitea_delivery_view, gitea.gitea_commit_status, gitea.gitea_commit_statuses, gitea.gitea_contains, gitea.gitea_open_pulls, gitea.gitea_merge_pull_request, gitea.gitea_add_comment, seat:operator-channel.notify, keeps state deliveries, groups, asked, pulls long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-19T18:28:58Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-19T18:28:58Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-delivery notes: - modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go and modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 54473 strings of 814 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.011s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.009s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.014s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.007s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.013s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.241s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.013s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.009s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.217s testing modules/mesh-delivery --- FAIL: TestAGroupOfTwoWithGreenChecksGetsOneAskAndOnItsApproveBothMergeInOnePassOverARealBus (11.63s) bus_test.go:147: bundle: [mesh-delivery] read back 0 delivery(ies) and 0 group(s) bus_test.go:147: bundle: [mesh-delivery] listening: gitea.pull.updated, gitea.pull.merged, gitea.pull.closed, gitea.forge.status, gitea.forge.pull-request.edited, gitea.forge.pull-request.closed, mesh-controller.checked, mesh-controller.plan-moved bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: (new) → proposed (announced): novox/mesh-controller#1's head announced bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: (new) → proposed (announced): novox/mesh-catalog#2's head announced bus_test.go:147: bundle: [mesh-delivery] group feat/x: novox/mesh-catalog@d2d2d2d2d2d2, novox/mesh-controller@c1c1c1c1c1c1 bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: its checks passed; the operator's Approve of its merge into main is asked once it may merge bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2 waits: its group feat/x is checking: 2 of 2 member(s) ready bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: its checks passed; the operator's Approve of its merge into main is asked once it may merge bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1 waits: its group feat/x is checking: 2 of 2 member(s) ready bus_test.go:147: bundle: [mesh-delivery] group feat/x composed: pass — both compose bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2 passed its checks: the operator is asked to Approve its merge into main (merge-2-d2d2d2d2d2d2-1, ask 1) bus_test.go:147: bundle: [mesh-delivery] group feat/x: the required statuses cannot be read, so the operator is not asked yet: the runtime answers no ask gitea.gitea_commit_statuses in this test bus_test.go:557: within 10s: the operator to be asked once for the group did not happen FAIL FAIL mesh-delivery/cmd/mesh-delivery 19.906s FAIL --- what failed, picked from the whole of its output (the whole is in the build's log) --- FAIL: TestAGroupOfTwoWithGreenChecksGetsOneAskAndOnItsApproveBothMergeInOnePassOverARealBus (11.63s) bus_test.go:147: bundle: [mesh-delivery] read back 0 delivery(ies) and 0 group(s) bus_test.go:147: bundle: [mesh-delivery] listening: gitea.pull.updated, gitea.pull.merged, gitea.pull.closed, gitea.forge.status, gitea.forge.pull-request.edited, gitea.forge.pull-request.closed, mesh-controller.checked, mesh-controller.plan-moved bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: (new) → proposed (announced): novox/mesh-controller#1's head announced bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: (new) → proposed (announced): novox/mesh-catalog#2's head announced bus_test.go:147: bundle: [mesh-delivery] group feat/x: novox/mesh-catalog@d2d2d2d2d2d2, novox/mesh-controller@c1c1c1c1c1c1 bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2: its checks passed; the operator's Approve of its merge into main is asked once it may merge bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2 waits: its group feat/x is checking: 2 of 2 member(s) ready bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1: its checks passed; the operator's Approve of its merge into main is asked once it may merge bus_test.go:147: bundle: [mesh-delivery] novox/mesh-controller@c1c1c1c1c1c1 waits: its group feat/x is checking: 2 of 2 member(s) ready bus_test.go:147: bundle: [mesh-delivery] group feat/x composed: pass — both compose bus_test.go:147: bundle: [mesh-delivery] novox/mesh-catalog@d2d2d2d2d2d2 passed its checks: the operator is asked to Approve its merge into main (merge-2-d2d2d2d2d2d2-1, ask 1) bus_test.go:147: bundle: [mesh-delivery] group feat/x: the required statuses cannot be read, so the operator is not asked yet: the runtime answers no ask gitea.gitea_commit_statuses in this test bus_test.go:557: within 10s: the operator to be asked once for the group did not happen FAIL mesh-delivery/cmd/mesh-delivery 19.906s ```

mesh-tools commented 2026-10-19 18:43:38 +00:00

Author

Member

Copy Link

Copy Source

Merge check at 301cd228
Judged: head 301cd2287f5f merged into trunk eda55ceb9e1b; read beside it: mesh-controller fdfda0e839e9, mesh-controller-main fdfda0e839e9, mesh-host 2474bf28330f, mesh-tools 7412c5b6c9c5

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-delivery → novox; no bus step

• tier 0: mesh-delivery
• novox: receives mesh-delivery
• read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go

Run by the build seat on ace as build-1792435223429678331 (builds --log build-1792435223429678331).

--- the gate: mesh-delivery
note: mesh-delivery uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here
mesh-delivery: ok, 1 tool(s), invokes seat:mesh-controller.delivery-plan, seat:mesh-controller.delivery-check, seat:mesh-controller.deliver, seat:mesh-controller.delivery-backups-again, seat:mesh-controller.delivery-stop, seat:mesh-controller.delivery-walks, seat:mesh-controller.forget-checks, gitea.gitea_note_append, gitea.gitea_delivery_view, gitea.gitea_commit_status, gitea.gitea_commit_statuses, gitea.gitea_contains, gitea.gitea_open_pulls, gitea.gitea_merge_pull_request, gitea.gitea_add_comment, seat:operator-channel.notify, keeps state deliveries, groups, asked, pulls
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-19T18:38:58Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-19T18:38:58Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-delivery

notes:
  - modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go and modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 54474 strings of 814 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.012s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.010s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.015s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.008s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.013s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.256s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.013s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.009s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.213s
testing modules/mesh-delivery
ok  	mesh-delivery/cmd/mesh-delivery	11.659s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `301cd228` Judged: head `301cd2287f5f` merged into trunk `eda55ceb9e1b`; read beside it: mesh-controller `fdfda0e839e9`, mesh-controller-main `fdfda0e839e9`, mesh-host `2474bf28330f`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-delivery → novox; no bus step - tier 0: mesh-delivery - novox: receives mesh-delivery - read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go Run by the build seat on ace as `build-1792435223429678331` (`builds --log build-1792435223429678331`). ``` --- the gate: mesh-delivery note: mesh-delivery uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here mesh-delivery: ok, 1 tool(s), invokes seat:mesh-controller.delivery-plan, seat:mesh-controller.delivery-check, seat:mesh-controller.deliver, seat:mesh-controller.delivery-backups-again, seat:mesh-controller.delivery-stop, seat:mesh-controller.delivery-walks, seat:mesh-controller.forget-checks, gitea.gitea_note_append, gitea.gitea_delivery_view, gitea.gitea_commit_status, gitea.gitea_commit_statuses, gitea.gitea_contains, gitea.gitea_open_pulls, gitea.gitea_merge_pull_request, gitea.gitea_add_comment, seat:operator-channel.notify, keeps state deliveries, groups, asked, pulls long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-19T18:38:58Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-19T18:38:58Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-delivery notes: - modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go and modules/mesh-delivery/cmd/mesh-delivery/issue1275_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 54474 strings of 814 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.012s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.015s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.008s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.013s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.256s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.013s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.009s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.213s testing modules/mesh-delivery ok mesh-delivery/cmd/mesh-delivery 11.659s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit 9efdd87a73 into main 2026-10-19 18:45:31 +00:00

mesh-tools deleted branch fix/1275-group-merges-whole-or-not 2026-10-19 18:45:31 +00:00

mesh-tools referenced this pull request 2026-10-19 18:52:11 +00:00

Say a group member refused only because main moved a warning for ten minutes, urgent after (issue 1275 AC6, ADR 0442) #376

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#375