novox/mesh-catalog
13
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

The mail web client: mesh-mail-web, and mesh-mail's views for it (design 59 milestone 1) #377

Merged
mesh-tools merged 18 commits from feat/mail-webclient into main 2026-10-19 21:27:33 +00:00
Conversation 2 Commits 18 Files Changed 39
+6319 -26
mesh-tools commented 2026-10-19 21:21:42 +00:00
Member
Copy Link
Copy Source

Design 59 milestone 1 (the mail web client), one release of mesh-catalog. In a browser on the laptop and the workstation, the operator signs in and browses, searches and reads every account's mail with its attachments, and writes a mail that goes out on their Approve.

  • mesh-mail: the account and newest-mail buckets a view reads (issues 1255, 1282); mail_send_status answers only its caller (1261).
  • mesh-mail-web, a new module: its manifest (1262), its web endpoint on the internal name with a content security policy (1283), Keycloak sign-in (1263) with a session-bound form token (1284), accounts, folders and mails (1264), search (1265), a mail and its attachments (1266), writing a mail (1267).
  • The acceptance test that starts mesh-mail-web whole against a real bus (1268), on a runtime player for a bundle's integration test (1285).

After delivery mesh-mail-web is built and assigned nowhere; its reach, assignment, operators and mesh-mail grant are four separate Approves (design 59 §7).

Issues: 1255, 1261, 1262, 1263, 1264, 1265, 1266, 1267, 1268, 1282, 1283, 1284, 1285. Opened during review, outside this milestone: 1310, 1312, 1313, 1319.

Tried before opening: build-1792444785063783501 passed at 9f3a8ee3 (integration tests included).

Reviewed-by: review-webclient@g14 at 9f3a8ee391

Design 59 milestone 1 (the mail web client), one release of mesh-catalog. In a browser on the laptop and the workstation, the operator signs in and browses, searches and reads every account's mail with its attachments, and writes a mail that goes out on their Approve. - mesh-mail: the account and newest-mail buckets a view reads (issues 1255, 1282); `mail_send_status` answers only its caller (1261). - mesh-mail-web, a new module: its manifest (1262), its web endpoint on the internal name with a content security policy (1283), Keycloak sign-in (1263) with a session-bound form token (1284), accounts, folders and mails (1264), search (1265), a mail and its attachments (1266), writing a mail (1267). - The acceptance test that starts mesh-mail-web whole against a real bus (1268), on a runtime player for a bundle's integration test (1285). After delivery mesh-mail-web is built and assigned nowhere; its reach, assignment, operators and mesh-mail grant are four separate Approves (design 59 §7). Issues: 1255, 1261, 1262, 1263, 1264, 1265, 1266, 1267, 1268, 1282, 1283, 1284, 1285. Opened during review, outside this milestone: 1310, 1312, 1313, 1319. Tried before opening: build-1792444785063783501 passed at 9f3a8ee3 (integration tests included). Reviewed-by: review-webclient@g14 at 9f3a8ee391013593c378a1080d4ba998cc798bdf
mesh-tools added 18 commits 2026-10-19 21:21:42 +00:00
Answer a send's state only to its caller (issue 1261) a9ff48e200
Keep each account's state in a bucket (issue 1255) 08200bc178
Keep each account's newest mails in a bucket, bounded past 81 accounts (issue 1282) a3e9985c15
Add the module mesh-mail-web, with its status verb (issue 1262) a9ad306693
Serve mesh-mail-web's HTTP endpoint: internal host check, CSP, open (issue 1283) 68c141849f
Sign in through Keycloak: code flow with PKCE, verified ID token, 12-hour session (issue 1263) 8e0ef84060 
Library choice: golang.org/x/oauth2 for the code exchange, github.com/coreos/go-oidc/v3 for the ID token's
verification (issuer, audience, expiry, signature from the issuer's JWKS).
Bind every changing form's token to its session (issue 1284) 3ee80c98ab
Show every granted account, its state and its folders' counts (issue 1264) 28fdbbd346 
Accounts bucket fixture (accountBucketValue/accountBucketFolder) copied from mesh-mail's own
modules/mesh-mail/cmd/mesh-mail/mirror.go AccountValue/AccountFolderValue (issue 1255); mesh-mail-web is its
own Go module, so this is a copy, not an import.
Add the search page, by mail-store.search's own argument names (issue 1265) ff1886ac62
Show a mail as escaped text and serve its attachments as downloads (issue 1266) 58b337770d
Add the write page and a send's state, behind issue 1284's form token (issue 1267) f863e852c9 
Wires 1284's per-session token into the real write form and its real POST /send; adds tests for 1284/AC1-AC4
against that real page and handler, beside this issue's own AC1-AC4.
Add the runtime player and stand-in mail-store for a bundle's integration test (issue 1285) c996121e9d 
Plays the SDK's own runtime protocol (initialize, tools/list, tools/call, the bundle's mesh/ask and
mesh/state.<verb>) against mesh-mail-web's real built binary, from stdio.go and state.go's own source. The
account bucket is a real JetStream key-value bucket (mesh-mail_accounts, named as mesh-mail's own
acceptance_integration_test.go names a module's state); its fixture (accountBucketValue/accountBucketFolder)
is accounts.go's own, itself copied from mesh-mail's mirror.go AccountValue (issue 1255, 1264).

Build tag integration; compiles under go vet -tags integration ./...; never run here (go test -tags
integration is this batch's hard rule) — the lead's try runs it.
Add design 59 milestone 1's acceptance tests on the runtime player (issue 1268) 502cda34cb 
Four scenarios, entered only through HTTP with Host mail.<node>.internal as a browser would, against the
built mesh-mail-web, a stand-in identity provider (auth_test.go's own fakeIssuer, reused) and a real account
bucket holding granted account a and ungranted account c: sign-in redirects, 403s and the session cookie's
attributes; the 404 for another host; browsing and a send followed to sent, only the five mail verbs asked,
account c never shown, paging by date, no database or extra writable directory; a mail's script and remote
image shown as text, an attachment downloaded with nosniff, and the CSP on every answer.

Build tag integration; compiles under go vet -tags integration ./...; never run here.
Fix mesh-mail-web's manifest: operators is type list, the listen word names its port number (issue 1262) 523d7846cd 
The controller refused the manifest: config.operators declared type "array" (not one of the controller's
five types, novox/hq ADR 0348 §4 — the word is "list"), and the bundle's env word MESH_MAIL_WEB_LISTEN said
${port:web} (a bundle's word takes the port NUMBER a listens entry gives, novox/hq ADR 0192; mesh-controller
internal/catalogue/port_into.go portsFilledInto matches it against listens[].Port, never an endpoint's
label). Fixed to type "list" and ${port:8099} (the listens entry's own port). main.go and the integration
harness already read/write a plain port number, so neither needed a change. manifest_test.go now asserts
both: config.operators.Type == "list", and the listen word equals ${port:<the listens entry's port>};
confirmed each independently fails against the old values before this fix.
Report an unknown ask through a small interface, not *testing.T directly (issue 1285) 5b57422523 
A failed subtest fails its parent, so TestHarnessFailsTheTestWhenTheBundleAsksSomethingUnknown could never
pass the way it was written (try 2's finding). The player now reports through askFailer (Helper, Errorf);
every other test keeps passing its own *testing.T, which satisfies it already. That one test gives a
recorder instead, and asserts it holds exactly one message naming seat:mail-store.accounts, and that
mail-webclient.status's own answer shows the ask got an error back. Checked: no other integration test uses
the same deliberate-subtest-failure pattern (grepped t.Run).
Bounce once through this origin before sign-in, so a Strict cookie is not lost crossing from Keycloak or another site (issue 1263) 3fd1b47fe7
Keep the HTTP endpoint's own state, so status and health stop claiming to serve once it has failed (issue 1283) cad6194447
Follow real links instead of building them, and check the CSP on every answer (issue 1268)
mesh/merge-gate head 9f3a8ee39101 merged into trunk 66aa204f6779 — pass: builds mesh-mail, new: modules/mesh-mail-web → novox; no bus step; every machine c…
Details
mesh/repo-check head 9f3a8ee39101 merged into trunk 66aa204f6779 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
Details
mesh/delivery delivered
Details
9f3a8ee391
mesh-tools commented 2026-10-19 21:21:44 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-catalog@9f3a8ee39101 — delivered since 2026-10-19T21:30:31Z

Delivery plan — builds mesh-mail, new: modules/mesh-mail-web → novox; no bus step

  • tier 0: mesh-mail
  • novox: receives mesh-mail

Machines

  • mesh-mail on every machine running it: sent

Transitions

  • 2026-10-19 21:21 (new) → proposed (announced): novox/mesh-catalog#377's head announced
  • 2026-10-19 21:24 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-19 21:24 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-19 21:27 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-19 21:27 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-19 21:30 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@9f3a8ee39101` — **delivered** since 2026-10-19T21:30:31Z **Delivery plan** — builds mesh-mail, new: modules/mesh-mail-web → novox; no bus step - tier 0: mesh-mail - novox: receives mesh-mail **Machines** - mesh-mail on every machine running it: sent **Transitions** - 2026-10-19 21:21 (new) → proposed (announced): novox/mesh-catalog#377's head announced - 2026-10-19 21:24 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-19 21:24 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-19 21:27 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-19 21:27 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-19 21:30 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools commented 2026-10-19 21:24:54 +00:00
Author
Member
Copy Link
Copy Source

Merge check at 9f3a8ee3
Judged: head 9f3a8ee39101 merged into trunk 66aa204f6779; read beside it: mesh-controller caa3fc899501, mesh-controller-main caa3fc899501, mesh-host 2474bf28330f, mesh-tools 7412c5b6c9c5

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-mail, new:modules/mesh-mail-web)
  • mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-mail, new: modules/mesh-mail-web → novox; no bus step

  • tier 0: mesh-mail
  • novox: receives mesh-mail
  • read by no module's build: modules/mesh-mail/cmd/mesh-mail/imap_test.go, modules/mesh-mail/cmd/mesh-mail/manifest_test.go, modules/mesh-mail/cmd/mesh-mail/mirror_test.go, modules/mesh-mail/cmd/mesh-mail/send_test.go

Run by the build seat on ace as build-1792444910156646010 (builds --log build-1792444910156646010).

--- the gate: mesh-mail, new:modules/mesh-mail-web
note: mesh-mail uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here
mesh-mail: ok, 11 tool(s), keeps state sends, accounts, mails, ready: keep by unit every 30s; watch by its tool mail_health every 1m0s; send by unit every 30s
mesh-mail-web: ok, 3 tool(s), invokes seat:mail-store.accounts, seat:mail-store.search, seat:mail-store.read, seat:mail-store.send, seat:mail-store.send-status, reads mesh-mail.accounts
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-19T21:17:52Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-19T21:17:52Z

modules the change moves:
  - mesh-mail (changed)
  - mesh-mail-web (added)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-mail

notes:
  - mesh-mail-web could not be tried on a machine: these assignments cannot be applied: - 2 providers of "route", wanted by mesh-mail-web — say which with `pin f35 route <node> <module>`: idt/route-proxy, ygcyr/route-proxy
  - modules/mesh-mail/cmd/mesh-mail/imap_test.go, modules/mesh-mail/cmd/mesh-mail/manifest_test.go, modules/mesh-mail/cmd/mesh-mail/mirror_test.go and modules/mesh-mail/cmd/mesh-mail/send_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 54926 strings of 827 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.012s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.008s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.016s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.008s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.288s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.015s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.011s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.005s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.234s
testing modules/mesh-mail
ok  	mesh-mail/cmd/mesh-mail	8.268s
?   	mesh-mail/cmd/mesh-mail/internal/secret	[no test files]
testing modules/mesh-mail-web
ok  	mesh-mail-web/cmd/mesh-mail-web	8.640s
--- its merge-check-typescript.sh (typescript toolchain)
**Merge check** at `9f3a8ee3` Judged: head `9f3a8ee39101` merged into trunk `66aa204f6779`; read beside it: mesh-controller `caa3fc899501`, mesh-controller-main `caa3fc899501`, mesh-host `2474bf28330f`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-mail, new:modules/mesh-mail-web) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-mail, new: modules/mesh-mail-web → novox; no bus step - tier 0: mesh-mail - novox: receives mesh-mail - read by no module's build: modules/mesh-mail/cmd/mesh-mail/imap_test.go, modules/mesh-mail/cmd/mesh-mail/manifest_test.go, modules/mesh-mail/cmd/mesh-mail/mirror_test.go, modules/mesh-mail/cmd/mesh-mail/send_test.go Run by the build seat on ace as `build-1792444910156646010` (`builds --log build-1792444910156646010`). ``` --- the gate: mesh-mail, new:modules/mesh-mail-web note: mesh-mail uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here mesh-mail: ok, 11 tool(s), keeps state sends, accounts, mails, ready: keep by unit every 30s; watch by its tool mail_health every 1m0s; send by unit every 30s mesh-mail-web: ok, 3 tool(s), invokes seat:mail-store.accounts, seat:mail-store.search, seat:mail-store.read, seat:mail-store.send, seat:mail-store.send-status, reads mesh-mail.accounts long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-19T21:17:52Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-19T21:17:52Z modules the change moves: - mesh-mail (changed) - mesh-mail-web (added) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-mail notes: - mesh-mail-web could not be tried on a machine: these assignments cannot be applied: - 2 providers of "route", wanted by mesh-mail-web — say which with `pin f35 route <node> <module>`: idt/route-proxy, ygcyr/route-proxy - modules/mesh-mail/cmd/mesh-mail/imap_test.go, modules/mesh-mail/cmd/mesh-mail/manifest_test.go, modules/mesh-mail/cmd/mesh-mail/mirror_test.go and modules/mesh-mail/cmd/mesh-mail/send_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 54926 strings of 827 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.012s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.008s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.016s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.008s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.288s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.015s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.011s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.005s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.234s testing modules/mesh-mail ok mesh-mail/cmd/mesh-mail 8.268s ? mesh-mail/cmd/mesh-mail/internal/secret [no test files] testing modules/mesh-mail-web ok mesh-mail-web/cmd/mesh-mail-web 8.640s --- its merge-check-typescript.sh (typescript toolchain) ```
mesh-tools merged commit 954f84ea19 into main 2026-10-19 21:27:33 +00:00
mesh-tools deleted branch feat/mail-webclient 2026-10-19 21:27:34 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-catalog#377