novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

The brother module: one module for the Brother printer, holding the scanner and printer seats, scans kept in its bucket and printing over the broker (issue 1453, ADR 0467, ADR 0468) #384

Merged
mesh-tools merged 14 commits from feat/brother into main 2026-10-20 19:48:06 +00:00
Conversation 2 Commits 14 Files Changed 59
+4936 -570
mesh-tools commented 2026-10-20 19:41:42 +00:00
Member
Copy Link
Copy Source

Issue 1453; ADR 0467 (one brother module, both seats) with its insight (the device process), ADR 0468 (scans in the module's bucket, documents in parts, printing over the broker).

  • modules/scan (merged as #383, assigned to no node) moves to modules/brother with its history and is retired.
  • Seats declared and held once for the mesh: scanner (scan, status, list, document) and printer (status, settings, upload, print). restart comes in the next change, built from the admin pages printer.settings reads live.
  • The process device, as the module's own account brother-device with its own bus account (ADR 0436), alone holds the admin password (given by the operator, issued outside) and the bucket's key; it scans, stores each PDF under its sha256 in the s3-bucket, emits scan.added with object, serves documents in parts of at most 700 KiB, takes uploads, prints by IPP Print-Job, and reads the admin pages (certificate pinned by fingerprint, login by the form's own field name). The tools only ask it over the work queue device-asks and read device-answers; printer.status, scanner.status and scanner.list need no credential and stay in the tools. scanner.scan files each stored scan into scan-folder as the operator account.
  • Config: scanner, scan-folder, printer, printer-certificate required and trusted; resolution, color-mode, crop preferences, untrusted (issue 1446's part).

Tests replay the scanner's eSCL answers, the printer's login page and IPP answer captured 2026-10-20; each cites its criterion (1453/AC1-AC12). AC13 and AC7 are proven live after the delivery to shanks.

Try: pass at 2f608612 (1m8s). Review: three rounds (the tool runner could not read the password, so the device process; the event declaration, a committed binary removed from history, the part size; a test's data race) and a close-out the operator approved. Follow-ups: issue 1466.

Reviewed-by: reviewer@shanks at 2f6086120c

Issue 1453; ADR 0467 (one brother module, both seats) with its insight (the device process), ADR 0468 (scans in the module's bucket, documents in parts, printing over the broker). - `modules/scan` (merged as #383, assigned to no node) moves to `modules/brother` with its history and is retired. - Seats declared and held once for the mesh: `scanner` (scan, status, list, document) and `printer` (status, settings, upload, print). `restart` comes in the next change, built from the admin pages `printer.settings` reads live. - The process `device`, as the module's own account `brother-device` with its own bus account (ADR 0436), alone holds the admin password (given by the operator, issued outside) and the bucket's key; it scans, stores each PDF under its sha256 in the `s3-bucket`, emits `scan.added` with `object`, serves documents in parts of at most 700 KiB, takes uploads, prints by IPP Print-Job, and reads the admin pages (certificate pinned by fingerprint, login by the form's own field name). The tools only ask it over the work queue `device-asks` and read `device-answers`; `printer.status`, `scanner.status` and `scanner.list` need no credential and stay in the tools. `scanner.scan` files each stored scan into `scan-folder` as the operator account. - Config: `scanner`, `scan-folder`, `printer`, `printer-certificate` required and trusted; `resolution`, `color-mode`, `crop` preferences, untrusted (issue 1446's part). Tests replay the scanner's eSCL answers, the printer's login page and IPP answer captured 2026-10-20; each cites its criterion (1453/AC1-AC12). AC13 and AC7 are proven live after the delivery to shanks. Try: pass at 2f608612 (1m8s). Review: three rounds (the tool runner could not read the password, so the device process; the event declaration, a committed binary removed from history, the part size; a test's data race) and a close-out the operator approved. Follow-ups: issue 1466. Reviewed-by: reviewer@shanks at 2f6086120c46a7e7754a6f87e3951d0240db0a25
mesh-tools added 14 commits 2026-10-20 19:41:42 +00:00
Move the scan module to brother, ADR 0467 clause 1: the code unchanged in what it does (issue 1453) 4a892ee29d
brother: the scanner seat declared and claimed, its verbs scan, status and list; preferences untrusted (issue 1453, 1446) 78f9731d4a
brother: the printer config and admin-password secret, HTTPS pinned to one certificate, and the login by the form's own field (issue 1453) 2b62a1819e
brother: the printer seat's settings verb, read-only through the login, with the page's links and form fields (issue 1453) 34260d8c29
brother: the printer seat's status verb, IPP Get-Printer-Attributes by hand and the eSCL state, replayed from captures (issue 1453) 6782816707
brother: README for the two seats, the pinned certificate, the admin password and the login (issue 1453) 58c0c0682c
brother: the admin process alone reads the admin password and logs in; printer.settings queues an ask and reads its answer (issue 1453) 29107b0d93
brother: the admin account, its owned secrets, the process and the printer-asks stream declared as mesh-mail's sender is; an integration test and the README (issue 1453) adfb61c053
brother: the admin process becomes the device process, brother-device, with device-asks and device-answers (issue 1453, ADR 0468 clause 1) feada9fb14
brother: the module requires an s3-bucket, with mesh-mail's S3 client and store.json read by the device account alone (issue 1453, ADR 0468 clause 2) d6e88fac17
brother: scanning moves into the device process and its scans are kept in the bucket; scanner.document, printer.upload and printer.print carry documents in parts and print over IPP (issue 1453, ADR 0468) 1d62305001
brother: README for the bucket, the documents in parts, printing and the device process (issue 1453) b430b35633
brother: emits declared in the module's own list too, parts of 700 KiB at most, a duplicates window on device-asks, and the built binary ignored (issue 1453) 02cb424d5c
issue 1453: read the fake printer's connection count under its lock, which the race detector requires; say 700 KiB as ADR 0468 does
mesh/merge-gate head 2f6086120c46 merged into trunk 809dd76973fd — pass: builds scan, new: modules/brother, sent nowhere; no bus step; every machine compos…
Details
mesh/repo-check head 2f6086120c46 merged into trunk 809dd76973fd — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
Details
mesh/delivery stopped: a merged change never reached the machines: its walk plan-1792525688362824501 ended done before its word without building scan (mo…
Details
2f6086120c
mesh-tools commented 2026-10-20 19:41:53 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-catalog@2f6086120c46 — stopped since 2026-10-20T20:08:14Z

Delivery plan — builds scan, new: modules/brother, sent nowhere; no bus step

Transitions

  • 2026-10-20 19:41 (new) → proposed (announced): novox/mesh-catalog#384's head announced
  • 2026-10-20 19:44 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-20 19:44 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-20 19:48 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-20 20:08 published → stopped (stop): a merged change never reached the machines: its walk plan-1792525688362824501 ended done before its word without building scan (moved nothing the mesh holds: nothing to walk), and no later merge into main that contains it delivered them (novox/hq issue 474)

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@2f6086120c46` — **stopped** since 2026-10-20T20:08:14Z **Delivery plan** — builds scan, new: modules/brother, sent nowhere; no bus step **Transitions** - 2026-10-20 19:41 (new) → proposed (announced): novox/mesh-catalog#384's head announced - 2026-10-20 19:44 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-20 19:44 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-20 19:48 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-20 20:08 published → stopped (stop): a merged change never reached the machines: its walk plan-1792525688362824501 ended done before its word without building scan (moved nothing the mesh holds: nothing to walk), and no later merge into main that contains it delivered them (novox/hq issue 474) The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools commented 2026-10-20 19:44:55 +00:00
Author
Member
Copy Link
Copy Source

Merge check at 2f608612
Judged: head 2f6086120c46 merged into trunk 809dd76973fd; read beside it: mesh-controller 073ccc29c603, mesh-controller-main 073ccc29c603, mesh-host ce1b97ad973d, mesh-tools 18260ce9beca

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: scan, new:modules/brother)
  • mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds scan, new: modules/brother, sent nowhere; no bus step

  • read by no module's build: .gitignore, modules/scan/cmd/scan/crop_test.go, modules/scan/cmd/scan/escl_test.go, modules/scan/cmd/scan/file_test.go, modules/scan/cmd/scan/helpers_test.go, modules/scan/cmd/scan/service_test.go, modules/scan/cmd/scan/testdata/escl/capabilities.xml, modules/scan/cmd/scan/testdata/escl/doc-headers.txt, modules/scan/cmd/scan/testdata/escl/post-headers.txt, modules/scan/cmd/scan/testdata/escl/scan.jpg, modules/scan/cmd/scan/testdata/escl/settings.xml, modules/scan/cmd/scan/testdata/escl/status-after.xml, modules/scan/cmd/scan/testdata/escl/status-idle.xml, modules/scan/README.md, modules/scan/cmd/scan/manifest_test.go

Run by the build seat on ace as build-1792525307333175951 (builds --log build-1792525307333175951).

--- the gate: scan, new:modules/brother
brother: ok, 8 tool(s), keeps state device-answers, ready: device by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-20T19:34:40Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-20T19:34:40Z

modules the change moves:
  - brother (added)
  - scan (removed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 0 module(s) in 0 tier(s)

notes:
  - .gitignore, modules/scan/README.md, modules/scan/cmd/scan/crop_test.go, modules/scan/cmd/scan/escl_test.go, modules/scan/cmd/scan/file_test.go, modules/scan/cmd/scan/helpers_test.go, modules/scan/cmd/scan/manifest_test.go, modules/scan/cmd/scan/service_test.go, modules/scan/cmd/scan/testdata/escl/capabilities.xml, modules/scan/cmd/scan/testdata/escl/doc-headers.txt, modules/scan/cmd/scan/testdata/escl/post-headers.txt, modules/scan/cmd/scan/testdata/escl/scan.jpg, modules/scan/cmd/scan/testdata/escl/settings.xml, modules/scan/cmd/scan/testdata/escl/status-after.xml and modules/scan/cmd/scan/testdata/escl/status-idle.xml read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 55966 strings of 849 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.011s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.009s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.015s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.007s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.013s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.237s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.013s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.012s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.210s
testing modules/brother
ok  	brother/cmd/brother	9.654s
ok  	brother/cmd/brother/internal/secret	1.010s
--- its merge-check-typescript.sh (typescript toolchain)
**Merge check** at `2f608612` Judged: head `2f6086120c46` merged into trunk `809dd76973fd`; read beside it: mesh-controller `073ccc29c603`, mesh-controller-main `073ccc29c603`, mesh-host `ce1b97ad973d`, mesh-tools `18260ce9beca` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: scan, new:modules/brother) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds scan, new: modules/brother, sent nowhere; no bus step - read by no module's build: .gitignore, modules/scan/cmd/scan/crop_test.go, modules/scan/cmd/scan/escl_test.go, modules/scan/cmd/scan/file_test.go, modules/scan/cmd/scan/helpers_test.go, modules/scan/cmd/scan/service_test.go, modules/scan/cmd/scan/testdata/escl/capabilities.xml, modules/scan/cmd/scan/testdata/escl/doc-headers.txt, modules/scan/cmd/scan/testdata/escl/post-headers.txt, modules/scan/cmd/scan/testdata/escl/scan.jpg, modules/scan/cmd/scan/testdata/escl/settings.xml, modules/scan/cmd/scan/testdata/escl/status-after.xml, modules/scan/cmd/scan/testdata/escl/status-idle.xml, modules/scan/README.md, modules/scan/cmd/scan/manifest_test.go Run by the build seat on ace as `build-1792525307333175951` (`builds --log build-1792525307333175951`). ``` --- the gate: scan, new:modules/brother brother: ok, 8 tool(s), keeps state device-answers, ready: device by unit every 30s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-20T19:34:40Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-20T19:34:40Z modules the change moves: - brother (added) - scan (removed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 0 module(s) in 0 tier(s) notes: - .gitignore, modules/scan/README.md, modules/scan/cmd/scan/crop_test.go, modules/scan/cmd/scan/escl_test.go, modules/scan/cmd/scan/file_test.go, modules/scan/cmd/scan/helpers_test.go, modules/scan/cmd/scan/manifest_test.go, modules/scan/cmd/scan/service_test.go, modules/scan/cmd/scan/testdata/escl/capabilities.xml, modules/scan/cmd/scan/testdata/escl/doc-headers.txt, modules/scan/cmd/scan/testdata/escl/post-headers.txt, modules/scan/cmd/scan/testdata/escl/scan.jpg, modules/scan/cmd/scan/testdata/escl/settings.xml, modules/scan/cmd/scan/testdata/escl/status-after.xml and modules/scan/cmd/scan/testdata/escl/status-idle.xml read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 55966 strings of 849 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.011s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.009s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.015s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.007s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.013s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.237s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.013s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.012s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.210s testing modules/brother ok brother/cmd/brother 9.654s ok brother/cmd/brother/internal/secret 1.010s --- its merge-check-typescript.sh (typescript toolchain) ```
mesh-tools merged commit 1357023bed into main 2026-10-20 19:48:06 +00:00
mesh-tools deleted branch feat/brother 2026-10-20 19:48:06 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-catalog#384