Build Go modules with Go's own release of the recipe's version, so the distribution's build no longer makes the guard refuse (issue 1560, ADR 0476) #400

Merged

mesh-tools merged 4 commits from fix/1560-go-release-toolchain into main 2026-10-21 06:47:12 +00:00

Conversation 2 Commits 4 Files Changed 15

+397 -40

mesh-tools commented 2026-10-21 01:01:13 +00:00

Member

Copy Link

Copy Source

Fixes issue 1560 and builds ADR 0476. Since 2026-10-21 02:18 the Go build module refused on every build node it runs on: 'go go1.27.1-X:nodwarf5 installed, the recipe builds with go go1.27.1'. Measured that night: the distribution's Go builds other bytes than Go's own go1.27.1 (fe949f7b / 369221d6 with dwarf5 / f14a2d0b for the release), so ADR 0476 has the module build with the release, fetched and verified by the installed Go.

• Every step (fetch, digest, test, build) and the probe run with GOTOOLCHAIN=; the probe runs with network and the module's GOMODCACHE, so the release lands there before any step; the toolchains key and the refusal carry the release's version (ADR 0476 §1-§3).
• A failed download names its cause, not Go's 'go: downloading' line (causeLine).
• Real-go integration tests fill a shared cache with the probe first and skip loudly ('NOT RUN: ADR 0476 ...') when the probe cannot have the release.

Checked: unit suite and vet (both tags); tries build-1792544177080010430 and build-1792544367460564532 PASSED (the first try failed on the integration tests' missing release, fixed by the third commit). Live after delivery: build_go_health healthy with go1.27.1 on shanks, g14 and novox.

Reviewed-by: review-1560@shanks at 3c4deb8bee

Fixes issue 1560 and builds ADR 0476. Since 2026-10-21 02:18 the Go build module refused on every build node it runs on: 'go go1.27.1-X:nodwarf5 installed, the recipe builds with go go1.27.1'. Measured that night: the distribution's Go builds other bytes than Go's own go1.27.1 (fe949f7b / 369221d6 with dwarf5 / f14a2d0b for the release), so ADR 0476 has the module build with the release, fetched and verified by the installed Go. - Every step (fetch, digest, test, build) and the probe run with GOTOOLCHAIN=<RecipeGo>; the probe runs with network and the module's GOMODCACHE, so the release lands there before any step; the toolchains key and the refusal carry the release's version (ADR 0476 §1-§3). - A failed download names its cause, not Go's 'go: downloading' line (causeLine). - Real-go integration tests fill a shared cache with the probe first and skip loudly ('NOT RUN: ADR 0476 ...') when the probe cannot have the release. Checked: unit suite and vet (both tags); tries build-1792544177080010430 and build-1792544367460564532 PASSED (the first try failed on the integration tests' missing release, fixed by the third commit). Live after delivery: build_go_health healthy with go1.27.1 on shanks, g14 and novox. Reviewed-by: review-1560@shanks at 3c4deb8bee8bb06b2d18144de6759fc3f021d6c7

mesh-tools added 4 commits 2026-10-21 01:01:13 +00:00

Build Go modules with Go's own release of the recipe's version, put in the module cache by the probe, so the distribution's build no longer makes the guard refuse (issue 1560, ADR 0476) 3f60d1ff31

Test that every step and the probe run Go's own release and the probe fills the module cache (issue 1560, ADR 0476) c5f8f81a07

Fill the shared module cache with the release by the probe before the real-go integration tests, and skip loudly when it cannot (issue 1560, ADR 0476) 4605fcf46d

Name the cause of a failed toolchain or module download, not Go's progress line before it (issue 1560, review round 1) 3c4deb8bee

mesh-tools commented 2026-10-21 01:01:32 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@3c4deb8bee8b — delivered since 2026-10-21T06:49:18Z

Delivery plan — builds mesh-build-go → g14, novox, shanks; no bus step

• tier 0: mesh-build-go
• g14: receives mesh-build-go
• novox: receives mesh-build-go
• shanks: receives mesh-build-go
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine

Machines

• mesh-build-go on every machine running it: sent

Transitions

• 2026-10-21 01:01 (new) → proposed (announced): novox/mesh-catalog#400's head announced
• 2026-10-21 01:05 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-21 01:05 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-21 06:47 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-21 06:47 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-21 06:49 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@3c4deb8bee8b` — **delivered** since 2026-10-21T06:49:18Z **Delivery plan** — builds mesh-build-go → g14, novox, shanks; no bus step - tier 0: mesh-build-go - g14: receives mesh-build-go - novox: receives mesh-build-go - shanks: receives mesh-build-go - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine **Machines** - mesh-build-go on every machine running it: sent **Transitions** - 2026-10-21 01:01 (new) → proposed (announced): novox/mesh-catalog#400's head announced - 2026-10-21 01:05 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 01:05 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 06:47 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-21 06:47 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 06:49 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented 2026-10-21 01:05:20 +00:00

Author

Member

Copy Link

Copy Source

Merge check at 3c4deb8b
Judged: head 3c4deb8bee8b merged into trunk 76bb22c36270; read beside it: mesh-controller 0fee5404d95b, mesh-controller-main 0fee5404d95b, mesh-host c5c4caa2a4ab, mesh-tools e0fadc43d9dd

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-go)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-build-go → g14, novox, shanks; no bus step

• tier 0: mesh-build-go
• g14: receives mesh-build-go
• novox: receives mesh-build-go
• shanks: receives mesh-build-go
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine
• read by no module's build: modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/digest_test.go, modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go, modules/mesh-build-go/cmd/mesh-build-go/test_real_integration_test.go, modules/mesh-build-go/cmd/mesh-build-go/test_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/toolchain_env_test.go, modules/mesh-build-go/cmd/mesh-build-go/toolchain_integration_test.go, modules/mesh-build-go/cmd/mesh-build-go/toolchain_probe_test.go

Run by the build seat on ace as build-1792544481031033041 (builds --log build-1792544481031033041).

--- the gate: mesh-build-go
mesh-build-go: ok, 6 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T00:27:13Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T00:27:13Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-go

notes:
  - modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/digest_test.go, modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go, modules/mesh-build-go/cmd/mesh-build-go/test_real_integration_test.go, modules/mesh-build-go/cmd/mesh-build-go/test_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/toolchain_env_test.go, modules/mesh-build-go/cmd/mesh-build-go/toolchain_integration_test.go and modules/mesh-build-go/cmd/mesh-build-go/toolchain_probe_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 58039 strings of 894 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.011s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.009s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.015s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.008s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.014s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.225s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.029s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.010s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.005s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.207s
testing modules/mesh-build-go
ok  	meshbuildgo/cmd/mesh-build-go	22.334s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `3c4deb8b` Judged: head `3c4deb8bee8b` merged into trunk `76bb22c36270`; read beside it: mesh-controller `0fee5404d95b`, mesh-controller-main `0fee5404d95b`, mesh-host `c5c4caa2a4ab`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-go) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-build-go → g14, novox, shanks; no bus step - tier 0: mesh-build-go - g14: receives mesh-build-go - novox: receives mesh-build-go - shanks: receives mesh-build-go - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine - read by no module's build: modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/digest_test.go, modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go, modules/mesh-build-go/cmd/mesh-build-go/test_real_integration_test.go, modules/mesh-build-go/cmd/mesh-build-go/test_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/toolchain_env_test.go, modules/mesh-build-go/cmd/mesh-build-go/toolchain_integration_test.go, modules/mesh-build-go/cmd/mesh-build-go/toolchain_probe_test.go Run by the build seat on ace as `build-1792544481031033041` (`builds --log build-1792544481031033041`). ``` --- the gate: mesh-build-go mesh-build-go: ok, 6 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T00:27:13Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-21T00:27:13Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-go notes: - modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/digest_test.go, modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go, modules/mesh-build-go/cmd/mesh-build-go/test_real_integration_test.go, modules/mesh-build-go/cmd/mesh-build-go/test_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/toolchain_env_test.go, modules/mesh-build-go/cmd/mesh-build-go/toolchain_integration_test.go and modules/mesh-build-go/cmd/mesh-build-go/toolchain_probe_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 58039 strings of 894 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.011s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.009s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.015s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.008s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.014s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.225s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.029s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.010s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.005s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.207s testing modules/mesh-build-go ok meshbuildgo/cmd/mesh-build-go 22.334s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit 9daeab209b into main 2026-10-21 06:47:12 +00:00

mesh-tools deleted branch fix/1560-go-release-toolchain 2026-10-21 06:47:12 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#400