Pack archive artifacts in mesh-build-go, a module's directory or a pinned file, and refuse any path that leads out of the module through a link (issue 1589, ADR 0478 §1) #408

2026-10-21T09:58:41Z

mesh-tools commented

2026-10-21 09:58:41 +00:00

Issue 1589 (design 47, R4c-4; ADR 0478 §1), with the symlink guards its reviews asked for (the same class as build-agent's issue 1609).

build_go_build packs an archive artifact of any module's tree: the directory from, or a file pinned by url and sha256 (kept whole as file or unpacked from within; gzip, bzip2; xz refused by name, issue 1590), with mesh-sdk's Pack, as build-agent packs it.
A link cannot take a build out of its module: the module directory must resolve inside the workspace's tree; an archive's from inside the module; the bundle's .mesh-build output directory inside the module, checked before RemoveAll/MkdirAll and again before Pack. The unresolved paths are packed, so no digest changes.
Archive file modes no longer depend on the packing account's umask.
The archive fixture's manifest is module.json.fixture (issue 1527).

Tests (each failing first): directory archive and both pinned forms compare the uncompressed tar stream with build-agent's own (captured from mesh-controller 0205b8f7), and the gzip digest under go1.27.1 (gzip bytes depend on the Go that compresses, issue 1499; ADR 0477 §6 compares build nodes with each other); refusals for a wrong sha256, a 404, entries outside within, a symlinked parent, a linked module directory, a .mesh-build link; an image still refused by name. mesh-controller.try build-1792576355517070582 passed at e023f699 (1m20s).

Later, from the reviews: issues 1590 (xz), 1628 (the Go bundle's executable mode under umask 077).

Reviewed-by: reviewer-1589@shanks at e023f69989

Issue 1589 (design 47, R4c-4; ADR 0478 §1), with the symlink guards its reviews asked for (the same class as build-agent's issue 1609). - build_go_build packs an archive artifact of any module's tree: the directory `from`, or a file pinned by url and sha256 (kept whole as `file` or unpacked from `within`; gzip, bzip2; xz refused by name, issue 1590), with mesh-sdk's Pack, as build-agent packs it. - A link cannot take a build out of its module: the module directory must resolve inside the workspace's tree; an archive's `from` inside the module; the bundle's `.mesh-build` output directory inside the module, checked before RemoveAll/MkdirAll and again before Pack. The unresolved paths are packed, so no digest changes. - Archive file modes no longer depend on the packing account's umask. - The archive fixture's manifest is `module.json.fixture` (issue 1527). Tests (each failing first): directory archive and both pinned forms compare the uncompressed tar stream with build-agent's own (captured from mesh-controller 0205b8f7), and the gzip digest under go1.27.1 (gzip bytes depend on the Go that compresses, issue 1499; ADR 0477 §6 compares build nodes with each other); refusals for a wrong sha256, a 404, entries outside `within`, a symlinked parent, a linked module directory, a `.mesh-build` link; an image still refused by name. mesh-controller.try build-1792576355517070582 passed at e023f699 (1m20s). Later, from the reviews: issues 1590 (xz), 1628 (the Go bundle's executable mode under umask 077). Reviewed-by: reviewer-1589@shanks at e023f69989abab0bc618da8a38c617f1162da814

mesh-tools added 11 commits 2026-10-21 09:58:41 +00:00

Add the archive fixture tree for mesh-build-go's archive tests (issue 1589) d8f87808b5

Unpack and pack archive artifacts in mesh-build-go: a module's directory or a pinned file (issue 1589, ADR 0478 §1) d369adf245

Hand an archive artifact to the packing step (issue 1589, ADR 0478 §1) 640c6f9b0c

Say the build tool packs archives, give the module a client for pinned files, and record how the digests were captured (issue 1589) bfd6b7c7ce

Test archive artifacts against build-agent's own digests (issue 1589) 8bfa626a8b

Add the pinned release the archive tests serve (issue 1589) 406ee69732

Refuse an archive whose directory leads out of the module through a symlinked parent (review of issue 1589) 6993ef003c

Refuse an archive of a module directory that is a link out of the workspace's tree (issue 1589) 800d6624d5

Refuse a build output directory that is a link out of the module (issue 1589) d7e6074d97

Make an archive's digest independent of the umask of the account that packs it (issue 1589) ef154705b9

Compare an archive's tar stream with the build agent's always and its digest only under the Go it was captured with (issue 1589)

mesh/merge-gate head e023f69989ab merged into trunk 710cfbd622d7 — pass: builds mesh-build-go → g14, novox, shanks; no bus step; every machine composes wit…

Details

mesh/repo-check head e023f69989ab merged into trunk 710cfbd622d7 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…

Details

mesh/delivery delivered

Details

e023f69989

mesh-tools commented

2026-10-21 09:58:51 +00:00

Delivery novox/mesh-catalog@e023f69989ab — delivered since 2026-10-21T10:59:40Z

Delivery plan — builds mesh-build-go → g14, novox, shanks; no bus step

tier 0: mesh-build-go
g14: receives mesh-build-go
novox: receives mesh-build-go
shanks: receives mesh-build-go
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine

Machines

dev-tools on every machine running it: sent
mesh-build-go on every machine running it: sent
mesh-build-node on every machine running it: sent
mesh-sdk on every machine running it: sent
mesh-tools on every machine running it: sent
audit-logger on every machine running it: sent
confluence on every machine running it: sent
gitea on every machine running it: sent
gitlab on every machine running it: sent
jira on every machine running it: sent
lab on every machine running it: sent
mesh-catalog on every machine running it: sent
model-usage on every machine running it: sent
openai-consumer on every machine running it: sent
route-adapter on every machine running it: sent
showcase on every machine running it: sent

Transitions

2026-10-21 09:58 (new) → proposed (announced): novox/mesh-catalog#408's head announced
2026-10-21 10:33 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-21 10:33 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-21 10:35 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-21 10:36 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-21 10:59 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@e023f69989ab` — **delivered** since 2026-10-21T10:59:40Z **Delivery plan** — builds mesh-build-go → g14, novox, shanks; no bus step - tier 0: mesh-build-go - g14: receives mesh-build-go - novox: receives mesh-build-go - shanks: receives mesh-build-go - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine **Machines** - dev-tools on every machine running it: sent - mesh-build-go on every machine running it: sent - mesh-build-node on every machine running it: sent - mesh-sdk on every machine running it: sent - mesh-tools on every machine running it: sent - audit-logger on every machine running it: sent - confluence on every machine running it: sent - gitea on every machine running it: sent - gitlab on every machine running it: sent - jira on every machine running it: sent - lab on every machine running it: sent - mesh-catalog on every machine running it: sent - model-usage on every machine running it: sent - openai-consumer on every machine running it: sent - route-adapter on every machine running it: sent - showcase on every machine running it: sent **Transitions** - 2026-10-21 09:58 (new) → proposed (announced): novox/mesh-catalog#408's head announced - 2026-10-21 10:33 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 10:33 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 10:35 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-21 10:36 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 10:59 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-21 10:13:10 +00:00

Merge check at e023f699
Judged: head e023f69989ab merged into trunk 0f2cee1bea4e; read beside it: mesh-controller 0205b8f7080a, mesh-controller-main 0205b8f7080a, mesh-host c5c4caa2a4ab, mesh-tools e0fadc43d9dd

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-go)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-build-go → g14, novox, shanks; no bus step

tier 0: mesh-build-go
g14: receives mesh-build-go
novox: receives mesh-build-go
shanks: receives mesh-build-go
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine
read by no module's build: modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture, modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz

Run by the build seat on shanks as build-1792576736563116877 (builds --log build-1792576736563116877).

--- the gate: mesh-build-go
mesh-build-go: ok, 6 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T10:06:45Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T10:06:45Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-go

notes:
  - modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture and modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 58184 strings of 898 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.014s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.010s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.020s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.009s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.015s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.275s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.016s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.013s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 59, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.227s
testing modules/mesh-build-go
ok  	meshbuildgo/cmd/mesh-build-go	19.051s
--- its merge-check-typescript.sh (typescript toolchain)

Out of date when it landed: out of date: judged against trunk 0f2cee1bea, the trunk is now f0c8958dd217; judged again on a recheck or when it is merged

**Merge check** at `e023f699` Judged: head `e023f69989ab` merged into trunk `0f2cee1bea4e`; read beside it: mesh-controller `0205b8f7080a`, mesh-controller-main `0205b8f7080a`, mesh-host `c5c4caa2a4ab`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-go) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-build-go → g14, novox, shanks; no bus step - tier 0: mesh-build-go - g14: receives mesh-build-go - novox: receives mesh-build-go - shanks: receives mesh-build-go - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine - read by no module's build: modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture, modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz Run by the build seat on shanks as `build-1792576736563116877` (`builds --log build-1792576736563116877`). ``` --- the gate: mesh-build-go mesh-build-go: ok, 6 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T10:06:45Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-21T10:06:45Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-go notes: - modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture and modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 58184 strings of 898 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.014s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.020s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.009s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.015s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.275s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.016s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.013s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 59, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.227s testing modules/mesh-build-go ok meshbuildgo/cmd/mesh-build-go 19.051s --- its merge-check-typescript.sh (typescript toolchain) ``` **Out of date when it landed**: out of date: judged against trunk 0f2cee1bea4e, the trunk is now f0c8958dd217; judged again on a recheck or when it is merged

mesh-tools commented

2026-10-21 10:29:16 +00:00

Merge check at e023f699
Judged: head e023f69989ab merged into trunk 940594b07478; read beside it: mesh-controller 0205b8f7080a, mesh-controller-main ff42f2183900, mesh-host c5c4caa2a4ab, mesh-tools e0fadc43d9dd

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-go)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-build-go → g14, novox, shanks; no bus step

tier 0: mesh-build-go
g14: receives mesh-build-go
novox: receives mesh-build-go
shanks: receives mesh-build-go
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine
read by no module's build: modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture, modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz

Run by the build seat on ace as build-1792577594281790419 (builds --log build-1792577594281790419).

--- the gate: mesh-build-go
mesh-build-go: ok, 6 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T10:16:45Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T10:16:45Z

modules the change moves:
  - mesh-build-go (changed)

machines:
  - a machine (f35): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go)
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go)
  - a machine (yvbpsm): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go)

a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-go

notes:
  - modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture and modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 58309 strings of 899 files
ok  	git.novox.be/novox/mesh-catalog/checks/toolchains	0.009s
toolchains: go, nodejs and npm are declared only by their owners
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.012s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.008s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.016s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.007s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.011s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.231s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.014s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.010s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 59, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.194s
testing modules/mesh-build-go
ok  	meshbuildgo/cmd/mesh-build-go	14.675s
--- its merge-check-typescript.sh (typescript toolchain)

Out of date when it landed: out of date: judged against trunk 940594b074, the trunk is now 710cfbd622d7; judged again on a recheck or when it is merged

**Merge check** at `e023f699` Judged: head `e023f69989ab` merged into trunk `940594b07478`; read beside it: mesh-controller `0205b8f7080a`, mesh-controller-main `ff42f2183900`, mesh-host `c5c4caa2a4ab`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-go) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-build-go → g14, novox, shanks; no bus step - tier 0: mesh-build-go - g14: receives mesh-build-go - novox: receives mesh-build-go - shanks: receives mesh-build-go - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine - read by no module's build: modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture, modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz Run by the build seat on ace as `build-1792577594281790419` (`builds --log build-1792577594281790419`). ``` --- the gate: mesh-build-go mesh-build-go: ok, 6 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T10:16:45Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-21T10:16:45Z modules the change moves: - mesh-build-go (changed) machines: - a machine (f35): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go) - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go) - a machine (yvbpsm): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go) a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-go notes: - modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture and modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 58309 strings of 899 files ok git.novox.be/novox/mesh-catalog/checks/toolchains 0.009s toolchains: go, nodejs and npm are declared only by their owners ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.012s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.008s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.016s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.007s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.011s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.231s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.014s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.010s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 59, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.194s testing modules/mesh-build-go ok meshbuildgo/cmd/mesh-build-go 14.675s --- its merge-check-typescript.sh (typescript toolchain) ``` **Out of date when it landed**: out of date: judged against trunk 940594b07478, the trunk is now 710cfbd622d7; judged again on a recheck or when it is merged

mesh-tools commented

2026-10-21 10:33:07 +00:00

Merge check at e023f699
Judged: head e023f69989ab merged into trunk 710cfbd622d7; read beside it: mesh-controller 0205b8f7080a, mesh-controller-main ff42f2183900, mesh-host c5c4caa2a4ab, mesh-tools e0fadc43d9dd

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-go)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-build-go → g14, novox, shanks; no bus step

tier 0: mesh-build-go
g14: receives mesh-build-go
novox: receives mesh-build-go
shanks: receives mesh-build-go
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine
read by no module's build: modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture, modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz

Run by the build seat on ace as build-1792578558374371648 (builds --log build-1792578558374371648).

--- the gate: mesh-build-go
mesh-build-go: ok, 9 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T10:26:45Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T10:26:45Z

modules the change moves:
  - mesh-build-go (changed)

machines:
  - a machine (f35): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go)
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go)
  - a machine (yvbpsm): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go)

a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-go

notes:
  - modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture and modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 58417 strings of 901 files
ok  	git.novox.be/novox/mesh-catalog/checks/toolchains	0.008s
toolchains: go, nodejs and npm are declared only by their owners
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.010s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.008s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.015s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.008s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.236s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.014s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.011s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 59, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.210s
testing modules/mesh-build-go
ok  	meshbuildgo/cmd/mesh-build-go	14.661s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `e023f699` Judged: head `e023f69989ab` merged into trunk `710cfbd622d7`; read beside it: mesh-controller `0205b8f7080a`, mesh-controller-main `ff42f2183900`, mesh-host `c5c4caa2a4ab`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-go) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-build-go → g14, novox, shanks; no bus step - tier 0: mesh-build-go - g14: receives mesh-build-go - novox: receives mesh-build-go - shanks: receives mesh-build-go - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go is judged on its first machine - read by no module's build: modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture, modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz Run by the build seat on ace as `build-1792578558374371648` (`builds --log build-1792578558374371648`). ``` --- the gate: mesh-build-go mesh-build-go: ok, 9 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T10:26:45Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-21T10:26:45Z modules the change moves: - mesh-build-go (changed) machines: - a machine (f35): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go) - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go) - a machine (yvbpsm): composes; the change adds 0 resource(s) and removes 1 (-package:mesh-build-go.go) a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-go notes: - modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/archive_test.go, modules/mesh-build-go/cmd/mesh-build-go/build_test.go, modules/mesh-build-go/cmd/mesh-build-go/testdata/captured/README, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/Z.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/a.txt, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/bin/run, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/files/sub/b.conf, modules/mesh-build-go/cmd/mesh-build-go/testdata/repos/archive/modules/demo/module.json.fixture and modules/mesh-build-go/cmd/mesh-build-go/testdata/upstream-release.tar.gz read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 58417 strings of 901 files ok git.novox.be/novox/mesh-catalog/checks/toolchains 0.008s toolchains: go, nodejs and npm are declared only by their owners ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.010s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.008s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.015s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.008s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.236s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.014s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.011s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 59, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.210s testing modules/mesh-build-go ok meshbuildgo/cmd/mesh-build-go 14.661s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit b5dbfbb784 into main

2026-10-21 10:34:00 +00:00

mesh-tools deleted branch fix/1589-archive-artifacts

2026-10-21 10:34:01 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#408