novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Keep the pacman keeper's state in a directory of its own, not in the package database's /var/lib/pacman (issue 1841) #452

Merged
mesh-tools merged 1 commits from fix/1841-keeper-state-dir into main 2026-10-22 19:31:25 +00:00
Conversation 2 Commits 1 Files Changed 7
+364 -19
mesh-tools commented 2026-10-22 19:25:58 +00:00
Member
Copy Link
Copy Source

Issue 1841 (note 10, AC17-AC19 in note 12). After upgrade safety's delivery (plan-1792694058124013462, 21:13), pacman's state directory with place "." resolved to /var/lib/pacman, the package manager's own database directory: the node-engine used it as found (root 0755) and reported pacman unhealthy on ace, g14, novox and shanks, and wrote keeper.json and broker-keeper.secret into it.

  • modules/pacman/module.json: the state directory takes place "mesh" (/var/lib/mesh/pacman, mesh-sdk dir_into.go:90-96, as docker does). Every keeper and root-helper path follows through PACMAN_KEEPER_CONFIG, PACMAN_KEEPER_BROKER and PACMAN_ROOT_SOCKET.
  • The old keeper.json and broker-keeper.secret are removed by the node-engine as former records (only while they hold what the mesh wrote); /var/lib/pacman itself is forgotten as found, never deleted. /var/lib/pacman/root (made by the root helper at run time) stays: noted on issue 1839 (zero residue).
  • checks/owned rule 5: refuses a resource that is, lies inside or holds a /var/lib directory a system package owns (checks/owned/system). checks/owned/system-known lists the known exceptions of issue 1873 (systemd state; postgres consumers, grants, state) and only shrinks.

Tests failed first: 1841/AC17 (manifest), 1841/AC18 (rule 5). Try build-1792696760565205379 PASS.

After delivery the operator sees pacman's four 'pacman not working' alerts lose their directory part; the upgrade-order part stays until upgrade-order is set.

Reviewed-by: review-1841-state@shanks at 098c6d3ec7

Issue 1841 (note 10, AC17-AC19 in note 12). After upgrade safety's delivery (plan-1792694058124013462, 21:13), pacman's state directory with place "." resolved to /var/lib/pacman, the package manager's own database directory: the node-engine used it as found (root 0755) and reported pacman unhealthy on ace, g14, novox and shanks, and wrote keeper.json and broker-keeper.secret into it. - modules/pacman/module.json: the state directory takes place "mesh" (/var/lib/mesh/pacman, mesh-sdk dir_into.go:90-96, as docker does). Every keeper and root-helper path follows through PACMAN_KEEPER_CONFIG, PACMAN_KEEPER_BROKER and PACMAN_ROOT_SOCKET. - The old keeper.json and broker-keeper.secret are removed by the node-engine as former records (only while they hold what the mesh wrote); /var/lib/pacman itself is forgotten as found, never deleted. /var/lib/pacman/root (made by the root helper at run time) stays: noted on issue 1839 (zero residue). - checks/owned rule 5: refuses a resource that is, lies inside or holds a /var/lib directory a system package owns (checks/owned/system). checks/owned/system-known lists the known exceptions of issue 1873 (systemd state; postgres consumers, grants, state) and only shrinks. Tests failed first: 1841/AC17 (manifest), 1841/AC18 (rule 5). Try build-1792696760565205379 PASS. After delivery the operator sees pacman's four 'pacman not working' alerts lose their directory part; the upgrade-order part stays until upgrade-order is set. Reviewed-by: review-1841-state@shanks at 098c6d3ec70f43f0c008748f1ba6ef81382ce16d
mesh-tools added 1 commit 2026-10-22 19:25:58 +00:00
Place pacman's state outside the package manager's own directory, and refuse a module directory in a system package's (issue 1841)
mesh/check failed: unit: clipmenu/cmd/clipmenu-tools.TestTheLauncherWaitsQuietlyWhileAnotherClipmenudHoldsTheLock: manifest_test.go:199: the launcher …
mesh/merge-gate head 098c6d3ec70f merged into trunk 2f05e70734cd — pass: builds pacman → ace, g14, novox, shanks; no bus step; every machine composes with …
Details
mesh/repo-check head 098c6d3ec70f merged into trunk 2f05e70734cd — pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the ch…
Details
mesh/delivery delivered
Details
098c6d3ec7 
pacman's state directory said place ".", which resolves to /var/lib/pacman: the
package manager's database directory. The node-engine used it as found and
reported it unhealthy on every machine, and wrote keeper.json into it. It is now
the mesh's directory for the module (place "mesh", /var/lib/mesh/pacman), as
docker's is; keeper.json, the keeper's bus secret and the root helper's socket
follow through ${dir:state}.

checks/owned rule 5 refuses a directory that is, lies in or holds a /var/lib
directory a system package owns (checks/owned/system, read from shanks through
pacman_owns and tmpfiles.d), and any resource inside one. systemd and postgres
collide today and are listed in checks/owned/system-known under issue 1873; that
list only shrinks.
mesh-tools commented 2026-10-22 19:26:09 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-catalog@098c6d3ec70f — delivered since 2026-10-22T19:39:45Z

Delivery plan — builds pacman → ace, g14, novox, shanks; no bus step

  • tier 0: pacman
  • ace: receives pacman
  • g14: receives pacman
  • novox: receives pacman
  • shanks: receives pacman
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before pacman is judged on its first machine

Machines

  • pacman on every machine running it: sent

Transitions

  • 2026-10-22 19:26 (new) → proposed (announced): novox/mesh-catalog#452's head announced
  • 2026-10-22 19:30 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-22 19:30 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-22 19:31 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-22 19:31 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-22 19:39 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@098c6d3ec70f` — **delivered** since 2026-10-22T19:39:45Z **Delivery plan** — builds pacman → ace, g14, novox, shanks; no bus step - tier 0: pacman - ace: receives pacman - g14: receives pacman - novox: receives pacman - shanks: receives pacman - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before pacman is judged on its first machine **Machines** - pacman on every machine running it: sent **Transitions** - 2026-10-22 19:26 (new) → proposed (announced): novox/mesh-catalog#452's head announced - 2026-10-22 19:30 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-22 19:30 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-22 19:31 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-22 19:31 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-22 19:39 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools commented 2026-10-22 19:30:42 +00:00
Author
Member
Copy Link
Copy Source

Merge check at 098c6d3e
Judged: head 098c6d3ec70f merged into trunk 2f05e70734cd; read beside it: mesh-controller 96441ea28a84, mesh-controller-main 96441ea28a84, mesh-host 4065b45ae84f, mesh-tools e0fadc43d9dd

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: pacman)
  • mesh/repo-check: PASS — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds pacman → ace, g14, novox, shanks; no bus step

  • tier 0: pacman
  • ace: receives pacman
  • g14: receives pacman
  • novox: receives pacman
  • shanks: receives pacman
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before pacman is judged on its first machine
  • read by no module's build: checks/owned/main.go, checks/owned/main_test.go, checks/owned/system, checks/owned/system-known, merge-check.sh, modules/pacman/cmd/pacman-tools/keeper_manifest_test.go

Run by the build seat on ace as build-1792697166668370802 (builds --log build-1792697166668370802).

--- the gate: pacman
note: pacman uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here
pacman: ok, 20 tool(s), keeps state installed, updates, runs, records, rounds, asks, reads mesh-controller.declared-packages, ready: mirror-refresh by unit every 30s; cache-cleaning by unit every 30s; root-helper by unit every 30s; keeper by its tool pacman_upgrade_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T19:11:55Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-22T19:11:55Z

modules the change moves:
  - pacman (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): pacman

notes:
  - checks/owned/main.go, checks/owned/main_test.go, checks/owned/system, checks/owned/system-known, merge-check.sh and modules/pacman/cmd/pacman-tools/keeper_manifest_test.go read by no module's build, and rebuild nothing (issue 280)
--- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 62033 strings of 959 files
ok  	git.novox.be/novox/mesh-catalog/checks/particulars	0.006s
particulars: none of 4 node names in the 2 covered modules
ok  	git.novox.be/novox/mesh-catalog/checks/toolchains	0.010s
toolchains: go, nodejs, npm and buildah are declared only by their owners
ok  	git.novox.be/novox/mesh-catalog/checks/imagebuild	0.009s
imagebuild: rootless-image-build is provided only by buildah
ok  	git.novox.be/novox/mesh-catalog/checks/imageplace	0.010s
imageplace: every image builds from a Dockerfile in its own module's directory
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.012s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.008s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.016s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.023s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.219s
predefined.json: 3 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.014s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.010s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 58, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.195s
testing modules/pacman
ok  	pacman/cmd/pacman-tools	5.352s
--- its merge-check-typescript.sh (typescript toolchain)
**Merge check** at `098c6d3e` Judged: head `098c6d3ec70f` merged into trunk `2f05e70734cd`; read beside it: mesh-controller `96441ea28a84`, mesh-controller-main `96441ea28a84`, mesh-host `4065b45ae84f`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: pacman) - `mesh/repo-check`: **PASS** — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds pacman → ace, g14, novox, shanks; no bus step - tier 0: pacman - ace: receives pacman - g14: receives pacman - novox: receives pacman - shanks: receives pacman - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before pacman is judged on its first machine - read by no module's build: checks/owned/main.go, checks/owned/main_test.go, checks/owned/system, checks/owned/system-known, merge-check.sh, modules/pacman/cmd/pacman-tools/keeper_manifest_test.go Run by the build seat on ace as `build-1792697166668370802` (`builds --log build-1792697166668370802`). ``` --- the gate: pacman note: pacman uses the seat "operator-channel", which no module declares and the mesh does not define among the manifests given; registration judges it against the whole catalogue, and passing the declaring module's manifest too judges it here pacman: ok, 20 tool(s), keeps state installed, updates, runs, records, rounds, asks, reads mesh-controller.declared-packages, ready: mirror-refresh by unit every 30s; cache-cleaning by unit every 30s; root-helper by unit every 30s; keeper by its tool pacman_upgrade_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T19:11:55Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-22T19:11:55Z modules the change moves: - pacman (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): pacman notes: - checks/owned/main.go, checks/owned/main_test.go, checks/owned/system, checks/owned/system-known, merge-check.sh and modules/pacman/cmd/pacman-tools/keeper_manifest_test.go read by no module's build, and rebuild nothing (issue 280) --- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 62033 strings of 959 files ok git.novox.be/novox/mesh-catalog/checks/particulars 0.006s particulars: none of 4 node names in the 2 covered modules ok git.novox.be/novox/mesh-catalog/checks/toolchains 0.010s toolchains: go, nodejs, npm and buildah are declared only by their owners ok git.novox.be/novox/mesh-catalog/checks/imagebuild 0.009s imagebuild: rootless-image-build is provided only by buildah ok git.novox.be/novox/mesh-catalog/checks/imageplace 0.010s imageplace: every image builds from a Dockerfile in its own module's directory ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.012s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.008s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.016s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.023s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.219s predefined.json: 3 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.014s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.010s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 58, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.195s testing modules/pacman ok pacman/cmd/pacman-tools 5.352s --- its merge-check-typescript.sh (typescript toolchain) ```
mesh-tools merged commit ef1e98f867 into main 2026-10-22 19:31:25 +00:00
mesh-tools deleted branch fix/1841-keeper-state-dir 2026-10-22 19:31:25 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-catalog#452