Give /var/lib/systemd and /var/lib/postgres back to their packages and keep the two modules' own files under /var/lib/mesh (issue 1873, delivery A) #453

Merged

mesh-tools merged 1 commits from fix/1873-system-state-dirs into main 2026-10-22 20:04:29 +00:00

Conversation 2 Commits 1 Files Changed 7

+179 -16

mesh-tools commented 2026-10-22 19:54:04 +00:00

Member

Copy Link

Copy Source

Issue 1873 (criteria 1873/AC1-AC6 in note 3); delivery group with mesh-host fix/1873-system-state-dirs (same branch). The operator called it urgent.

The systemd and postgres modules declared their state directory with place ".", which resolves to /var/lib/systemd and /var/lib/postgres, directories their packages own; the node-engine gave them to the operator's account, mode 0700, on every machine that runs them.

• Each module's own files move to a new directory data with place "mesh" (/var/lib/mesh/systemd, /var/lib/mesh/postgres): postgres's grants, consumers.json and its two own secrets, the secret's container volume and the provider's env.
• The resource state is kept for this delivery, pinned to its path with the package's owner and mode (/var/lib/systemd root 0755; /var/lib/postgres postgres 0700), so the node-engine, whose record under that id names that path, sets them back. Delivery B (a later pull request) drops both state resources once every machine shows the package's owner and mode.
• The store's data is untouched: /var/lib/mesh-store, its dumps, PGDATA and the data volume are equal, asserted by a test.
• checks/owned/system-known keeps only "postgres state" and "systemd state" until B.

What the operator sees: the postgres container (the mesh's store) is recreated on novox and ace, because its secret's volume moves (the secrets' values stay: the vault keys them by node, module and name); every consumer of the store reconnects once. postgres is upgrade: record, so its move waits for the operator's take. The old secret, consumers and grant files under /var/lib/postgres are removed by the node-engine at the apply after.

Tests failed first (1873/AC1, AC2). Try build-1792697530985726842 PASS.

Reviewed-by: review-1873@shanks at e0bf87c2e3

Issue 1873 (criteria 1873/AC1-AC6 in note 3); delivery group with mesh-host fix/1873-system-state-dirs (same branch). The operator called it urgent. The systemd and postgres modules declared their state directory with place ".", which resolves to /var/lib/systemd and /var/lib/postgres, directories their packages own; the node-engine gave them to the operator's account, mode 0700, on every machine that runs them. - Each module's own files move to a new directory `data` with place "mesh" (/var/lib/mesh/systemd, /var/lib/mesh/postgres): postgres's grants, consumers.json and its two own secrets, the secret's container volume and the provider's env. - The resource `state` is kept for this delivery, pinned to its path with the package's owner and mode (/var/lib/systemd root 0755; /var/lib/postgres postgres 0700), so the node-engine, whose record under that id names that path, sets them back. Delivery B (a later pull request) drops both `state` resources once every machine shows the package's owner and mode. - The store's data is untouched: /var/lib/mesh-store, its dumps, PGDATA and the data volume are equal, asserted by a test. - checks/owned/system-known keeps only "postgres state" and "systemd state" until B. What the operator sees: the postgres container (the mesh's store) is recreated on novox and ace, because its secret's volume moves (the secrets' values stay: the vault keys them by node, module and name); every consumer of the store reconnects once. postgres is upgrade: record, so its move waits for the operator's take. The old secret, consumers and grant files under /var/lib/postgres are removed by the node-engine at the apply after. Tests failed first (1873/AC1, AC2). Try build-1792697530985726842 PASS. Reviewed-by: review-1873@shanks at e0bf87c2e3da778fe7998dceb75044a0a4f3d32b

mesh-tools added 1 commit 2026-10-22 19:54:04 +00:00

Give /var/lib/systemd and /var/lib/postgres back to their packages, and keep the modules' files in their own directories (issue 1873) ... e0bf87c2e3

The systemd and postgres modules' state directories said place ".", which is
/var/lib/systemd and /var/lib/postgres: directories the systemd and postgresql
packages own (root 0755; postgres 0700). The node-engine took both before issue
339's rule and gave them to the operator's account, 0700, on every machine; postgres's
grants directory, placed by default, lay inside /var/lib/postgres too.

What each module keeps moves to a directory of its own, "data", placed "mesh"
(/var/lib/mesh/systemd, /var/lib/mesh/postgres): the unlink record, and postgres's
own secrets (the same values: the vault keys them by name), consumers.json and
grants. The store's data stays /var/lib/mesh-store, untouched.

The node-engine keeps no found owner or mode for a directory, and forgets one no
longer declared as it stands; it sets the declared owner and mode on a directory it
recorded at the same path under the same id. So for this delivery "state" names
the package's directory with the package's owner and mode, and the engine gives it
back; the next change drops "state". The postgres container is recreated, its
secret's volume moving.

checks/owned/system-known keeps systemd state and postgres state, declared for
this delivery only; postgres's consumers and grants leave the list.

mesh-tools commented 2026-10-22 19:54:17 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@e0bf87c2e3da — delivered since 2026-10-22T20:10:56Z

Delivery plan — builds postgres, systemd → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person

• tier 0: postgres, systemd
• ace: receives systemd; waits for a person: postgres
• g14: receives systemd
• novox: receives systemd; waits for a person: postgres
• shanks: receives systemd
• postgres waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
• postgres provides postgres-database: its consumers are sent again after it
• postgres keeps data (ADR 0233): what it holds is backed up before it moves
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before systemd is judged on its first machine

Group fix/1873-system-state-dirs: novox/mesh-catalog@e0bf87c2e3, novox/mesh-host@8c0bb9d453

• composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Machines

• systemd on every machine running it: sent

Transitions

• 2026-10-22 19:54 (new) → proposed (announced): novox/mesh-catalog#453's head announced
• 2026-10-22 19:58 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-22 19:58 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-22 20:06 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-22 20:06 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-22 20:10 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@e0bf87c2e3da` — **delivered** since 2026-10-22T20:10:56Z **Delivery plan** — builds postgres, systemd → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person - tier 0: postgres, systemd - ace: receives systemd; waits for a person: postgres - g14: receives systemd - novox: receives systemd; waits for a person: postgres - shanks: receives systemd - postgres waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - postgres provides postgres-database: its consumers are sent again after it - postgres keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before systemd is judged on its first machine **Group** `fix/1873-system-state-dirs`: novox/mesh-catalog@e0bf87c2e3da, novox/mesh-host@8c0bb9d4531d - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - systemd on every machine running it: sent **Transitions** - 2026-10-22 19:54 (new) → proposed (announced): novox/mesh-catalog#453's head announced - 2026-10-22 19:58 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-22 19:58 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-22 20:06 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-22 20:06 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-22 20:10 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented 2026-10-22 19:58:58 +00:00

Author

Member

Copy Link

Copy Source

Merge check at e0bf87c2
Judged: head e0bf87c2e3da merged into trunk ef1e98f8678c; read beside it: mesh-controller f2a4363a1a77, mesh-controller-main f2a4363a1a77, mesh-host 4065b45ae84f, mesh-tools e0fadc43d9dd

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: postgres, systemd)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds postgres, systemd → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person

• tier 0: postgres, systemd
• ace: receives systemd; waits for a person: postgres
• g14: receives systemd
• novox: receives systemd; waits for a person: postgres
• shanks: receives systemd
• postgres waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
• postgres provides postgres-database: its consumers are sent again after it
• postgres keeps data (ADR 0233): what it holds is backed up before it moves
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before systemd is judged on its first machine
• read by no module's build: checks/owned/system-known, modules/postgres/README.md, modules/postgres/cmd/postgres-provider/manifest_test.go, modules/systemd/README.md, modules/systemd/cmd/systemd-tools/manifest_test.go

Run by the build seat on ace as build-1792698849064975173 (builds --log build-1792698849064975173).

--- the gate: postgres, systemd
postgres: ok, keeps state bound, reads mesh-controller.assignments, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s
systemd: ok
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T19:47:54Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-22T19:47:54Z

modules the change moves:
  - postgres (changed)
  - systemd (changed)

machines:
  - a machine (f35): composes; the change adds 1 resource(s) and removes 0 (+directory:systemd.data)
  - holds mesh-dns-resolver (idt): composes; the change adds 2 resource(s) and removes 0 (+directory:postgres.data, +directory:systemd.data)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 2 resource(s) and removes 0 (+directory:postgres.data, +directory:systemd.data)
  - a machine (yvbpsm): composes; the change adds 1 resource(s) and removes 0 (+directory:systemd.data)

a merge would rebuild 2 module(s) in 1 tier(s): postgres, systemd

notes:
  - checks/owned/system-known, modules/postgres/README.md, modules/postgres/cmd/postgres-provider/manifest_test.go, modules/systemd/README.md and modules/systemd/cmd/systemd-tools/manifest_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 62033 strings of 959 files
ok  	git.novox.be/novox/mesh-catalog/checks/particulars	0.006s
particulars: none of 4 node names in the 2 covered modules
ok  	git.novox.be/novox/mesh-catalog/checks/toolchains	0.010s
toolchains: go, nodejs, npm and buildah are declared only by their owners
ok  	git.novox.be/novox/mesh-catalog/checks/imagebuild	0.010s
imagebuild: rootless-image-build is provided only by buildah
ok  	git.novox.be/novox/mesh-catalog/checks/imageplace	0.010s
imageplace: every image builds from a Dockerfile in its own module's directory
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.012s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.010s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.017s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.024s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.016s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.246s
predefined.json: 3 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.034s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.011s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 58, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.208s
testing modules/postgres
ok  	postgres/cmd/postgres-provider	1.087s
testing modules/systemd
ok  	systemd-tools/cmd/systemd-tools	1.088s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `e0bf87c2` Judged: head `e0bf87c2e3da` merged into trunk `ef1e98f8678c`; read beside it: mesh-controller `f2a4363a1a77`, mesh-controller-main `f2a4363a1a77`, mesh-host `4065b45ae84f`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: postgres, systemd) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds postgres, systemd → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person - tier 0: postgres, systemd - ace: receives systemd; waits for a person: postgres - g14: receives systemd - novox: receives systemd; waits for a person: postgres - shanks: receives systemd - postgres waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - postgres provides postgres-database: its consumers are sent again after it - postgres keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before systemd is judged on its first machine - read by no module's build: checks/owned/system-known, modules/postgres/README.md, modules/postgres/cmd/postgres-provider/manifest_test.go, modules/systemd/README.md, modules/systemd/cmd/systemd-tools/manifest_test.go Run by the build seat on ace as `build-1792698849064975173` (`builds --log build-1792698849064975173`). ``` --- the gate: postgres, systemd postgres: ok, keeps state bound, reads mesh-controller.assignments, keeps store (valuable), dumps (rebuildable), ready: server by tcp on database every 30s systemd: ok long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T19:47:54Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-22T19:47:54Z modules the change moves: - postgres (changed) - systemd (changed) machines: - a machine (f35): composes; the change adds 1 resource(s) and removes 0 (+directory:systemd.data) - holds mesh-dns-resolver (idt): composes; the change adds 2 resource(s) and removes 0 (+directory:postgres.data, +directory:systemd.data) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 2 resource(s) and removes 0 (+directory:postgres.data, +directory:systemd.data) - a machine (yvbpsm): composes; the change adds 1 resource(s) and removes 0 (+directory:systemd.data) a merge would rebuild 2 module(s) in 1 tier(s): postgres, systemd notes: - checks/owned/system-known, modules/postgres/README.md, modules/postgres/cmd/postgres-provider/manifest_test.go, modules/systemd/README.md and modules/systemd/cmd/systemd-tools/manifest_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 62033 strings of 959 files ok git.novox.be/novox/mesh-catalog/checks/particulars 0.006s particulars: none of 4 node names in the 2 covered modules ok git.novox.be/novox/mesh-catalog/checks/toolchains 0.010s toolchains: go, nodejs, npm and buildah are declared only by their owners ok git.novox.be/novox/mesh-catalog/checks/imagebuild 0.010s imagebuild: rootless-image-build is provided only by buildah ok git.novox.be/novox/mesh-catalog/checks/imageplace 0.010s imageplace: every image builds from a Dockerfile in its own module's directory ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.012s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.017s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.024s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's ok git.novox.be/novox/mesh-catalog/checks/secrets 0.016s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.246s predefined.json: 3 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.034s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.011s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 58, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.208s testing modules/postgres ok postgres/cmd/postgres-provider 1.087s testing modules/systemd ok systemd-tools/cmd/systemd-tools 1.088s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit 083515da1b into main 2026-10-22 20:04:29 +00:00

mesh-tools deleted branch fix/1873-system-state-dirs 2026-10-22 20:04:29 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#453