Fill a module again when a node-engine returns after any failed fill, not only a missing socket (issue 1873) #455

Merged

mesh-tools merged 2 commits from fix/1873-fill-path into main 2026-10-22 21:19:10 +00:00

Conversation 2 Commits 2 Files Changed 2

+42 -5

mesh-tools commented 2026-10-22 21:01:38 +00:00

Member

Copy Link

Copy Source

Issue 1873 (notes 8-10); the operator asked for a quick fix. After mesh-host #131 was delivered (22:44) ace still says 'ace's provisioner has failed to place the files of postgres since 20:12 UTC': the provisioner client marked a module to be filled again only when its write failed for want of the node-engine's socket (socketAbsent, issue 1165). postgres's fill failed with the old engine's own 'read /var/lib/mesh/postgres/superuser.secret: is a directory', so when the new engine made its socket at 22:42 the client never tried postgres again and kept repeating the old failure.

• modules/mesh-provisioner-client: any failed fill marks the module to be filled again when a node-engine makes its socket again (a newer engine may write what the older could not). Only on a socket return, never on a timer; a later success clears the mark; a refill uses the secrets the client already holds (no new value, no rotation).
• Test TestNatsAFillTheEngineFailedIsTriedWhenTheSocketReturns (integration) failed first in try build-1792702425726840831; try build-1792702581889442897 PASS.

What the operator sees after delivery: mesh-provisioner-client restarts on every machine and fills every module; on ace postgres's superuser.secret is written through the node-engine of #131, which replaces the empty directory the container runtime left, and the condition 'ace is not applying its update' should clear. Then novox's held postgres move is released.

Reviewed-by: review-1873-fill@shanks at 16331cdfdc

Issue 1873 (notes 8-10); the operator asked for a quick fix. After mesh-host #131 was delivered (22:44) ace still says 'ace's provisioner has failed to place the files of postgres since 20:12 UTC': the provisioner client marked a module to be filled again only when its write failed for want of the node-engine's socket (socketAbsent, issue 1165). postgres's fill failed with the old engine's own 'read /var/lib/mesh/postgres/superuser.secret: is a directory', so when the new engine made its socket at 22:42 the client never tried postgres again and kept repeating the old failure. - modules/mesh-provisioner-client: any failed fill marks the module to be filled again when a node-engine makes its socket again (a newer engine may write what the older could not). Only on a socket return, never on a timer; a later success clears the mark; a refill uses the secrets the client already holds (no new value, no rotation). - Test TestNatsAFillTheEngineFailedIsTriedWhenTheSocketReturns (integration) failed first in try build-1792702425726840831; try build-1792702581889442897 PASS. What the operator sees after delivery: mesh-provisioner-client restarts on every machine and fills every module; on ace postgres's superuser.secret is written through the node-engine of #131, which replaces the empty directory the container runtime left, and the condition 'ace is not applying its update' should clear. Then novox's held postgres move is released. Reviewed-by: review-1873-fill@shanks at 16331cdfdce607063c6ad693a353bfb0679f7067

mesh-tools added 2 commits 2026-10-22 21:01:38 +00:00

Test that a fill the node-engine failed is tried again when its socket returns (issue 1873) ab3722d3b3

Fill a module again when the node-engine's socket returns after any failed fill, not only one for want of the socket (issue 1873) ... 16331cdfdc

On ace postgres's fill of superuser.secret failed at 22:12 with the engine's own
"is a directory", what a container runtime had left at the path. The engine
delivered at 22:42 clears such a directory, but the client tried again only
modules whose fill had failed for want of the socket (issue 1165), so postgres
was never filled again and its old failure was said every 30 s. A newer engine
may write what the older could not: any failed fill is now tried again when a
node-engine makes its socket again.

mesh-tools commented 2026-10-22 21:01:49 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@16331cdfdce6 — delivered since 2026-10-22T21:23:53Z

Delivery plan — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step

• tier 0: mesh-provisioner-client
• ace: receives mesh-provisioner-client
• g14: receives mesh-provisioner-client
• novox: receives mesh-provisioner-client
• shanks: receives mesh-provisioner-client
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine

Machines

• mesh-provisioner-client on every machine running it: sent

Transitions

• 2026-10-22 21:01 (new) → proposed (announced): novox/mesh-catalog#455's head announced
• 2026-10-22 21:06 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-22 21:06 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-22 21:19 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-22 21:19 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-22 21:23 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@16331cdfdce6` — **delivered** since 2026-10-22T21:23:53Z **Delivery plan** — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step - tier 0: mesh-provisioner-client - ace: receives mesh-provisioner-client - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client - shanks: receives mesh-provisioner-client - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine **Machines** - mesh-provisioner-client on every machine running it: sent **Transitions** - 2026-10-22 21:01 (new) → proposed (announced): novox/mesh-catalog#455's head announced - 2026-10-22 21:06 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-22 21:06 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-22 21:19 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-22 21:19 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-22 21:23 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented 2026-10-22 21:06:30 +00:00

Author

Member

Copy Link

Copy Source

Merge check at 16331cdf
Judged: head 16331cdfdce6 merged into trunk 66c404fd39a5; read beside it: mesh-controller f2a4363a1a77, mesh-controller-main f2a4363a1a77, mesh-host 48c3e3834c69, mesh-tools e0fadc43d9dd

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step

• tier 0: mesh-provisioner-client
• ace: receives mesh-provisioner-client
• g14: receives mesh-provisioner-client
• novox: receives mesh-provisioner-client
• shanks: receives mesh-provisioner-client
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine
• read by no module's build: modules/mesh-provisioner-client/cmd/mesh-provisioner-client/socket_integration_test.go

Run by the build seat on ace as build-1792702902957543457 (builds --log build-1792702902957543457).

--- the gate: mesh-provisioner-client
mesh-provisioner-client: ok, ready: client by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T20:56:54Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-22T20:56:54Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client

notes:
  - modules/mesh-provisioner-client/cmd/mesh-provisioner-client/socket_integration_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 62035 strings of 959 files
ok  	git.novox.be/novox/mesh-catalog/checks/particulars	0.006s
particulars: none of 4 node names in the 2 covered modules
ok  	git.novox.be/novox/mesh-catalog/checks/toolchains	0.010s
toolchains: go, nodejs, npm and buildah are declared only by their owners
ok  	git.novox.be/novox/mesh-catalog/checks/imagebuild	0.009s
imagebuild: rootless-image-build is provided only by buildah
ok  	git.novox.be/novox/mesh-catalog/checks/imageplace	0.010s
imageplace: every image builds from a Dockerfile in its own module's directory
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.014s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.008s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.017s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.024s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.013s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.279s
predefined.json: 3 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.014s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.011s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.005s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 58, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.309s
testing modules/mesh-provisioner-client
ok  	mesh-provisioner-client/cmd/mesh-provisioner-client	22.609s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `16331cdf` Judged: head `16331cdfdce6` merged into trunk `66c404fd39a5`; read beside it: mesh-controller `f2a4363a1a77`, mesh-controller-main `f2a4363a1a77`, mesh-host `48c3e3834c69`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-provisioner-client) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-provisioner-client → ace, g14, novox, shanks; no bus step - tier 0: mesh-provisioner-client - ace: receives mesh-provisioner-client - g14: receives mesh-provisioner-client - novox: receives mesh-provisioner-client - shanks: receives mesh-provisioner-client - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-provisioner-client is judged on its first machine - read by no module's build: modules/mesh-provisioner-client/cmd/mesh-provisioner-client/socket_integration_test.go Run by the build seat on ace as `build-1792702902957543457` (`builds --log build-1792702902957543457`). ``` --- the gate: mesh-provisioner-client mesh-provisioner-client: ok, ready: client by unit every 30s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T20:56:54Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-22T20:56:54Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-provisioner-client notes: - modules/mesh-provisioner-client/cmd/mesh-provisioner-client/socket_integration_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 62035 strings of 959 files ok git.novox.be/novox/mesh-catalog/checks/particulars 0.006s particulars: none of 4 node names in the 2 covered modules ok git.novox.be/novox/mesh-catalog/checks/toolchains 0.010s toolchains: go, nodejs, npm and buildah are declared only by their owners ok git.novox.be/novox/mesh-catalog/checks/imagebuild 0.009s imagebuild: rootless-image-build is provided only by buildah ok git.novox.be/novox/mesh-catalog/checks/imageplace 0.010s imageplace: every image builds from a Dockerfile in its own module's directory ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.014s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.008s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.017s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.024s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's ok git.novox.be/novox/mesh-catalog/checks/secrets 0.013s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.279s predefined.json: 3 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.014s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.011s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.005s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 58, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.309s testing modules/mesh-provisioner-client ok mesh-provisioner-client/cmd/mesh-provisioner-client 22.609s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit 48dd41db91 into main 2026-10-22 21:19:10 +00:00

mesh-tools deleted branch fix/1873-fill-path 2026-10-22 21:19:10 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#455