Make the catalogue's tests pass in the build sandbox, and give the integration level the installed Node toolchain read-only (issue 1891, ADR 0533) #459

2026-10-23T09:46:08Z

mesh-tools commented

2026-10-23 09:46:08 +00:00

Issue 1891: since R4e the forge requires mesh/check, which runs every catalogue test inside the build modules' sandbox; several tests read the machine and failed there, hidden behind first-failure verdicts, so no mesh-catalog pull request can pass (the issue 1839 group #458 among them).

Test fixes (self-contained in the sandbox, not weakened): logrotate TestTheBaseParses, pacman's pacman-conf test, ssh-client's SSH_AUTH_SOCK test; gitea's strict tsc types (pulls.ts, trunk.ts: string[] | null, emitted JS unchanged); gitea, minio and mosquitto test scripts compile/build what their tests import.

ADR 0533 (accepted, the operator's option 1): mesh-build-go mounts /var/lib/mesh-build-node-cache/toolchain read-only into the integration level only (still no network); mesh-build-node's cache 0711 and its toolchain folders opened read-only to other accounts (npm download cache stays 0700; the install's registry credential is written in the account's home, 0600, removed before anything is opened; open refuses a folder holding one); the five mesh-build-node integration tests copy the installed toolchain of the change's lock instead of npm ci (else the last installed, logging NOT THIS LOCK).

This pull request cannot pass its own mesh/check: the build modules installed on the nodes judge it and do not mount the toolchain yet (try-1792747332922483594: unit level 4461 passed; integration fails only on the five). The operator merges it once at the forge; after its delivery mesh/check works for every catalogue change.

Tests seen failing first; unit suites and vet (with and without the integration and isolation tags) green; reproduced in bubblewrap with the level's mounts.

Reviewed-by: review-1891-all@shanks at a2e5a20f52

Issue 1891: since R4e the forge requires mesh/check, which runs every catalogue test inside the build modules' sandbox; several tests read the machine and failed there, hidden behind first-failure verdicts, so no mesh-catalog pull request can pass (the issue 1839 group #458 among them). Test fixes (self-contained in the sandbox, not weakened): logrotate TestTheBaseParses, pacman's pacman-conf test, ssh-client's SSH_AUTH_SOCK test; gitea's strict tsc types (pulls.ts, trunk.ts: string[] | null, emitted JS unchanged); gitea, minio and mosquitto test scripts compile/build what their tests import. ADR 0533 (accepted, the operator's option 1): mesh-build-go mounts /var/lib/mesh-build-node-cache/toolchain read-only into the integration level only (still no network); mesh-build-node's cache 0711 and its toolchain folders opened read-only to other accounts (npm download cache stays 0700; the install's registry credential is written in the account's home, 0600, removed before anything is opened; open refuses a folder holding one); the five mesh-build-node integration tests copy the installed toolchain of the change's lock instead of npm ci (else the last installed, logging NOT THIS LOCK). This pull request cannot pass its own mesh/check: the build modules installed on the nodes judge it and do not mount the toolchain yet (try-1792747332922483594: unit level 4461 passed; integration fails only on the five). The operator merges it once at the forge; after its delivery mesh/check works for every catalogue change. Tests seen failing first; unit suites and vet (with and without the integration and isolation tags) green; reproduced in bubblewrap with the level's mounts. Reviewed-by: review-1891-all@shanks at a2e5a20f52ed765c7e0609a44a3e5e80df2893f7

mesh-tools added 9 commits 2026-10-23 09:46:08 +00:00

logrotate: dry-run the base against logs of its own, so the shut-off unit level does not stat the machine's /var/log (issue 1891) b1d875410a

The unit level runs in bubblewrap, where /var/log is not there; the base's
/var/log/wtmp block has no missingok, so logrotate -d failed its stat and
every mesh-catalog check that reached this test failed.

pacman, ssh-client: tests read nothing of the machine, so the unit level passes shut off and on a desk (issue 1891) f9247342d1

pacman-conf proved the shipped pacman.conf through its Include of
/etc/pacman.d/mirrorlist, which the shut-off unit level does not have: the
proven file now reads a mirror list of its own, and a guard test holds that
every repository of the shipped file includes the list reflector writes.

ssh-client's Test case for a run without an agent read the account's
SSH_AUTH_SOCK, so it failed on any desk with an agent: it now sets its own,
and also proves the environment's agent is the one reported.

gitea: take a rule's null contexts as the forge's type says, so the strict build the checker runs compiles (issue 1891) dc96d7c2dd

The checker builds a package with a build script by its tsconfig (strict),
where requiredOf and TrunkForge's appliedProtection said
status_check_contexts is string[] and BranchProtection says string[] | null:
four TS2345 errors, hidden on main behind earlier failures. Types only; the
emitted code is the same, and a test holds that null contexts require nothing.

gitea, minio, mosquitto: tests run as the Node build module runs them, tsc -p . then npm test (issue 1891) 437c524b81

The old TypeScript check compiled every source beside itself, and into
dist/, before it ran the tests; mesh-build-node runs `tsc -p .` (these
tsconfigs say noEmit) and then the package's test script, so:

- gitea and minio: the tests import the .ts sources, which import each
  other as ./x.js. A resolve hook in test/ resolves such an import, when no
  .js is there, to the .ts beside it and compiles it with the toolchain's
  TypeScript (gitea's sources use parameter properties, which type
  stripping refuses). 57 of gitea's tests and minio's links test failed.
- mosquitto: its ctrl test imports ../dist/client.js; its test script now
  builds first, as gitea's does.

Test scripts and a test helper only; what is built and delivered is the same.

gitea, minio: compile the sources beside themselves in the test script, as the old check did (issue 1891) 933370df7c

The resolve hook needed the typescript package, which mesh-build-node keeps
out of the workspace (notCopied): tsc is reached only as the bin/tsc
command. So the test scripts now do what merge-check-typescript.sh did
before the tests: tsc over the module's sources with --outDir ., so the
sources' ./x.js imports resolve. The emitted .js is ignored by git.

Give the integration level the node's installed Node toolchains read-only, so the Node build module's tests build offline (issue 1891, ADR 0533) 00e54d46d7

mesh-build-go binds /var/lib/mesh-build-node-cache/toolchain read-only into the
integration level's one shut-off process when it is there; the unit level never.
mesh-build-node opens its installed toolchains to other accounts (folders 0755,
files 0644, writable by its owner alone; its cache 0711, so the npm cache beside
them stays its own), and realMachine copies the toolchain of its own lock from
there instead of npm ci from the registry, which the level cannot reach.

realMachine: a change carrying a lock no release has installed runs with the toolchain installed last, and says so, so a lock change is not refused by its own check (issue 1891, ADR 0533 §3) 2ebcb18097

mesh-build-node: prove the npm download cache beside the toolchains stays its owner's (ADR 0533 §2) 845479d7cd

mesh-build-node: write the install's registry credential in the account's home, never beneath the opened cache, and refuse to open a toolchain holding one (issue 1891 review, ADR 0533 §2)

mesh/delivery failed: its walk failed, carrying its own commit: a gate on a first machine (what it carried put back), a build, a machine

Details

mesh/check failed: integration: meshbuildnode/cmd/mesh-build-node.TestAFixtureBundleBuiltTwiceHasOneDigest: build_integration_test.go:71: no toolchain…

a2e5a20f52

mesh-tools commented

2026-10-23 09:46:16 +00:00

Delivery novox/mesh-catalog@a2e5a20f52ed — failed since 2026-10-23T09:51:39Z

Delivery plan — builds gitea, mesh-build-go, mesh-build-node, minio, mosquitto, ssh-client → ace, g14, novox, shanks; no bus step; 1 wait(s) for a person

tier 0: gitea, mesh-build-go, mesh-build-node, minio, mosquitto, ssh-client
ace: receives mosquitto, ssh-client
g14: receives mesh-build-go, mesh-build-node, ssh-client
novox: receives gitea, mesh-build-go, mesh-build-node, ssh-client; waits for a person: minio
shanks: receives mesh-build-go, mesh-build-node, ssh-client
gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
gitea keeps data (ADR 0233): what it holds is backed up before it moves
minio waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
minio provides s3-bucket: its consumers are sent again after it
minio keeps data (ADR 0233): what it holds is backed up before it moves
mosquitto provides mqtt-topic: its consumers are sent again after it
mosquitto keeps data (ADR 0233): what it holds is backed up before it moves
ssh-client keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go, mesh-build-node, mosquitto, ssh-client is judged on its first machine

Transitions

2026-10-23 09:46 (new) → proposed (announced): novox/mesh-catalog#459's head announced
2026-10-23 09:48 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on
2026-10-23 09:49 held → delivering (release): the operator merged #459 by hand at the forge at 11:48 knowing its mesh/check could not pass (the installed build modules judge it; issue 1891, ADR 0533) and that its delivery follows; reviewed in two rounds (review-1891-all at a2e5a20f)
2026-10-23 09:51 delivering → failed (failed): its walk failed, carrying its own commit: a gate on a first machine (what it carried put back), a build, a machine

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@a2e5a20f52ed` — **failed** since 2026-10-23T09:51:39Z **Delivery plan** — builds gitea, mesh-build-go, mesh-build-node, minio, mosquitto, ssh-client → ace, g14, novox, shanks; no bus step; 1 wait(s) for a person - tier 0: gitea, mesh-build-go, mesh-build-node, minio, mosquitto, ssh-client - ace: receives mosquitto, ssh-client - g14: receives mesh-build-go, mesh-build-node, ssh-client - novox: receives gitea, mesh-build-go, mesh-build-node, ssh-client; waits for a person: minio - shanks: receives mesh-build-go, mesh-build-node, ssh-client - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves - minio waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - minio provides s3-bucket: its consumers are sent again after it - minio keeps data (ADR 0233): what it holds is backed up before it moves - mosquitto provides mqtt-topic: its consumers are sent again after it - mosquitto keeps data (ADR 0233): what it holds is backed up before it moves - ssh-client keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-go, mesh-build-node, mosquitto, ssh-client is judged on its first machine **Transitions** - 2026-10-23 09:46 (new) → proposed (announced): novox/mesh-catalog#459's head announced - 2026-10-23 09:48 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on - 2026-10-23 09:49 held → delivering (release): the operator merged #459 by hand at the forge at 11:48 knowing its mesh/check could not pass (the installed build modules judge it; issue 1891, ADR 0533) and that its delivery follows; reviewed in two rounds (review-1891-all at a2e5a20f) - 2026-10-23 09:51 delivering → failed (failed): its walk failed, carrying its own commit: a gate on a first machine (what it carried put back), a build, a machine The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben merged commit 6c0024e43b into main

2026-10-23 09:48:23 +00:00

jschoubben deleted branch fix/logrotate-base-parses

2026-10-23 09:48:24 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#459