mesh-vault: own answers a node within its bound — assignments from a watched mirror, one read per module, one synced record per answer (issue 1126) #545

2026-10-28T13:58:46Z

mesh-tools commented

2026-10-28 13:58:46 +00:00

Issue 1126 note 78. The seed-9 probe (mesh-catalog#544) saw ace and novox refuse their whole shadow answer: 'the vault's own could not be asked … context deadline exceeded'. novox asks 57 own secrets and 146 credentials. The vault read the controller's assignment over the bus once per value, listed every node's records, and synced one hand-out line per value under the lock every node shares, so it took 26 s against the node-engine's 15 s.

Quick vs thorough: quick was a longer VaultWithin in mesh-host; thorough, chosen, removes the cost in the vault, because it grows with every module and node:

WatchedAssignments: a watch of the assignments state (no poll), read from memory once caught up. Each attempt starts from an empty mirror and carries a number, so late deliveries to an older attempt are ignored; until it has caught up, reads go to the bus.
One read per module per answer (planReader); only own// is listed.
One synced write per answer (RecordHandings); a failed write hands out nothing.
A 'not on node' credential refusal is confirmed by a direct read first.
The seat contract is unchanged (no mesh-sdk change). VaultWithin stays at 15 s, so a slow vault still fails loudly.

Review: two rounds. Round 1 found that a watch begun again kept stale assignments; fixed with attempt numbers.
Tests: TestOwnReadsEachAssignmentOnceAndSyncsItsRecordOnce and TestTheWatchedAssignmentsAnswerWithoutTheBusOnceCaughtUp, each failing first; 119 unit tests (budget 500). go test -race passes.
Not a group: mesh-host#163-to-be (the shadow says what woke it) is independent.

Reviewed-by: rev-vault-own@shanks at a9d96b30be

Issue 1126 note 78. The seed-9 probe (mesh-catalog#544) saw ace and novox refuse their whole shadow answer: 'the vault's own could not be asked … context deadline exceeded'. novox asks 57 own secrets and 146 credentials. The vault read the controller's assignment over the bus once per value, listed every node's records, and synced one hand-out line per value under the lock every node shares, so it took 26 s against the node-engine's 15 s. Quick vs thorough: quick was a longer VaultWithin in mesh-host; thorough, chosen, removes the cost in the vault, because it grows with every module and node: - WatchedAssignments: a watch of the assignments state (no poll), read from memory once caught up. Each attempt starts from an empty mirror and carries a number, so late deliveries to an older attempt are ignored; until it has caught up, reads go to the bus. - One read per module per answer (planReader); only own/<node>/ is listed. - One synced write per answer (RecordHandings); a failed write hands out nothing. - A 'not on node' credential refusal is confirmed by a direct read first. The seat contract is unchanged (no mesh-sdk change). VaultWithin stays at 15 s, so a slow vault still fails loudly. Review: two rounds. Round 1 found that a watch begun again kept stale assignments; fixed with attempt numbers. Tests: TestOwnReadsEachAssignmentOnceAndSyncsItsRecordOnce and TestTheWatchedAssignmentsAnswerWithoutTheBusOnceCaughtUp, each failing first; 119 unit tests (budget 500). go test -race passes. Not a group: mesh-host#163-to-be (the shadow says what woke it) is independent. Reviewed-by: rev-vault-own@shanks at a9d96b30be8d89820eed67cb07092756f530de99

mesh-tools added 2 commits 2026-10-28 13:58:47 +00:00

mesh-vault answers own in one pass: assignments from its watch, each module's once, one synced record per answer (issue 1126) 277a4d0060

Seed-9's probe (13:31-13:36Z): novox's own of 57 secrets and 146 credentials took 26 s, past the node-engine's 15 s,
and ace and novox refused their whole shadow answer. own read the controller's assignment over the bus once per secret
and per credential (203 reads), read every record of every node, and synced the hand-out record once per value, under
the one lock every node's answers share.

Now the vault watches the assignments mirror (a watch, never a poll) and reads it from memory once caught up, over the
bus until then; one answer reads each module's assignment once; only own/<node>/ records are read; and every hand-out
of one answer is recorded in one synced write, none handed when it cannot be.

Quick fix weighed: a longer bound in the node-engine (VaultWithin). Thorough fix chosen: the cost grows with every
module and every node, and the lock is shared by every shadow answer and every apply.

mesh-vault: a watch of the assignments begun again keeps nothing an earlier attempt took, and a module the mirror lacks is read directly before a credential is refused (issue 1126, review round 1)

mesh/delivery merged: source.main moved to novox/mesh-catalog@85bbeb37e3e0

Details

mesh/delivery-group group fix/1126-vault-own merged: every member is merged

Details

mesh/check pass a9d96b30be8d on 69056948bfa8 | unit 1639 run, 4201 kept, 46 skipped | integration 1674 run, 4215 kept, 47 skipped | over bound: unit, …

a9d96b30be

A watch that failed partway kept what it had taken; begun again, the runtime does not hand a key deleted meanwhile, so
a removed assignment read as standing and credentialRefusal could hand a consumer credential to a node no longer
running its module. Each attempt now begins from nothing held, and a late delivery to an older attempt changes nothing.
A 'not on the node' refusal is confirmed by a direct read first, since a watched mirror can be behind.

mesh-tools commented

2026-10-28 13:58:50 +00:00

Delivery novox/mesh-catalog@a9d96b30be8d — merged since 2026-10-28T14:20:38Z

Source — source.main moved to novox/mesh-catalog@85bbeb37e3. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group fix/1126-vault-own: novox/mesh-catalog@a9d96b30be, novox/mesh-host@8bd0b5db15

composed together: pass — the checker's verdict at the members' heads (e56c5fb70f60)

Transitions

2026-10-28 13:58 (new) → proposed (announced): novox/mesh-catalog#545's head announced
2026-10-28 13:58 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-28 14:20 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@a9d96b30be8d` — **merged** since 2026-10-28T14:20:38Z **Source** — source.main moved to novox/mesh-catalog@85bbeb37e3e0. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `fix/1126-vault-own`: novox/mesh-catalog@a9d96b30be8d, novox/mesh-host@8bd0b5db15a3 - composed together: pass — the checker's verdict at the members' heads (e56c5fb70f60) **Transitions** - 2026-10-28 13:58 (new) → proposed (announced): novox/mesh-catalog#545's head announced - 2026-10-28 13:58 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-28 14:20 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 85bbeb37e3 into main

2026-10-28 14:20:36 +00:00

mesh-tools deleted branch fix/1126-vault-own

2026-10-28 14:20:36 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#545