One rule for whether a plan hands its module, so no part reads a provisions-only plan as handed (issue 774) #574

2026-10-30T23:02:30Z

mesh-tools commented

2026-10-30 23:02:30 +00:00

Issue 774 (L3). Thorough fix of the kind behind the 23:33 provisions group fault (22 modules could not compose; quick fix mesh-catalog #573 merged 00:00): parts read "a plan exists" as "the module is handed", and since mesh-sdk 125bb91 the provisioner keeps provisions-only plans (a route) for modules it does not hand.

Group fix/plan-hands, merge order mesh-sdk first:

mesh-sdk: catalogue.Plan.Hands(): a plan hands its module when it names a template source, a file, a secret or an item; table cases in the existing keyed test.
mesh-catalog: mesh-vault readers asking "is it handed" call Hands (own, get, pair.go readBindings/716/732/814/830); readers that only bind stay on plan existence, marked "binds, not handing"; mesh-provisioner-client planOf treats a non-handing plan as no plan (it refused every route-only plan live); new catalogue check checks/planhands refuses a line testing Provisioning ==/!= nil unless it asks Hands or says "not handing" (reads-outside lists modules). Both modules pin mesh-sdk 17fc9b9 exactly.

Quick vs thorough: quick was the vault-only rule (#573, blocking fault). This is the thorough fix: one shared rule in mesh-sdk, every reader on it, and a catalogue check that refuses a new reader testing plan existence. Second time this week two parts disagreed about what a plan means (fix-a-bug-met-twice).

Tests: gofmt, go vet (both tags), go test -count=1 with GOWORK=off in mesh-vault, mesh-provisioner-client, checks/planhands, mesh-sdk go/catalogue. No new test functions beyond the check's one.

Reviewed-by: rev-hands@shanks at 6bd3da7736

Issue 774 (L3). Thorough fix of the kind behind the 23:33 provisions group fault (22 modules could not compose; quick fix mesh-catalog #573 merged 00:00): parts read "a plan exists" as "the module is handed", and since mesh-sdk 125bb91 the provisioner keeps provisions-only plans (a route) for modules it does not hand. Group fix/plan-hands, merge order mesh-sdk first: - mesh-sdk: catalogue.Plan.Hands(): a plan hands its module when it names a template source, a file, a secret or an item; table cases in the existing keyed test. - mesh-catalog: mesh-vault readers asking "is it handed" call Hands (own, get, pair.go readBindings/716/732/814/830); readers that only bind stay on plan existence, marked "binds, not handing"; mesh-provisioner-client planOf treats a non-handing plan as no plan (it refused every route-only plan live); new catalogue check checks/planhands refuses a line testing Provisioning ==/!= nil unless it asks Hands or says "not handing" (reads-outside lists modules). Both modules pin mesh-sdk 17fc9b9 exactly. Quick vs thorough: quick was the vault-only rule (#573, blocking fault). This is the thorough fix: one shared rule in mesh-sdk, every reader on it, and a catalogue check that refuses a new reader testing plan existence. Second time this week two parts disagreed about what a plan means (fix-a-bug-met-twice). Tests: gofmt, go vet (both tags), go test -count=1 with GOWORK=off in mesh-vault, mesh-provisioner-client, checks/planhands, mesh-sdk go/catalogue. No new test functions beyond the check's one. Reviewed-by: rev-hands@shanks at 6bd3da773683a5908d0a98f2bca17508b4167022

mesh-tools added 3 commits 2026-10-30 23:02:30 +00:00

Ask mesh-sdk's Plan.Hands wherever the vault and the provisioner client judge a module handed, and refuse in the catalogue check any line that takes a plan existing for it, so a plan of provisions alone never again withholds a module's secrets (issue 774) 3c3d018dbc

Pin mesh-sdk 17fc9b9 in mesh-vault and mesh-provisioner-client for Plan.Hands, and say what providerPlan answers now that a plan of provisions alone exists (issue 774) 1b0c09763e

Read every module whole for the plan-hands check, so its verdict follows their source, and judge a shared value's consumer by whether its plan hands it; leave mesh-provisioner out of the group (review round 1, issue 774)

mesh/delivery merged: source.main moved to novox/mesh-catalog@d412991c6992

Details

mesh/delivery-group group fix/plan-hands merged: every member is merged

Details

mesh/check being carried to 6bd3da773683 on ca48943b925a | from mesh-sdk 125bb9177189 | novox/mesh-catalog#574 in group fix/plan-hands

6bd3da7736

mesh-tools commented

2026-10-30 23:02:32 +00:00

Delivery novox/mesh-catalog@6bd3da773683 — merged since 2026-10-30T23:19:01Z

Source — source.main moved to novox/mesh-catalog@d412991c69. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group fix/plan-hands: novox/mesh-catalog@6bd3da7736, novox/mesh-sdk@17fc9b9b81

composed together: pass — the checker's verdict at the members' heads (cf7063063ec0)

Transitions

2026-10-30 23:02 (new) → proposed (announced): novox/mesh-catalog#574's head announced
2026-10-30 23:02 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-30 23:19 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@6bd3da773683` — **merged** since 2026-10-30T23:19:01Z **Source** — source.main moved to novox/mesh-catalog@d412991c6992. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `fix/plan-hands`: novox/mesh-catalog@6bd3da773683, novox/mesh-sdk@17fc9b9b8115 - composed together: pass — the checker's verdict at the members' heads (cf7063063ec0) **Transitions** - 2026-10-30 23:02 (new) → proposed (announced): novox/mesh-catalog#574's head announced - 2026-10-30 23:02 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-30 23:19 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit d412991c69 into main

2026-10-30 23:19:00 +00:00

mesh-tools deleted branch fix/plan-hands

2026-10-30 23:19:00 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#574