Modules without the controller: vault judges each sensitive caller, nox records its hand acts, provisioner binds ahead of the want (issue 1126 group B) #594

2026-11-02T11:31:17Z

mesh-tools commented

2026-11-02 11:31:17 +00:00

Issue 1126 (remove the controller), delivery group feat/1126-removal: mesh-sdk, mesh-delivery, mesh-catalog, mesh-host, mesh-tools, mesh-networking. Decision: ADR 0590 (the controller ends by its unassignment; each sensitive vault verb judges its own caller). Also folds in mesh-catalog #593's commits and the fixes of issues 1748, 1926, 1930.

Tests: offline untagged suites of every module against mesh-sdk abf5eac, go vet -tags integration, the bus removal integration test; see the review record.

Reviewed-by: review-1126@shanks at fa6dc3a48b

https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Issue 1126 (remove the controller), delivery group feat/1126-removal: mesh-sdk, mesh-delivery, mesh-catalog, mesh-host, mesh-tools, mesh-networking. Decision: ADR 0590 (the controller ends by its unassignment; each sensitive vault verb judges its own caller). Also folds in mesh-catalog #593's commits and the fixes of issues 1748, 1926, 1930. Tests: offline untagged suites of every module against mesh-sdk abf5eac, go vet -tags integration, the bus removal integration test; see the review record. Reviewed-by: review-1126@shanks at fa6dc3a48b0c687cdcbd39255d50673bf1c6d950 https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools added 25 commits 2026-11-02 11:31:17 +00:00

Make the controller checks strict: nothing names the placed-nowhere controller 0bfc72d230

controllerdeps refuses any manifest naming the controller's seat, states or
buckets, the lease and the entries once kept to its write among them, and
any module file naming one of its buckets (ADR 0590 §5). The words check
refuses a controller address in any text a module shows. The handacts check
and noplacement's list of assignments readers are folded into it (issue 1126 B10).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Let the bus tools remove the controller's leftovers by one word 40c4fabff6

The controller ended by its unassignment, so its consumers, streams and
buckets may be removed as recorded hand acts (ADR 0590 §6). The nats tools'
account declares controller-leftovers in place of the lease write's two
words, and the removal test proves a consumer of EVENTS and a bucket's
stream go while EVENTS and its other consumers stay (issue 1126 B5).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Point messenger, mesh-watcher, restic and mesh-issues away from the controller e009088150

The controller is not placed (ADR 0590): messenger no longer treats it as
a condition owner or a walk's subject, mesh-watcher reads only where the bus
runs, restic tells the operator to compose the machine or set config through
the seats that do it now, and mesh-issues' examples name a placed repository.
mesh-issues keeps mesh-controller among its owners: issues located there,
issue 1126 among them, and route-proxy until it moves, still name it
(issue 1126 B11).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Give mesh-mail-reader's two acceptance tests a due date a week from now, so they do not expire c4a6452f21

Both stand-in judges answered the fixed due date 2026-11-01; since 2026-11-02 00:00 UTC that date is past,
signalEntries drops the mail, no tell is sent, and both tests time out on every check that rebuilds the module
(met in the enrolment group's check of issue 774, 2026-11-02 02:50).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Read a go download failure as a pin on a pull request head only when go does not know the revision, so a network failure is retaken and says its own cause ab610ffed4

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Drop artifact-store-tools' controller client; the provisioner client reads placement b44e600e87

The controller is not placed and its assignments mirror is frozen (ADR
0590). artifact-store-tools already answers through the seat's holder, so
its controller client goes. mesh-provisioner-client reads the seat
mesh-placement's placement, which its account is granted whole: a module
placed here stays while the seat holds no plan of it, filled from its last
plan, and leaves only when neither names it (issue 1126 B12).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Let claude-code read its tools and machines from the bus, not the controller f723d4372f

The controller is not placed (ADR 0590), so its tools, modules, nodes and
node verbs answer nothing. claude-code now reads the seats' verbs from the
seats' contract, the placed modules' replaces from the indexer's manifests,
and the machines and where modules run from mesh-placement's placement; the
rendered instructions name the seats that own each job (issue 1126 B13).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Make each sensitive vault verb judge its own caller f83e6e4713

The controller judged the operator's account for approving or deleting a
retirement, rotating a secret and exporting sealed copies; it is not
placed, and these verbs are reached through the mesh MCP server on each
machine. Each now answers the operator's account (person.<name>), or a
caller naming its own recorded hand act for that verb and subject, and
nothing else (ADR 0590 §8, issue 1126).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Drop the keeper's and config's take-over verbs with the controller's sources a73b02ea30

mesh-sdk drops compare, take-over and hand-back from the keeper's and
config's seats (ADR 0590): there is no controller to compare with or hand
back to. mesh-conditions loses those verbs, its take-over key and asks;
mesh-config reads its own sources always and pull-declares is gone; and
mesh-hand-acts no longer names the controller's log (issue 1126).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Stop serving the vault's move-asks, which only the controller called f8e4c1b0ae

move-asks copied the controller's record of asks into the vault's once;
the controller is not placed (ADR 0590) and nothing else calls it. move-in
stays: the node-engine calls it. The drift test names the node's own
composition now that the controller composes for none (issue 1126).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Prove the bus tools' removals on the grant mesh-sdk composes e7b3fd470b

The removal test took a grant written by hand; it now composes it with
BusRemovalGrants for controller-leftovers and the node-engine's acts, so
it proves the mesh's own grant is enough and no wider (issue 1126 B5).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Point the nats README's bus upgrade at the assigner's put and mesh-wants, since the controller's bus verb ended 067117b8b8

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Drop mesh-conditions' use of operator-channel, since nothing in it asks the operator 4aa24ba013

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Pin mesh-sdk to the group head of issue 1126 70396caeab

Every member builds against mesh-sdk 729a86b, the head of feat/1126-removal, so the group is checked as one contract.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

End the self-check's bus-consumer probe, whose consumers were the controller's 344fc6f6bf

With the controller ended mesh-sdk defines no mesh consumer, so the probe judged none and always passed (issue 1126).
The account consumers are the grants part's, which now says their differences and delays as conditions of its own;
the probe's three kinds are carried as ended in mesh-conditions' table.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

nox records the hand act a sensitive vault verb is warranted by 0f0ec66e9a

Each sensitive vault verb judges its own caller, and nox reaches the vault
as its machine's runtime, never as a person, so it could use none of them.
Before rotate, retire approve, cleanup delete and secret export nox records
the act through mesh-hand-acts (the vault verb as its verb, what it acts on
as its what) and names it as act; a refused recording calls the vault not at
all (ADR 0590 §8, issue 1126 review 1).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Let one hand act warrant a retirement of several consumers 9e9877e6ec

mesh-hand-acts records one what per act, so an approve of two consumers
could never be warranted. The judge reads each word of the act's what as a
name, and nox records one act listing the consumers (issue 1126 review 1).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

End healers H3 and H4 and the bus-health probe's consumer half with the controller 3ed3266dde

Nobody raises a lost or a far-behind consumer since the self-check's bus-consumer probe ended (issue 1126): the grants
part makes a missing account consumer itself and says one far behind as mesh-grants.consumer-behind, and H4's repair
was the controller's. The mesh defines no consumer of its own, so H-bus's consumer half judged nothing.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Privilege no caller named controller in the vault; match a hand act's verb exactly ecc7621274

The controller is not placed (ADR 0590), yet the vault still answered a
caller named controller alone (accept), took its relay of who asked
(secret-ask, rotate's by) and sealed it the core's credentials. Those
branches and accept go with their tests; a node's account alone is never
minted or rotated here. The sensitive-verb judge now needs the act's verb to
be the vault's own, mesh-vault.<verb>, not any verb ending so (issue 1126
review 1).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Key each provision with the plan entry it is composed from fda81c129e

mesh-provisioner keys provisions from a consumer's wanted and newest builds
but writes the wanted build's plan alone, so a requirement the newest build
adds was never bound. Each key now carries its plan entry, and a key ahead of
its want says in its why that no plan names it yet and its provider binds it
from the entry (issue 1126 review 1).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Carry the plan entry only on a key no plan names 9a3ead8fcd

A reader on an older mesh-sdk refuses a provision field it does not know,
so a key a plan names carries no entry: such readers skip only a key ahead
of its consumer's want, which they could never bind (issue 1126 review 1).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Pin mesh-sdk to the group head of issue 1126 04379702e5

Every member builds against mesh-sdk f569924, the head of feat/1126-removal, so the group is checked as one contract.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Count nox's warrant acts for a vault verb as the operator's decisions 0ef81d85b3

nox records a hand act before each sensitive vault verb, with the verb's
address as its verb and cause operator; two in a fortnight raised a false
healer-wanted. mesh-healers reads those four verbs as decisions by design
(issue 1126 review 2).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Record no hand act for a cleanup that deletes nothing 067f2f4d61

nox cleanup delete without --confirm deletes nothing; the vault refuses it
for its missing confirm alone and judges only a confirmed delete, and nox
records the warranting act only for that one (issue 1126 review 2).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Pin mesh-sdk to the group head of issue 1126

mesh/delivery-group group feat/1126-removal rejected: composed together: the checker's verdict at the members' heads (a523066f1791): integration: meshbuildgo/c…

Details

mesh/delivery closed: a newer head of the same pull request

Details

mesh/check failed: integration: meshbuildgo/cmd/mesh-build-go… | 7f8701637f9d on 32c4c52261c4 | judged by the candidate's mesh-build-go at b82f7f676986

7f8701637f

Every member builds against mesh-sdk abf5eac, the head of feat/1126-removal, so the group is checked as one contract.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools commented

2026-11-02 11:31:39 +00:00

Delivery novox/mesh-catalog@fa6dc3a48b0c — merged since 2026-11-02T13:41:13Z

Source — source.main moved to novox/mesh-catalog@fe7c5ccb64. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group feat/1126-removal: novox/mesh-catalog@fa6dc3a48b, novox/mesh-delivery@e2cb398186, novox/mesh-host@049c3b8c11, novox/mesh-sdk@abf5eace77, novox/mesh-tools@e475d9f849

composed together: pass — the checker's verdict at the members' heads (f929346c4b40)

Transitions

2026-11-02 11:52 (new) → proposed (announced): novox/mesh-catalog#594's head announced
2026-11-02 11:52 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-02 13:41 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@fa6dc3a48b0c` — **merged** since 2026-11-02T13:41:13Z **Source** — source.main moved to novox/mesh-catalog@fe7c5ccb64bf. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `feat/1126-removal`: novox/mesh-catalog@fa6dc3a48b0c, novox/mesh-delivery@e2cb3981866e, novox/mesh-host@049c3b8c11c9, novox/mesh-sdk@abf5eace7791, novox/mesh-tools@e475d9f849ca - composed together: pass — the checker's verdict at the members' heads (f929346c4b40) **Transitions** - 2026-11-02 11:52 (new) → proposed (announced): novox/mesh-catalog#594's head announced - 2026-11-02 11:52 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-02 13:41 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

jschoubben added 2 commits 2026-11-02 11:52:22 +00:00

Decide a pin on a pull request head from the forge, not from go's words 7c5df1d7aa

The group's check has no name lookup, so go failed on the network before it
could say it knew no such revision, and the fetch, reading go's words, took
the asked head for a download failure. Whether a commit is a pull request's
head is now the forge's fact, asked whenever go cannot fetch it; go's words
only label a commit on no head (issue 1748, issue 1126 review 2).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Retake a pin whose forge listing failed, naming the forge's cause

mesh/delivery merged: source.main moved to novox/mesh-catalog@fe7c5ccb64bf

Details

mesh/delivery-group group feat/1126-removal merged: every member is merged

Details

mesh/check checking fa6dc3a48b0c on 32c4c52261c4 | novox/mesh-catalog#594 in group feat/1126-removal

fa6dc3a48b

When the forge's listing of pull request heads fails, the fetch now says it
as a download failure that may be retaken, so a forge outage is asked again
and not held as a refusal (issue 1748, issue 1126 review 3).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools commented

2026-11-02 11:52:39 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools commented

2026-11-02 12:55:48 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools commented

2026-11-02 13:19:41 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools merged commit fe7c5ccb64 into main

2026-11-02 13:40:54 +00:00

mesh-tools deleted branch feat/1126-removal

2026-11-02 13:40:55 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#594