novox/mesh-catalog
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

messenger and dunst: only acknowledgements from a desk click, one-time answer tokens (hq ADR 0258, issue 324) #131

Merged
mesh-admin merged 2 commits from fix/notifications-after-review into main 2026-10-08 13:02:26 +00:00
Conversation 3 Commits 2 Files Changed 19
+675 -137
mesh-admin commented 2026-10-08 12:40:14 +00:00
Contributor
Copy Link
Copy Source

Fix forward of #126 after review, before its build (541b24d9) goes out.

messenger

  • Explicit allow-list answerable: a desk click performs only Details and Silence for a week (mesh-controller.conditions silence, cause operator-answer). Everything else is never offered; a token for one is refused without a call. Manifest no longer invokes release/stop/plans/restart.
  • Tokens: made per message, bound to the machines it was shown on (Sent[desktop]), good for 24 h, single use, refused for cleared or silenced conditions; Chosen acts once per event id (x-event-id); the machine is the event's node. A refused answer is shown on the desk where it was chosen.
  • Why says "a desk click: whoever was at the operator's session", not "the operator chose".
  • Quiet rule: a change of words to Needs is said via the event and via sync; a quiet warning is said once after 24 h.
  • Notifications with answers are sent with expire_ms 0; on dunst.started the open notifications with answers are re-offered with fresh tokens.
  • time/tzdata embedded.

dunst: answers never expire unless asked; the bundle emits started {machine} once it serves. Checked live on the laptop: notify-send --print-id --wait writes the id into a pipe at once (and "Wait timeout expired" on expiry, which is not a token).

Tests: answers_test.go (allow-list and forged token, 4-answer limit, same token twice, event once, other machine, unknown, expired, silenced, cleared, refused verb, words-only change via event and sync, quiet reminder, re-offer after restart), words_test.go updated, dunst actions_test.go. merge-check.sh (both modules, race) passes.

Group: novox/hq and novox/mesh-controller fix/notifications-after-review. Do not merge without the operator.

Fix forward of #126 after review, before its build (541b24d9) goes out. **messenger** - Explicit allow-list `answerable`: a desk click performs only Details and Silence for a week (`mesh-controller.conditions silence`, cause `operator-answer`). Everything else is never offered; a token for one is refused without a call. Manifest no longer invokes release/stop/plans/restart. - Tokens: made per message, bound to the machines it was shown on (`Sent[desktop]`), good for 24 h, single use, refused for cleared or silenced conditions; `Chosen` acts once per event id (`x-event-id`); the machine is the event's node. A refused answer is shown on the desk where it was chosen. - Why says "a desk click: whoever was at the operator's session", not "the operator chose". - Quiet rule: a change of words to Needs is said via the event and via sync; a quiet warning is said once after 24 h. - Notifications with answers are sent with `expire_ms` 0; on `dunst.started` the open notifications with answers are re-offered with fresh tokens. - `time/tzdata` embedded. **dunst**: answers never expire unless asked; the bundle emits `started` {machine} once it serves. Checked live on the laptop: `notify-send --print-id --wait` writes the id into a pipe at once (and "Wait timeout expired" on expiry, which is not a token). Tests: `answers_test.go` (allow-list and forged token, 4-answer limit, same token twice, event once, other machine, unknown, expired, silenced, cleared, refused verb, words-only change via event and sync, quiet reminder, re-offer after restart), `words_test.go` updated, dunst `actions_test.go`. `merge-check.sh` (both modules, race) passes. Group: novox/hq and novox/mesh-controller `fix/notifications-after-review`. Do not merge without the operator.
mesh-admin added 1 commit 2026-10-08 12:40:15 +00:00
Take only acknowledgements from a desk click, and make each answer a one-time ticket
mesh/merge-gate pass: builds dunst, messenger → g14, novox, shanks; no bus step; every machine composes with the change as it did without (4 of 4 compose)
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery-group group fix/notifications-after-review ready: every member ready, and composed together they pass
Details
mesh/delivery superseded: a newer head of the same pull request
Details
d83711f11e 
Review found that any process of the operator's account can choose a dunst action,
so a click could release or stop a delivery in the operator's name; that tokens
lived for ever; that a warning's answers died in ten seconds; and that a restarted
notifier left dead buttons (hq ADR 0258).
mesh-admin commented 2026-10-08 12:40:44 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-catalog@700dd7fa1abd — delivered since 2026-10-08T13:18:58Z

Delivery plan — builds dunst, messenger → g14, novox, shanks; no bus step

  • tier 0: dunst, messenger
  • g14: receives dunst
  • novox: receives messenger
  • shanks: receives dunst

Group fix/notifications-after-review, in order: novox/hq@3bfedcfa15 → novox/mesh-controller@76cfbac7a1 → novox/mesh-catalog@700dd7fa1a

Machines

  • build-agent on ace: passed — carried by plan-1791464570239417964
  • route-proxy on ace: passed — carried by plan-1791464570239417964
  • dunst on g14: passed — healthy 3 times over 2m39s
  • messenger on novox: passed — healthy 3 times over 2m26s
  • dunst on the rest running it: sent
  • messenger on the rest running it: sent

Transitions

  • 2026-10-08 12:53 (new) → proposed (announced): novox/mesh-catalog#131's head announced
  • 2026-10-08 12:56 proposed → checked (checked): the verdict names this commit
  • 2026-10-08 12:56 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-08 13:02 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-08 13:15 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
  • 2026-10-08 13:18 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@700dd7fa1abd` — **delivered** since 2026-10-08T13:18:58Z **Delivery plan** — builds dunst, messenger → g14, novox, shanks; no bus step - tier 0: dunst, messenger - g14: receives dunst - novox: receives messenger - shanks: receives dunst **Group** `fix/notifications-after-review`, in order: novox/hq@3bfedcfa1561 → novox/mesh-controller@76cfbac7a1eb → novox/mesh-catalog@700dd7fa1abd - novox/mesh-controller@76cfbac7a1eb before novox/mesh-catalog@700dd7fa1abd: built by - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - build-agent on ace: passed — carried by plan-1791464570239417964 - route-proxy on ace: passed — carried by plan-1791464570239417964 - dunst on g14: passed — healthy 3 times over 2m39s - messenger on novox: passed — healthy 3 times over 2m26s - dunst on the rest running it: sent - messenger on the rest running it: sent **Transitions** - 2026-10-08 12:53 (new) → proposed (announced): novox/mesh-catalog#131's head announced - 2026-10-08 12:56 proposed → checked (checked): the verdict names this commit - 2026-10-08 12:56 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-08 13:02 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-08 13:15 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-08 13:18 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-admin commented 2026-10-08 12:43:04 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at d83711f1

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: dunst, messenger)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds dunst, messenger → g14, novox, shanks; no bus step

  • tier 0: dunst, messenger
  • g14: receives dunst
  • novox: receives messenger
  • shanks: receives dunst

Run by the build seat on novox as build-1791463238347415563 (builds --log build-1791463238347415563).

--- the gate: dunst, messenger
dunst: ok, 5 tool(s)
messenger: ok, 4 tool(s), invokes seat:node-notifier.send, seat:mesh-controller.conditions, keeps state open, sent
long-running resources without health: 0
2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T12:31:31Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-08T12:31:31Z

modules the change moves:
  - dunst (changed)
  - messenger (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 2 module(s) in 1 tier(s): dunst, messenger
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 29826 strings of 548 files
long-running resources without health: 70, as kept
testing modules/dunst
ok  	dunst/cmd/dunst-tools	3.090s
testing modules/messenger
ok  	messenger/cmd/messenger	1.467s
**Merge check** at `d83711f1` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: dunst, messenger) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds dunst, messenger → g14, novox, shanks; no bus step - tier 0: dunst, messenger - g14: receives dunst - novox: receives messenger - shanks: receives dunst Run by the build seat on novox as `build-1791463238347415563` (`builds --log build-1791463238347415563`). ``` --- the gate: dunst, messenger dunst: ok, 5 tool(s) messenger: ok, 4 tool(s), invokes seat:node-notifier.send, seat:mesh-controller.conditions, keeps state open, sent long-running resources without health: 0 2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T12:31:31Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-08T12:31:31Z modules the change moves: - dunst (changed) - messenger (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 2 module(s) in 1 tier(s): dunst, messenger --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 29826 strings of 548 files long-running resources without health: 70, as kept testing modules/dunst ok dunst/cmd/dunst-tools 3.090s testing modules/messenger ok messenger/cmd/messenger 1.467s ```
jschoubben added 1 commit 2026-10-08 12:53:14 +00:00
Load the records the live build kept, remind every quiet warning, silence only its own condition
mesh/merge-gate pass: builds dunst, messenger → g14, novox, shanks; no bus step; every machine composes with the change as it did without (4 of 4 compose)
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
mesh/delivery-group group fix/notifications-after-review merged: every member is merged
Details
700dd7fa1a 
The build live since 14:38 keeps tokens as token -> index; reading them as grants
failed and skipped the record. A quiet warning known from history was never
reminded, and an answer could silence another condition than its own.
mesh-admin commented 2026-10-08 12:56:07 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at 700dd7fa

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: dunst, messenger)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds dunst, messenger → g14, novox, shanks; no bus step

  • tier 0: dunst, messenger
  • g14: receives dunst
  • novox: receives messenger
  • shanks: receives dunst

Run by the build seat on shanks as build-1791463995961151174 (builds --log build-1791463995961151174).

--- the gate: dunst, messenger
dunst: ok, 5 tool(s)
messenger: ok, 4 tool(s), invokes seat:node-notifier.send, seat:mesh-controller.conditions, keeps state open, sent
long-running resources without health: 0
2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T12:46:24Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-08T12:46:24Z

modules the change moves:
  - dunst (changed)
  - messenger (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 2 module(s) in 1 tier(s): dunst, messenger
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 29827 strings of 548 files
long-running resources without health: 70, as kept
testing modules/dunst
ok  	dunst/cmd/dunst-tools	3.048s
testing modules/messenger
ok  	messenger/cmd/messenger	1.448s
**Merge check** at `700dd7fa` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: dunst, messenger) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds dunst, messenger → g14, novox, shanks; no bus step - tier 0: dunst, messenger - g14: receives dunst - novox: receives messenger - shanks: receives dunst Run by the build seat on shanks as `build-1791463995961151174` (`builds --log build-1791463995961151174`). ``` --- the gate: dunst, messenger dunst: ok, 5 tool(s) messenger: ok, 4 tool(s), invokes seat:node-notifier.send, seat:mesh-controller.conditions, keeps state open, sent long-running resources without health: 0 2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T12:46:24Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-08T12:46:24Z modules the change moves: - dunst (changed) - messenger (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 2 module(s) in 1 tier(s): dunst, messenger --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 29827 strings of 548 files long-running resources without health: 70, as kept testing modules/dunst ok dunst/cmd/dunst-tools 3.048s testing modules/messenger ok messenger/cmd/messenger 1.448s ```
mesh-admin merged commit ea462666cc into main 2026-10-08 13:02:26 +00:00
mesh-admin deleted branch fix/notifications-after-review 2026-10-08 13:02:26 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-catalog#131