claude-code: declare the account agents run as and claude-agent (hq ADR 0266) #141

Merged

mesh-admin merged 10 commits from feat/the-agent-account-is-declared into main 2026-10-09 21:59:39 +00:00

Conversation 12 Commits 10 Files Changed 29

+2031 -114

mesh-admin commented 2026-10-08 18:04:04 +00:00

Contributor

Copy Link

Copy Source

Built on #140 and contains its commit; merge #140 first.

• A user resource named ${machine:agent-account}, with root: ${machine:agent-root}. Where the node names an agent account, the mesh creates it and the node-engine judges it unable to become root. Elsewhere it names the operator account and asserts nothing new.
• ~/.claude moves to ${machine:agent-home}, owned by ${machine:agent-account}. Where no agent account is named, these resolve to the same path and owner as before.
• /usr/local/bin/claude-agent (0755): runs claude directly when the caller is already the agent account. Otherwise it runs sudo -iu <agent> claude through the operator's own sudo, and carries MESH_GUARD_OVERRIDE only when it is set in the operator's shell.

Order. This needs the controller that knows the new machine facts, which is mesh-controller #164, and the node-engine that knows root, which is mesh-host #61. Both must be merged and running first. Until then mesh/merge-gate cannot pass, because the running controller refuses ${machine:agent-account}. Once they run, nothing changes on any node until the operator states the agent account at the controller's terminal.

Built on #140 and contains its commit; merge #140 first. - A `user` resource named `${machine:agent-account}`, with `root: ${machine:agent-root}`. Where the node names an agent account, the mesh creates it and the node-engine judges it unable to become root. Elsewhere it names the operator account and asserts nothing new. - `~/.claude` moves to `${machine:agent-home}`, owned by `${machine:agent-account}`. Where no agent account is named, these resolve to the same path and owner as before. - `/usr/local/bin/claude-agent` (0755): runs `claude` directly when the caller is already the agent account. Otherwise it runs `sudo -iu <agent> claude` through the operator's own sudo, and carries `MESH_GUARD_OVERRIDE` only when it is set in the operator's shell. **Order.** This needs the controller that knows the new machine facts, which is mesh-controller #164, and the node-engine that knows `root`, which is mesh-host #61. Both must be merged and running first. Until then `mesh/merge-gate` cannot pass, because the running controller refuses `${machine:agent-account}`. Once they run, nothing changes on any node until the operator states the agent account at the controller's terminal.

mesh-admin commented 2026-10-08 18:21:40 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-catalog@b240085e0a50 — delivered since 2026-10-09T22:06:51Z

Delivery plan — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager, restic, sudo
• ace: receives claude-code, restic, sudo
• g14: receives claude-code, restic, sudo
• novox: receives claude-code, claude-licence-manager, restic, sudo
• shanks: receives claude-code, restic, sudo
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• restic keeps data (ADR 0233): what it holds is backed up before it moves

Machines

• claude-code on ace: passed — healthy 3 times over 2m12s
• restic on ace: passed — judged with claude-code: healthy 3 times over 2m12s
• sudo on ace: passed — judged with claude-code: healthy 3 times over 2m12s
• claude-code on novox: judging — carried by plan-1791583236492975389
• claude-licence-manager on novox: passed — healthy 3 times over 2m27s
• restic on novox: judging — carried by plan-1791583236492975389
• sudo on novox: judging — carried by plan-1791583236492975389
• claude-code on the rest running it: sent
• restic on the rest running it: sent
• sudo on the rest running it: sent
• claude-licence-manager on the rest running it: sent

Transitions

• 2026-10-09 21:48 (new) → proposed (announced): novox/mesh-catalog#141's head announced
• 2026-10-09 21:50 proposed → checked (checked): the verdict names this commit
• 2026-10-09 21:50 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-09 22:00 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-09 22:00 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
• 2026-10-09 22:06 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@b240085e0a50` — **delivered** since 2026-10-09T22:06:51Z **Delivery plan** — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager, restic, sudo - ace: receives claude-code, restic, sudo - g14: receives claude-code, restic, sudo - novox: receives claude-code, claude-licence-manager, restic, sudo - shanks: receives claude-code, restic, sudo - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - restic keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - claude-code on ace: passed — healthy 3 times over 2m12s - restic on ace: passed — judged with claude-code: healthy 3 times over 2m12s - sudo on ace: passed — judged with claude-code: healthy 3 times over 2m12s - claude-code on novox: judging — carried by plan-1791583236492975389 - claude-licence-manager on novox: passed — healthy 3 times over 2m27s - restic on novox: judging — carried by plan-1791583236492975389 - sudo on novox: judging — carried by plan-1791583236492975389 - claude-code on the rest running it: sent - restic on the rest running it: sent - sudo on the rest running it: sent - claude-licence-manager on the rest running it: sent **Transitions** - 2026-10-09 21:48 (new) → proposed (announced): novox/mesh-catalog#141's head announced - 2026-10-09 21:50 proposed → checked (checked): the verdict names this commit - 2026-10-09 21:50 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-09 22:00 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-09 22:00 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-09 22:06 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented 2026-10-08 18:24:05 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 9bd234cc

• mesh/merge-gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code)
• mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds claude-code → ace, g14, novox, shanks; no bus step

• tier 0: claude-code
• ace: receives claude-code
• g14: receives claude-code
• novox: receives claude-code
• shanks: receives claude-code
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on g14 as build-1791483714214864485 (builds --log build-1791483714214864485).

--- the gate: claude-code
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
long-running resources without health: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T18:08:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
judged by controller development build against the facts of 2026-10-08T18:08:48Z

fails:
  - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name

modules the change moves:
  - claude-code (changed)

machines:
  - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359
  - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485
  - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322

a merge would rebuild 1 module(s) in 1 tier(s): claude-code
mesh-controller: the change fails the merge gate
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 31047 strings of 565 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.005s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.147s

**Merge check** at `9bd234cc` - `mesh/merge-gate`: **FAIL** — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds claude-code → ace, g14, novox, shanks; no bus step - tier 0: claude-code - ace: receives claude-code - g14: receives claude-code - novox: receives claude-code - shanks: receives claude-code - claude-code keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on g14 as `build-1791483714214864485` (`builds --log build-1791483714214864485`). ``` --- the gate: claude-code claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable) long-running resources without health: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T18:08:48Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name judged by controller development build against the facts of 2026-10-08T18:08:48Z fails: - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name modules the change moves: - claude-code (changed) machines: - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359 - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672 - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485 - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322 a merge would rebuild 1 module(s) in 1 tier(s): claude-code mesh-controller: the change fails the merge gate --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 31047 strings of 565 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.005s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.147s ```

jschoubben force-pushed feat/the-agent-account-is-declared from 9bd234cc7d to 2208381e26 2026-10-08 18:32:38 +00:00 Compare

mesh-admin commented 2026-10-08 18:34:48 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 2208381e

• mesh/merge-gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager)
• mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds claude-code, claude-licence-manager → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager
• ace: receives claude-code
• g14: receives claude-code
• novox: receives claude-code, claude-licence-manager
• shanks: receives claude-code
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: .gitignore

Run by the build seat on g14 as build-1791484367771240405 (builds --log build-1791484367771240405).

--- the gate: claude-code, claude-licence-manager
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
long-running resources without health: 0
2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T18:28:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
judged by controller development build against the facts of 2026-10-08T18:28:48Z

fails:
  - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name

modules the change moves:
  - claude-code (changed)

machines:
  - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359
  - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485
  - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322

a merge would rebuild 2 module(s) in 1 tier(s): claude-code, claude-licence-manager

notes:
  - .gitignore read by no module's build, and rebuild nothing (issue 280)
mesh-controller: the change fails the merge gate
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 31079 strings of 565 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.005s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.124s
testing modules/claude-licence-manager
ok  	claude-licence-manager/cmd/claude-licence-manager	1.104s

**Merge check** at `2208381e` - `mesh/merge-gate`: **FAIL** — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds claude-code, claude-licence-manager → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager - ace: receives claude-code - g14: receives claude-code - novox: receives claude-code, claude-licence-manager - shanks: receives claude-code - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: .gitignore Run by the build seat on g14 as `build-1791484367771240405` (`builds --log build-1791484367771240405`). ``` --- the gate: claude-code, claude-licence-manager claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable) claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings long-running resources without health: 0 2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T18:28:48Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name judged by controller development build against the facts of 2026-10-08T18:28:48Z fails: - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name modules the change moves: - claude-code (changed) machines: - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359 - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672 - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485 - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322 a merge would rebuild 2 module(s) in 1 tier(s): claude-code, claude-licence-manager notes: - .gitignore read by no module's build, and rebuild nothing (issue 280) mesh-controller: the change fails the merge gate --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 31079 strings of 565 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.005s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.124s testing modules/claude-licence-manager ok claude-licence-manager/cmd/claude-licence-manager 1.104s ```

mesh-admin commented 2026-10-08 18:35:54 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at ae3ad8ad

• mesh/merge-gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, sudo)
• mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds claude-code, claude-licence-manager, sudo → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager, sudo
• ace: receives claude-code, sudo
• g14: receives claude-code, sudo
• novox: receives claude-code, claude-licence-manager, sudo
• shanks: receives claude-code, sudo
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: .gitignore

Run by the build seat on shanks as build-1791484429051498761 (builds --log build-1791484429051498761).

--- the gate: claude-code, claude-licence-manager, sudo
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
sudo: ok, 3 tool(s)
long-running resources without health: 0
3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T18:28:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
judged by controller development build against the facts of 2026-10-08T18:28:48Z

fails:
  - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name

modules the change moves:
  - claude-code (changed)
  - sudo (changed)

machines:
  - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359
  - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485
  - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322

a merge would rebuild 3 module(s) in 1 tier(s): claude-code, claude-licence-manager, sudo

notes:
  - .gitignore read by no module's build, and rebuild nothing (issue 280)
mesh-controller: the change fails the merge gate
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 31079 strings of 565 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.148s
testing modules/claude-licence-manager
ok  	claude-licence-manager/cmd/claude-licence-manager	1.120s
testing modules/sudo
ok  	sudo/cmd/sudo-tools	1.010s

**Merge check** at `ae3ad8ad` - `mesh/merge-gate`: **FAIL** — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, sudo) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds claude-code, claude-licence-manager, sudo → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager, sudo - ace: receives claude-code, sudo - g14: receives claude-code, sudo - novox: receives claude-code, claude-licence-manager, sudo - shanks: receives claude-code, sudo - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: .gitignore Run by the build seat on shanks as `build-1791484429051498761` (`builds --log build-1791484429051498761`). ``` --- the gate: claude-code, claude-licence-manager, sudo claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable) claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings sudo: ok, 3 tool(s) long-running resources without health: 0 3 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T18:28:48Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name judged by controller development build against the facts of 2026-10-08T18:28:48Z fails: - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name modules the change moves: - claude-code (changed) - sudo (changed) machines: - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359 - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672 - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485 - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322 a merge would rebuild 3 module(s) in 1 tier(s): claude-code, claude-licence-manager, sudo notes: - .gitignore read by no module's build, and rebuild nothing (issue 280) mesh-controller: the change fails the merge gate --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 31079 strings of 565 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.148s testing modules/claude-licence-manager ok claude-licence-manager/cmd/claude-licence-manager 1.120s testing modules/sudo ok sudo/cmd/sudo-tools 1.010s ```

jschoubben force-pushed feat/the-agent-account-is-declared from ae3ad8ad8e to 5db571666a 2026-10-08 18:41:09 +00:00 Compare

mesh-admin commented 2026-10-08 18:43:06 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 5db57166

• mesh/merge-gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo)
• mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager, restic, sudo
• ace: receives claude-code, restic, sudo
• g14: receives claude-code, restic, sudo
• novox: receives claude-code, claude-licence-manager, restic, sudo
• shanks: receives claude-code, restic, sudo
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• restic keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: .gitignore

Run by the build seat on ace as build-1791484883060199951 (builds --log build-1791484883060199951).

--- the gate: claude-code, claude-licence-manager, restic, sudo
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
restic: ok, keeps repository (rebuildable), state (cache)
sudo: ok, 3 tool(s)
long-running resources without health: 0
4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T18:28:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
judged by controller development build against the facts of 2026-10-08T18:28:48Z

fails:
  - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name

modules the change moves:
  - claude-code (changed)
  - sudo (changed)

machines:
  - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359
  - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485
  - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322

a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo

notes:
  - .gitignore read by no module's build, and rebuild nothing (issue 280)
mesh-controller: the change fails the merge gate
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 31100 strings of 565 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.005s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.121s
testing modules/claude-licence-manager
ok  	claude-licence-manager/cmd/claude-licence-manager	1.097s
testing modules/restic
ok  	restic/cmd/restic-backups	1.031s
testing modules/sudo
ok  	sudo/cmd/sudo-tools	1.011s

**Merge check** at `5db57166` - `mesh/merge-gate`: **FAIL** — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager, restic, sudo - ace: receives claude-code, restic, sudo - g14: receives claude-code, restic, sudo - novox: receives claude-code, claude-licence-manager, restic, sudo - shanks: receives claude-code, restic, sudo - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - restic keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: .gitignore Run by the build seat on ace as `build-1791484883060199951` (`builds --log build-1791484883060199951`). ``` --- the gate: claude-code, claude-licence-manager, restic, sudo claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable) claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings restic: ok, keeps repository (rebuildable), state (cache) sudo: ok, 3 tool(s) long-running resources without health: 0 4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T18:28:48Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name judged by controller development build against the facts of 2026-10-08T18:28:48Z fails: - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name modules the change moves: - claude-code (changed) - sudo (changed) machines: - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359 - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672 - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485 - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322 a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo notes: - .gitignore read by no module's build, and rebuild nothing (issue 280) mesh-controller: the change fails the merge gate --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 31100 strings of 565 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.005s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.121s testing modules/claude-licence-manager ok claude-licence-manager/cmd/claude-licence-manager 1.097s testing modules/restic ok restic/cmd/restic-backups 1.031s testing modules/sudo ok sudo/cmd/sudo-tools 1.011s ```

mesh-admin commented 2026-10-08 19:20:37 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 805bf176

• mesh/merge-gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo)
• mesh/repo-check: PASS — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed

Delivery plan — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager, restic, sudo
• ace: receives claude-code, restic, sudo
• g14: receives claude-code, restic, sudo
• novox: receives claude-code, claude-licence-manager, restic, sudo
• shanks: receives claude-code, restic, sudo
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• restic keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh

Run by the build seat on novox as build-1791487018847283372 (builds --log build-1791487018847283372).

--- the gate: claude-code, claude-licence-manager, restic, sudo
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
restic: ok, keeps repository (rebuildable), state (cache)
sudo: ok, 3 tool(s)
long-running resources without health: 0
4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T19:09:42Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
judged by controller development build against the facts of 2026-10-08T19:09:42Z

fails:
  - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name

modules the change moves:
  - claude-code (changed)
  - sudo (changed)

machines:
  - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359
  - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485
  - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322

a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo

notes:
  - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280)
mesh-controller: the change fails the merge gate
--- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 31100 strings of 565 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.007s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.267s
testing modules/claude-licence-manager
ok  	claude-licence-manager/cmd/claude-licence-manager	1.135s
testing modules/restic
ok  	restic/cmd/restic-backups	1.058s
testing modules/sudo
ok  	sudo/cmd/sudo-tools	1.014s

**Merge check** at `805bf176` - `mesh/merge-gate`: **FAIL** — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo) - `mesh/repo-check`: **PASS** — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed **Delivery plan** — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager, restic, sudo - ace: receives claude-code, restic, sudo - g14: receives claude-code, restic, sudo - novox: receives claude-code, claude-licence-manager, restic, sudo - shanks: receives claude-code, restic, sudo - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - restic keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh Run by the build seat on novox as `build-1791487018847283372` (`builds --log build-1791487018847283372`). ``` --- the gate: claude-code, claude-licence-manager, restic, sudo claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable) claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings restic: ok, keeps repository (rebuildable), state (cache) sudo: ok, 3 tool(s) long-running resources without health: 0 4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T19:09:42Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name judged by controller development build against the facts of 2026-10-08T19:09:42Z fails: - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name modules the change moves: - claude-code (changed) - sudo (changed) machines: - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359 - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672 - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485 - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322 a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo notes: - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280) mesh-controller: the change fails the merge gate --- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 31100 strings of 565 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.007s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.267s testing modules/claude-licence-manager ok claude-licence-manager/cmd/claude-licence-manager 1.135s testing modules/restic ok restic/cmd/restic-backups 1.058s testing modules/sudo ok sudo/cmd/sudo-tools 1.014s ```

mesh-admin commented 2026-10-08 19:48:44 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 824ad112

• mesh/merge-gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo)
• mesh/repo-check: FAIL — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh failed: --- FAIL: TestAGrantAtRestOpensOnlyWithItsKey (0.00s)

Delivery plan — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager, restic, sudo
• ace: receives claude-code, restic, sudo
• g14: receives claude-code, restic, sudo
• novox: receives claude-code, claude-licence-manager, restic, sudo
• shanks: receives claude-code, restic, sudo
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• restic keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh

Run by the build seat on g14 as build-1791488782677269870 (builds --log build-1791488782677269870).

--- the gate: claude-code, claude-licence-manager, restic, sudo
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
restic: ok, keeps repository (rebuildable), state (cache)
sudo: ok, 3 tool(s)
long-running resources without health: 0
4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T19:43:11Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
judged by controller development build against the facts of 2026-10-08T19:43:11Z

fails:
  - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name

modules the change moves:
  - claude-code (changed)
  - sudo (changed)

machines:
  - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359
  - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485
  - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322

a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo

notes:
  - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280)
mesh-controller: the change fails the merge gate
--- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words, none in the 31100 strings of 565 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.007s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.152s
testing modules/claude-licence-manager
--- FAIL: TestAGrantAtRestOpensOnlyWithItsKey (0.00s)
    store_test.go:114: stored in the clear
FAIL
FAIL	claude-licence-manager/cmd/claude-licence-manager	0.106s
FAIL

**Merge check** at `824ad112` - `mesh/merge-gate`: **FAIL** — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo) - `mesh/repo-check`: **FAIL** — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh failed: --- FAIL: TestAGrantAtRestOpensOnlyWithItsKey (0.00s) **Delivery plan** — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager, restic, sudo - ace: receives claude-code, restic, sudo - g14: receives claude-code, restic, sudo - novox: receives claude-code, claude-licence-manager, restic, sudo - shanks: receives claude-code, restic, sudo - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - restic keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh Run by the build seat on g14 as `build-1791488782677269870` (`builds --log build-1791488782677269870`). ``` --- the gate: claude-code, claude-licence-manager, restic, sudo claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable) claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings restic: ok, keeps repository (rebuildable), state (cache) sudo: ok, 3 tool(s) long-running resources without health: 0 4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T19:43:11Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name judged by controller development build against the facts of 2026-10-08T19:43:11Z fails: - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name modules the change moves: - claude-code (changed) - sudo (changed) machines: - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359 - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672 - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485 - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322 a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo notes: - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280) mesh-controller: the change fails the merge gate --- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words, none in the 31100 strings of 565 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.007s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.152s testing modules/claude-licence-manager --- FAIL: TestAGrantAtRestOpensOnlyWithItsKey (0.00s) store_test.go:114: stored in the clear FAIL FAIL claude-licence-manager/cmd/claude-licence-manager 0.106s FAIL ```

jschoubben referenced this issue from a commit 2026-10-08 19:56:41 +00:00

Test that a sealed grant hides its words, not two letters

jschoubben force-pushed feat/the-agent-account-is-declared from 824ad11210 to 4f4e1ec5b0 2026-10-08 19:56:42 +00:00 Compare

mesh-admin commented 2026-10-08 20:01:13 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 4f4e1ec5

• mesh/merge-gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo)
• mesh/repo-check: PASS — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed

Delivery plan — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager, restic, sudo
• ace: receives claude-code, restic, sudo
• g14: receives claude-code, restic, sudo
• novox: receives claude-code, claude-licence-manager, restic, sudo
• shanks: receives claude-code, restic, sudo
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• restic keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh

Run by the build seat on shanks as build-1791489422045515128 (builds --log build-1791489422045515128).

--- the gate: claude-code, claude-licence-manager, restic, sudo
claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings
restic: ok, keeps repository (rebuildable), state (cache)
sudo: ok, 3 tool(s)
long-running resources without health: 0
4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T19:59:18Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
judged by controller development build against the facts of 2026-10-08T19:59:18Z

fails:
  - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name

modules the change moves:
  - claude-code (changed)
  - sudo (changed)

machines:
  - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359
  - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485
  - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322

a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo

notes:
  - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280)
mesh-controller: the change fails the merge gate
--- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 31100 strings of 565 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.146s
testing modules/claude-licence-manager
ok  	claude-licence-manager/cmd/claude-licence-manager	1.118s
testing modules/restic
ok  	restic/cmd/restic-backups	1.031s
testing modules/sudo
ok  	sudo/cmd/sudo-tools	1.010s

**Merge check** at `4f4e1ec5` - `mesh/merge-gate`: **FAIL** — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo) - `mesh/repo-check`: **PASS** — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed **Delivery plan** — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager, restic, sudo - ace: receives claude-code, restic, sudo - g14: receives claude-code, restic, sudo - novox: receives claude-code, claude-licence-manager, restic, sudo - shanks: receives claude-code, restic, sudo - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - restic keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh Run by the build seat on shanks as `build-1791489422045515128` (`builds --log build-1791489422045515128`). ``` --- the gate: claude-code, claude-licence-manager, restic, sudo claude-code: ok, 40 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable) claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings restic: ok, keeps repository (rebuildable), state (cache) sudo: ok, 3 tool(s) long-running resources without health: 0 4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T19:59:18Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name judged by controller development build against the facts of 2026-10-08T19:59:18Z fails: - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name modules the change moves: - claude-code (changed) - sudo (changed) machines: - a machine (f35): does not compose; the change adds 0 resource(s) and removes 359 - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 672 - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 485 - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 322 a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo notes: - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280) mesh-controller: the change fails the merge gate --- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 31100 strings of 565 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.146s testing modules/claude-licence-manager ok claude-licence-manager/cmd/claude-licence-manager 1.118s testing modules/restic ok restic/cmd/restic-backups 1.031s testing modules/sudo ok sudo/cmd/sudo-tools 1.010s ```

jschoubben referenced this issue from a commit 2026-10-09 09:03:17 +00:00

Test that a sealed grant hides its words, not two letters

jschoubben added 8 commits 2026-10-09 09:03:17 +00:00

claude-code: write the agent's home as its own account where it has one ... b57e6e8144

On the control node agents are to run as an account that cannot become root
(hq ADR 0266). The runtime keeps running as the operator, so the token, the
identity and the home-scope items go to the agent's home through a helper
started as that account; the licence and the account file follow the move,
what was placed in the operator's home goes once the agent holds the licence,
and the guard refuses every tool of a session running as anyone else,
recording to the journal. An API key is taken only from the agent's home and
only when it is one, here and in the licence manager, so the tool cannot carry
off the runtime's credential. Unchanged where no agent account is named.

restic: restore away from a directory another account owns ... dae7bb848d

Root writes a restore beside the live data. In a directory another account
controls, such as the agent's home (hq ADR 0266), that account could put a
symbolic link where root writes and have root write anywhere; such a restore
now goes to the module's state.

Test that a sealed grant hides its words, not two letters ... c8fb0016f2

The check looked for "rt" in a random base64 ciphertext, which holds it
about one time in seventy, and failed mesh-catalog #141's repo check by
chance.

claude-code: declare the account agents run as and the command that starts it ... 17b0ac9f6c

The control node is to run its agents under an account that cannot become root
(hq ADR 0266). Declare it as a user the node-engine judges root: never, put the
agent's directory in its home, and place claude-agent so the operator starts a
session there through their own sudo. Where no agent account is named, both
name the operator's account, as before.

sudo: give every command run through sudo a terminal of its own ... 9afea75f93

An agent the operator starts as the agent account through sudo (hq ADR 0266)
would otherwise share the operator's terminal and could push keystrokes into
their shell after it ends. sudo still runs without a terminal for the mesh's
own tools, so nothing they do changes.

Refuse an archive or a file written into under the agent's home ... 87862f3bf5

The node-engine writes those as root after checking the path, and the agent
account owns its home and could swap a link in between (hq ADR 0266). No
module does it today; this keeps a future one from opening the gap.

Refuse the agent-home gap reached through a module's own directory or a literal home ... 6d32975ca6

A path written as ${dir:<id>} can resolve under the agent's home, and a
literal /home path may be it; both escaped the check (hq ADR 0266).

claude-code: make the agent account at the home its node names ... eacda6e3ae

The controller fills ${machine:agent-home} in a user's home now, so an agent
account the operator names with a home of its own is created there, where the
module places its ~/.claude (hq ADR 0266). An existing account is never moved.

jschoubben referenced this issue from a commit 2026-10-09 09:03:17 +00:00

Test that a sealed grant hides its words, not two letters

jschoubben force-pushed feat/the-agent-account-is-declared from 4f4e1ec5b0 to eacda6e3ae 2026-10-09 09:03:17 +00:00 Compare

mesh-admin commented 2026-10-09 09:05:39 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at eacda6e3

• mesh/merge-gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo)
• mesh/repo-check: PASS — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager, restic, sudo
• ace: receives claude-code, restic, sudo
• g14: receives claude-code, restic, sudo
• novox: receives claude-code, claude-licence-manager, restic, sudo
• shanks: receives claude-code, restic, sudo
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• restic keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh

Run by the build seat on ace as build-1791536617718847980 (builds --log build-1791536617718847980).

--- the gate: claude-code, claude-licence-manager, restic, sudo
claude-code: ok, 41 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable); WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings; WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339)
restic: ok, keeps repository (rebuildable), state (cache)
sudo: ok, 3 tool(s)
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 2
4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T08:07:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
judged by controller development build against the facts of 2026-10-09T08:07:39Z

fails:
  - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name
  - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name

modules the change moves:
  - claude-code (changed)
  - sudo (changed)

machines:
  - a machine (f35): does not compose; the change adds 0 resource(s) and removes 362
  - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 674
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 487
  - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 325

a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo

notes:
  - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280)
mesh-controller: the change fails the merge gate
--- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words, none in the 34302 strings of 605 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.005s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.476s
testing modules/claude-licence-manager
ok  	claude-licence-manager/cmd/claude-licence-manager	1.108s
testing modules/restic
ok  	restic/cmd/restic-backups	1.032s
testing modules/sudo
ok  	sudo/cmd/sudo-tools	1.012s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `eacda6e3` - `mesh/merge-gate`: **FAIL** — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name (modules: claude-code, claude-licence-manager, restic, sudo) - `mesh/repo-check`: **PASS** — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager, restic, sudo - ace: receives claude-code, restic, sudo - g14: receives claude-code, restic, sudo - novox: receives claude-code, claude-licence-manager, restic, sudo - shanks: receives claude-code, restic, sudo - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - restic keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh Run by the build seat on ace as `build-1791536617718847980` (`builds --log build-1791536617718847980`). ``` --- the gate: claude-code, claude-licence-manager, restic, sudo claude-code: ok, 41 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable); WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339) claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings; WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339) restic: ok, keeps repository (rebuildable), state (cache) sudo: ok, 3 tool(s) long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 2 4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T08:07:39Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: FAIL — 4 problem(s) the change brings; the first: a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name judged by controller development build against the facts of 2026-10-09T08:07:39Z fails: - a machine (f35): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - a machine (yvbpsm): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name - holds mesh-dns-resolver (idt): nothing could be sent to it with this change — claude-code has a name that says ${machine:agent-account}, and this machine says account, account-home, address, at, mesh-range or name modules the change moves: - claude-code (changed) - sudo (changed) machines: - a machine (f35): does not compose; the change adds 0 resource(s) and removes 362 - holds mesh-dns-resolver (idt): does not compose; the change adds 0 resource(s) and removes 674 - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose; the change adds 0 resource(s) and removes 487 - a machine (yvbpsm): does not compose; the change adds 0 resource(s) and removes 325 a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo notes: - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280) mesh-controller: the change fails the merge gate --- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words, none in the 34302 strings of 605 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.005s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.476s testing modules/claude-licence-manager ok claude-licence-manager/cmd/claude-licence-manager 1.108s testing modules/restic ok restic/cmd/restic-backups 1.032s testing modules/sudo ok sudo/cmd/sudo-tools 1.012s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-admin commented 2026-10-09 09:07:51 +00:00

Author

Contributor

Copy Link

Copy Source

Rebased onto the rebased #140 on 2026-10-09 (head eacda6e).

• New: the user resource declares "home": "${machine:agent-home}", so an agent account named with a home of its own is created there. This needs mesh-controller #164 at 926dbd7 or later. An existing account is never moved.
• merge-check.sh passed with a controller built from #164's head as the gate (claude-code, claude-licence-manager, restic, sudo).
• With the running controller as the gate it stays red until #164 runs, as said above.

A note on Defaults use_pty: it applies to every sudo on every node, the operator's included. sudo has made it the default since 1.9.14. It changes no rule; it gives each command a terminal of its own.

**Rebased onto the rebased #140 on 2026-10-09 (head eacda6e).** - **New:** the user resource declares `"home": "${machine:agent-home}"`, so an agent account named with a home of its own is created there. This needs mesh-controller #164 at 926dbd7 or later. An existing account is never moved. - `merge-check.sh` passed with a controller built from #164's head as the gate (claude-code, claude-licence-manager, restic, sudo). - With the running controller as the gate it stays red until #164 runs, as said above. **A note on `Defaults use_pty`:** it applies to every sudo on every node, the operator's included. sudo has made it the default since 1.9.14. It changes no rule; it gives each command a terminal of its own.

jschoubben added 1 commit 2026-10-09 21:37:50 +00:00

Merge remote-tracking branch 'origin/main' into feat/the-agent-account-is-declared b382045721

mesh-admin commented 2026-10-09 21:40:49 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at b3820457

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: claude-code, claude-licence-manager, restic, sudo)
• mesh/repo-check: PASS — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager, restic, sudo
• ace: receives claude-code, restic, sudo
• g14: receives claude-code, restic, sudo
• novox: receives claude-code, claude-licence-manager, restic, sudo
• shanks: receives claude-code, restic, sudo
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• restic keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh

Run by the build seat on novox as build-1791581892624312018 (builds --log build-1791581892624312018).

--- the gate: claude-code, claude-licence-manager, restic, sudo
claude-code: ok, 41 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable); WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings; WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339)
restic: ok, keeps repository (rebuildable), state (cache)
sudo: ok, 4 tool(s)
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 2
4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T18:18:32Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T18:18:32Z

modules the change moves:
  - claude-code (changed)
  - sudo (changed)

machines:
  - a machine (f35): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account)
  - holds mesh-dns-resolver (idt): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account)
  - a machine (yvbpsm): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account)

a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo

notes:
  - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280)
--- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.014s
words: 12 retired words and 70 daemons' lines, none in the 36377 strings of 629 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.007s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.665s
testing modules/claude-licence-manager
ok  	claude-licence-manager/cmd/claude-licence-manager	1.139s
testing modules/restic
ok  	restic/cmd/restic-backups	1.072s
testing modules/sudo
ok  	sudo/cmd/sudo-tools	1.017s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `b3820457` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: claude-code, claude-licence-manager, restic, sudo) - `mesh/repo-check`: **PASS** — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager, restic, sudo - ace: receives claude-code, restic, sudo - g14: receives claude-code, restic, sudo - novox: receives claude-code, claude-licence-manager, restic, sudo - shanks: receives claude-code, restic, sudo - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - restic keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh Run by the build seat on novox as `build-1791581892624312018` (`builds --log build-1791581892624312018`). ``` --- the gate: claude-code, claude-licence-manager, restic, sudo claude-code: ok, 41 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable); WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339) claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings; WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339) restic: ok, keeps repository (rebuildable), state (cache) sudo: ok, 4 tool(s) long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 2 4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T18:18:32Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T18:18:32Z modules the change moves: - claude-code (changed) - sudo (changed) machines: - a machine (f35): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account) - holds mesh-dns-resolver (idt): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account) - a machine (yvbpsm): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account) a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo notes: - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280) --- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.014s words: 12 retired words and 70 daemons' lines, none in the 36377 strings of 629 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.007s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.665s testing modules/claude-licence-manager ok claude-licence-manager/cmd/claude-licence-manager 1.139s testing modules/restic ok restic/cmd/restic-backups 1.072s testing modules/sudo ok sudo/cmd/sudo-tools 1.017s --- its merge-check-typescript.sh (typescript toolchain) ```

jschoubben added 1 commit 2026-10-09 21:48:16 +00:00

Close the review's gaps round the agent account (hq ADR 0266) ... b240085e0a

The managed settings apply to every account's claude, so a key-helper script under the
agent's home would run as the operator, and through sudo as root: the command is now
carried whole in the root-owned managed settings and reads the key only as the agent.
The helper reads only a regular file, bounded, without blocking, and a request it does
not answer fails in time instead of holding every later one; a directory entry it
answers that is not a name is refused. The guard's record is matched on its binary in
the query, a half-named agent account is not taken as the operator's, the kept API key
stays until the agent's home holds one, restic refuses to restore beside a directory
others may write, and the agent-home check cleans a path before judging it.

mesh-admin commented 2026-10-09 21:50:45 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at b240085e

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: claude-code, claude-licence-manager, restic, sudo)
• mesh/repo-check: PASS — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step

• tier 0: claude-code, claude-licence-manager, restic, sudo
• ace: receives claude-code, restic, sudo
• g14: receives claude-code, restic, sudo
• novox: receives claude-code, claude-licence-manager, restic, sudo
• shanks: receives claude-code, restic, sudo
• claude-code keeps data (ADR 0233): what it holds is backed up before it moves
• restic keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh

Run by the build seat on g14 as build-1791582502092154538 (builds --log build-1791582502092154538).

--- the gate: claude-code, claude-licence-manager, restic, sudo
claude-code: ok, 41 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable); WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339)
claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings; WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339)
restic: ok, keeps repository (rebuildable), state (cache)
sudo: ok, 4 tool(s)
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 2
4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T21:38:32Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T21:38:32Z

modules the change moves:
  - claude-code (changed)
  - sudo (changed)

machines:
  - a machine (f35): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account)
  - holds mesh-dns-resolver (idt): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account)
  - a machine (yvbpsm): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account)

a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo

notes:
  - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280)
--- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 36404 strings of 629 files
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 70, as kept
testing modules/claude-code
ok  	claude-code/cmd/claude-code	1.737s
testing modules/claude-licence-manager
ok  	claude-licence-manager/cmd/claude-licence-manager	1.093s
testing modules/restic
ok  	restic/cmd/restic-backups	1.033s
testing modules/sudo
ok  	sudo/cmd/sudo-tools	1.016s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `b240085e` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: claude-code, claude-licence-manager, restic, sudo) - `mesh/repo-check`: **PASS** — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step - tier 0: claude-code, claude-licence-manager, restic, sudo - ace: receives claude-code, restic, sudo - g14: receives claude-code, restic, sudo - novox: receives claude-code, claude-licence-manager, restic, sudo - shanks: receives claude-code, restic, sudo - claude-code keeps data (ADR 0233): what it holds is backed up before it moves - restic keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go, merge-check.sh Run by the build seat on g14 as `build-1791582502092154538` (`builds --log build-1791582502092154538`). ``` --- the gate: claude-code, claude-licence-manager, restic, sudo claude-code: ok, 41 tool(s), keeps state servers, holdings, config, reads claude-licence-manager.bindings, keeps agent-home (valuable); WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339) claude-licence-manager: ok, keeps state bindings, reads claude-code.holdings; WARNING: settings ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339) restic: ok, keeps repository (rebuildable), state (cache) sudo: ok, 4 tool(s) long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 2 4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T21:38:32Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T21:38:32Z modules the change moves: - claude-code (changed) - sudo (changed) machines: - a machine (f35): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account) - holds mesh-dns-resolver (idt): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account) - a machine (yvbpsm): composes; the change adds 2 resource(s) and removes 0 (+file:claude-code.start, +user:claude-code.agent-account) a merge would rebuild 4 module(s) in 1 tier(s): claude-code, claude-licence-manager, restic, sudo notes: - .gitignore, checks/agenthome/go.mod, checks/agenthome/main.go, checks/agenthome/main_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280) --- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 36404 strings of 629 files ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 70, as kept testing modules/claude-code ok claude-code/cmd/claude-code 1.737s testing modules/claude-licence-manager ok claude-licence-manager/cmd/claude-licence-manager 1.093s testing modules/restic ok restic/cmd/restic-backups 1.033s testing modules/sudo ok sudo/cmd/sudo-tools 1.016s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-admin merged commit db84ebf48e into main 2026-10-09 21:59:39 +00:00

mesh-admin deleted branch feat/the-agent-account-is-declared 2026-10-09 21:59:39 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#141