gitea_commit takes a large patch from a hash-checked spool file (issue 852) #319

2026-10-15T20:39:42Z

mesh-tools commented

2026-10-15 20:39:42 +00:00

Issue 852 (playbook 08). A feature's diff is megabytes, too large to type into a tool call, and ADR 0365 clause 5 lets an agent write to the forge only through the forge's tools. gitea_commit now also takes patch_file: the random hex name of a file in the module's spool directory /var/lib/mesh/forge-patches (mode 0733, owned by the machine's account), with a required patch_sha256.

The tool reads only that directory (name 32-64 hex characters, never a path), never through a symlink (O_NOFOLLOW, regular file checked on the handle) or a hard link (Nlink > 1 refused), refuses a file whose SHA-256 differs (the directory has no sticky bit: the manifest allows none), applies it exactly as it applies patch (same 4 MiB limit, same /diffpatch call) and removes it. patch and files behave as before.

Review: round 1 APPROVE at 29c8db57 and round 2 APPROVE at cbe67e07 (independent Opus reviewer; the tree of this head, 2341a299, equals the reviewed tree). Known, not blocking: three README nits from round 2 (a comma in the tool table, an incomplete list of files that stay in the spool, one long line).

Not yet measured: Gitea's own /diffpatch limit for a 2.1 MB patch, and the directory's mode and owner on a real machine; both are seen at the first use after delivery.

Issue 852 (playbook 08). A feature's diff is megabytes, too large to type into a tool call, and ADR 0365 clause 5 lets an agent write to the forge only through the forge's tools. `gitea_commit` now also takes `patch_file`: the random hex name of a file in the module's spool directory `/var/lib/mesh/forge-patches` (mode 0733, owned by the machine's account), with a required `patch_sha256`. The tool reads only that directory (name 32-64 hex characters, never a path), never through a symlink (O_NOFOLLOW, regular file checked on the handle) or a hard link (Nlink > 1 refused), refuses a file whose SHA-256 differs (the directory has no sticky bit: the manifest allows none), applies it exactly as it applies `patch` (same 4 MiB limit, same /diffpatch call) and removes it. `patch` and `files` behave as before. Review: round 1 APPROVE at 29c8db57 and round 2 APPROVE at cbe67e07 (independent Opus reviewer; the tree of this head, 2341a299, equals the reviewed tree). Known, not blocking: three README nits from round 2 (a comma in the tool table, an incomplete list of files that stay in the spool, one long line). Not yet measured: Gitea's own /diffpatch limit for a 2.1 MB patch, and the directory's mode and owner on a real machine; both are seen at the first use after delivery.

mesh-tools added 1 commit 2026-10-15 20:39:43 +00:00

Let gitea_commit take a large patch from a hash-checked spool file (issue 852)

mesh/merge-gate head d4b8b2470159 merged into trunk aee97bf8ad42 — pass: builds gitea → novox; no bus step; every machine composes with the change as it di…

Details

mesh/repo-check head d4b8b2470159 merged into trunk aee97bf8ad42 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…

Details

mesh/delivery delivered

Details

d4b8b24701

A feature's diff is megabytes, too large to type into a call. gitea_commit now also takes patch_file, the
random hex name of a file in the module's spool directory /var/lib/mesh/forge-patches (mode 0733, owned by
the machine's account), with patch_sha256. The tool reads only that directory, never through a symlink or a
hard link, refuses a file whose SHA-256 differs, applies it as it applies patch, and removes it.

Co-Authored-By: Claude <noreply@anthropic.com>

mesh-tools commented

2026-10-15 20:39:49 +00:00

Delivery novox/mesh-catalog@d4b8b2470159 — delivered since 2026-10-15T20:57:01Z

Delivery plan — builds gitea → novox; no bus step

tier 0: gitea
novox: receives gitea
gitea provides npm-package-registry, git: its consumers are sent again after it
gitea keeps data (ADR 0233): what it holds is backed up before it moves

Machines

gitea on every machine running it: sent

Transitions

2026-10-15 20:39 (new) → proposed (announced): novox/mesh-catalog#319's head announced
2026-10-15 20:42 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-15 20:42 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-15 20:47 ready → proposed (trunk moved): out of date: judged against trunk de6657c846, the trunk is now aee97bf8ad42; judged again on a recheck or when it is merged
2026-10-15 20:55 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-15 20:55 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-15 20:55 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-15 20:55 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-15 20:57 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@d4b8b2470159` — **delivered** since 2026-10-15T20:57:01Z **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - gitea on every machine running it: sent **Transitions** - 2026-10-15 20:39 (new) → proposed (announced): novox/mesh-catalog#319's head announced - 2026-10-15 20:42 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-15 20:42 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-15 20:47 ready → proposed (trunk moved): out of date: judged against trunk de6657c846b9, the trunk is now aee97bf8ad42; judged again on a recheck or when it is merged - 2026-10-15 20:55 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-15 20:55 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-15 20:55 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-15 20:55 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-15 20:57 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-15 20:40:28 +00:00

ready at d4b8b24701

The operator's word was given in the novox session at 22:41 (asked there and on Telegram). Reviewed: round 1 APPROVE at 29c8db57, round 2 APPROVE at cbe67e07; this head's tree 2341a299 equals the reviewed tree.

ready at d4b8b2470159456a5961e9b19e1e38112c2a63f7 The operator's word was given in the novox session at 22:41 (asked there and on Telegram). Reviewed: round 1 APPROVE at 29c8db57, round 2 APPROVE at cbe67e07; this head's tree 2341a299 equals the reviewed tree.

mesh-tools commented

2026-10-15 20:41:20 +00:00

mesh-delivery: the ready mark at is cleared: the head is now d4b8b24701, pushed after it. Mark the new head ready once it is reviewed.

mesh-delivery: the ready mark at is cleared: the head is now d4b8b2470159456a5961e9b19e1e38112c2a63f7, pushed after it. Mark the new head ready once it is reviewed.

mesh-tools commented

2026-10-15 20:42:54 +00:00

Merge check at d4b8b247
Judged: head d4b8b2470159 merged into trunk de6657c846b9; read beside it: mesh-controller 7543f64911c5, mesh-controller-main 7543f64911c5, mesh-host 198fd34ec497, mesh-tools 6b3e15042fee

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds gitea → novox; no bus step

tier 0: gitea
novox: receives gitea
gitea provides npm-package-registry, git: its consumers are sent again after it
gitea keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on novox as build-1792096784505376750 (builds --log build-1792096784505376750).

  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 1 resource(s) and removes 0 (+directory:gitea.forge-patches)
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): gitea
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 48771 strings of 747 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.014s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.010s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.014s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 62, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	1.294s
testing modules/gitea
ok  	gitea/cmd/forge	1.598s
ok  	gitea/cmd/npm-registry	1.973s
?   	gitea/internal/forgehttp	[no test files]
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/gitea (TypeScript)
testing modules/gitea (TypeScript)
✔ a pull request opened after the margin is looked at, by its own update time (23.121605ms)
✔ every open pull request is read with what its base requires and what its head has (gitea_open_pulls) (115.407989ms)
✔ a pull request or issue number that is not one is refused before the forge is asked (4.988075ms)
✔ a merged pull request whose branch was deleted is announced with its branch, not its pull ref (30.126456ms)
✔ a pull request's ready mark is read: the label and the head the newest listed ready comment names (42.836352ms)
✔ a ready comment by an account not listed is ignored, and said (0.507912ms)
✔ a ready comment older than the latest push, or than the label, never counts (128.823097ms)
[gitea] f cannot be read (gone); only mesh-tools, mesh-admin may mark a pull request ready
[gitea] f names no account that may mark a pull request ready; only mesh-tools, mesh-admin may
✔ a long thread hides nothing: every page of the timeline is read (33.124494ms)
✔ the accounts that may mark are the setting's, and only the mesh's own when it cannot be read (0.941803ms)
✔ the newest status of each context is kept, with what it said, when and by whom (117.811136ms)
✔ a commit merges only when every required status is a success; a warning blocks (0.481771ms)
✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.244171ms)
✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.724112ms)
✔ a note line is appended once, as the forge's user, in its own repository (20.405228ms)
✔ a note that cannot be written is said, never read as written (0.490372ms)
✔ one view per pull request, found by its marker; only the mesh's statuses (0.693942ms)
✔ a build machine taking the check is said on the head: building on which machine, since the local time (114.169746ms)
✔ the verdict heard while a 'building' write is in flight lands last and stays (18.785303ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.443834ms)
✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (1.879525ms)
✔ a start heard after the verdict writes nothing (0.509081ms)
✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (4.795944ms)
✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.114403ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (24.342269ms)
✔ a rechecked head says where its new run is: building on which machine (4.012961ms)
✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (3.428949ms)
✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (6.88035ms)
✔ a recheck the forge does not take fails its caller, and the head is as it was (3.40153ms)
✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (27.675939ms)
✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (4.561233ms)
✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (2.763028ms)
✔ a repository as the mesh clones it is told from another (0.438092ms)
✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (6.955449ms)
✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (106.932625ms)
✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (54.000474ms)
✔ gitea_api still writes what an author writes (18.948014ms)
✔ gitea_branch_protection_set only strengthens (39.984063ms)
✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (134.199602ms)
✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (182.308929ms)
✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (16.738308ms)
✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (15.428584ms)
✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (25.147821ms)
✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (60.023631ms)
✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (22.188954ms)
✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.465233ms)
✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (5.643356ms)
✔ a rule named for a branch is not made weaker than the glob rule that guards it now (13.95028ms)
✔ a repository owner or name is never another path (0.27216ms)
✔ the judges, without a forge (0.440581ms)
✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (3.225559ms)
✔ gitea_api never approves a pull request nor requests changes: those are the operator's (1.287244ms)
✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (5.227715ms)
✔ every page of a pull request's files is read, though the forge caps a page at fifty (59.9584ms)
✔ a pass asks only the repositories that moved since the last look, every one before the first (0.780822ms)
✔ the directories above a merge's files that hold a module at the commit are said, the root never (24.060909ms)
✔ a lookup the forge refuses is thrown, not read as no module (16.304706ms)
✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (22.548474ms)
✔ a new head beyond the newest 20 open pull requests is announced, exactly once (98.42856ms)
✔ a pass pages until it reaches back past its floor, and no further (55.742459ms)
✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (46.217452ms)
✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (30.238866ms)
✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (10.207509ms)
✔ the statuses asked for replace the rule's, and an empty list requires none (7.728532ms)
✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.350331ms)
✔ each open pull request's new head is announced once, and nothing closed or merged (14.03085ms)
✔ a verdict is the head commit's status; an error is the forge's error, never a success (0.926923ms)
✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.678172ms)
✔ no verdict sets warning on a required check; only a person's decision fails (0.956973ms)
✔ a commit status is set on the commit, under the merge check's context (75.597225ms)
✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.519892ms)
✔ a head announced is pending in the build queue, since the local time it was announced (0.350801ms)
✔ the vault's token is used, a setting of it is ignored and said once, without its value (3.62348ms)
✔ a consumer that asks nothing, or write, publishes: the package team (1.585145ms)
✔ a consumer that asks to read joins the readers, who write no package (0.464381ms)
✔ a reader is made, put on the readers team, and taken off the package team (0.557461ms)
✔ a publisher is made and put on the package team, as before (0.214021ms)
✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (73.85664ms)
✔ second start: reuses the kept token, mints nothing (38.048378ms)
✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (42.476511ms)
✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (34.259847ms)
✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (37.307786ms)
✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (27.712039ms)
✔ concurrent first calls share one mint (15.795976ms)
✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (15.969205ms)
✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (73.61595ms)
✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (5.831296ms)
✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (15.135833ms)
✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.849392ms)
✔ a second process finds the token the first renewed, and reuses it instead of minting over it (22.495744ms)
✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.683828ms)
✔ nothing to mint with and no token: the client says what is missing (0.211131ms)
[gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-fhW5h2/state/token
✔ the tools register once there is a way to a token, and the first call mints it (28.826072ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-8N3pmP/state/token
✔ a pull request can be closed, read and cleaned up through the tools (37.309616ms)
[gitea] no token kept — minting one
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nWzZPE/state/token
✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (100.472926ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-fli55j/state/token
✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (53.824994ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-YCMSiI/state/token
✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (49.06667ms)
[gitea] the kept token was minted with other scopes than the tools take now — minting one with them
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-hTOQYb/state/token
[gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now
✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (34.290897ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-CMVNAe/state/token
✔ a tools' account someone made an administrator is made a plain account again at the next mint (29.118163ms)
✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.956653ms)
✔ the manifest hands the tools their account, and the merge-ready authors name it rather than the administrator (1.057863ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-10DiFr/state/token
✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (28.838192ms)
[gitea] no token kept — minting one
✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (14.938833ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-Vvmsut/state/token
[gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"}
✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (35.01743ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-oLXU1A/state/token
✔ a team another process made between the look and the create is found, not a failure (28.362661ms)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (2.503437ms)
✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.446864ms)
✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (9.414557ms)
✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.371821ms)
✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.549561ms)
✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.332041ms)
✔ a verdict that landed out of date keeps its account on the pull request (0.306991ms)
✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.873903ms)
✔ a signed event is published on the bus and acted on once (96.548315ms)
✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (35.1393ms)
✔ an event and the poll seeing the same head announce it once (0.541692ms)
✔ each forge event is named in the module's stream and trimmed (0.622222ms)
✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.670895ms)
✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.284963ms)
✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (7.848712ms)
✔ a forge that makes no system webhook is said, never taken as heard (0.654752ms)
✔ the receiver tells what it verified and what it refused (8.553104ms)
✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.315814ms)
✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.533031ms)
✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.408942ms)
✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.24606ms)
ℹ tests 125
ℹ suites 0
ℹ pass 125
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 941.532741

**Merge check** at `d4b8b247` Judged: head `d4b8b2470159` merged into trunk `de6657c846b9`; read beside it: mesh-controller `7543f64911c5`, mesh-controller-main `7543f64911c5`, mesh-host `198fd34ec497`, mesh-tools `6b3e15042fee` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on novox as `build-1792096784505376750` (`builds --log build-1792096784505376750`). ``` - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 1 resource(s) and removes 0 (+directory:gitea.forge-patches) - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): gitea --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 48771 strings of 747 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.014s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/secrets 0.014s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 62, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 1.294s testing modules/gitea ok gitea/cmd/forge 1.598s ok gitea/cmd/npm-registry 1.973s ? gitea/internal/forgehttp [no test files] --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/gitea (TypeScript) testing modules/gitea (TypeScript) ✔ a pull request opened after the margin is looked at, by its own update time (23.121605ms) ✔ every open pull request is read with what its base requires and what its head has (gitea_open_pulls) (115.407989ms) ✔ a pull request or issue number that is not one is refused before the forge is asked (4.988075ms) ✔ a merged pull request whose branch was deleted is announced with its branch, not its pull ref (30.126456ms) ✔ a pull request's ready mark is read: the label and the head the newest listed ready comment names (42.836352ms) ✔ a ready comment by an account not listed is ignored, and said (0.507912ms) ✔ a ready comment older than the latest push, or than the label, never counts (128.823097ms) [gitea] f cannot be read (gone); only mesh-tools, mesh-admin may mark a pull request ready [gitea] f names no account that may mark a pull request ready; only mesh-tools, mesh-admin may ✔ a long thread hides nothing: every page of the timeline is read (33.124494ms) ✔ the accounts that may mark are the setting's, and only the mesh's own when it cannot be read (0.941803ms) ✔ the newest status of each context is kept, with what it said, when and by whom (117.811136ms) ✔ a commit merges only when every required status is a success; a warning blocks (0.481771ms) ✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.244171ms) ✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.724112ms) ✔ a note line is appended once, as the forge's user, in its own repository (20.405228ms) ✔ a note that cannot be written is said, never read as written (0.490372ms) ✔ one view per pull request, found by its marker; only the mesh's statuses (0.693942ms) ✔ a build machine taking the check is said on the head: building on which machine, since the local time (114.169746ms) ✔ the verdict heard while a 'building' write is in flight lands last and stays (18.785303ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.443834ms) ✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (1.879525ms) ✔ a start heard after the verdict writes nothing (0.509081ms) ✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (4.795944ms) ✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.114403ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (24.342269ms) ✔ a rechecked head says where its new run is: building on which machine (4.012961ms) ✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (3.428949ms) ✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (6.88035ms) ✔ a recheck the forge does not take fails its caller, and the head is as it was (3.40153ms) ✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (27.675939ms) ✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (4.561233ms) ✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (2.763028ms) ✔ a repository as the mesh clones it is told from another (0.438092ms) ✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (6.955449ms) ✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (106.932625ms) ✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (54.000474ms) ✔ gitea_api still writes what an author writes (18.948014ms) ✔ gitea_branch_protection_set only strengthens (39.984063ms) ✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (134.199602ms) ✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (182.308929ms) ✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (16.738308ms) ✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (15.428584ms) ✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (25.147821ms) ✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (60.023631ms) ✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (22.188954ms) ✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.465233ms) ✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (5.643356ms) ✔ a rule named for a branch is not made weaker than the glob rule that guards it now (13.95028ms) ✔ a repository owner or name is never another path (0.27216ms) ✔ the judges, without a forge (0.440581ms) ✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (3.225559ms) ✔ gitea_api never approves a pull request nor requests changes: those are the operator's (1.287244ms) ✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (5.227715ms) ✔ every page of a pull request's files is read, though the forge caps a page at fifty (59.9584ms) ✔ a pass asks only the repositories that moved since the last look, every one before the first (0.780822ms) ✔ the directories above a merge's files that hold a module at the commit are said, the root never (24.060909ms) ✔ a lookup the forge refuses is thrown, not read as no module (16.304706ms) ✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (22.548474ms) ✔ a new head beyond the newest 20 open pull requests is announced, exactly once (98.42856ms) ✔ a pass pages until it reaches back past its floor, and no further (55.742459ms) ✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (46.217452ms) ✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (30.238866ms) ✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (10.207509ms) ✔ the statuses asked for replace the rule's, and an empty list requires none (7.728532ms) ✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.350331ms) ✔ each open pull request's new head is announced once, and nothing closed or merged (14.03085ms) ✔ a verdict is the head commit's status; an error is the forge's error, never a success (0.926923ms) ✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.678172ms) ✔ no verdict sets warning on a required check; only a person's decision fails (0.956973ms) ✔ a commit status is set on the commit, under the merge check's context (75.597225ms) ✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.519892ms) ✔ a head announced is pending in the build queue, since the local time it was announced (0.350801ms) ✔ the vault's token is used, a setting of it is ignored and said once, without its value (3.62348ms) ✔ a consumer that asks nothing, or write, publishes: the package team (1.585145ms) ✔ a consumer that asks to read joins the readers, who write no package (0.464381ms) ✔ a reader is made, put on the readers team, and taken off the package team (0.557461ms) ✔ a publisher is made and put on the package team, as before (0.214021ms) ✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (73.85664ms) ✔ second start: reuses the kept token, mints nothing (38.048378ms) ✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (42.476511ms) ✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (34.259847ms) ✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (37.307786ms) ✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (27.712039ms) ✔ concurrent first calls share one mint (15.795976ms) ✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (15.969205ms) ✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (73.61595ms) ✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (5.831296ms) ✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (15.135833ms) ✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.849392ms) ✔ a second process finds the token the first renewed, and reuses it instead of minting over it (22.495744ms) ✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.683828ms) ✔ nothing to mint with and no token: the client says what is missing (0.211131ms) [gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-fhW5h2/state/token ✔ the tools register once there is a way to a token, and the first call mints it (28.826072ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-8N3pmP/state/token ✔ a pull request can be closed, read and cleaned up through the tools (37.309616ms) [gitea] no token kept — minting one [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nWzZPE/state/token ✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (100.472926ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-fli55j/state/token ✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (53.824994ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-YCMSiI/state/token ✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (49.06667ms) [gitea] the kept token was minted with other scopes than the tools take now — minting one with them [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-hTOQYb/state/token [gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now ✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (34.290897ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-CMVNAe/state/token ✔ a tools' account someone made an administrator is made a plain account again at the next mint (29.118163ms) ✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.956653ms) ✔ the manifest hands the tools their account, and the merge-ready authors name it rather than the administrator (1.057863ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-10DiFr/state/token ✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (28.838192ms) [gitea] no token kept — minting one ✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (14.938833ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-Vvmsut/state/token [gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"} ✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (35.01743ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-oLXU1A/state/token ✔ a team another process made between the look and the create is found, not a failure (28.362661ms) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (2.503437ms) ✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.446864ms) ✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (9.414557ms) ✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.371821ms) ✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.549561ms) ✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.332041ms) ✔ a verdict that landed out of date keeps its account on the pull request (0.306991ms) ✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.873903ms) ✔ a signed event is published on the bus and acted on once (96.548315ms) ✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (35.1393ms) ✔ an event and the poll seeing the same head announce it once (0.541692ms) ✔ each forge event is named in the module's stream and trimmed (0.622222ms) ✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.670895ms) ✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.284963ms) ✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (7.848712ms) ✔ a forge that makes no system webhook is said, never taken as heard (0.654752ms) ✔ the receiver tells what it verified and what it refused (8.553104ms) ✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.315814ms) ✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.533031ms) ✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.408942ms) ✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.24606ms) ℹ tests 125 ℹ suites 0 ℹ pass 125 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 941.532741 ```

mesh-tools commented

2026-10-15 20:55:14 +00:00

Merge check at d4b8b247
Judged: head d4b8b2470159 merged into trunk aee97bf8ad42; read beside it: mesh-controller 7543f64911c5, mesh-controller-main 7543f64911c5, mesh-host 198fd34ec497, mesh-tools 6b3e15042fee

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds gitea → novox; no bus step

tier 0: gitea
novox: receives gitea
gitea provides npm-package-registry, git: its consumers are sent again after it
gitea keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on novox as build-1792097522212689179 (builds --log build-1792097522212689179).

  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 1 resource(s) and removes 0 (+directory:gitea.forge-patches)
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): gitea
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 48771 strings of 747 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.017s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.010s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.014s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.007s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 62, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.293s
testing modules/gitea
ok  	gitea/cmd/forge	1.565s
ok  	gitea/cmd/npm-registry	1.947s
?   	gitea/internal/forgehttp	[no test files]
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/gitea (TypeScript)
testing modules/gitea (TypeScript)
✔ a pull request opened after the margin is looked at, by its own update time (43.134968ms)
✔ every open pull request is read with what its base requires and what its head has (gitea_open_pulls) (131.657208ms)
✔ a pull request or issue number that is not one is refused before the forge is asked (2.001194ms)
✔ a merged pull request whose branch was deleted is announced with its branch, not its pull ref (13.148787ms)
✔ a pull request's ready mark is read: the label and the head the newest listed ready comment names (16.079473ms)
✔ a ready comment by an account not listed is ignored, and said (0.460771ms)
✔ a ready comment older than the latest push, or than the label, never counts (50.557013ms)
[gitea] f cannot be read (gone); only mesh-tools, mesh-admin may mark a pull request ready
[gitea] f names no account that may mark a pull request ready; only mesh-tools, mesh-admin may
✔ a long thread hides nothing: every page of the timeline is read (21.354774ms)
✔ the accounts that may mark are the setting's, and only the mesh's own when it cannot be read (0.900712ms)
✔ the newest status of each context is kept, with what it said, when and by whom (18.401968ms)
✔ a commit merges only when every required status is a success; a warning blocks (0.622201ms)
✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.294751ms)
✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.815371ms)
✔ a note line is appended once, as the forge's user, in its own repository (13.335977ms)
✔ a note that cannot be written is said, never read as written (0.550941ms)
✔ one view per pull request, found by its marker; only the mesh's statuses (0.882371ms)
✔ a build machine taking the check is said on the head: building on which machine, since the local time (16.259093ms)
✔ the verdict heard while a 'building' write is in flight lands last and stays (8.159746ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ the verdict written while a start's read of the forge is in flight stays the newest status (0.990742ms)
✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (1.225053ms)
✔ a start heard after the verdict writes nothing (0.494701ms)
✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.613591ms)
✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.209592ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.440427ms)
✔ a rechecked head says where its new run is: building on which machine (0.848142ms)
✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.736032ms)
✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.590271ms)
✔ a recheck the forge does not take fails its caller, and the head is as it was (0.591091ms)
✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (8.446428ms)
✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.25747ms)
✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (2.541736ms)
✔ a repository as the mesh clones it is told from another (0.34777ms)
✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (7.670956ms)
✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (64.997712ms)
✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (41.352244ms)
✔ gitea_api still writes what an author writes (11.724634ms)
✔ gitea_branch_protection_set only strengthens (21.649674ms)
✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (57.927418ms)
✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (164.305454ms)
✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (18.499408ms)
✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (13.812888ms)
✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (27.125556ms)
✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (59.2373ms)
✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (22.085445ms)
✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.190769ms)
✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (7.196274ms)
✔ a rule named for a branch is not made weaker than the glob rule that guards it now (13.914608ms)
✔ a repository owner or name is never another path (0.398281ms)
✔ the judges, without a forge (0.33278ms)
✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (1.641343ms)
✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.501875ms)
✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (5.391471ms)
✔ every page of a pull request's files is read, though the forge caps a page at fifty (38.205738ms)
✔ a pass asks only the repositories that moved since the last look, every one before the first (0.633901ms)
✔ the directories above a merge's files that hold a module at the commit are said, the root never (27.304556ms)
✔ a lookup the forge refuses is thrown, not read as no module (19.109959ms)
✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (15.312861ms)
✔ a new head beyond the newest 20 open pull requests is announced, exactly once (81.112165ms)
✔ a pass pages until it reaches back past its floor, and no further (53.750589ms)
✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (25.108431ms)
✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (8.303057ms)
✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (4.229238ms)
✔ the statuses asked for replace the rule's, and an empty list requires none (8.159787ms)
✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.354831ms)
✔ each open pull request's new head is announced once, and nothing closed or merged (11.773094ms)
✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.044283ms)
✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.757821ms)
✔ no verdict sets warning on a required check; only a person's decision fails (1.069312ms)
✔ a commit status is set on the commit, under the merge check's context (46.031253ms)
✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.581412ms)
✔ a head announced is pending in the build queue, since the local time it was announced (0.37523ms)
✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.391035ms)
✔ a consumer that asks nothing, or write, publishes: the package team (1.631264ms)
✔ a consumer that asks to read joins the readers, who write no package (0.547941ms)
✔ a reader is made, put on the readers team, and taken off the package team (0.517131ms)
✔ a publisher is made and put on the package team, as before (0.21014ms)
✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (43.649109ms)
✔ second start: reuses the kept token, mints nothing (27.886237ms)
✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (88.4766ms)
✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (28.226927ms)
✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (46.513535ms)
✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (23.381378ms)
✔ concurrent first calls share one mint (13.343377ms)
✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (17.523746ms)
✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (54.04581ms)
✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (6.661564ms)
✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (16.633834ms)
✔ one process shares one source per kept file — the watcher and the tools never renew against each other (1.012882ms)
✔ a second process finds the token the first renewed, and reuses it instead of minting over it (22.442416ms)
✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.359054ms)
✔ nothing to mint with and no token: the client says what is missing (0.16625ms)
[gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-oUQJKa/state/token
✔ the tools register once there is a way to a token, and the first call mints it (27.520116ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-EytGas/state/token
✔ a pull request can be closed, read and cleaned up through the tools (37.880997ms)
[gitea] no token kept — minting one
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-MGDjVU/state/token
✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (62.201526ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-kISnj7/state/token
✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (43.899859ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-FvaWUz/state/token
✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (34.63877ms)
[gitea] the kept token was minted with other scopes than the tools take now — minting one with them
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-ygYJcm/state/token
[gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now
✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (57.839957ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-yf45vv/state/token
✔ a tools' account someone made an administrator is made a plain account again at the next mint (30.323811ms)
✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.766431ms)
✔ the manifest hands the tools their account, and the merge-ready authors name it rather than the administrator (1.506243ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-u8INzV/state/token
✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (29.22502ms)
[gitea] no token kept — minting one
✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (17.554106ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-oiDRAQ/state/token
[gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"}
✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (36.269164ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-wWrPot/state/token
✔ a team another process made between the look and the create is found, not a failure (29.914371ms)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (2.183965ms)
✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (4.446408ms)
✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (8.280526ms)
✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.36074ms)
✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.498222ms)
✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.28795ms)
✔ a verdict that landed out of date keeps its account on the pull request (0.261601ms)
✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (1.030802ms)
✔ a signed event is published on the bus and acted on once (75.130933ms)
✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (32.766376ms)
✔ an event and the poll seeing the same head announce it once (0.317761ms)
✔ each forge event is named in the module's stream and trimmed (0.496831ms)
✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.126043ms)
✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (0.973052ms)
✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (3.056706ms)
✔ a forge that makes no system webhook is said, never taken as heard (0.582401ms)
✔ the receiver tells what it verified and what it refused (7.603356ms)
✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.344463ms)
✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.432631ms)
✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.32406ms)
✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.17286ms)
ℹ tests 125
ℹ suites 0
ℹ pass 125
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 894.962431

**Merge check** at `d4b8b247` Judged: head `d4b8b2470159` merged into trunk `aee97bf8ad42`; read beside it: mesh-controller `7543f64911c5`, mesh-controller-main `7543f64911c5`, mesh-host `198fd34ec497`, mesh-tools `6b3e15042fee` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on novox as `build-1792097522212689179` (`builds --log build-1792097522212689179`). ``` - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 1 resource(s) and removes 0 (+directory:gitea.forge-patches) - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): gitea --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 48771 strings of 747 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.017s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/secrets 0.014s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/paths 0.007s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 62, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.293s testing modules/gitea ok gitea/cmd/forge 1.565s ok gitea/cmd/npm-registry 1.947s ? gitea/internal/forgehttp [no test files] --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/gitea (TypeScript) testing modules/gitea (TypeScript) ✔ a pull request opened after the margin is looked at, by its own update time (43.134968ms) ✔ every open pull request is read with what its base requires and what its head has (gitea_open_pulls) (131.657208ms) ✔ a pull request or issue number that is not one is refused before the forge is asked (2.001194ms) ✔ a merged pull request whose branch was deleted is announced with its branch, not its pull ref (13.148787ms) ✔ a pull request's ready mark is read: the label and the head the newest listed ready comment names (16.079473ms) ✔ a ready comment by an account not listed is ignored, and said (0.460771ms) ✔ a ready comment older than the latest push, or than the label, never counts (50.557013ms) [gitea] f cannot be read (gone); only mesh-tools, mesh-admin may mark a pull request ready [gitea] f names no account that may mark a pull request ready; only mesh-tools, mesh-admin may ✔ a long thread hides nothing: every page of the timeline is read (21.354774ms) ✔ the accounts that may mark are the setting's, and only the mesh's own when it cannot be read (0.900712ms) ✔ the newest status of each context is kept, with what it said, when and by whom (18.401968ms) ✔ a commit merges only when every required status is a success; a warning blocks (0.622201ms) ✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.294751ms) ✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.815371ms) ✔ a note line is appended once, as the forge's user, in its own repository (13.335977ms) ✔ a note that cannot be written is said, never read as written (0.550941ms) ✔ one view per pull request, found by its marker; only the mesh's statuses (0.882371ms) ✔ a build machine taking the check is said on the head: building on which machine, since the local time (16.259093ms) ✔ the verdict heard while a 'building' write is in flight lands last and stays (8.159746ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ the verdict written while a start's read of the forge is in flight stays the newest status (0.990742ms) ✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (1.225053ms) ✔ a start heard after the verdict writes nothing (0.494701ms) ✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.613591ms) ✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.209592ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.440427ms) ✔ a rechecked head says where its new run is: building on which machine (0.848142ms) ✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.736032ms) ✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.590271ms) ✔ a recheck the forge does not take fails its caller, and the head is as it was (0.591091ms) ✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (8.446428ms) ✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.25747ms) ✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (2.541736ms) ✔ a repository as the mesh clones it is told from another (0.34777ms) ✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (7.670956ms) ✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (64.997712ms) ✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (41.352244ms) ✔ gitea_api still writes what an author writes (11.724634ms) ✔ gitea_branch_protection_set only strengthens (21.649674ms) ✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (57.927418ms) ✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (164.305454ms) ✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (18.499408ms) ✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (13.812888ms) ✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (27.125556ms) ✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (59.2373ms) ✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (22.085445ms) ✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.190769ms) ✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (7.196274ms) ✔ a rule named for a branch is not made weaker than the glob rule that guards it now (13.914608ms) ✔ a repository owner or name is never another path (0.398281ms) ✔ the judges, without a forge (0.33278ms) ✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (1.641343ms) ✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.501875ms) ✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (5.391471ms) ✔ every page of a pull request's files is read, though the forge caps a page at fifty (38.205738ms) ✔ a pass asks only the repositories that moved since the last look, every one before the first (0.633901ms) ✔ the directories above a merge's files that hold a module at the commit are said, the root never (27.304556ms) ✔ a lookup the forge refuses is thrown, not read as no module (19.109959ms) ✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (15.312861ms) ✔ a new head beyond the newest 20 open pull requests is announced, exactly once (81.112165ms) ✔ a pass pages until it reaches back past its floor, and no further (53.750589ms) ✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (25.108431ms) ✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (8.303057ms) ✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (4.229238ms) ✔ the statuses asked for replace the rule's, and an empty list requires none (8.159787ms) ✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.354831ms) ✔ each open pull request's new head is announced once, and nothing closed or merged (11.773094ms) ✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.044283ms) ✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.757821ms) ✔ no verdict sets warning on a required check; only a person's decision fails (1.069312ms) ✔ a commit status is set on the commit, under the merge check's context (46.031253ms) ✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.581412ms) ✔ a head announced is pending in the build queue, since the local time it was announced (0.37523ms) ✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.391035ms) ✔ a consumer that asks nothing, or write, publishes: the package team (1.631264ms) ✔ a consumer that asks to read joins the readers, who write no package (0.547941ms) ✔ a reader is made, put on the readers team, and taken off the package team (0.517131ms) ✔ a publisher is made and put on the package team, as before (0.21014ms) ✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (43.649109ms) ✔ second start: reuses the kept token, mints nothing (27.886237ms) ✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (88.4766ms) ✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (28.226927ms) ✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (46.513535ms) ✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (23.381378ms) ✔ concurrent first calls share one mint (13.343377ms) ✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (17.523746ms) ✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (54.04581ms) ✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (6.661564ms) ✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (16.633834ms) ✔ one process shares one source per kept file — the watcher and the tools never renew against each other (1.012882ms) ✔ a second process finds the token the first renewed, and reuses it instead of minting over it (22.442416ms) ✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.359054ms) ✔ nothing to mint with and no token: the client says what is missing (0.16625ms) [gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-oUQJKa/state/token ✔ the tools register once there is a way to a token, and the first call mints it (27.520116ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-EytGas/state/token ✔ a pull request can be closed, read and cleaned up through the tools (37.880997ms) [gitea] no token kept — minting one [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-MGDjVU/state/token ✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (62.201526ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-kISnj7/state/token ✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (43.899859ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-FvaWUz/state/token ✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (34.63877ms) [gitea] the kept token was minted with other scopes than the tools take now — minting one with them [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-ygYJcm/state/token [gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now ✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (57.839957ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-yf45vv/state/token ✔ a tools' account someone made an administrator is made a plain account again at the next mint (30.323811ms) ✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.766431ms) ✔ the manifest hands the tools their account, and the merge-ready authors name it rather than the administrator (1.506243ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-u8INzV/state/token ✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (29.22502ms) [gitea] no token kept — minting one ✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (17.554106ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-oiDRAQ/state/token [gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"} ✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (36.269164ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-wWrPot/state/token ✔ a team another process made between the look and the create is found, not a failure (29.914371ms) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (2.183965ms) ✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (4.446408ms) ✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (8.280526ms) ✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.36074ms) ✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.498222ms) ✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.28795ms) ✔ a verdict that landed out of date keeps its account on the pull request (0.261601ms) ✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (1.030802ms) ✔ a signed event is published on the bus and acted on once (75.130933ms) ✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (32.766376ms) ✔ an event and the poll seeing the same head announce it once (0.317761ms) ✔ each forge event is named in the module's stream and trimmed (0.496831ms) ✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.126043ms) ✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (0.973052ms) ✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (3.056706ms) ✔ a forge that makes no system webhook is said, never taken as heard (0.582401ms) ✔ the receiver tells what it verified and what it refused (7.603356ms) ✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.344463ms) ✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.432631ms) ✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.32406ms) ✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.17286ms) ℹ tests 125 ℹ suites 0 ℹ pass 125 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 894.962431 ```

mesh-tools merged commit 7443938fef into main

2026-10-15 20:55:15 +00:00

mesh-tools deleted branch fix/852-commit-a-patch-file

2026-10-15 20:55:16 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#319