novox/mesh-catalog
13
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

No ready mark: the Approve is asked once the checks pass, and a group merges in one pass on its one Approve (issues 1022, 978) #352

Merged
mesh-tools merged 4 commits from feat/one-group-one-plan into main 2026-10-17 20:11:06 +00:00
Conversation 5 Commits 4 Files Changed 51
+1474 -2734
mesh-tools commented 2026-10-17 19:41:32 +00:00
Member
Copy Link
Copy Source

Design 47 milestone 3, with mesh-controller and hq on the same branch name (one delivery group).

Issue 1022 (ADR 0421): mesh-delivery asks the operator's Approve as soon as both checks pass, a group once for all members; the review record is read from the pull request's Reviewed-by: line and shown in the ask, never a gate; a new head or a Decline ends the Approve; no label, comment or mark-ready; after a trunk move the members' checks and the composed check are asked again and the same Approve merges (issue 1047).

Issue 978 (ADR 0401 §1 §7, 0418, 0419): a single pull request is a lone delivery; a group merges in one pass on its one Approve, the gitea merge tool taking the approved heads; no merge order, no turns, no delivery-order call; the groups answer says composed_gate; the composed verdict sets each member's mesh/merge-gate, pending while none exists; the merged announcement stays.

mesh-delivery's real-bus tests carry //go:build integration and run in the merge check (the script change shipped first as #351).

Reviewed-by: review-m3@shanks at 0771797431 (APPROVE, round 2)

Design 47 milestone 3, with mesh-controller and hq on the same branch name (one delivery group). Issue 1022 (ADR 0421): mesh-delivery asks the operator's Approve as soon as both checks pass, a group once for all members; the review record is read from the pull request's `Reviewed-by:` line and shown in the ask, never a gate; a new head or a Decline ends the Approve; no label, comment or mark-ready; after a trunk move the members' checks and the composed check are asked again and the same Approve merges (issue 1047). Issue 978 (ADR 0401 §1 §7, 0418, 0419): a single pull request is a lone delivery; a group merges in one pass on its one Approve, the gitea merge tool taking the approved heads; no merge order, no turns, no delivery-order call; the groups answer says `composed_gate`; the composed verdict sets each member's mesh/merge-gate, pending while none exists; the `merged` announcement stays. mesh-delivery's real-bus tests carry `//go:build integration` and run in the merge check (the script change shipped first as #351). Reviewed-by: review-m3@shanks at 0771797431edd1f927c3d404dad36cd4db122abf (APPROVE, round 2)
mesh-tools added 4 commits 2026-10-17 19:41:32 +00:00
Ask the Approve as soon as the checks pass, with no ready mark (issue 1022) 668444785d 
The review finishes before the push and its record is a Reviewed-by line in the
description, so the mark repeated what the push meant. mesh-delivery asks the
operator when a pull request's checks pass, keeps an ask through a trunk move
by asking the check again at once, and hands the merge tool the approved heads,
which replace the forge review of each sibling.
Merge a group in one pass on its one Approve, with no order and no turns (issue 978) 2d3b61ec45 
A group has no order: mesh-delivery asks the controller for none, reads no after:
line (it says once that the line is not read), merges every member in one pass
once the composed check passed and the Approve covers the heads, and gives the
plan its word once every member is merged. A failed member stops no other. The
composed verdict sets each member's mesh/merge-gate (pending, saying why, until
one stands), the groups answer says composed_gate, and a trunk move asks the
out-of-date members' checks at once and merges on the same Approve (issue 1047).
Leave a composed member's gate to the group's verdict, reword the mark leftovers, restore main's merge-check.sh (issues 1022, 978) 47e42806ff
Merge remote-tracking branch 'origin/main' into feat/one-group-one-plan
mesh/merge-gate head 0771797431ed merged into trunk f69f84b9e54c beside mesh-controller#374@2d24fbb7 — pass: builds gitea, mesh-delivery → novox; no bus st…
Details
mesh/repo-check head 0771797431ed merged into trunk f69f84b9e54c beside mesh-controller#374@2d24fbb7 — pass: its merge-check.sh passed, each part in its to…
Details
mesh/delivery delivered
Details
mesh/delivery-group group feat/one-group-one-plan delivered: every member is delivered
Details
0771797431
mesh-tools commented 2026-10-17 19:41:40 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-catalog@0771797431ed — delivered since 2026-10-17T20:20:27Z

Delivery plan — builds gitea, mesh-delivery → novox; no bus step

  • tier 0: gitea, mesh-delivery
  • novox: receives gitea, mesh-delivery
  • gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
  • gitea keeps data (ADR 0233): what it holds is backed up before it moves

Group feat/one-group-one-plan: novox/hq@64e357da7d, novox/mesh-catalog@0771797431, novox/mesh-controller@2d24fbb716

  • composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Machines

  • mesh-controller on every machine running it: sent
  • build-agent on every machine running it: sent
  • gitea on every machine running it: sent
  • mesh-delivery on every machine running it: sent

Transitions

  • 2026-10-17 19:41 (new) → proposed (announced): novox/mesh-catalog#352's head announced
  • 2026-10-17 19:45 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-17 19:45 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-17 20:03 ready → proposed (recheck): its statuses are out of date since 21:50 (judged beside mesh-controller#374's old head 9cdc7d62); rechecked now beside hq#413 so the group does not stall again on a lost merge-tool ask (as hq did at 22:00)
  • 2026-10-17 20:06 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-17 20:06 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-17 20:12 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-17 20:12 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-17 20:20 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@0771797431ed` — **delivered** since 2026-10-17T20:20:27Z **Delivery plan** — builds gitea, mesh-delivery → novox; no bus step - tier 0: gitea, mesh-delivery - novox: receives gitea, mesh-delivery - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves **Group** `feat/one-group-one-plan`: novox/hq@64e357da7d7e, novox/mesh-catalog@0771797431ed, novox/mesh-controller@2d24fbb71611 - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - mesh-controller on every machine running it: sent - build-agent on every machine running it: sent - gitea on every machine running it: sent - mesh-delivery on every machine running it: sent **Transitions** - 2026-10-17 19:41 (new) → proposed (announced): novox/mesh-catalog#352's head announced - 2026-10-17 19:45 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-17 19:45 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-17 20:03 ready → proposed (recheck): its statuses are out of date since 21:50 (judged beside mesh-controller#374's old head 9cdc7d62); rechecked now beside hq#413 so the group does not stall again on a lost merge-tool ask (as hq did at 22:00) - 2026-10-17 20:06 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-17 20:06 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-17 20:12 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-17 20:12 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-17 20:20 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools added the mesh/ready label 2026-10-17 19:42:01 +00:00
mesh-tools commented 2026-10-17 19:42:02 +00:00
Author
Member
Copy Link
Copy Source

ready at 0771797431

Reviewed by review-m3@shanks: milestone 3 review round 2 APPROVE: composed member gate pending, repo-check only, main's merge-check.sh. Marked through mesh-delivery.mark-ready (novox/hq issue 913).

ready at 0771797431edd1f927c3d404dad36cd4db122abf Reviewed by review-m3@shanks: milestone 3 review round 2 APPROVE: composed member gate pending, repo-check only, main's merge-check.sh. Marked through mesh-delivery.mark-ready (novox/hq issue 913).
mesh-tools commented 2026-10-17 19:45:46 +00:00
Author
Member
Copy Link
Copy Source

Merge check at 07717974
Judged: head 0771797431ed merged into trunk f69f84b9e54c; read beside it: mesh-controller 52d42b4b76cb, mesh-controller-main b77a298a7eee, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5
Siblings read beside it: novox/mesh-controller#374 9cdc7d6276d2 merged onto b77a298a7eee (main); judged by sibling novox/mesh-controller#374 merge 52d42b4b76cb

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea, mesh-delivery)
  • mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds gitea, mesh-delivery → novox; no bus step

  • tier 0: gitea, mesh-delivery
  • novox: receives gitea, mesh-delivery
  • gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
  • gitea keeps data (ADR 0233): what it holds is backed up before it moves
  • read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/approval_test.go, modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/covered_test.go, modules/mesh-delivery/cmd/mesh-delivery/events_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/holder_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue341_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue442_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue445_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue459_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue747_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue753_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue902_test.go, modules/mesh-delivery/cmd/mesh-delivery/manifest_test.go, modules/mesh-delivery/cmd/mesh-delivery/markready_test.go, modules/mesh-delivery/cmd/mesh-delivery/pullkey_test.go, modules/mesh-delivery/cmd/mesh-delivery/ready_test.go, modules/mesh-delivery/cmd/mesh-delivery/timers_test.go, modules/mesh-delivery/cmd/mesh-delivery/unchecked_events_test.go

Run by the build seat on shanks as build-1792266099717449204 (builds --log build-1792266099717449204).

✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.278204ms)
✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.892502ms)
✔ a note line is appended once, as the forge's user, in its own repository (24.404442ms)
✔ a note that cannot be written is said, never read as written (0.553597ms)
✔ one view per pull request, found by its marker; only the mesh's statuses (0.932443ms)
✔ a build machine taking the check is said on the head: building on which machine, since the local time (22.589748ms)
✔ the verdict heard while a 'building' write is in flight lands last and stays (6.102123ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.273857ms)
✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (0.661539ms)
✔ a start heard after the verdict writes nothing (0.666389ms)
✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.78877ms)
✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.076014ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.59043ms)
✔ a rechecked head says where its new run is: building on which machine (0.941122ms)
✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (2.512934ms)
✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.843901ms)
✔ a recheck the forge does not take fails its caller, and the head is as it was (0.605578ms)
✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (4.786595ms)
✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (1.284688ms)
✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (0.351375ms)
✔ a repository as the mesh clones it is told from another (0.326734ms)
✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (5.991661ms)
✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (46.967319ms)
✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (24.797567ms)
✔ gitea_api still writes what an author writes (7.253649ms)
✔ gitea_branch_protection_set only strengthens (16.616516ms)
✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (47.247553ms)
✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (144.692839ms)
✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (17.879683ms)
✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (14.02155ms)
✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (27.794438ms)
✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (56.159154ms)
✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (22.185042ms)
✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.930717ms)
✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (6.301325ms)
✔ a rule named for a branch is not made weaker than the glob rule that guards it now (15.643512ms)
✔ a repository owner or name is never another path (0.364725ms)
✔ the judges, without a forge (0.465607ms)
✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.303354ms)
✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.20929ms)
✔ gitea_api never approves a pull request nor requests changes: those are the operator's (1.723924ms)
✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (4.862896ms)
✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (89.164673ms)
✔ gitea_merge_pull_request refuses a head the Approve did not name (19.670547ms)
✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (19.391793ms)
✔ every page of a pull request's files is read, though the forge caps a page at fifty (37.102024ms)
✔ a pass asks only the repositories that moved since the last look, every one before the first (0.539998ms)
✔ the directories above a merge's files that hold a module at the commit are said, the root never (12.848185ms)
✔ a lookup the forge refuses is thrown, not read as no module (4.548412ms)
✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (5.517435ms)
✔ a new head beyond the newest 20 open pull requests is announced, exactly once (66.813518ms)
✔ a pass pages until it reaches back past its floor, and no further (28.022992ms)
✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (24.360361ms)
✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (6.718751ms)
✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (3.841612ms)
✔ the statuses asked for replace the rule's, and an empty list requires none (4.652373ms)
✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.384435ms)
✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (0.830591ms)
✔ another branch's body carries no merge whitelist (0.267624ms)
✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.379256ms)
✔ each open pull request's new head is announced once, and nothing closed or merged (25.352485ms)
✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.000494ms)
✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.642379ms)
✔ no verdict sets warning on a required check; only a person's decision fails (0.932063ms)
✔ a commit status is set on the commit, under the merge check's context (36.875861ms)
✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.476487ms)
✔ a head announced is pending in the build queue, since the local time it was announced (0.301825ms)
✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.444266ms)
✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.658509ms)
✔ the vault's token is used, a setting of it is ignored and said once, without its value (3.177464ms)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (2.459123ms)
✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (0.435526ms)
✔ a verdict without siblings is said exactly as before (an older controller) (2.141649ms)
✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (1.046414ms)
✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (2.149879ms)
✔ a sibling closed unmerged puts the member's verdict out of date (0.457276ms)
✔ a move of the sibling's base puts it out of date, naming both commits (0.528677ms)
✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (1.217657ms)
✔ a merge of another head, or onto another base, is a move (0.916423ms)
✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.76066ms)
✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.644388ms)
✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.342048ms)
✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.249764ms)
✔ a consumer that asks nothing, or write, publishes: the package team (1.882736ms)
✔ a consumer that asks to read joins the readers, who write no package (0.524147ms)
✔ a reader is made, put on the readers team, and taken off the package team (0.632479ms)
✔ a publisher is made and put on the package team, as before (0.257843ms)
✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (39.643229ms)
✔ second start: reuses the kept token, mints nothing (29.298059ms)
✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (26.353619ms)
✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (27.110329ms)
✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (27.283041ms)
✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (21.32833ms)
✔ concurrent first calls share one mint (12.696952ms)
✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (16.211441ms)
✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (92.165473ms)
✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (5.711828ms)
✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (15.878395ms)
✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.849541ms)
✔ a second process finds the token the first renewed, and reuses it instead of minting over it (20.068673ms)
✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.378933ms)
✔ nothing to mint with and no token: the client says what is missing (0.181043ms)
[gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-7hIYMm/state/token
✔ the tools register once there is a way to a token, and the first call mints it (28.846742ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-KXpYhe/state/token
✔ a pull request can be closed, read and cleaned up through the tools (38.304761ms)
[gitea] no token kept — minting one
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-sru2wb/state/token
✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (80.062878ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-kKC5xS/state/token
✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (48.49284ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-4Wz4Ec/state/token
✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (46.603954ms)
[gitea] the kept token was minted with other scopes than the tools take now — minting one with them
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-RmNDCi/state/token
[gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now
✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (42.884464ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-36G6DL/state/token
✔ a tools' account someone made an administrator is made a plain account again at the next mint (36.821411ms)
✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.788021ms)
✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (0.75988ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-UoqCSQ/state/token
✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (39.258594ms)
[gitea] no token kept — minting one
✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (27.869408ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-RpQo76/state/token
[gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"}
✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (44.82875ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-RgcMAo/state/token
✔ a team another process made between the look and the create is found, not a failure (36.235503ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-1owDMC/state/token
✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (34.665372ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-B9GDym/state/token
✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (35.088908ms)
✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (13.158019ms)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (2.603535ms)
✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.43696ms)
✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (6.739571ms)
✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.676569ms)
✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.558697ms)
✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.320094ms)
✔ a verdict that landed out of date keeps its account on the pull request (0.298394ms)
✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.888662ms)
✔ a signed event is published on the bus and acted on once (58.661858ms)
✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (34.753314ms)
✔ an event and the poll seeing the same head announce it once (0.484026ms)
✔ each forge event is named in the module's stream and trimmed (0.684869ms)
✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.531742ms)
✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.461071ms)
✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (4.947897ms)
✔ a forge that makes no system webhook is said, never taken as heard (0.926023ms)
✔ the receiver tells what it verified and what it refused (10.084368ms)
✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.43418ms)
✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.627528ms)
✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.455976ms)
✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.364305ms)
ℹ tests 150
ℹ suites 0
ℹ pass 150
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 824.380104
**Merge check** at `07717974` Judged: head `0771797431ed` merged into trunk `f69f84b9e54c`; read beside it: mesh-controller `52d42b4b76cb`, mesh-controller-main `b77a298a7eee`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` Siblings read beside it: novox/mesh-controller#374 `9cdc7d6276d2` merged onto `b77a298a7eee` (main); judged by sibling novox/mesh-controller#374 merge 52d42b4b76cb - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea, mesh-delivery) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds gitea, mesh-delivery → novox; no bus step - tier 0: gitea, mesh-delivery - novox: receives gitea, mesh-delivery - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/approval_test.go, modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/covered_test.go, modules/mesh-delivery/cmd/mesh-delivery/events_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/holder_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue341_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue442_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue445_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue459_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue747_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue753_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue902_test.go, modules/mesh-delivery/cmd/mesh-delivery/manifest_test.go, modules/mesh-delivery/cmd/mesh-delivery/markready_test.go, modules/mesh-delivery/cmd/mesh-delivery/pullkey_test.go, modules/mesh-delivery/cmd/mesh-delivery/ready_test.go, modules/mesh-delivery/cmd/mesh-delivery/timers_test.go, modules/mesh-delivery/cmd/mesh-delivery/unchecked_events_test.go Run by the build seat on shanks as `build-1792266099717449204` (`builds --log build-1792266099717449204`). ``` ✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.278204ms) ✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.892502ms) ✔ a note line is appended once, as the forge's user, in its own repository (24.404442ms) ✔ a note that cannot be written is said, never read as written (0.553597ms) ✔ one view per pull request, found by its marker; only the mesh's statuses (0.932443ms) ✔ a build machine taking the check is said on the head: building on which machine, since the local time (22.589748ms) ✔ the verdict heard while a 'building' write is in flight lands last and stays (6.102123ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.273857ms) ✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (0.661539ms) ✔ a start heard after the verdict writes nothing (0.666389ms) ✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.78877ms) ✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.076014ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.59043ms) ✔ a rechecked head says where its new run is: building on which machine (0.941122ms) ✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (2.512934ms) ✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.843901ms) ✔ a recheck the forge does not take fails its caller, and the head is as it was (0.605578ms) ✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (4.786595ms) ✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (1.284688ms) ✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (0.351375ms) ✔ a repository as the mesh clones it is told from another (0.326734ms) ✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (5.991661ms) ✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (46.967319ms) ✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (24.797567ms) ✔ gitea_api still writes what an author writes (7.253649ms) ✔ gitea_branch_protection_set only strengthens (16.616516ms) ✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (47.247553ms) ✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (144.692839ms) ✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (17.879683ms) ✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (14.02155ms) ✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (27.794438ms) ✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (56.159154ms) ✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (22.185042ms) ✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.930717ms) ✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (6.301325ms) ✔ a rule named for a branch is not made weaker than the glob rule that guards it now (15.643512ms) ✔ a repository owner or name is never another path (0.364725ms) ✔ the judges, without a forge (0.465607ms) ✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.303354ms) ✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.20929ms) ✔ gitea_api never approves a pull request nor requests changes: those are the operator's (1.723924ms) ✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (4.862896ms) ✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (89.164673ms) ✔ gitea_merge_pull_request refuses a head the Approve did not name (19.670547ms) ✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (19.391793ms) ✔ every page of a pull request's files is read, though the forge caps a page at fifty (37.102024ms) ✔ a pass asks only the repositories that moved since the last look, every one before the first (0.539998ms) ✔ the directories above a merge's files that hold a module at the commit are said, the root never (12.848185ms) ✔ a lookup the forge refuses is thrown, not read as no module (4.548412ms) ✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (5.517435ms) ✔ a new head beyond the newest 20 open pull requests is announced, exactly once (66.813518ms) ✔ a pass pages until it reaches back past its floor, and no further (28.022992ms) ✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (24.360361ms) ✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (6.718751ms) ✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (3.841612ms) ✔ the statuses asked for replace the rule's, and an empty list requires none (4.652373ms) ✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.384435ms) ✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (0.830591ms) ✔ another branch's body carries no merge whitelist (0.267624ms) ✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.379256ms) ✔ each open pull request's new head is announced once, and nothing closed or merged (25.352485ms) ✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.000494ms) ✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.642379ms) ✔ no verdict sets warning on a required check; only a person's decision fails (0.932063ms) ✔ a commit status is set on the commit, under the merge check's context (36.875861ms) ✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.476487ms) ✔ a head announced is pending in the build queue, since the local time it was announced (0.301825ms) ✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.444266ms) ✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.658509ms) ✔ the vault's token is used, a setting of it is ignored and said once, without its value (3.177464ms) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (2.459123ms) ✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (0.435526ms) ✔ a verdict without siblings is said exactly as before (an older controller) (2.141649ms) ✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (1.046414ms) ✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (2.149879ms) ✔ a sibling closed unmerged puts the member's verdict out of date (0.457276ms) ✔ a move of the sibling's base puts it out of date, naming both commits (0.528677ms) ✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (1.217657ms) ✔ a merge of another head, or onto another base, is a move (0.916423ms) ✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.76066ms) ✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.644388ms) ✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.342048ms) ✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.249764ms) ✔ a consumer that asks nothing, or write, publishes: the package team (1.882736ms) ✔ a consumer that asks to read joins the readers, who write no package (0.524147ms) ✔ a reader is made, put on the readers team, and taken off the package team (0.632479ms) ✔ a publisher is made and put on the package team, as before (0.257843ms) ✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (39.643229ms) ✔ second start: reuses the kept token, mints nothing (29.298059ms) ✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (26.353619ms) ✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (27.110329ms) ✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (27.283041ms) ✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (21.32833ms) ✔ concurrent first calls share one mint (12.696952ms) ✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (16.211441ms) ✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (92.165473ms) ✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (5.711828ms) ✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (15.878395ms) ✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.849541ms) ✔ a second process finds the token the first renewed, and reuses it instead of minting over it (20.068673ms) ✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.378933ms) ✔ nothing to mint with and no token: the client says what is missing (0.181043ms) [gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-7hIYMm/state/token ✔ the tools register once there is a way to a token, and the first call mints it (28.846742ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-KXpYhe/state/token ✔ a pull request can be closed, read and cleaned up through the tools (38.304761ms) [gitea] no token kept — minting one [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-sru2wb/state/token ✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (80.062878ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-kKC5xS/state/token ✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (48.49284ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-4Wz4Ec/state/token ✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (46.603954ms) [gitea] the kept token was minted with other scopes than the tools take now — minting one with them [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-RmNDCi/state/token [gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now ✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (42.884464ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-36G6DL/state/token ✔ a tools' account someone made an administrator is made a plain account again at the next mint (36.821411ms) ✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.788021ms) ✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (0.75988ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-UoqCSQ/state/token ✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (39.258594ms) [gitea] no token kept — minting one ✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (27.869408ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-RpQo76/state/token [gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"} ✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (44.82875ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-RgcMAo/state/token ✔ a team another process made between the look and the create is found, not a failure (36.235503ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-1owDMC/state/token ✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (34.665372ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-B9GDym/state/token ✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (35.088908ms) ✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (13.158019ms) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (2.603535ms) ✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.43696ms) ✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (6.739571ms) ✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.676569ms) ✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.558697ms) ✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.320094ms) ✔ a verdict that landed out of date keeps its account on the pull request (0.298394ms) ✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.888662ms) ✔ a signed event is published on the bus and acted on once (58.661858ms) ✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (34.753314ms) ✔ an event and the poll seeing the same head announce it once (0.484026ms) ✔ each forge event is named in the module's stream and trimmed (0.684869ms) ✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.531742ms) ✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.461071ms) ✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (4.947897ms) ✔ a forge that makes no system webhook is said, never taken as heard (0.926023ms) ✔ the receiver tells what it verified and what it refused (10.084368ms) ✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.43418ms) ✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.627528ms) ✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.455976ms) ✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.364305ms) ℹ tests 150 ℹ suites 0 ℹ pass 150 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 824.380104 ```
mesh-tools commented 2026-10-17 19:50:32 +00:00
Author
Member
Copy Link
Copy Source

Merge check at 07717974
Judged: head 0771797431ed merged into trunk f69f84b9e54c; read beside it: mesh-controller c6862718e14e, mesh-controller-main b77a298a7eee, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5
Siblings read beside it: novox/mesh-controller#374 9cdc7d6276d2 merged onto b77a298a7eee (main); judged by sibling novox/mesh-controller#374 merge c6862718e14e

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea, mesh-delivery)
  • mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds gitea, mesh-delivery → novox; no bus step

  • tier 0: gitea, mesh-delivery
  • novox: receives gitea, mesh-delivery
  • gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
  • gitea keeps data (ADR 0233): what it holds is backed up before it moves
  • read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/approval_test.go, modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/covered_test.go, modules/mesh-delivery/cmd/mesh-delivery/events_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/holder_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue341_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue442_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue445_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue459_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue747_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue753_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue902_test.go, modules/mesh-delivery/cmd/mesh-delivery/manifest_test.go, modules/mesh-delivery/cmd/mesh-delivery/markready_test.go, modules/mesh-delivery/cmd/mesh-delivery/pullkey_test.go, modules/mesh-delivery/cmd/mesh-delivery/ready_test.go, modules/mesh-delivery/cmd/mesh-delivery/timers_test.go, modules/mesh-delivery/cmd/mesh-delivery/unchecked_events_test.go

Run by the build seat on ace as build-1792266125904374788 (builds --log build-1792266125904374788).

✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.311966ms)
✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.966426ms)
✔ a note line is appended once, as the forge's user, in its own repository (17.944108ms)
✔ a note that cannot be written is said, never read as written (0.566454ms)
✔ one view per pull request, found by its marker; only the mesh's statuses (1.130134ms)
✔ a build machine taking the check is said on the head: building on which machine, since the local time (37.764491ms)
✔ the verdict heard while a 'building' write is in flight lands last and stays (12.475353ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.255018ms)
✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (1.436389ms)
✔ a start heard after the verdict writes nothing (0.567787ms)
✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.698302ms)
✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.036628ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.88982ms)
✔ a rechecked head says where its new run is: building on which machine (0.897797ms)
✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.759317ms)
✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.641135ms)
✔ a recheck the forge does not take fails its caller, and the head is as it was (0.590489ms)
✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (8.609487ms)
✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.259558ms)
✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (0.382058ms)
✔ a repository as the mesh clones it is told from another (0.276259ms)
✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (5.286624ms)
✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (49.904174ms)
✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (17.963565ms)
✔ gitea_api still writes what an author writes (8.100271ms)
✔ gitea_branch_protection_set only strengthens (15.193489ms)
✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (42.719543ms)
✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (140.837736ms)
✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (16.079895ms)
✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (14.046704ms)
✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (24.730662ms)
✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (54.579599ms)
✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (21.65911ms)
✔ gitea_api sends the path it judged, and refuses moving a pull request's base (3.990759ms)
✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (6.707413ms)
✔ a rule named for a branch is not made weaker than the glob rule that guards it now (13.548067ms)
✔ a repository owner or name is never another path (0.244519ms)
✔ the judges, without a forge (0.350438ms)
✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.235883ms)
✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.400371ms)
✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.138839ms)
✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (4.513071ms)
✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (82.15695ms)
✔ gitea_merge_pull_request refuses a head the Approve did not name (18.826627ms)
✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (13.460424ms)
✔ every page of a pull request's files is read, though the forge caps a page at fifty (31.197062ms)
✔ a pass asks only the repositories that moved since the last look, every one before the first (0.538271ms)
✔ the directories above a merge's files that hold a module at the commit are said, the root never (13.468058ms)
✔ a lookup the forge refuses is thrown, not read as no module (4.460611ms)
✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (5.706373ms)
✔ a new head beyond the newest 20 open pull requests is announced, exactly once (67.300893ms)
✔ a pass pages until it reaches back past its floor, and no further (25.94795ms)
✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (24.909949ms)
✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (6.303303ms)
✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (2.635882ms)
✔ the statuses asked for replace the rule's, and an empty list requires none (4.658424ms)
✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.348776ms)
✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (0.775307ms)
✔ another branch's body carries no merge whitelist (0.290936ms)
✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.353454ms)
✔ each open pull request's new head is announced once, and nothing closed or merged (19.066587ms)
✔ a verdict is the head commit's status; an error is the forge's error, never a success (0.827355ms)
✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.561194ms)
✔ no verdict sets warning on a required check; only a person's decision fails (0.793271ms)
✔ a commit status is set on the commit, under the merge check's context (32.139673ms)
✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.422765ms)
✔ a head announced is pending in the build queue, since the local time it was announced (0.258316ms)
✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.418847ms)
✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.450336ms)
✔ the vault's token is used, a setting of it is ignored and said once, without its value (3.864823ms)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (2.33614ms)
✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (0.373742ms)
✔ a verdict without siblings is said exactly as before (an older controller) (1.42129ms)
✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (0.904088ms)
✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (1.719841ms)
✔ a sibling closed unmerged puts the member's verdict out of date (0.305685ms)
✔ a move of the sibling's base puts it out of date, naming both commits (0.372319ms)
✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.555884ms)
✔ a merge of another head, or onto another base, is a move (0.539604ms)
✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.490672ms)
✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.432503ms)
✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (0.873782ms)
✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.168476ms)
✔ a consumer that asks nothing, or write, publishes: the package team (1.54896ms)
✔ a consumer that asks to read joins the readers, who write no package (0.455816ms)
✔ a reader is made, put on the readers team, and taken off the package team (0.556866ms)
✔ a publisher is made and put on the package team, as before (0.310213ms)
✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (38.752929ms)
✔ second start: reuses the kept token, mints nothing (22.168677ms)
✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (20.859016ms)
✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (24.047978ms)
✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (27.088522ms)
✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (21.172424ms)
✔ concurrent first calls share one mint (13.886644ms)
✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (13.221124ms)
✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (55.93772ms)
✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (6.903263ms)
✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (14.601798ms)
✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.684185ms)
✔ a second process finds the token the first renewed, and reuses it instead of minting over it (20.762634ms)
✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.127808ms)
✔ nothing to mint with and no token: the client says what is missing (0.163558ms)
[gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-dDwiqc/state/token
✔ the tools register once there is a way to a token, and the first call mints it (26.117187ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-oLG7J3/state/token
✔ a pull request can be closed, read and cleaned up through the tools (37.37475ms)
[gitea] no token kept — minting one
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-gS4fMZ/state/token
✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (68.060632ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-av0T5m/state/token
✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (45.550031ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-3gnsYP/state/token
✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (43.12857ms)
[gitea] the kept token was minted with other scopes than the tools take now — minting one with them
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-T9oFks/state/token
[gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now
✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (43.177395ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-U7wgzd/state/token
✔ a tools' account someone made an administrator is made a plain account again at the next mint (35.118239ms)
✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.753566ms)
✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (0.700867ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-Iglo5e/state/token
✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (36.093592ms)
[gitea] no token kept — minting one
✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (25.944925ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-ME44ss/state/token
[gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"}
✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (43.983738ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-8VpIc0/state/token
✔ a team another process made between the look and the create is found, not a failure (37.364702ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-HcKrln/state/token
✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (35.103562ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-ryPc0K/state/token
✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (35.837761ms)
✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (12.726826ms)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away
✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (1.498246ms)
✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (0.886346ms)
✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (3.936076ms)
✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.316063ms)
✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.377128ms)
✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.216227ms)
✔ a verdict that landed out of date keeps its account on the pull request (0.215645ms)
✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.413156ms)
✔ a signed event is published on the bus and acted on once (49.707294ms)
✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (25.922651ms)
✔ an event and the poll seeing the same head announce it once (0.351039ms)
✔ each forge event is named in the module's stream and trimmed (0.46281ms)
✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.079348ms)
✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (0.945496ms)
✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (2.782518ms)
✔ a forge that makes no system webhook is said, never taken as heard (0.557979ms)
✔ the receiver tells what it verified and what it refused (7.155335ms)
✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (0.876768ms)
✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.359425ms)
✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.312598ms)
✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.17053ms)
ℹ tests 150
ℹ suites 0
ℹ pass 150
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 716.797638
**Merge check** at `07717974` Judged: head `0771797431ed` merged into trunk `f69f84b9e54c`; read beside it: mesh-controller `c6862718e14e`, mesh-controller-main `b77a298a7eee`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` Siblings read beside it: novox/mesh-controller#374 `9cdc7d6276d2` merged onto `b77a298a7eee` (main); judged by sibling novox/mesh-controller#374 merge c6862718e14e - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea, mesh-delivery) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds gitea, mesh-delivery → novox; no bus step - tier 0: gitea, mesh-delivery - novox: receives gitea, mesh-delivery - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/approval_test.go, modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/covered_test.go, modules/mesh-delivery/cmd/mesh-delivery/events_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/holder_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue341_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue442_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue445_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue459_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue747_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue753_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue902_test.go, modules/mesh-delivery/cmd/mesh-delivery/manifest_test.go, modules/mesh-delivery/cmd/mesh-delivery/markready_test.go, modules/mesh-delivery/cmd/mesh-delivery/pullkey_test.go, modules/mesh-delivery/cmd/mesh-delivery/ready_test.go, modules/mesh-delivery/cmd/mesh-delivery/timers_test.go, modules/mesh-delivery/cmd/mesh-delivery/unchecked_events_test.go Run by the build seat on ace as `build-1792266125904374788` (`builds --log build-1792266125904374788`). ``` ✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.311966ms) ✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.966426ms) ✔ a note line is appended once, as the forge's user, in its own repository (17.944108ms) ✔ a note that cannot be written is said, never read as written (0.566454ms) ✔ one view per pull request, found by its marker; only the mesh's statuses (1.130134ms) ✔ a build machine taking the check is said on the head: building on which machine, since the local time (37.764491ms) ✔ the verdict heard while a 'building' write is in flight lands last and stays (12.475353ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.255018ms) ✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (1.436389ms) ✔ a start heard after the verdict writes nothing (0.567787ms) ✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.698302ms) ✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.036628ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.88982ms) ✔ a rechecked head says where its new run is: building on which machine (0.897797ms) ✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.759317ms) ✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.641135ms) ✔ a recheck the forge does not take fails its caller, and the head is as it was (0.590489ms) ✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (8.609487ms) ✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.259558ms) ✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (0.382058ms) ✔ a repository as the mesh clones it is told from another (0.276259ms) ✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (5.286624ms) ✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (49.904174ms) ✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (17.963565ms) ✔ gitea_api still writes what an author writes (8.100271ms) ✔ gitea_branch_protection_set only strengthens (15.193489ms) ✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (42.719543ms) ✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (140.837736ms) ✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (16.079895ms) ✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (14.046704ms) ✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (24.730662ms) ✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (54.579599ms) ✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (21.65911ms) ✔ gitea_api sends the path it judged, and refuses moving a pull request's base (3.990759ms) ✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (6.707413ms) ✔ a rule named for a branch is not made weaker than the glob rule that guards it now (13.548067ms) ✔ a repository owner or name is never another path (0.244519ms) ✔ the judges, without a forge (0.350438ms) ✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.235883ms) ✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.400371ms) ✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.138839ms) ✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (4.513071ms) ✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (82.15695ms) ✔ gitea_merge_pull_request refuses a head the Approve did not name (18.826627ms) ✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (13.460424ms) ✔ every page of a pull request's files is read, though the forge caps a page at fifty (31.197062ms) ✔ a pass asks only the repositories that moved since the last look, every one before the first (0.538271ms) ✔ the directories above a merge's files that hold a module at the commit are said, the root never (13.468058ms) ✔ a lookup the forge refuses is thrown, not read as no module (4.460611ms) ✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (5.706373ms) ✔ a new head beyond the newest 20 open pull requests is announced, exactly once (67.300893ms) ✔ a pass pages until it reaches back past its floor, and no further (25.94795ms) ✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (24.909949ms) ✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (6.303303ms) ✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (2.635882ms) ✔ the statuses asked for replace the rule's, and an empty list requires none (4.658424ms) ✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.348776ms) ✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (0.775307ms) ✔ another branch's body carries no merge whitelist (0.290936ms) ✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.353454ms) ✔ each open pull request's new head is announced once, and nothing closed or merged (19.066587ms) ✔ a verdict is the head commit's status; an error is the forge's error, never a success (0.827355ms) ✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.561194ms) ✔ no verdict sets warning on a required check; only a person's decision fails (0.793271ms) ✔ a commit status is set on the commit, under the merge check's context (32.139673ms) ✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.422765ms) ✔ a head announced is pending in the build queue, since the local time it was announced (0.258316ms) ✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.418847ms) ✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.450336ms) ✔ the vault's token is used, a setting of it is ignored and said once, without its value (3.864823ms) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (2.33614ms) ✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (0.373742ms) ✔ a verdict without siblings is said exactly as before (an older controller) (1.42129ms) ✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (0.904088ms) ✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (1.719841ms) ✔ a sibling closed unmerged puts the member's verdict out of date (0.305685ms) ✔ a move of the sibling's base puts it out of date, naming both commits (0.372319ms) ✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.555884ms) ✔ a merge of another head, or onto another base, is a move (0.539604ms) ✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.490672ms) ✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.432503ms) ✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (0.873782ms) ✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.168476ms) ✔ a consumer that asks nothing, or write, publishes: the package team (1.54896ms) ✔ a consumer that asks to read joins the readers, who write no package (0.455816ms) ✔ a reader is made, put on the readers team, and taken off the package team (0.556866ms) ✔ a publisher is made and put on the package team, as before (0.310213ms) ✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (38.752929ms) ✔ second start: reuses the kept token, mints nothing (22.168677ms) ✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (20.859016ms) ✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (24.047978ms) ✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (27.088522ms) ✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (21.172424ms) ✔ concurrent first calls share one mint (13.886644ms) ✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (13.221124ms) ✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (55.93772ms) ✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (6.903263ms) ✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (14.601798ms) ✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.684185ms) ✔ a second process finds the token the first renewed, and reuses it instead of minting over it (20.762634ms) ✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.127808ms) ✔ nothing to mint with and no token: the client says what is missing (0.163558ms) [gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-dDwiqc/state/token ✔ the tools register once there is a way to a token, and the first call mints it (26.117187ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-oLG7J3/state/token ✔ a pull request can be closed, read and cleaned up through the tools (37.37475ms) [gitea] no token kept — minting one [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-gS4fMZ/state/token ✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (68.060632ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-av0T5m/state/token ✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (45.550031ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-3gnsYP/state/token ✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (43.12857ms) [gitea] the kept token was minted with other scopes than the tools take now — minting one with them [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-T9oFks/state/token [gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now ✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (43.177395ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-U7wgzd/state/token ✔ a tools' account someone made an administrator is made a plain account again at the next mint (35.118239ms) ✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.753566ms) ✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (0.700867ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-Iglo5e/state/token ✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (36.093592ms) [gitea] no token kept — minting one ✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (25.944925ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-ME44ss/state/token [gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"} ✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (43.983738ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-8VpIc0/state/token ✔ a team another process made between the look and the create is found, not a failure (37.364702ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-HcKrln/state/token ✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (35.103562ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-ryPc0K/state/token ✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (35.837761ms) ✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (12.726826ms) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away ✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (1.498246ms) ✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (0.886346ms) ✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (3.936076ms) ✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.316063ms) ✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.377128ms) ✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.216227ms) ✔ a verdict that landed out of date keeps its account on the pull request (0.215645ms) ✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.413156ms) ✔ a signed event is published on the bus and acted on once (49.707294ms) ✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (25.922651ms) ✔ an event and the poll seeing the same head announce it once (0.351039ms) ✔ each forge event is named in the module's stream and trimmed (0.46281ms) ✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.079348ms) ✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (0.945496ms) ✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (2.782518ms) ✔ a forge that makes no system webhook is said, never taken as heard (0.557979ms) ✔ the receiver tells what it verified and what it refused (7.155335ms) ✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (0.876768ms) ✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.359425ms) ✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.312598ms) ✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.17053ms) ℹ tests 150 ℹ suites 0 ℹ pass 150 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 716.797638 ```
mesh-tools commented 2026-10-17 20:06:49 +00:00
Author
Member
Copy Link
Copy Source

Merge check at 07717974
Judged: head 0771797431ed merged into trunk f69f84b9e54c; read beside it: mesh-controller ec0424e344bc, mesh-controller-main b77a298a7eee, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5
Siblings read beside it: novox/mesh-controller#374 2d24fbb71611 merged onto b77a298a7eee (main); judged by sibling novox/mesh-controller#374 merge ec0424e344bc

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea, mesh-delivery)
  • mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds gitea, mesh-delivery → novox; no bus step

  • tier 0: gitea, mesh-delivery
  • novox: receives gitea, mesh-delivery
  • gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
  • gitea keeps data (ADR 0233): what it holds is backed up before it moves
  • read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/approval_test.go, modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/covered_test.go, modules/mesh-delivery/cmd/mesh-delivery/events_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/holder_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue341_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue442_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue445_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue459_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue747_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue753_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue902_test.go, modules/mesh-delivery/cmd/mesh-delivery/manifest_test.go, modules/mesh-delivery/cmd/mesh-delivery/markready_test.go, modules/mesh-delivery/cmd/mesh-delivery/pullkey_test.go, modules/mesh-delivery/cmd/mesh-delivery/ready_test.go, modules/mesh-delivery/cmd/mesh-delivery/timers_test.go, modules/mesh-delivery/cmd/mesh-delivery/unchecked_events_test.go

Run by the build seat on shanks as build-1792267391779065737 (builds --log build-1792267391779065737).

✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.248324ms)
✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.841993ms)
✔ a note line is appended once, as the forge's user, in its own repository (15.389408ms)
✔ a note that cannot be written is said, never read as written (0.505508ms)
✔ one view per pull request, found by its marker; only the mesh's statuses (0.825642ms)
✔ a build machine taking the check is said on the head: building on which machine, since the local time (39.700409ms)
✔ the verdict heard while a 'building' write is in flight lands last and stays (7.618094ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.222518ms)
✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (0.726231ms)
✔ a start heard after the verdict writes nothing (0.62567ms)
✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.897764ms)
✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.093697ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.408221ms)
✔ a rechecked head says where its new run is: building on which machine (0.952064ms)
✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (1.35727ms)
✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.724601ms)
✔ a recheck the forge does not take fails its caller, and the head is as it was (0.622849ms)
✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (7.021654ms)
✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.346085ms)
✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (2.67024ms)
✔ a repository as the mesh clones it is told from another (0.400326ms)
✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (6.07553ms)
✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (53.746928ms)
✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (26.557204ms)
✔ gitea_api still writes what an author writes (6.469767ms)
✔ gitea_branch_protection_set only strengthens (16.897131ms)
✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (46.900685ms)
✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (166.111386ms)
✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (20.346831ms)
✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (16.614566ms)
✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (31.041761ms)
✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (62.02117ms)
✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (25.245245ms)
✔ gitea_api sends the path it judged, and refuses moving a pull request's base (3.975109ms)
✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (6.609908ms)
✔ a rule named for a branch is not made weaker than the glob rule that guards it now (15.49363ms)
✔ a repository owner or name is never another path (0.571629ms)
✔ the judges, without a forge (0.370665ms)
✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.243623ms)
✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (1.953579ms)
✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.762082ms)
✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (5.752666ms)
✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (85.243585ms)
✔ gitea_merge_pull_request refuses a head the Approve did not name (18.26577ms)
✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (15.151315ms)
✔ every page of a pull request's files is read, though the forge caps a page at fifty (33.469877ms)
✔ a pass asks only the repositories that moved since the last look, every one before the first (0.547198ms)
✔ the directories above a merge's files that hold a module at the commit are said, the root never (18.229931ms)
✔ a lookup the forge refuses is thrown, not read as no module (5.35162ms)
✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (7.498031ms)
✔ a new head beyond the newest 20 open pull requests is announced, exactly once (69.038476ms)
✔ a pass pages until it reaches back past its floor, and no further (30.814117ms)
✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (23.780682ms)
✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (9.41947ms)
✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (5.230517ms)
✔ the statuses asked for replace the rule's, and an empty list requires none (6.713959ms)
✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.476747ms)
✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (1.686965ms)
✔ another branch's body carries no merge whitelist (0.295974ms)
✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (4.424755ms)
✔ each open pull request's new head is announced once, and nothing closed or merged (16.647627ms)
✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.099276ms)
✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.991634ms)
✔ no verdict sets warning on a required check; only a person's decision fails (1.580333ms)
✔ a commit status is set on the commit, under the merge check's context (44.906097ms)
✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.541408ms)
✔ a head announced is pending in the build queue, since the local time it was announced (0.308215ms)
✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.516338ms)
✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.527568ms)
✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.796351ms)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (1.787806ms)
✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (0.308625ms)
✔ a verdict without siblings is said exactly as before (an older controller) (0.619999ms)
✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (0.926124ms)
✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (1.926748ms)
✔ a sibling closed unmerged puts the member's verdict out of date (1.586223ms)
✔ a move of the sibling's base puts it out of date, naming both commits (0.410046ms)
✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.528718ms)
✔ a merge of another head, or onto another base, is a move (0.769251ms)
✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.654719ms)
✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.623319ms)
✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.271399ms)
✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.245744ms)
✔ a consumer that asks nothing, or write, publishes: the package team (1.523743ms)
✔ a consumer that asks to read joins the readers, who write no package (0.367765ms)
✔ a reader is made, put on the readers team, and taken off the package team (0.435657ms)
✔ a publisher is made and put on the package team, as before (0.176373ms)
✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (42.018144ms)
✔ second start: reuses the kept token, mints nothing (25.768893ms)
✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (31.954884ms)
✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (29.724391ms)
✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (25.487498ms)
✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (23.428728ms)
✔ concurrent first calls share one mint (12.729098ms)
✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (15.884936ms)
✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (58.421207ms)
✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (7.386289ms)
✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (15.441089ms)
✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.753362ms)
✔ a second process finds the token the first renewed, and reuses it instead of minting over it (19.148455ms)
✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.234273ms)
✔ nothing to mint with and no token: the client says what is missing (0.170532ms)
[gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-XFYPOy/state/token
✔ the tools register once there is a way to a token, and the first call mints it (29.719871ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-WN1rPa/state/token
✔ a pull request can be closed, read and cleaned up through the tools (36.749045ms)
[gitea] no token kept — minting one
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-7A96IQ/state/token
✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (78.910111ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nqzlZe/state/token
✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (55.495894ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-EkUwm0/state/token
✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (43.448505ms)
[gitea] the kept token was minted with other scopes than the tools take now — minting one with them
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-p7vERK/state/token
[gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now
✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (48.536131ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-DyHxXv/state/token
✔ a tools' account someone made an administrator is made a plain account again at the next mint (43.985282ms)
✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.825452ms)
✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (1.070656ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-5OqOHN/state/token
✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (41.447185ms)
[gitea] no token kept — minting one
✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (31.506628ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-yaqGer/state/token
[gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"}
✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (52.217364ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-vuIzIb/state/token
✔ a team another process made between the look and the create is found, not a failure (43.511186ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-ZrnaVz/state/token
✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (38.815796ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-rykDqj/state/token
✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (39.966724ms)
✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (14.555657ms)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (3.024024ms)
✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.726166ms)
✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (6.705571ms)
✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.501147ms)
✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (1.091326ms)
✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.385496ms)
✔ a verdict that landed out of date keeps its account on the pull request (0.369816ms)
✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.975884ms)
✔ a signed event is published on the bus and acted on once (71.771865ms)
✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (40.055804ms)
✔ an event and the poll seeing the same head announce it once (0.487737ms)
✔ each forge event is named in the module's stream and trimmed (0.69896ms)
✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.608334ms)
✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.38361ms)
✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (5.170436ms)
✔ a forge that makes no system webhook is said, never taken as heard (1.064595ms)
✔ the receiver tells what it verified and what it refused (11.276547ms)
✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.38548ms)
✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.599919ms)
✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.439056ms)
✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.228303ms)
ℹ tests 150
ℹ suites 0
ℹ pass 150
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 890.147181
**Merge check** at `07717974` Judged: head `0771797431ed` merged into trunk `f69f84b9e54c`; read beside it: mesh-controller `ec0424e344bc`, mesh-controller-main `b77a298a7eee`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` Siblings read beside it: novox/mesh-controller#374 `2d24fbb71611` merged onto `b77a298a7eee` (main); judged by sibling novox/mesh-controller#374 merge ec0424e344bc - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea, mesh-delivery) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds gitea, mesh-delivery → novox; no bus step - tier 0: gitea, mesh-delivery - novox: receives gitea, mesh-delivery - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/approval_test.go, modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/covered_test.go, modules/mesh-delivery/cmd/mesh-delivery/events_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/holder_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue341_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue442_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue445_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue459_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue747_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue753_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue902_test.go, modules/mesh-delivery/cmd/mesh-delivery/manifest_test.go, modules/mesh-delivery/cmd/mesh-delivery/markready_test.go, modules/mesh-delivery/cmd/mesh-delivery/pullkey_test.go, modules/mesh-delivery/cmd/mesh-delivery/ready_test.go, modules/mesh-delivery/cmd/mesh-delivery/timers_test.go, modules/mesh-delivery/cmd/mesh-delivery/unchecked_events_test.go Run by the build seat on shanks as `build-1792267391779065737` (`builds --log build-1792267391779065737`). ``` ✔ no rule requires nothing; a rule that cannot be read says nothing, never yes (0.248324ms) ✔ a commit is contained in another when the compare finds nothing on it the other lacks (0.841993ms) ✔ a note line is appended once, as the forge's user, in its own repository (15.389408ms) ✔ a note that cannot be written is said, never read as written (0.505508ms) ✔ one view per pull request, found by its marker; only the mesh's statuses (0.825642ms) ✔ a build machine taking the check is said on the head: building on which machine, since the local time (39.700409ms) ✔ the verdict heard while a 'building' write is in flight lands last and stays (7.618094ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.222518ms) ✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (0.726231ms) ✔ a start heard after the verdict writes nothing (0.62567ms) ✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.897764ms) ✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.093697ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.408221ms) ✔ a rechecked head says where its new run is: building on which machine (0.952064ms) ✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (1.35727ms) ✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.724601ms) ✔ a recheck the forge does not take fails its caller, and the head is as it was (0.622849ms) ✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (7.021654ms) ✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.346085ms) ✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (2.67024ms) ✔ a repository as the mesh clones it is told from another (0.400326ms) ✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (6.07553ms) ✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (53.746928ms) ✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (26.557204ms) ✔ gitea_api still writes what an author writes (6.469767ms) ✔ gitea_branch_protection_set only strengthens (16.897131ms) ✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (46.900685ms) ✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (166.111386ms) ✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (20.346831ms) ✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (16.614566ms) ✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (31.041761ms) ✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (62.02117ms) ✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (25.245245ms) ✔ gitea_api sends the path it judged, and refuses moving a pull request's base (3.975109ms) ✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (6.609908ms) ✔ a rule named for a branch is not made weaker than the glob rule that guards it now (15.49363ms) ✔ a repository owner or name is never another path (0.571629ms) ✔ the judges, without a forge (0.370665ms) ✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.243623ms) ✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (1.953579ms) ✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.762082ms) ✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (5.752666ms) ✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (85.243585ms) ✔ gitea_merge_pull_request refuses a head the Approve did not name (18.26577ms) ✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (15.151315ms) ✔ every page of a pull request's files is read, though the forge caps a page at fifty (33.469877ms) ✔ a pass asks only the repositories that moved since the last look, every one before the first (0.547198ms) ✔ the directories above a merge's files that hold a module at the commit are said, the root never (18.229931ms) ✔ a lookup the forge refuses is thrown, not read as no module (5.35162ms) ✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (7.498031ms) ✔ a new head beyond the newest 20 open pull requests is announced, exactly once (69.038476ms) ✔ a pass pages until it reaches back past its floor, and no further (30.814117ms) ✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (23.780682ms) ✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (9.41947ms) ✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (5.230517ms) ✔ the statuses asked for replace the rule's, and an empty list requires none (6.713959ms) ✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.476747ms) ✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (1.686965ms) ✔ another branch's body carries no merge whitelist (0.295974ms) ✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (4.424755ms) ✔ each open pull request's new head is announced once, and nothing closed or merged (16.647627ms) ✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.099276ms) ✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.991634ms) ✔ no verdict sets warning on a required check; only a person's decision fails (1.580333ms) ✔ a commit status is set on the commit, under the merge check's context (44.906097ms) ✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.541408ms) ✔ a head announced is pending in the build queue, since the local time it was announced (0.308215ms) ✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.516338ms) ✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.527568ms) ✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.796351ms) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (1.787806ms) ✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (0.308625ms) ✔ a verdict without siblings is said exactly as before (an older controller) (0.619999ms) ✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (0.926124ms) ✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (1.926748ms) ✔ a sibling closed unmerged puts the member's verdict out of date (1.586223ms) ✔ a move of the sibling's base puts it out of date, naming both commits (0.410046ms) ✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.528718ms) ✔ a merge of another head, or onto another base, is a move (0.769251ms) ✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.654719ms) ✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.623319ms) ✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.271399ms) ✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.245744ms) ✔ a consumer that asks nothing, or write, publishes: the package team (1.523743ms) ✔ a consumer that asks to read joins the readers, who write no package (0.367765ms) ✔ a reader is made, put on the readers team, and taken off the package team (0.435657ms) ✔ a publisher is made and put on the package team, as before (0.176373ms) ✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (42.018144ms) ✔ second start: reuses the kept token, mints nothing (25.768893ms) ✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (31.954884ms) ✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (29.724391ms) ✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (25.487498ms) ✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (23.428728ms) ✔ concurrent first calls share one mint (12.729098ms) ✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (15.884936ms) ✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (58.421207ms) ✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (7.386289ms) ✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (15.441089ms) ✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.753362ms) ✔ a second process finds the token the first renewed, and reuses it instead of minting over it (19.148455ms) ✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.234273ms) ✔ nothing to mint with and no token: the client says what is missing (0.170532ms) [gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-XFYPOy/state/token ✔ the tools register once there is a way to a token, and the first call mints it (29.719871ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-WN1rPa/state/token ✔ a pull request can be closed, read and cleaned up through the tools (36.749045ms) [gitea] no token kept — minting one [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-7A96IQ/state/token ✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (78.910111ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nqzlZe/state/token ✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (55.495894ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-EkUwm0/state/token ✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (43.448505ms) [gitea] the kept token was minted with other scopes than the tools take now — minting one with them [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-p7vERK/state/token [gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now ✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (48.536131ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-DyHxXv/state/token ✔ a tools' account someone made an administrator is made a plain account again at the next mint (43.985282ms) ✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.825452ms) ✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (1.070656ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-5OqOHN/state/token ✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (41.447185ms) [gitea] no token kept — minting one ✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (31.506628ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-yaqGer/state/token [gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"} ✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (52.217364ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-vuIzIb/state/token ✔ a team another process made between the look and the create is found, not a failure (43.511186ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-ZrnaVz/state/token ✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (38.815796ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-rykDqj/state/token ✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (39.966724ms) ✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (14.555657ms) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (3.024024ms) ✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.726166ms) ✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (6.705571ms) ✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.501147ms) ✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (1.091326ms) ✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.385496ms) ✔ a verdict that landed out of date keeps its account on the pull request (0.369816ms) ✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.975884ms) ✔ a signed event is published on the bus and acted on once (71.771865ms) ✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (40.055804ms) ✔ an event and the poll seeing the same head announce it once (0.487737ms) ✔ each forge event is named in the module's stream and trimmed (0.69896ms) ✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.608334ms) ✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.38361ms) ✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (5.170436ms) ✔ a forge that makes no system webhook is said, never taken as heard (1.064595ms) ✔ the receiver tells what it verified and what it refused (11.276547ms) ✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.38548ms) ✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.599919ms) ✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.439056ms) ✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.228303ms) ℹ tests 150 ℹ suites 0 ℹ pass 150 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 890.147181 ```
mesh-tools merged commit f076cadece into main 2026-10-17 20:11:06 +00:00
mesh-tools deleted branch feat/one-group-one-plan 2026-10-17 20:11:06 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels mesh/ready
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-catalog#352