A group approved together merges in one pass and goes out in one delivery plan (design 47 milestone 3 fix: issues 1049, 1082, 1047, 1083, 1079) #356

Merged

mesh-tools merged 8 commits from feat/group-one-pass into main 2026-10-17 23:44:21 +00:00

Conversation 2 Commits 8 Files Changed 16

+759 -14

mesh-tools commented 2026-10-17 23:20:53 +00:00

Member

Copy Link

Copy Source

Milestone "3 fix" of design 47 (hq 03-DESIGN/01-to-be/47): a group approved together merges in one pass and goes out in one delivery plan, also when its members' tests read each other's repositories (acceptance test 1).

• issue 1049 (gitea): a group's composed verdict refreshes each member's siblings record at the heads it composed, so a sibling's own merge of the judged head is no move of the base.
• issue 1082 (mesh-delivery): a closed group's member whose merge is refused asks the composed check again at once; a refusal loop past ten minutes is said as stalled.
• issue 1047 (mesh-delivery): a trunk move asks a group member's check again at once, and a composed verdict judged against a moved trunk is out of date and asked again, whichever verdict lands first.
• issue 1083 (mesh-delivery): a new pull request at a commit whose delivery was stopped and unmerged takes that delivery over.
• issue 1079 (gitea, mesh-delivery): an edit of the description is heard (new consumed subject gitea.forge.pull-request.edited, so a grants step); an unanswered Approve ask whose review record changed is withdrawn and asked again (the operator agreed 2026-10-18).

Tests: each issue's unit test failed first; mesh-delivery unit suite ~0.3 s, gitea 155 of 155. Integration: bus_test.go extended for 1079 (compiled only; runs in the merge gate). Opened along the way: 1085.

Reviewed-by: reviewer-group-one-pass@shanks at 7383bc3170

Milestone "3 fix" of design 47 (hq 03-DESIGN/01-to-be/47): a group approved together merges in one pass and goes out in one delivery plan, also when its members' tests read each other's repositories (acceptance test 1). - issue 1049 (gitea): a group's composed verdict refreshes each member's siblings record at the heads it composed, so a sibling's own merge of the judged head is no move of the base. - issue 1082 (mesh-delivery): a closed group's member whose merge is refused asks the composed check again at once; a refusal loop past ten minutes is said as stalled. - issue 1047 (mesh-delivery): a trunk move asks a group member's check again at once, and a composed verdict judged against a moved trunk is out of date and asked again, whichever verdict lands first. - issue 1083 (mesh-delivery): a new pull request at a commit whose delivery was stopped and unmerged takes that delivery over. - issue 1079 (gitea, mesh-delivery): an edit of the description is heard (new consumed subject gitea.forge.pull-request.edited, so a grants step); an unanswered Approve ask whose review record changed is withdrawn and asked again (the operator agreed 2026-10-18). Tests: each issue's unit test failed first; mesh-delivery unit suite ~0.3 s, gitea 155 of 155. Integration: bus_test.go extended for 1079 (compiled only; runs in the merge gate). Opened along the way: 1085. Reviewed-by: reviewer-group-one-pass@shanks at 7383bc31703eca05b6663e351f844c6568da2d18

mesh-tools added 8 commits 2026-10-17 23:20:53 +00:00

A group's composed verdict names each member's siblings at the heads it composed, so a sibling's own merge is no move (issue 1049) da094008ea

A closed group's member whose merge was refused asks the composed check again at once, and a refusal loop past ten minutes is said (issue 1082) 983e4a6444

A trunk move asks at once the check of a group member whose Approve is not asked yet (issue 1047) 814c1a991c

A new pull request at a commit whose delivery was stopped and unmerged takes that delivery over (issue 1083) 93365be98f

Read a pull request's review record again when its description is edited, and ask the Approve again if it was unanswered (issue 1079) 6556e61485

A composed check that lands judged against a trunk that has moved is out of date and asked again (issue 1047, review round 1) e8a74765f8

Prove over a real bus that an edit of the description asks the Approve again (issue 1079, review round 1) ebd29223f3

A stale composed pass counts members judged since it was asked, whichever verdict lands first (issue 1047, review round 2) 7383bc3170

mesh-tools commented 2026-10-17 23:20:57 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@7383bc31703e — delivered since 2026-10-17T23:46:53Z

Delivery plan — builds gitea, mesh-delivery → novox; no bus step

• tier 0: gitea, mesh-delivery
• novox: receives gitea, mesh-delivery
• gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
• gitea keeps data (ADR 0233): what it holds is backed up before it moves

Machines

• gitea on every machine running it: sent
• mesh-delivery on every machine running it: sent

Transitions

• 2026-10-17 23:20 (new) → proposed (announced): novox/mesh-catalog#356's head announced
• 2026-10-17 23:23 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-17 23:23 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-17 23:44 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-17 23:44 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-17 23:46 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@7383bc31703e` — **delivered** since 2026-10-17T23:46:53Z **Delivery plan** — builds gitea, mesh-delivery → novox; no bus step - tier 0: gitea, mesh-delivery - novox: receives gitea, mesh-delivery - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - gitea on every machine running it: sent - mesh-delivery on every machine running it: sent **Transitions** - 2026-10-17 23:20 (new) → proposed (announced): novox/mesh-catalog#356's head announced - 2026-10-17 23:23 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-17 23:23 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-17 23:44 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-17 23:44 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-17 23:46 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented 2026-10-17 23:23:51 +00:00

Author

Member

Copy Link

Copy Source

Merge check at 7383bc31
Judged: head 7383bc31703e merged into trunk 0c56f603059b; read beside it: mesh-controller 47f9290b37aa, mesh-controller-main 47f9290b37aa, mesh-host 6469e8238443, mesh-tools 7412c5b6c9c5

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea, mesh-delivery)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds gitea, mesh-delivery → novox; no bus step

• tier 0: gitea, mesh-delivery
• novox: receives gitea, mesh-delivery
• gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
• gitea keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue1079_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue1083_test.go

Run by the build seat on ace as build-1792279256474978398 (builds --log build-1792279256474978398).

[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.468446ms)
✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (0.602816ms)
✔ a start heard after the verdict writes nothing (0.460628ms)
✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.576005ms)
✔ an old run's verdict redelivered after a recheck's pending is not written over it (0.962062ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (2.754158ms)
✔ a rechecked head says where its new run is: building on which machine (0.88097ms)
✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.803553ms)
✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.617673ms)
✔ a recheck the forge does not take fails its caller, and the head is as it was (0.595251ms)
✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (10.669818ms)
✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.258777ms)
✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (3.836977ms)
✔ a repository as the mesh clones it is told from another (0.314272ms)
✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (4.239205ms)
✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (47.351713ms)
✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (16.997377ms)
✔ gitea_api still writes what an author writes (5.605339ms)
✔ gitea_branch_protection_set only strengthens (13.065058ms)
✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (45.624939ms)
✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (134.987745ms)
✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (15.636473ms)
✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (14.058632ms)
✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (23.299798ms)
✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (54.228386ms)
✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (22.192712ms)
✔ gitea_api sends the path it judged, and refuses moving a pull request's base (3.257636ms)
✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (7.047205ms)
✔ a rule named for a branch is not made weaker than the glob rule that guards it now (13.869766ms)
✔ a repository owner or name is never another path (0.229933ms)
✔ the judges, without a forge (0.344269ms)
✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.24994ms)
✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.569941ms)
✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.284974ms)
✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (4.772448ms)
✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (82.977748ms)
✔ gitea_merge_pull_request refuses a head the Approve did not name (18.028219ms)
✔ a group of two merges in one pass: the sibling's merge of the composed head does not stop the member's merge (issue 1049) (16.655523ms)
✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (8.920413ms)
✔ every page of a pull request's files is read, though the forge caps a page at fifty (28.507608ms)
✔ a pass asks only the repositories that moved since the last look, every one before the first (0.446131ms)
✔ the directories above a merge's files that hold a module at the commit are said, the root never (12.693649ms)
✔ a lookup the forge refuses is thrown, not read as no module (4.395289ms)
✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (5.701049ms)
✔ a new head beyond the newest 20 open pull requests is announced, exactly once (70.114859ms)
✔ a pass pages until it reaches back past its floor, and no further (19.643852ms)
✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (25.886992ms)
✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (6.72649ms)
✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (3.829943ms)
✔ the statuses asked for replace the rule's, and an empty list requires none (3.829483ms)
✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.337426ms)
✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (0.716369ms)
✔ another branch's body carries no merge whitelist (0.62631ms)
✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.317869ms)
✔ each open pull request's new head is announced once, and nothing closed or merged (19.986948ms)
✔ a verdict is the head commit's status; an error is the forge's error, never a success (0.762065ms)
✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.566968ms)
✔ no verdict sets warning on a required check; only a person's decision fails (0.803002ms)
✔ a commit status is set on the commit, under the merge check's context (36.979615ms)
✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.412527ms)
✔ a head announced is pending in the build queue, since the local time it was announced (0.252646ms)
✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.452242ms)
✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.48825ms)
✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.729882ms)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head dddddddddddd onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (2.107119ms)
✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (0.364096ms)
✔ a verdict without siblings is said exactly as before (an older controller) (1.35932ms)
✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (0.887932ms)
✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (1.685315ms)
✔ a sibling closed unmerged puts the member's verdict out of date (0.28665ms)
✔ a move of the sibling's base puts it out of date, naming both commits (0.378904ms)
✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.561929ms)
✔ a merge of another head, or onto another base, is a move (0.752528ms)
✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.67974ms)
✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.610821ms)
✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.219798ms)
✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.241084ms)
✔ without the composed verdict's siblings, a sibling's own merge of its new head is a move (the pin of issue 1049) (0.291028ms)
✔ a composed verdict names the siblings of each member at the heads and base commits it composed, so a sibling's own merge of its new head is no move (issue 1049) (0.794767ms)
✔ a composed verdict keeps nothing for a member it cannot name, and a group of one is none (issue 1049) (0.245853ms)
✔ a consumer that asks nothing, or write, publishes: the package team (1.694281ms)
✔ a consumer that asks to read joins the readers, who write no package (0.427145ms)
✔ a reader is made, put on the readers team, and taken off the package team (0.500964ms)
✔ a publisher is made and put on the package team, as before (0.225225ms)
✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (28.401888ms)
✔ second start: reuses the kept token, mints nothing (22.628755ms)
✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (22.347754ms)
✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (23.458578ms)
✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (25.552951ms)
✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (21.326612ms)
✔ concurrent first calls share one mint (12.716532ms)
✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (15.246489ms)
✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (58.462321ms)
✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (4.883448ms)
✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (14.584089ms)
✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.577328ms)
✔ a second process finds the token the first renewed, and reuses it instead of minting over it (21.536587ms)
✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.217107ms)
✔ nothing to mint with and no token: the client says what is missing (0.179578ms)
[gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-QdDwrv/state/token
✔ the tools register once there is a way to a token, and the first call mints it (28.461911ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-bD8Kw6/state/token
✔ a pull request can be closed, read and cleaned up through the tools (35.021667ms)
[gitea] no token kept — minting one
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-Wsz68Y/state/token
✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (69.624726ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-FlaY6i/state/token
✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (42.468835ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-VUEGMd/state/token
✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (42.121711ms)
[gitea] the kept token was minted with other scopes than the tools take now — minting one with them
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-M6Ca29/state/token
[gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now
✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (41.152125ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-tkLuoo/state/token
✔ a tools' account someone made an administrator is made a plain account again at the next mint (34.779571ms)
✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.62075ms)
✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (0.7595ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-k8XBRN/state/token
✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (36.104787ms)
[gitea] no token kept — minting one
✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (25.24849ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-we672L/state/token
[gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"}
✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (42.968736ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-jj42EK/state/token
✔ a team another process made between the look and the create is found, not a failure (35.184053ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-fgLSUv/state/token
✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (35.732586ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nllDkD/state/token
✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (35.709413ms)
✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (11.487298ms)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (1.655738ms)
✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.119448ms)
✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (5.330881ms)
✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.422346ms)
✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.542372ms)
✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.407728ms)
✔ a verdict that landed out of date keeps its account on the pull request (0.295176ms)
✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.491555ms)
✔ a signed event is published on the bus and acted on once (64.553084ms)
✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (27.006279ms)
✔ an event and the poll seeing the same head announce it once (0.310405ms)
✔ each forge event is named in the module's stream and trimmed (0.479163ms)
✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.071008ms)
✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (0.960769ms)
✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (2.947202ms)
✔ a forge that makes no system webhook is said, never taken as heard (0.613736ms)
✔ the receiver tells what it verified and what it refused (5.946451ms)
✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (0.974906ms)
✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.349959ms)
✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.313641ms)
✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.165582ms)
✔ a pull request's edit event carries its description, and no other pull request event does (issue 1079) (0.189677ms)
ℹ tests 155
ℹ suites 0
ℹ pass 155
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 717.141967

**Merge check** at `7383bc31` Judged: head `7383bc31703e` merged into trunk `0c56f603059b`; read beside it: mesh-controller `47f9290b37aa`, mesh-controller-main `47f9290b37aa`, mesh-host `6469e8238443`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea, mesh-delivery) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds gitea, mesh-delivery → novox; no bus step - tier 0: gitea, mesh-delivery - novox: receives gitea, mesh-delivery - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: modules/mesh-delivery/cmd/mesh-delivery/bus_test.go, modules/mesh-delivery/cmd/mesh-delivery/fakes_test.go, modules/mesh-delivery/cmd/mesh-delivery/group_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue1079_test.go, modules/mesh-delivery/cmd/mesh-delivery/issue1083_test.go Run by the build seat on ace as `build-1792279256474978398` (`builds --log build-1792279256474978398`). ``` [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ the verdict written while a start's read of the forge is in flight stays the newest status (1.468446ms) ✔ the verdict heard while a 'building' write still waits its turn: the 'building' is never written (0.602816ms) ✔ a start heard after the verdict writes nothing (0.460628ms) ✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.576005ms) ✔ an old run's verdict redelivered after a recheck's pending is not written over it (0.962062ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (2.754158ms) ✔ a rechecked head says where its new run is: building on which machine (0.88097ms) ✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.803553ms) ✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.617673ms) ✔ a recheck the forge does not take fails its caller, and the head is as it was (0.595251ms) ✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (10.669818ms) ✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.258777ms) ✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (3.836977ms) ✔ a repository as the mesh clones it is told from another (0.314272ms) ✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (4.239205ms) ✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (47.351713ms) ✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (16.997377ms) ✔ gitea_api still writes what an author writes (5.605339ms) ✔ gitea_branch_protection_set only strengthens (13.065058ms) ✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (45.624939ms) ✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (134.987745ms) ✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (15.636473ms) ✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (14.058632ms) ✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (23.299798ms) ✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (54.228386ms) ✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (22.192712ms) ✔ gitea_api sends the path it judged, and refuses moving a pull request's base (3.257636ms) ✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (7.047205ms) ✔ a rule named for a branch is not made weaker than the glob rule that guards it now (13.869766ms) ✔ a repository owner or name is never another path (0.229933ms) ✔ the judges, without a forge (0.344269ms) ✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.24994ms) ✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.569941ms) ✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.284974ms) ✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (4.772448ms) ✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (82.977748ms) ✔ gitea_merge_pull_request refuses a head the Approve did not name (18.028219ms) ✔ a group of two merges in one pass: the sibling's merge of the composed head does not stop the member's merge (issue 1049) (16.655523ms) ✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (8.920413ms) ✔ every page of a pull request's files is read, though the forge caps a page at fifty (28.507608ms) ✔ a pass asks only the repositories that moved since the last look, every one before the first (0.446131ms) ✔ the directories above a merge's files that hold a module at the commit are said, the root never (12.693649ms) ✔ a lookup the forge refuses is thrown, not read as no module (4.395289ms) ✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (5.701049ms) ✔ a new head beyond the newest 20 open pull requests is announced, exactly once (70.114859ms) ✔ a pass pages until it reaches back past its floor, and no further (19.643852ms) ✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (25.886992ms) ✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (6.72649ms) ✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (3.829943ms) ✔ the statuses asked for replace the rule's, and an empty list requires none (3.829483ms) ✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.337426ms) ✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (0.716369ms) ✔ another branch's body carries no merge whitelist (0.62631ms) ✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.317869ms) ✔ each open pull request's new head is announced once, and nothing closed or merged (19.986948ms) ✔ a verdict is the head commit's status; an error is the forge's error, never a success (0.762065ms) ✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.566968ms) ✔ no verdict sets warning on a required check; only a person's decision fails (0.803002ms) ✔ a commit status is set on the commit, under the merge check's context (36.979615ms) ✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.412527ms) ✔ a head announced is pending in the build queue, since the local time it was announced (0.252646ms) ✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.452242ms) ✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.48825ms) ✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.729882ms) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head dddddddddddd onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) ✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (2.107119ms) ✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (0.364096ms) ✔ a verdict without siblings is said exactly as before (an older controller) (1.35932ms) ✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (0.887932ms) ✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (1.685315ms) ✔ a sibling closed unmerged puts the member's verdict out of date (0.28665ms) ✔ a move of the sibling's base puts it out of date, naming both commits (0.378904ms) ✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.561929ms) ✔ a merge of another head, or onto another base, is a move (0.752528ms) ✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.67974ms) ✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.610821ms) ✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.219798ms) ✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.241084ms) ✔ without the composed verdict's siblings, a sibling's own merge of its new head is a move (the pin of issue 1049) (0.291028ms) ✔ a composed verdict names the siblings of each member at the heads and base commits it composed, so a sibling's own merge of its new head is no move (issue 1049) (0.794767ms) ✔ a composed verdict keeps nothing for a member it cannot name, and a group of one is none (issue 1049) (0.245853ms) ✔ a consumer that asks nothing, or write, publishes: the package team (1.694281ms) ✔ a consumer that asks to read joins the readers, who write no package (0.427145ms) ✔ a reader is made, put on the readers team, and taken off the package team (0.500964ms) ✔ a publisher is made and put on the package team, as before (0.225225ms) ✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (28.401888ms) ✔ second start: reuses the kept token, mints nothing (22.628755ms) ✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (22.347754ms) ✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (23.458578ms) ✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (25.552951ms) ✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (21.326612ms) ✔ concurrent first calls share one mint (12.716532ms) ✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (15.246489ms) ✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (58.462321ms) ✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (4.883448ms) ✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (14.584089ms) ✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.577328ms) ✔ a second process finds the token the first renewed, and reuses it instead of minting over it (21.536587ms) ✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.217107ms) ✔ nothing to mint with and no token: the client says what is missing (0.179578ms) [gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-QdDwrv/state/token ✔ the tools register once there is a way to a token, and the first call mints it (28.461911ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-bD8Kw6/state/token ✔ a pull request can be closed, read and cleaned up through the tools (35.021667ms) [gitea] no token kept — minting one [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-Wsz68Y/state/token ✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (69.624726ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-FlaY6i/state/token ✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (42.468835ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-VUEGMd/state/token ✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (42.121711ms) [gitea] the kept token was minted with other scopes than the tools take now — minting one with them [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-M6Ca29/state/token [gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now ✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (41.152125ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-tkLuoo/state/token ✔ a tools' account someone made an administrator is made a plain account again at the next mint (34.779571ms) ✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.62075ms) ✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (0.7595ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-k8XBRN/state/token ✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (36.104787ms) [gitea] no token kept — minting one ✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (25.24849ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-we672L/state/token [gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"} ✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (42.968736ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-jj42EK/state/token ✔ a team another process made between the look and the create is found, not a failure (35.184053ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-fgLSUv/state/token ✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (35.732586ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nllDkD/state/token ✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (35.709413ms) ✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (11.487298ms) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (1.655738ms) ✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.119448ms) ✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (5.330881ms) ✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.422346ms) ✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.542372ms) ✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.407728ms) ✔ a verdict that landed out of date keeps its account on the pull request (0.295176ms) ✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.491555ms) ✔ a signed event is published on the bus and acted on once (64.553084ms) ✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (27.006279ms) ✔ an event and the poll seeing the same head announce it once (0.310405ms) ✔ each forge event is named in the module's stream and trimmed (0.479163ms) ✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.071008ms) ✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (0.960769ms) ✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (2.947202ms) ✔ a forge that makes no system webhook is said, never taken as heard (0.613736ms) ✔ the receiver tells what it verified and what it refused (5.946451ms) ✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (0.974906ms) ✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.349959ms) ✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.313641ms) ✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.165582ms) ✔ a pull request's edit event carries its description, and no other pull request event does (issue 1079) (0.189677ms) ℹ tests 155 ℹ suites 0 ℹ pass 155 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 717.141967 ```

mesh-tools merged commit 44e7002d3c into main 2026-10-17 23:44:21 +00:00

mesh-tools deleted branch feat/group-one-pass 2026-10-17 23:44:22 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#356