novox/mesh-catalog
13
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Read the grant file on keycloak's moved path, so a consumer not moved gets its client (issue 1332) #378

Merged
mesh-tools merged 2 commits from fix/1332-keycloak-reads-the-grant-file into main 2026-10-19 22:46:05 +00:00
Conversation 2 Commits 2 Files Changed 4
+186 -10
mesh-tools commented 2026-10-19 22:42:00 +00:00
Member
Copy Link
Copy Source

Issue 1332. Since b0dc3323 (issue 849) keycloak's provider has run on the moved path with WithGrants: false and no Receives, so it learned its consumers only from moved modules' plans. mesh-mail-web, grafana and car-hunter are not moved. So mesh_novox_mail_web was never made (the mail web client's sign-in says 'Client not found'), and mesh_ace_grafana and mesh_ace_carhunt were held for retirement (the URGENT condition provider.keycloak.novox.retire).

  • moved.go: WithGrants true, as postgres's provider (issue 937).
  • main.go: the moved-path harness is built by movedHarness and reads MESH_RECEIVES, as the grant path does.
  • Tests 1332/AC1 (a grant-file consumer is made), 1332/AC2 (an existing grant-file client is not retired), 1332/AC3 (the moved harness reads MESH_RECEIVES); each fails without the fix.

The first pass after delivery Ensures the 3 grant-file clients: it creates mesh_novox_mail_web, and updates mesh_ace_grafana and mesh_ace_carhunt in place with the values they were last given (their oidc-client pairs were made once, on 2026-09-30, and never re-minted). The review expects no value of theirs to change. Sign-in on grafana.zurag.be and car-hunter.zurag.be is read right after the delivery (1332/AC5).

Tried before opening: build-1792449086089615612 passed at b9104454.

Reviewed-by: review-1332@g14 at b9104454f9

Issue 1332. Since b0dc3323 (issue 849) keycloak's provider has run on the moved path with WithGrants: false and no Receives, so it learned its consumers only from moved modules' plans. mesh-mail-web, grafana and car-hunter are not moved. So mesh_novox_mail_web was never made (the mail web client's sign-in says 'Client not found'), and mesh_ace_grafana and mesh_ace_carhunt were held for retirement (the URGENT condition provider.keycloak.novox.retire). - moved.go: WithGrants true, as postgres's provider (issue 937). - main.go: the moved-path harness is built by movedHarness and reads MESH_RECEIVES, as the grant path does. - Tests 1332/AC1 (a grant-file consumer is made), 1332/AC2 (an existing grant-file client is not retired), 1332/AC3 (the moved harness reads MESH_RECEIVES); each fails without the fix. The first pass after delivery Ensures the 3 grant-file clients: it creates mesh_novox_mail_web, and updates mesh_ace_grafana and mesh_ace_carhunt in place with the values they were last given (their oidc-client pairs were made once, on 2026-09-30, and never re-minted). The review expects no value of theirs to change. Sign-in on grafana.zurag.be and car-hunter.zurag.be is read right after the delivery (1332/AC5). Tried before opening: build-1792449086089615612 passed at b9104454. Reviewed-by: review-1332@g14 at b9104454f9a5a3461c6a969ae199d921a6829955
mesh-tools added 2 commits 2026-10-19 22:42:01 +00:00
Pull keycloak's moved-path harness into movedHarness, and test it reads the grant file (issue 1332) 73a10fafc7 
Adds the failing unit tests for keycloak's provider on the moved path: a grant-file consumer not
moved should still be made and never held for retirement, and the moved harness should read
MESH_RECEIVES as the grant path does. All three fail on an assertion against today's code, which
wants nothing from the grant file on this path.
Read the grant file on keycloak's moved path, so a consumer not moved is still made (issue 1332)
mesh/merge-gate head b9104454f9a5 merged into trunk 954f84ea19b5 — pass: builds keycloak, sent nowhere; no bus step; 1 wait(s) for a person; every machine …
Details
mesh/repo-check head b9104454f9a5 merged into trunk 954f84ea19b5 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
Details
mesh/delivery delivering: 0 machine step(s) passed
Details
b9104454f9 
mesh-mail-web, grafana and car-hunter are not moved, so keycloak wanted nothing for them: it never
made mesh_novox_mail_web, and held mesh_ace_grafana and mesh_ace_carhunt for retirement. Keycloak's
moved spec now asks for the grant file's consumers too (WithGrants: true), and the moved harness
reads MESH_RECEIVES exactly as the grant path does and as postgres's moved harness already did.
mesh-tools commented 2026-10-19 22:42:09 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-catalog@b9104454f9a5 — delivering since 2026-10-19T22:58:32Z

Delivery plan — builds keycloak, sent nowhere; no bus step; 1 wait(s) for a person

  • tier 0: keycloak
  • novox: waits for a person: keycloak
  • keycloak waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
  • keycloak provides oidc-client: its consumers are sent again after it
  • keycloak keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

  • 2026-10-19 22:42 (new) → proposed (announced): novox/mesh-catalog#378's head announced
  • 2026-10-19 22:45 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-19 22:45 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-19 22:56 ready → held (hold): something holds it for a person: its group's composed check did not pass for the heads that merged, or it merged and no walk was opened for it
  • 2026-10-19 22:58 held → delivering (release): the operator, via telegram (user id verified), chose Release (ask ceaa7298bd55bc5d5)

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@b9104454f9a5` — **delivering** since 2026-10-19T22:58:32Z **Delivery plan** — builds keycloak, sent nowhere; no bus step; 1 wait(s) for a person - tier 0: keycloak - novox: waits for a person: keycloak - keycloak waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - keycloak provides oidc-client: its consumers are sent again after it - keycloak keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-19 22:42 (new) → proposed (announced): novox/mesh-catalog#378's head announced - 2026-10-19 22:45 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-19 22:45 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-19 22:56 ready → held (hold): something holds it for a person: its group's composed check did not pass for the heads that merged, or it merged and no walk was opened for it - 2026-10-19 22:58 held → delivering (release): the operator, via telegram (user id verified), chose Release (ask ceaa7298bd55bc5d5) The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools commented 2026-10-19 22:45:13 +00:00
Author
Member
Copy Link
Copy Source

Merge check at b9104454
Judged: head b9104454f9a5 merged into trunk 954f84ea19b5; read beside it: mesh-controller 1f708e2d8d72, mesh-controller-main 1f708e2d8d72, mesh-host 2474bf28330f, mesh-tools 7412c5b6c9c5

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: keycloak)
  • mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds keycloak, sent nowhere; no bus step; 1 wait(s) for a person

  • tier 0: keycloak
  • novox: waits for a person: keycloak
  • keycloak waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
  • keycloak provides oidc-client: its consumers are sent again after it
  • keycloak keeps data (ADR 0233): what it holds is backed up before it moves
  • read by no module's build: modules/keycloak/cmd/keycloak-provider/grant_moved_test.go, modules/keycloak/cmd/keycloak-provider/main_test.go

Run by the build seat on ace as build-1792449727394035484 (builds --log build-1792449727394035484).

--- the gate: keycloak
keycloak: ok, keeps state bound, reads mesh-controller.assignments; WARNING: runtime-config ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-19T22:37:52Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-19T22:37:52Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): keycloak

notes:
  - modules/keycloak/cmd/keycloak-provider/grant_moved_test.go and modules/keycloak/cmd/keycloak-provider/main_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 54927 strings of 827 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.011s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.008s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.018s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.007s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.245s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.014s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.010s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.008s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.289s
testing modules/keycloak
ok  	keycloak/cmd/keycloak-provider	1.335s
--- its merge-check-typescript.sh (typescript toolchain)
**Merge check** at `b9104454` Judged: head `b9104454f9a5` merged into trunk `954f84ea19b5`; read beside it: mesh-controller `1f708e2d8d72`, mesh-controller-main `1f708e2d8d72`, mesh-host `2474bf28330f`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: keycloak) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds keycloak, sent nowhere; no bus step; 1 wait(s) for a person - tier 0: keycloak - novox: waits for a person: keycloak - keycloak waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - keycloak provides oidc-client: its consumers are sent again after it - keycloak keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: modules/keycloak/cmd/keycloak-provider/grant_moved_test.go, modules/keycloak/cmd/keycloak-provider/main_test.go Run by the build seat on ace as `build-1792449727394035484` (`builds --log build-1792449727394035484`). ``` --- the gate: keycloak keycloak: ok, keeps state bound, reads mesh-controller.assignments; WARNING: runtime-config ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: server stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-19T22:37:52Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-19T22:37:52Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): keycloak notes: - modules/keycloak/cmd/keycloak-provider/grant_moved_test.go and modules/keycloak/cmd/keycloak-provider/main_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 54927 strings of 827 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.011s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.008s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.018s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.007s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.245s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.014s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.010s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.008s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.289s testing modules/keycloak ok keycloak/cmd/keycloak-provider 1.335s --- its merge-check-typescript.sh (typescript toolchain) ```
mesh-tools merged commit c0880c4dc2 into main 2026-10-19 22:46:05 +00:00
mesh-tools deleted branch fix/1332-keycloak-reads-the-grant-file 2026-10-19 22:46:05 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-catalog#378