Polish the brother module so the scanner and printer just work: long feeder scans, several tickets, joined glass pages, one-call print, certificate health #399

2026-10-21T00:13:48Z

mesh-tools commented

2026-10-21 00:13:48 +00:00

The operator, 2026-10-21 01:33: "polish the module so it's in a decent state and my next time using the scanner/printer, I won't run into issues". One milestone, one commit per issue, reviewed whole (three rounds plus checks of the last two commits).

1515: the admin client follows no redirect off https on the printer's own host and never re-sends the password (307/308 refused).
1536: a failed part fetch is retried once.
1552 + 1539: a feeder scan answers within 25 s, done or started with an id; scanner.scan {id} reads the outcome; the call that asked follows its scan and files it (5 min glass, 35 min feeder); every ask carries its deadline and is dropped before any work once it passed; the feeder bound grows with the pages (20 s a page, 3 to 30 min); a PDF over 100 MiB is refused before it is kept or announced.
1551: printer.print {path} prints a PDF or JPEG under the operator's home folder in one call (links resolved; anything else refused with one message).
1528: scanner.scan {apart: true} files several documents on the glass each on its own (opt-in; without it the glass is unchanged).
1538: scanner.scan {document: start | id, finish} joins glass scans into one PDF; pages under pending// in the bucket, deleted when finished; an open document finishes itself after 30 minutes, also after a restart.
1510: brother_health (on a watch process beside the device's unit check) compares the certificates the printer serves with the pinned ones; unpinned is unhealthy and named; an absent printer is healthy with a note; unset settings answer waits.

Decisions: ADR 0475 (proposed) decides the scanning and printing behaviour and ADR 0474 (proposed) the configure verb, not in this change; the design is hq 03-DESIGN/01-to-be/60-the-brother-module.md.

mesh-controller.try build-1792541346376148029 passed at 3757d75d6a merged into f99f11e8a4.

Reviewed-by: reviewer@shanks at 3757d75d6a

The operator, 2026-10-21 01:33: "polish the module so it's in a decent state and my next time using the scanner/printer, I won't run into issues". One milestone, one commit per issue, reviewed whole (three rounds plus checks of the last two commits). - 1515: the admin client follows no redirect off https on the printer's own host and never re-sends the password (307/308 refused). - 1536: a failed part fetch is retried once. - 1552 + 1539: a feeder scan answers within 25 s, done or started with an id; scanner.scan {id} reads the outcome; the call that asked follows its scan and files it (5 min glass, 35 min feeder); every ask carries its deadline and is dropped before any work once it passed; the feeder bound grows with the pages (20 s a page, 3 to 30 min); a PDF over 100 MiB is refused before it is kept or announced. - 1551: printer.print {path} prints a PDF or JPEG under the operator's home folder in one call (links resolved; anything else refused with one message). - 1528: scanner.scan {apart: true} files several documents on the glass each on its own (opt-in; without it the glass is unchanged). - 1538: scanner.scan {document: start | id, finish} joins glass scans into one PDF; pages under pending/<id>/ in the bucket, deleted when finished; an open document finishes itself after 30 minutes, also after a restart. - 1510: brother_health (on a watch process beside the device's unit check) compares the certificates the printer serves with the pinned ones; unpinned is unhealthy and named; an absent printer is healthy with a note; unset settings answer waits. Decisions: ADR 0475 (proposed) decides the scanning and printing behaviour and ADR 0474 (proposed) the configure verb, not in this change; the design is hq 03-DESIGN/01-to-be/60-the-brother-module.md. mesh-controller.try build-1792541346376148029 passed at 3757d75d6acf merged into f99f11e8a406. Reviewed-by: reviewer@shanks at 3757d75d6acf4410bb6ac70fae5801f43930547e

mesh-tools added 14 commits 2026-10-21 00:13:48 +00:00

Refuse a redirect off https or off the printer's host and a re-sent login body in the admin client (issue 1515) 8295bc3894

Ask a failed part fetch once more before a scan fails, and name the stored object (issue 1536) 7bf63f9eff

Answer a long feeder scan as started with an id, file it in the background, and scale the feeder's bound with its pages (issues 1552, 1539) 23c3a2396e

Let printer.print take a file path and upload and print it in one call (issue 1551) a5bc37459b

Cut each of several documents lying apart on the glass out and file it as its own PDF (issue 1528) 17f3c45182

Scan several glass pages into one PDF with scanner.scan document start, an id and finish (issue 1538) a75e11e814

Judge the module healthy by the certificates the printer serves against the pinned list (issue 1510) 1e19e8ee9a

Drop an ask taken up after its deadline, follow a scan for its run, re-arm open documents and delete their pages (issues 1539, 1552, 1538) ef833e26c7

Cut several documents apart only when scanner.scan is asked apart: true (issue 1528) 43771458f6

Print from a path only under the home folder, refused in one fixed way (issue 1551) 95c47a09c9

Bound the certificate check to 3 s a handshake and 7 s, and answer waits while printer is not given (issue 1510) 65e67abb7d

Answer brother_health's wait for unset settings with the SDK's health.Waiting (issue 1510) 7eddb116b1

Carry brother's certificate check on a watch process beside the device unit check, as fail2ban does (issue 1510) b7243505ca

Wait for the background scan's outcome in the test instead of reading it once, and say where brother_health sits (issue 1552)

mesh/merge-gate head 3757d75d6acf merged into trunk 9aa97926141f — pass: builds brother → shanks; no bus step; every machine composes with the change as it…

Details

mesh/repo-check head 3757d75d6acf merged into trunk 9aa97926141f — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…

Details

mesh/delivery delivered

Details

3757d75d6a

mesh-tools commented

2026-10-21 00:13:57 +00:00

Delivery novox/mesh-catalog@3757d75d6acf — delivered since 2026-10-21T00:25:34Z

Delivery plan — builds brother → shanks; no bus step

tier 0: brother
shanks: receives brother
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before brother is judged on its first machine

Machines

brother on every machine running it: sent

Transitions

2026-10-21 00:13 (new) → proposed (announced): novox/mesh-catalog#399's head announced
2026-10-21 00:18 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-21 00:18 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-21 00:22 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-21 00:23 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-21 00:25 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@3757d75d6acf` — **delivered** since 2026-10-21T00:25:34Z **Delivery plan** — builds brother → shanks; no bus step - tier 0: brother - shanks: receives brother - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before brother is judged on its first machine **Machines** - brother on every machine running it: sent **Transitions** - 2026-10-21 00:13 (new) → proposed (announced): novox/mesh-catalog#399's head announced - 2026-10-21 00:18 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 00:18 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 00:22 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-21 00:23 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 00:25 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-21 00:20:47 +00:00

Merge check at 3757d75d
Judged: head 3757d75d6acf merged into trunk 9aa97926141f; read beside it: mesh-controller 0fee5404d95b, mesh-controller-main 0fee5404d95b, mesh-host c5c4caa2a4ab, mesh-tools e0fadc43d9dd

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: brother)
mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds brother → shanks; no bus step

tier 0: brother
shanks: receives brother
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before brother is judged on its first machine
read by no module's build: modules/brother/README.md, modules/brother/cmd/brother/admin_test.go, modules/brother/cmd/brother/certcheck_test.go, modules/brother/cmd/brother/crop_test.go, modules/brother/cmd/brother/device_boundary_test.go, modules/brother/cmd/brother/documents_test.go, modules/brother/cmd/brother/feeder_test.go, modules/brother/cmd/brother/glass_test.go, modules/brother/cmd/brother/manifest_test.go, modules/brother/cmd/brother/objects_test.go, modules/brother/cmd/brother/service_test.go

Run by the build seat on shanks as build-1792541631715396227 (builds --log build-1792541631715396227).

--- the gate: brother
brother: ok, 9 tool(s), keeps state device-answers, ready: device by unit every 30s; watch by its tool brother_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T00:07:13Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T00:07:13Z

modules the change moves:
  - brother (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes; the change adds 1 resource(s) and removes 0 (+process:brother.watch)

a merge would rebuild 1 module(s) in 1 tier(s): brother

notes:
  - modules/brother/README.md, modules/brother/cmd/brother/admin_test.go, modules/brother/cmd/brother/certcheck_test.go, modules/brother/cmd/brother/crop_test.go, modules/brother/cmd/brother/device_boundary_test.go, modules/brother/cmd/brother/documents_test.go, modules/brother/cmd/brother/feeder_test.go, modules/brother/cmd/brother/glass_test.go, modules/brother/cmd/brother/manifest_test.go, modules/brother/cmd/brother/objects_test.go and modules/brother/cmd/brother/service_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 58025 strings of 894 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.013s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.010s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.020s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.009s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.015s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.271s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.016s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.012s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 61, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.233s
testing modules/brother
ok  	brother/cmd/brother	26.331s
ok  	brother/cmd/brother/internal/secret	1.013s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `3757d75d` Judged: head `3757d75d6acf` merged into trunk `9aa97926141f`; read beside it: mesh-controller `0fee5404d95b`, mesh-controller-main `0fee5404d95b`, mesh-host `c5c4caa2a4ab`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: brother) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds brother → shanks; no bus step - tier 0: brother - shanks: receives brother - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before brother is judged on its first machine - read by no module's build: modules/brother/README.md, modules/brother/cmd/brother/admin_test.go, modules/brother/cmd/brother/certcheck_test.go, modules/brother/cmd/brother/crop_test.go, modules/brother/cmd/brother/device_boundary_test.go, modules/brother/cmd/brother/documents_test.go, modules/brother/cmd/brother/feeder_test.go, modules/brother/cmd/brother/glass_test.go, modules/brother/cmd/brother/manifest_test.go, modules/brother/cmd/brother/objects_test.go, modules/brother/cmd/brother/service_test.go Run by the build seat on shanks as `build-1792541631715396227` (`builds --log build-1792541631715396227`). ``` --- the gate: brother brother: ok, 9 tool(s), keeps state device-answers, ready: device by unit every 30s; watch by its tool brother_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T00:07:13Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-21T00:07:13Z modules the change moves: - brother (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes; the change adds 1 resource(s) and removes 0 (+process:brother.watch) a merge would rebuild 1 module(s) in 1 tier(s): brother notes: - modules/brother/README.md, modules/brother/cmd/brother/admin_test.go, modules/brother/cmd/brother/certcheck_test.go, modules/brother/cmd/brother/crop_test.go, modules/brother/cmd/brother/device_boundary_test.go, modules/brother/cmd/brother/documents_test.go, modules/brother/cmd/brother/feeder_test.go, modules/brother/cmd/brother/glass_test.go, modules/brother/cmd/brother/manifest_test.go, modules/brother/cmd/brother/objects_test.go and modules/brother/cmd/brother/service_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 58025 strings of 894 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.013s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.020s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.009s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.015s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.271s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.016s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.012s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 61, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.233s testing modules/brother ok brother/cmd/brother 26.331s ok brother/cmd/brother/internal/secret 1.013s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit 76bb22c362 into main

2026-10-21 00:22:45 +00:00

mesh-tools deleted branch feat/brother-polish

2026-10-21 00:22:45 +00:00

mesh-tools referenced this pull request

2026-10-21 07:28:14 +00:00

Declare scanner.scan's apart argument, so several tickets on the glass can be filed apart (issue 1528) #401

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#399