novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Upgrade every node's packages on a Saturday 04:00 timer and make its outcome the pacman module's health, so the nodes stay on the same versions (issue 1574, ADR 0477) #404

Merged
mesh-tools merged 8 commits from fix/1574-weekly-upgrade into main 2026-10-21 08:15:54 +00:00
Conversation 2 Commits 8 Files Changed 10
+303 -4
mesh-tools commented 2026-10-21 08:11:41 +00:00
Member
Copy Link
Copy Source

Issue 1574, ADR 0477 clause 5.

  • pacman module: resources upgrade-service and upgrade-timer in /etc/systemd/system, and the service weekly-upgrade on mesh-pacman-weekly-upgrade.timer (OnCalendar Sat *-*-* 04:00:00, Persistent=true, no random delay), so every node upgrades at the same moment and a node asleep at 04:00 runs at wake. The service is a oneshot running pacman -Syu --noconfirm (the same arguments as UpgradeArgs, held together by a manifest test).
  • Its health is the tool pacman_upgrade_health: unhealthy when the last run failed, naming the exit and the last error: line of the journal; unhealthy when a run has gone on past 2 hours, naming its start and the journal's last line (it is hung and holds pacman's lock; no start timeout on purpose, killing pacman mid-transaction is worse); healthy while a run is within 2 hours, after a pass, and before any run.
  • mirror-refresh and cache-cleaning gain health: {kind: unit}; health-undeclared goes from 61 to 59.
  • README says the same.

Tests: manifest and health unit tests (fail on main, pass here; also under TZ Europe/Brussels, America/New_York, Asia/Tokyo, UTC); systemd-analyze verify clean; mesh-controller.try build-1792570106601218361 passed at bd10ec4f (38 s).

Acceptance after delivery: the timer is scheduled for Sat 04:00 on ace, g14, novox and shanks, and pacman_upgrade_health answers on each (AC3).

Reviewed-by: reviewer-1574@shanks at bd10ec4f0d

Issue 1574, ADR 0477 clause 5. - pacman module: resources upgrade-service and upgrade-timer in /etc/systemd/system, and the service weekly-upgrade on `mesh-pacman-weekly-upgrade.timer` (OnCalendar `Sat *-*-* 04:00:00`, Persistent=true, no random delay), so every node upgrades at the same moment and a node asleep at 04:00 runs at wake. The service is a oneshot running `pacman -Syu --noconfirm` (the same arguments as `UpgradeArgs`, held together by a manifest test). - Its health is the tool `pacman_upgrade_health`: unhealthy when the last run failed, naming the exit and the last `error:` line of the journal; unhealthy when a run has gone on past 2 hours, naming its start and the journal's last line (it is hung and holds pacman's lock; no start timeout on purpose, killing pacman mid-transaction is worse); healthy while a run is within 2 hours, after a pass, and before any run. - mirror-refresh and cache-cleaning gain `health: {kind: unit}`; health-undeclared goes from 61 to 59. - README says the same. Tests: manifest and health unit tests (fail on main, pass here; also under TZ Europe/Brussels, America/New_York, Asia/Tokyo, UTC); `systemd-analyze verify` clean; mesh-controller.try build-1792570106601218361 passed at bd10ec4f (38 s). Acceptance after delivery: the timer is scheduled for Sat 04:00 on ace, g14, novox and shanks, and pacman_upgrade_health answers on each (AC3). Reviewed-by: reviewer-1574@shanks at bd10ec4f0dbebe918d91a004682b00c5bdac5c31
mesh-tools added 8 commits 2026-10-21 08:11:41 +00:00
Upgrade every node's packages together each Saturday at 04:00, with the outcome as the pacman module's health, so the nodes keep the same toolchain versions (issue 1574, ADR 0477) cf197fee89
Upgrade every node's packages together each Saturday at 04:00, with the outcome as the pacman module's health, so the nodes keep the same toolchain versions (issue 1574, ADR 0477) e319f9877f
The weekly upgrade's timer, service and health tool (issue 1574, ADR 0477) f12f87f1f9
Declare the weekly upgrade timer with its health, and serve pacman_upgrade_health (issue 1574, ADR 0477) 1f5046f47e
Test the weekly upgrade's timer and its health (issue 1574, ADR 0477) e3ac017c28
Say the weekly upgrade and its health in the pacman README (issue 1574, ADR 0477) 5123c1dd57
Name pacman_upgrade_health in the pacman README's tools (issue 1574) d4d1a1591b
Say a weekly upgrade that hangs past two hours, so a stuck pacman lock is loud (issue 1574, ADR 0477)
mesh/merge-gate head bd10ec4f0dbe merged into trunk 4bdacf38d2f0 — pass: builds pacman → ace, g14, novox, shanks; no bus step; every machine composes with …
Details
mesh/repo-check head bd10ec4f0dbe merged into trunk 4bdacf38d2f0 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
Details
mesh/delivery delivered
Details
bd10ec4f0d
mesh-tools commented 2026-10-21 08:11:51 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-catalog@bd10ec4f0dbe — delivered since 2026-10-21T08:43:21Z

Delivery plan — builds pacman → ace, g14, novox, shanks; no bus step

  • tier 0: pacman
  • ace: receives pacman
  • g14: receives pacman
  • novox: receives pacman
  • shanks: receives pacman
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before pacman is judged on its first machine

Machines

  • pacman on every machine running it: sent

Transitions

  • 2026-10-21 08:11 (new) → proposed (announced): novox/mesh-catalog#404's head announced
  • 2026-10-21 08:15 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-21 08:15 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-21 08:25 ready → held (hold): something holds it for a person: its group's composed check did not pass for the heads that merged, or it merged and no walk was opened for it
  • 2026-10-21 08:41 held → published (lifted): lifted: the walk plan-1792572038466425891, which answers its merge, opened
  • 2026-10-21 08:41 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-21 08:43 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@bd10ec4f0dbe` — **delivered** since 2026-10-21T08:43:21Z **Delivery plan** — builds pacman → ace, g14, novox, shanks; no bus step - tier 0: pacman - ace: receives pacman - g14: receives pacman - novox: receives pacman - shanks: receives pacman - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before pacman is judged on its first machine **Machines** - pacman on every machine running it: sent **Transitions** - 2026-10-21 08:11 (new) → proposed (announced): novox/mesh-catalog#404's head announced - 2026-10-21 08:15 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 08:15 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 08:25 ready → held (hold): something holds it for a person: its group's composed check did not pass for the heads that merged, or it merged and no walk was opened for it - 2026-10-21 08:41 held → published (lifted): lifted: the walk plan-1792572038466425891, which answers its merge, opened - 2026-10-21 08:41 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 08:43 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools commented 2026-10-21 08:15:08 +00:00
Author
Member
Copy Link
Copy Source

Merge check at bd10ec4f
Judged: head bd10ec4f0dbe merged into trunk 4bdacf38d2f0; read beside it: mesh-controller 0fee5404d95b, mesh-controller-main 0fee5404d95b, mesh-host c5c4caa2a4ab, mesh-tools e0fadc43d9dd

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: pacman)
  • mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds pacman → ace, g14, novox, shanks; no bus step

  • tier 0: pacman
  • ace: receives pacman
  • g14: receives pacman
  • novox: receives pacman
  • shanks: receives pacman
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before pacman is judged on its first machine
  • read by no module's build: health-undeclared, modules/pacman/README.md, modules/pacman/cmd/pacman-tools/manifest_test.go, modules/pacman/cmd/pacman-tools/pacman_test.go

Run by the build seat on ace as build-1792570305382859916 (builds --log build-1792570305382859916).

--- the gate: pacman
pacman: ok, 16 tool(s), ready: mirror-refresh by unit every 30s; cache-cleaning by unit every 30s; weekly-upgrade by its tool pacman_upgrade_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T07:37:13Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T07:37:13Z

modules the change moves:
  - pacman (changed)

machines:
  - a machine (f35): composes; the change adds 3 resource(s) and removes 0 (+file:pacman.upgrade-service, +file:pacman.upgrade-timer, +service:pacman.weekly-upgrade)
  - holds mesh-dns-resolver (idt): composes; the change adds 3 resource(s) and removes 0 (+file:pacman.upgrade-service, +file:pacman.upgrade-timer, +service:pacman.weekly-upgrade)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 3 resource(s) and removes 0 (+file:pacman.upgrade-service, +file:pacman.upgrade-timer, +service:pacman.weekly-upgrade)
  - a machine (yvbpsm): composes; the change adds 3 resource(s) and removes 0 (+file:pacman.upgrade-service, +file:pacman.upgrade-timer, +service:pacman.weekly-upgrade)

a merge would rebuild 1 module(s) in 1 tier(s): pacman

notes:
  - health-undeclared, modules/pacman/README.md, modules/pacman/cmd/pacman-tools/manifest_test.go and modules/pacman/cmd/pacman-tools/pacman_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 58096 strings of 895 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.010s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.009s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.018s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.007s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.013s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.231s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.013s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.011s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 59, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.210s
testing modules/pacman
ok  	pacman/cmd/pacman-tools	1.018s
--- its merge-check-typescript.sh (typescript toolchain)
**Merge check** at `bd10ec4f` Judged: head `bd10ec4f0dbe` merged into trunk `4bdacf38d2f0`; read beside it: mesh-controller `0fee5404d95b`, mesh-controller-main `0fee5404d95b`, mesh-host `c5c4caa2a4ab`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: pacman) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds pacman → ace, g14, novox, shanks; no bus step - tier 0: pacman - ace: receives pacman - g14: receives pacman - novox: receives pacman - shanks: receives pacman - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before pacman is judged on its first machine - read by no module's build: health-undeclared, modules/pacman/README.md, modules/pacman/cmd/pacman-tools/manifest_test.go, modules/pacman/cmd/pacman-tools/pacman_test.go Run by the build seat on ace as `build-1792570305382859916` (`builds --log build-1792570305382859916`). ``` --- the gate: pacman pacman: ok, 16 tool(s), ready: mirror-refresh by unit every 30s; cache-cleaning by unit every 30s; weekly-upgrade by its tool pacman_upgrade_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T07:37:13Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-21T07:37:13Z modules the change moves: - pacman (changed) machines: - a machine (f35): composes; the change adds 3 resource(s) and removes 0 (+file:pacman.upgrade-service, +file:pacman.upgrade-timer, +service:pacman.weekly-upgrade) - holds mesh-dns-resolver (idt): composes; the change adds 3 resource(s) and removes 0 (+file:pacman.upgrade-service, +file:pacman.upgrade-timer, +service:pacman.weekly-upgrade) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 3 resource(s) and removes 0 (+file:pacman.upgrade-service, +file:pacman.upgrade-timer, +service:pacman.weekly-upgrade) - a machine (yvbpsm): composes; the change adds 3 resource(s) and removes 0 (+file:pacman.upgrade-service, +file:pacman.upgrade-timer, +service:pacman.weekly-upgrade) a merge would rebuild 1 module(s) in 1 tier(s): pacman notes: - health-undeclared, modules/pacman/README.md, modules/pacman/cmd/pacman-tools/manifest_test.go and modules/pacman/cmd/pacman-tools/pacman_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 58096 strings of 895 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.010s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.009s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.018s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.007s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.013s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.231s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.013s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.011s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 59, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.210s testing modules/pacman ok pacman/cmd/pacman-tools 1.018s --- its merge-check-typescript.sh (typescript toolchain) ```
mesh-tools merged commit 50ef13d293 into main 2026-10-21 08:15:54 +00:00
mesh-tools deleted branch fix/1574-weekly-upgrade 2026-10-21 08:15:55 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-catalog#404