Make dev-tools, lab and the build modules need the go and nodejs modules instead of declaring the toolchain packages, step B of issue 1573 (ADR 0477 §4) #409

2026-10-21T10:08:35Z

mesh-tools commented

2026-10-21 10:08:35 +00:00

Issue 1573, step B (ADR 0477 §4). Step A (#406) added the modules go and nodejs; both are now assigned on ace, g14, novox and shanks.

dev-tools and lab require go-toolchain and node-toolchain; mesh-build-go requires go-toolchain; mesh-build-node requires node-toolchain. None of them declares the go, nodejs or npm package any more (lab runs npm, node and go build, so it needs both).
checks/toolchains (wired into merge-check.sh): over every manifest, only go declares package go and only nodejs declares nodejs and npm; an owner that stops declaring its package fails too.
READMEs of go, nodejs and the four users say so; the build modules' manifest tests follow.

Every user's node has its toolchain module assigned (module list), so every node still composes; the node-engine never uninstalls a package, so nothing leaves a node. The merge gate proves the composition.

Tests: checks/toolchains fails on main's manifests; mesh-build-go forge_test.go:147 and manifest_test.go:68, mesh-build-node manifest_test.go:70 and :138 fail without the change. mesh-controller.try build-1792576435935332427 passed at 36259f34 (1m17s).

Later, from the review: issue 1644 (six other modules run node without requiring node-toolchain). mesh-sdk's resolve tests for the toolchain requirement follow after this merge.

Reviewed-by: reviewer-1573b@shanks at 36259f3406

Issue 1573, step B (ADR 0477 §4). Step A (#406) added the modules go and nodejs; both are now assigned on ace, g14, novox and shanks. - dev-tools and lab require go-toolchain and node-toolchain; mesh-build-go requires go-toolchain; mesh-build-node requires node-toolchain. None of them declares the go, nodejs or npm package any more (lab runs npm, node and go build, so it needs both). - checks/toolchains (wired into merge-check.sh): over every manifest, only `go` declares package go and only `nodejs` declares nodejs and npm; an owner that stops declaring its package fails too. - READMEs of go, nodejs and the four users say so; the build modules' manifest tests follow. Every user's node has its toolchain module assigned (module list), so every node still composes; the node-engine never uninstalls a package, so nothing leaves a node. The merge gate proves the composition. Tests: checks/toolchains fails on main's manifests; mesh-build-go forge_test.go:147 and manifest_test.go:68, mesh-build-node manifest_test.go:70 and :138 fail without the change. mesh-controller.try build-1792576435935332427 passed at 36259f34 (1m17s). Later, from the review: issue 1644 (six other modules run node without requiring node-toolchain). mesh-sdk's resolve tests for the toolchain requirement follow after this merge. Reviewed-by: reviewer-1573b@shanks at 36259f3406f7f6fbda4087a9d0419908e4a3d4ab

mesh-tools added 6 commits 2026-10-21 10:08:35 +00:00

Make dev-tools, lab and the two build modules require the toolchain provisions instead of declaring the packages (issue 1573) 7753c27042

Check that only the go and nodejs modules declare the toolchain packages (issue 1573) c4cd7a1b16

Wire the toolchains check into the merge check (issue 1573) 9d1f152603

Say in the build modules' READMEs where the packages come from (issue 1573) bda75011a1

Say in the go and nodejs READMEs that they are now the only declarers (issue 1573) d8d153295a

Update the build modules' manifest tests for the toolchain provisions (issue 1573)

mesh/merge-gate head 36259f3406f7 merged into trunk f0c8958dd217 — pass: builds dev-tools, lab, mesh-build-go, mesh-build-node → ace, g14, novox, shanks; n…

Details

mesh/repo-check head 36259f3406f7 merged into trunk f0c8958dd217 — pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the ch…

Details

mesh/delivery covered: a later merge that contains it was delivered: novox/mesh-catalog@e023f69989ab (merged as b5dbfbb7 into main, walk plan-17925769516…

Details

36259f3406

mesh-tools commented

2026-10-21 10:08:48 +00:00

Delivery novox/mesh-catalog@36259f3406f7 — covered since 2026-10-21T10:59:40Z

Delivery plan — builds dev-tools, lab, mesh-build-go, mesh-build-node → ace, g14, novox, shanks; no bus step

tier 0: dev-tools, lab, mesh-build-go, mesh-build-node
ace: receives dev-tools
g14: receives dev-tools, mesh-build-go, mesh-build-node
novox: receives dev-tools, mesh-build-go, mesh-build-node
shanks: receives dev-tools, lab, mesh-build-go, mesh-build-node
lab keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before dev-tools, lab, mesh-build-go, mesh-build-node is judged on its first machine

Machines

dev-tools on every machine running it: sent
mesh-build-go on every machine running it: sent
mesh-build-node on every machine running it: sent
mesh-sdk on every machine running it: sent
mesh-tools on every machine running it: sent
audit-logger on every machine running it: sent
confluence on every machine running it: sent
gitea on every machine running it: sent
gitlab on every machine running it: sent
jira on every machine running it: sent
lab on every machine running it: sent
mesh-catalog on every machine running it: sent
model-usage on every machine running it: sent
openai-consumer on every machine running it: sent
route-adapter on every machine running it: sent
showcase on every machine running it: sent

Transitions

2026-10-21 10:08 (new) → proposed (announced): novox/mesh-catalog#409's head announced
2026-10-21 10:20 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-21 10:20 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-21 10:35 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-21 10:36 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-21 10:59 delivering → covered (covered): covered: a later merge that contains it was delivered: novox/mesh-catalog@e023f69989 (merged as b5dbfbb7 into main, walk plan-1792576951664537534)

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@36259f3406f7` — **covered** since 2026-10-21T10:59:40Z **Delivery plan** — builds dev-tools, lab, mesh-build-go, mesh-build-node → ace, g14, novox, shanks; no bus step - tier 0: dev-tools, lab, mesh-build-go, mesh-build-node - ace: receives dev-tools - g14: receives dev-tools, mesh-build-go, mesh-build-node - novox: receives dev-tools, mesh-build-go, mesh-build-node - shanks: receives dev-tools, lab, mesh-build-go, mesh-build-node - lab keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before dev-tools, lab, mesh-build-go, mesh-build-node is judged on its first machine **Machines** - dev-tools on every machine running it: sent - mesh-build-go on every machine running it: sent - mesh-build-node on every machine running it: sent - mesh-sdk on every machine running it: sent - mesh-tools on every machine running it: sent - audit-logger on every machine running it: sent - confluence on every machine running it: sent - gitea on every machine running it: sent - gitlab on every machine running it: sent - jira on every machine running it: sent - lab on every machine running it: sent - mesh-catalog on every machine running it: sent - model-usage on every machine running it: sent - openai-consumer on every machine running it: sent - route-adapter on every machine running it: sent - showcase on every machine running it: sent **Transitions** - 2026-10-21 10:08 (new) → proposed (announced): novox/mesh-catalog#409's head announced - 2026-10-21 10:20 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 10:20 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 10:35 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-21 10:36 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 10:59 delivering → covered (covered): covered: a later merge that contains it was delivered: novox/mesh-catalog@e023f69989ab (merged as b5dbfbb7 into main, walk plan-1792576951664537534) The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-21 10:20:19 +00:00

Merge check at 36259f34
Judged: head 36259f3406f7 merged into trunk f0c8958dd217; read beside it: mesh-controller 0205b8f7080a, mesh-controller-main 0205b8f7080a, mesh-host c5c4caa2a4ab, mesh-tools e0fadc43d9dd

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: dev-tools, lab, mesh-build-go, mesh-build-node)
mesh/repo-check: PASS — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds dev-tools, lab, mesh-build-go, mesh-build-node → ace, g14, novox, shanks; no bus step

tier 0: dev-tools, lab, mesh-build-go, mesh-build-node
ace: receives dev-tools
g14: receives dev-tools, mesh-build-go, mesh-build-node
novox: receives dev-tools, mesh-build-go, mesh-build-node
shanks: receives dev-tools, lab, mesh-build-go, mesh-build-node
lab keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before dev-tools, lab, mesh-build-go, mesh-build-node is judged on its first machine
read by no module's build: checks/toolchains/go.mod, checks/toolchains/main.go, checks/toolchains/main_test.go, merge-check.sh, modules/dev-tools/README.md, modules/go/README.md, modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/forge_test.go, modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go, modules/mesh-build-node/README.md, modules/mesh-build-node/cmd/mesh-build-node/manifest_test.go, modules/nodejs/README.md

Run by the build seat on ace as build-1792577333906727399 (builds --log build-1792577333906727399).

--- the gate: dev-tools, lab, mesh-build-go, mesh-build-node
dev-tools: ok
lab: ok, keeps work (cache); WARNING: runtime-env ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339)
mesh-build-go: ok, 6 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s
mesh-build-node: ok, 5 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-node.own-runtime by its tool build_node_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 1
4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 4 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T10:06:45Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T10:06:45Z

modules the change moves:
  - dev-tools (changed)
  - lab (changed)
  - mesh-build-go (changed)
  - mesh-build-node (changed)

machines:
  - a machine (f35): composes; the change adds 0 resource(s) and removes 6 (-package:dev-tools.go, -package:dev-tools.nodejs, -package:dev-tools.npm, -package:mesh-build-go.go, -package:mesh-build-node.nodejs, -package:mesh-build-node.npm)
  - holds mesh-dns-resolver (idt): composes; the change adds 0 resource(s) and removes 3 (-package:dev-tools.go, -package:dev-tools.nodejs, -package:dev-tools.npm)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 0 resource(s) and removes 6 (-package:dev-tools.go, -package:dev-tools.nodejs, -package:dev-tools.npm, -package:mesh-build-go.go, -package:mesh-build-node.nodejs, -package:mesh-build-node.npm)
  - a machine (yvbpsm): composes; the change adds 0 resource(s) and removes 8

a merge would rebuild 4 module(s) in 1 tier(s): dev-tools, lab, mesh-build-go, mesh-build-node

notes:
  - checks/toolchains/go.mod, checks/toolchains/main.go, checks/toolchains/main_test.go, merge-check.sh, modules/dev-tools/README.md, modules/go/README.md, modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/forge_test.go, modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go, modules/mesh-build-node/README.md, modules/mesh-build-node/cmd/mesh-build-node/manifest_test.go and modules/nodejs/README.md read by no module's build, and rebuild nothing (issue 280)
--- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.002s
words: 12 retired words and 70 daemons' lines, none in the 58220 strings of 898 files
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.012s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.009s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.015s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.007s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.012s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.232s
predefined.json: 2 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.015s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.010s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 59, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.205s
modules/lab is TypeScript: merge-check-typescript.sh type-checks and tests it
testing modules/mesh-build-go
ok  	meshbuildgo/cmd/mesh-build-go	14.741s
testing modules/mesh-build-node
ok  	meshbuildnode/cmd/mesh-build-node	1.248s
--- its merge-check-typescript.sh (typescript toolchain)
type-checking modules/lab (TypeScript)
testing modules/lab (TypeScript)
✔ the base image's age is read from when this machine made it (1.729602ms)
✔ an image older than the bound refuses a run, naming the tool that rebuilds it (0.187342ms)
✔ an image within the bound runs (0.11657ms)
✔ a missing image, or one whose age cannot be read, is said and not refused (0.122981ms)
✔ no run starts while the base image is rebuilt (0.175159ms)
✔ a rebuild is mesh-lab's base build from the forge's main, with no secret in its script (0.243668ms)
✔ a rebuild is known by its status, and is not a run (7.159083ms)
✔ a run and a rebuild asked at once: exactly one starts (42.60572ms)
✔ two runs, or two rebuilds, asked at once: one of each starts (41.001263ms)
✔ a run is refused on a stale base, and starts nothing (20.042821ms)
✔ a rebuild or a run that never recorded its process is lost, and holds nothing up (0.922165ms)
✔ a rebuild's credential left behind is cleaned, and a running one's is kept (0.81355ms)
✔ lab_check's problem: a stale, missing or unread base image; a fresh one is none (0.129845ms)
✔ lab_run and lab_base start through the gate, and lab_check names what is wrong with the base (0.322376ms)
✔ a checkout with a lock file at its root is installed there (2.228451ms)
✔ a checkout whose package lives one directory down is installed there, as mesh-tools' node-tools (0.731917ms)
✔ a package.json with no lock file is named, never installed (0.448623ms)
✔ a run installs and builds mesh-tools in node-tools, where its lock file is (12.594353ms)
✔ a run installs a checkout with its lock file at the root there, and builds only when asked (3.918669ms)
✔ a run fails at its setup, naming the checkout, when nothing of it can be installed (9.406188ms)
✔ a run checks out mesh-tools-go and says where its checkouts are (0.578979ms)
✔ the forge credential is the bound account and its sealed secret, for the forge's own origin (0.566986ms)
✔ a run clones through git's credential store, and its script carries no secret (0.68025ms)
✔ git presents the stored credential to the forge, and only when one is given (18.942902ms)
✔ a stopped script removes the credential, whatever ends it (9.999104ms)
✔ the script removes the credential as soon as its clones are done (0.304052ms)
✔ credentials a crashed run left are removed, but not the running one's (0.668788ms)
✔ the lab asks the package registry for read only (0.299202ms)
✔ each check gets a fresh directory of its own (0.571094ms)
﹣ what earlier checks left is cleared, and what cannot be is named rather than tripped over (0.071184ms) # running as root, which no directory mode stops from removing anything
✔ leftover checks are cleared, whoever runs the check (0.822126ms)
✔ the lab's tools bundle names its bound credential and binding in its env (0.177504ms)
✔ a run names the package registry by the address the registry gives its tarballs (16.248946ms)
✔ a registry that does not give an address the lab takes leaves the forge's, and the reason is said (3.360019ms)
✔ a run's npm configuration names the registry it was given, and the forge's own address only without one (0.24476ms)
✔ a tarball is taken at the forge's public root, and at no other port or scheme of its host (0.913759ms)
✔ the public root is read from the binding, and only an https root at the npm path is taken (1.240002ms)
✔ a forge setting that is not http(s) trusts no origin of its own (0.401675ms)
✔ every file takes its text from a template in files/ (0.233419ms)
✔ a run whose only test skipped as NOT REACHED, from a lab of before, reads as failed with the reason (1.208834ms)
✔ the lab's own NOT PASSED and skipped lines are read, a test name's punctuation and all (0.59004ms)
✔ a run that passed tests and skipped one for a declared reason stays passed, its skip listed (0.57411ms)
✔ a run that ran no test at all is not passed (0.092955ms)
✔ a line a test printed that looks like the suite's is not read as the suite's (0.105509ms)
✔ not reached is matched in any case (0.09528ms)
ℹ tests 45
ℹ suites 0
ℹ pass 44
ℹ fail 0
ℹ cancelled 0
ℹ skipped 1
ℹ todo 0
ℹ duration_ms 190.620269

**Merge check** at `36259f34` Judged: head `36259f3406f7` merged into trunk `f0c8958dd217`; read beside it: mesh-controller `0205b8f7080a`, mesh-controller-main `0205b8f7080a`, mesh-host `c5c4caa2a4ab`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: dev-tools, lab, mesh-build-go, mesh-build-node) - `mesh/repo-check`: **PASS** — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds dev-tools, lab, mesh-build-go, mesh-build-node → ace, g14, novox, shanks; no bus step - tier 0: dev-tools, lab, mesh-build-go, mesh-build-node - ace: receives dev-tools - g14: receives dev-tools, mesh-build-go, mesh-build-node - novox: receives dev-tools, mesh-build-go, mesh-build-node - shanks: receives dev-tools, lab, mesh-build-go, mesh-build-node - lab keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before dev-tools, lab, mesh-build-go, mesh-build-node is judged on its first machine - read by no module's build: checks/toolchains/go.mod, checks/toolchains/main.go, checks/toolchains/main_test.go, merge-check.sh, modules/dev-tools/README.md, modules/go/README.md, modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/forge_test.go, modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go, modules/mesh-build-node/README.md, modules/mesh-build-node/cmd/mesh-build-node/manifest_test.go, modules/nodejs/README.md Run by the build seat on ace as `build-1792577333906727399` (`builds --log build-1792577333906727399`). ``` --- the gate: dev-tools, lab, mesh-build-go, mesh-build-node dev-tools: ok lab: ok, keeps work (cache); WARNING: runtime-env ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339) mesh-build-go: ok, 6 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-go.own-runtime by its tool build_go_health every 1m0s mesh-build-node: ok, 5 tool(s), keeps state toolchains, keys, steps, ready: mesh-build-node.own-runtime by its tool build_node_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 1 4 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 4 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T10:06:45Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-21T10:06:45Z modules the change moves: - dev-tools (changed) - lab (changed) - mesh-build-go (changed) - mesh-build-node (changed) machines: - a machine (f35): composes; the change adds 0 resource(s) and removes 6 (-package:dev-tools.go, -package:dev-tools.nodejs, -package:dev-tools.npm, -package:mesh-build-go.go, -package:mesh-build-node.nodejs, -package:mesh-build-node.npm) - holds mesh-dns-resolver (idt): composes; the change adds 0 resource(s) and removes 3 (-package:dev-tools.go, -package:dev-tools.nodejs, -package:dev-tools.npm) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes; the change adds 0 resource(s) and removes 6 (-package:dev-tools.go, -package:dev-tools.nodejs, -package:dev-tools.npm, -package:mesh-build-go.go, -package:mesh-build-node.nodejs, -package:mesh-build-node.npm) - a machine (yvbpsm): composes; the change adds 0 resource(s) and removes 8 a merge would rebuild 4 module(s) in 1 tier(s): dev-tools, lab, mesh-build-go, mesh-build-node notes: - checks/toolchains/go.mod, checks/toolchains/main.go, checks/toolchains/main_test.go, merge-check.sh, modules/dev-tools/README.md, modules/go/README.md, modules/mesh-build-go/README.md, modules/mesh-build-go/cmd/mesh-build-go/forge_test.go, modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go, modules/mesh-build-node/README.md, modules/mesh-build-node/cmd/mesh-build-node/manifest_test.go and modules/nodejs/README.md read by no module's build, and rebuild nothing (issue 280) --- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.002s words: 12 retired words and 70 daemons' lines, none in the 58220 strings of 898 files ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.012s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.009s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.015s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.007s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory ok git.novox.be/novox/mesh-catalog/checks/secrets 0.012s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.232s predefined.json: 2 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.015s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.010s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 59, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.205s modules/lab is TypeScript: merge-check-typescript.sh type-checks and tests it testing modules/mesh-build-go ok meshbuildgo/cmd/mesh-build-go 14.741s testing modules/mesh-build-node ok meshbuildnode/cmd/mesh-build-node 1.248s --- its merge-check-typescript.sh (typescript toolchain) type-checking modules/lab (TypeScript) testing modules/lab (TypeScript) ✔ the base image's age is read from when this machine made it (1.729602ms) ✔ an image older than the bound refuses a run, naming the tool that rebuilds it (0.187342ms) ✔ an image within the bound runs (0.11657ms) ✔ a missing image, or one whose age cannot be read, is said and not refused (0.122981ms) ✔ no run starts while the base image is rebuilt (0.175159ms) ✔ a rebuild is mesh-lab's base build from the forge's main, with no secret in its script (0.243668ms) ✔ a rebuild is known by its status, and is not a run (7.159083ms) ✔ a run and a rebuild asked at once: exactly one starts (42.60572ms) ✔ two runs, or two rebuilds, asked at once: one of each starts (41.001263ms) ✔ a run is refused on a stale base, and starts nothing (20.042821ms) ✔ a rebuild or a run that never recorded its process is lost, and holds nothing up (0.922165ms) ✔ a rebuild's credential left behind is cleaned, and a running one's is kept (0.81355ms) ✔ lab_check's problem: a stale, missing or unread base image; a fresh one is none (0.129845ms) ✔ lab_run and lab_base start through the gate, and lab_check names what is wrong with the base (0.322376ms) ✔ a checkout with a lock file at its root is installed there (2.228451ms) ✔ a checkout whose package lives one directory down is installed there, as mesh-tools' node-tools (0.731917ms) ✔ a package.json with no lock file is named, never installed (0.448623ms) ✔ a run installs and builds mesh-tools in node-tools, where its lock file is (12.594353ms) ✔ a run installs a checkout with its lock file at the root there, and builds only when asked (3.918669ms) ✔ a run fails at its setup, naming the checkout, when nothing of it can be installed (9.406188ms) ✔ a run checks out mesh-tools-go and says where its checkouts are (0.578979ms) ✔ the forge credential is the bound account and its sealed secret, for the forge's own origin (0.566986ms) ✔ a run clones through git's credential store, and its script carries no secret (0.68025ms) ✔ git presents the stored credential to the forge, and only when one is given (18.942902ms) ✔ a stopped script removes the credential, whatever ends it (9.999104ms) ✔ the script removes the credential as soon as its clones are done (0.304052ms) ✔ credentials a crashed run left are removed, but not the running one's (0.668788ms) ✔ the lab asks the package registry for read only (0.299202ms) ✔ each check gets a fresh directory of its own (0.571094ms) ﹣ what earlier checks left is cleared, and what cannot be is named rather than tripped over (0.071184ms) # running as root, which no directory mode stops from removing anything ✔ leftover checks are cleared, whoever runs the check (0.822126ms) ✔ the lab's tools bundle names its bound credential and binding in its env (0.177504ms) ✔ a run names the package registry by the address the registry gives its tarballs (16.248946ms) ✔ a registry that does not give an address the lab takes leaves the forge's, and the reason is said (3.360019ms) ✔ a run's npm configuration names the registry it was given, and the forge's own address only without one (0.24476ms) ✔ a tarball is taken at the forge's public root, and at no other port or scheme of its host (0.913759ms) ✔ the public root is read from the binding, and only an https root at the npm path is taken (1.240002ms) ✔ a forge setting that is not http(s) trusts no origin of its own (0.401675ms) ✔ every file takes its text from a template in files/ (0.233419ms) ✔ a run whose only test skipped as NOT REACHED, from a lab of before, reads as failed with the reason (1.208834ms) ✔ the lab's own NOT PASSED and skipped lines are read, a test name's punctuation and all (0.59004ms) ✔ a run that passed tests and skipped one for a declared reason stays passed, its skip listed (0.57411ms) ✔ a run that ran no test at all is not passed (0.092955ms) ✔ a line a test printed that looks like the suite's is not read as the suite's (0.105509ms) ✔ not reached is matched in any case (0.09528ms) ℹ tests 45 ℹ suites 0 ℹ pass 44 ℹ fail 0 ℹ cancelled 0 ℹ skipped 1 ℹ todo 0 ℹ duration_ms 190.620269 ```

mesh-tools merged commit 940594b074 into main

2026-10-21 10:21:03 +00:00

mesh-tools deleted branch fix/1573b-toolchain-users

2026-10-21 10:21:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#409