Files go through the store: object-store links, node-files upload/download, a document converter, and brother printing a key, a path on any machine or a web link (design 60 F3, ADR 0468) #417

Merged

mesh-tools merged 20 commits from feat/files-through-the-store into main 2026-10-21 16:31:23 +00:00

Conversation 2 Commits 20 Files Changed 58

+4921 -357

mesh-tools commented 2026-10-21 14:42:31 +00:00

Member

Copy Link

Copy Source

Design 60 milestone F3, building ADR 0468 (as changed by ADR 0479 §5, whose parts are not here). Member of the delivery group feat/files-through-the-store with mesh-controller #424 (mesh-sdk d4deecdb, issue 1718): mesh-files' new node-files verbs need that controller, and that controller needs this mesh-files.

• minio: a link key per bucket limited to get and put (issue 1594); object-store.link in a Go bundle, signed with that key for the consumer and its shares, seat: shares matched through mesh-controller.seats; minio_presigned_url retired (issue 1516).
• mesh-files: node-files.upload and download by short links, secret places refused before anything is sent, 25 s bound (issue 1597).
• only-office: seat document-converter, verb convert queued to the converter process that alone holds the JWT and posts to the document server's /converter (issues 1595, 1596).
• brother: the scan folder filed from the store by a link (issue 1601); printer.print takes exactly one of object, path with node, url or ask, answers within 25 s, checks the printer's document-format-supported (issue 1598); a URL fetched bounded and never inside the mesh (issue 1599); non-PDF documents converted first (issue 1600).

Every issue's acceptance criteria are on the issue, each tested at its level and seen failing first. Review: three rounds (round 1: every verb answers within 25 s since the tool runner cuts calls at 30 s; round 3: three data races the group's check found under -race, fixed by 6cf51173 and ad85a979; every suite passes -race three times). The integration tests run in this group's check, since no try composes the two heads.

Delivery: minio and only-office on novox (minio's data backed up first), mesh-files on ace, g14, novox and shanks, brother on shanks. Live proofs after delivery: a .docx on g14 printed by path, a PDF and an HTML page by URL, a glass scan in the scan folder by a link.

Reviewed-by: review-fts@shanks at 6cf51173d5

Design 60 milestone F3, building ADR 0468 (as changed by ADR 0479 §5, whose parts are not here). Member of the delivery group feat/files-through-the-store with mesh-controller #424 (mesh-sdk d4deecdb, issue 1718): mesh-files' new node-files verbs need that controller, and that controller needs this mesh-files. - minio: a link key per bucket limited to get and put (issue 1594); object-store.link in a Go bundle, signed with that key for the consumer and its shares, seat:<s> shares matched through mesh-controller.seats; minio_presigned_url retired (issue 1516). - mesh-files: node-files.upload and download by short links, secret places refused before anything is sent, 25 s bound (issue 1597). - only-office: seat document-converter, verb convert queued to the converter process that alone holds the JWT and posts to the document server's /converter (issues 1595, 1596). - brother: the scan folder filed from the store by a link (issue 1601); printer.print takes exactly one of object, path with node, url or ask, answers within 25 s, checks the printer's document-format-supported (issue 1598); a URL fetched bounded and never inside the mesh (issue 1599); non-PDF documents converted first (issue 1600). Every issue's acceptance criteria are on the issue, each tested at its level and seen failing first. Review: three rounds (round 1: every verb answers within 25 s since the tool runner cuts calls at 30 s; round 3: three data races the group's check found under -race, fixed by 6cf51173 and ad85a979; every suite passes -race three times). The integration tests run in this group's check, since no try composes the two heads. Delivery: minio and only-office on novox (minio's data backed up first), mesh-files on ace, g14, novox and shanks, brother on shanks. Live proofs after delivery: a .docx on g14 printed by path, a PDF and an HTML page by URL, a glass scan in the scan folder by a link. Reviewed-by: review-fts@shanks at 6cf51173d586fc8fb7fc1188d7a990f2ca835531

mesh-tools added 17 commits 2026-10-21 14:42:32 +00:00

Make a link key per bucket, limited to get and put of its objects and kept as minio's own secret, so links are not signed by the root account (issue 1594) 5b3fd1008a

Serve object-store.link: a signed link to one object, signed with the bucket's link key, for the consumer and its shares; retire the root-signed minio_presigned_url (issue 1516) 06ca1b7fb9

Serve node-files.upload and download: a machine's file goes into a bucket and an object comes out of one, by short links, never over the bus (issue 1597) 6ee3507af0

Claim document-converter and serve convert: queue the ask for the converter and read its answer, holding no credential (issue 1595) caae838a2a

Add the converter process: take convert-asks, have the document server make the PDF with a token only it holds, and put it to the target link (issue 1596) 278014fd79

File a scan from the store by the link the device process signs, not by parts over the bus (issue 1601) cb226c6fef

Make printer.print take exactly one of object, path with node, or url, send a machine's file through its node-files, and check the printer's formats first (issue 1598) e959cf339b

Print a web link: the device process fetches it bounded, never inside the mesh or the machine, stores it under its SHA-256 and prints that (issue 1599) 657b38ccd1

Convert a Word, spreadsheet, slide, text or web document to PDF through the converter before printing it (issue 1600) 6358041eca

Post conversions to the document server's documented /converter path (issue 1596) b54640e386

Merge remote-tracking branch 'origin/main' into feat/files-through-the-store dc2b0641bf

Declare the seat object-store in minio's seats (issue 1516) 6e2762d943

Declare the seat document-converter in only-office's seats (issue 1595) 68e1ad80ac

Bound an upload and a download to 25 s, so a tool call is never cut while the transfer goes on (issue 1597) 7c97ce0bf8

Answer a conversion not done in 25 s as converting and read it with convert {ask}, so no call is cut by the tool runner (issue 1595) 778356f10c

Follow a conversion with convert {ask}, each call under 25 s, and leave the SDK's call timeout alone (issue 1600) 72ef20a4e7

Answer printer.print within 25 s as started with its ask id, and read it with printer.print {ask}, so no call is cut by the tool runner (issue 1598) a2deae03b7

mesh-tools commented 2026-10-21 14:42:46 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@6cf51173d586 — superseded since 2026-10-21T16:51:19Z

Covered: delivered after its walk was superseded: the walk plan-1792597220088006936, which took its walk plan-1792600286186319151 over, ended done

Delivery plan — builds brother, mesh-files, minio, only-office → ace, g14, novox, shanks; no bus step; 1 wait(s) for a person

• tier 0: brother, mesh-files, minio, only-office
• ace: receives mesh-files
• g14: receives mesh-files
• novox: receives mesh-files, only-office; waits for a person: minio
• shanks: receives brother, mesh-files
• minio waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
• minio provides s3-bucket: its consumers are sent again after it
• minio keeps data (ADR 0233): what it holds is backed up before it moves
• only-office keeps data (ADR 0233): what it holds is backed up before it moves
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before brother, mesh-files is judged on its first machine

Group feat/files-through-the-store: novox/mesh-catalog@6cf51173d5, novox/mesh-controller@550cf37d71

• composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Transitions

• 2026-10-21 16:05 (new) → proposed (announced): novox/mesh-catalog#417's head announced
• 2026-10-21 16:06 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-21 16:06 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-21 16:51 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-21 16:51 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-21 16:51 delivering → superseded (superseded): its walk was superseded and names no walk that took it over: a walk that took it over answers its merge, and it follows that walk (novox/hq ADR 0276)

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@6cf51173d586` — **superseded** since 2026-10-21T16:51:19Z **Covered**: delivered after its walk was superseded: the walk plan-1792597220088006936, which took its walk plan-1792600286186319151 over, ended done **Delivery plan** — builds brother, mesh-files, minio, only-office → ace, g14, novox, shanks; no bus step; 1 wait(s) for a person - tier 0: brother, mesh-files, minio, only-office - ace: receives mesh-files - g14: receives mesh-files - novox: receives mesh-files, only-office; waits for a person: minio - shanks: receives brother, mesh-files - minio waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - minio provides s3-bucket: its consumers are sent again after it - minio keeps data (ADR 0233): what it holds is backed up before it moves - only-office keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before brother, mesh-files is judged on its first machine **Group** `feat/files-through-the-store`: novox/mesh-catalog@6cf51173d586, novox/mesh-controller@550cf37d7109 - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Transitions** - 2026-10-21 16:05 (new) → proposed (announced): novox/mesh-catalog#417's head announced - 2026-10-21 16:06 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 16:06 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 16:51 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-21 16:51 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 16:51 delivering → superseded (superseded): its walk was superseded and names no walk that took it over: a walk that took it over answers its merge, and it follows that walk (novox/hq ADR 0276) The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented 2026-10-21 14:52:59 +00:00

Author

Member

Copy Link

Copy Source

Merge check at a2deae03
Judged: head a2deae03b712 merged into trunk 90ecba4e50a3
Siblings read beside it: novox/mesh-controller#424 227c86ebb388 merged onto 12752911b644 (main)

• mesh/merge-gate: FAIL — the sibling novox/mesh-controller#424 (head 227c86ebb388) does not merge cleanly into its base main 12752911b644: in conflict go.mod, go.sum, testdata/beside/CAPTURED, vendor/modules.txt
• mesh/repo-check: FAIL — the sibling novox/mesh-controller#424 (head 227c86ebb388) does not merge cleanly into its base main 12752911b644: in conflict go.mod, go.sum, testdata/beside/CAPTURED, vendor/modules.txt

Delivery plan — builds brother, mesh-files, minio, only-office → ace, g14, novox, shanks; no bus step; 1 wait(s) for a person

• tier 0: brother, mesh-files, minio, only-office
• ace: receives mesh-files
• g14: receives mesh-files
• novox: receives mesh-files, only-office; waits for a person: minio
• shanks: receives brother, mesh-files
• minio waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
• minio provides s3-bucket: its consumers are sent again after it
• minio keeps data (ADR 0233): what it holds is backed up before it moves
• only-office keeps data (ADR 0233): what it holds is backed up before it moves
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before brother, mesh-files is judged on its first machine
• read by no module's build: modules/brother/README.md, modules/brother/cmd/brother/convert_test.go, modules/brother/cmd/brother/documents_test.go, modules/brother/cmd/brother/fetch_test.go, modules/brother/cmd/brother/manifest_test.go, modules/brother/cmd/brother/objects_test.go, modules/brother/cmd/brother/printlink_test.go, modules/brother/cmd/brother/rig_test.go, modules/brother/cmd/brother/scanlink_test.go, modules/brother/cmd/brother/service_test.go, modules/mesh-files/cmd/mesh-files/manifest_test.go, modules/mesh-files/cmd/mesh-files/transfer_test.go, modules/only-office/cmd/only-office/convert.go, modules/only-office/cmd/only-office/convert_test.go, modules/only-office/cmd/only-office/converter.go, modules/only-office/cmd/only-office/converter_integration_test.go, modules/only-office/cmd/only-office/converter_test.go, modules/only-office/cmd/only-office/main.go, modules/only-office/go.mod, modules/only-office/go.sum

Run by the build seat on ace as build-1792593798722564984 (builds --log build-1792593798722564984).

the sibling novox/mesh-controller#424 (head 227c86ebb388) does not merge cleanly into its base main 12752911b644: in conflict go.mod, go.sum, testdata/beside/CAPTURED, vendor/modules.txt

**Merge check** at `a2deae03` Judged: head `a2deae03b712` merged into trunk `90ecba4e50a3` Siblings read beside it: novox/mesh-controller#424 `227c86ebb388` merged onto `12752911b644` (main) - `mesh/merge-gate`: **FAIL** — the sibling novox/mesh-controller#424 (head 227c86ebb388) does not merge cleanly into its base main 12752911b644: in conflict go.mod, go.sum, testdata/beside/CAPTURED, vendor/modules.txt - `mesh/repo-check`: **FAIL** — the sibling novox/mesh-controller#424 (head 227c86ebb388) does not merge cleanly into its base main 12752911b644: in conflict go.mod, go.sum, testdata/beside/CAPTURED, vendor/modules.txt **Delivery plan** — builds brother, mesh-files, minio, only-office → ace, g14, novox, shanks; no bus step; 1 wait(s) for a person - tier 0: brother, mesh-files, minio, only-office - ace: receives mesh-files - g14: receives mesh-files - novox: receives mesh-files, only-office; waits for a person: minio - shanks: receives brother, mesh-files - minio waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - minio provides s3-bucket: its consumers are sent again after it - minio keeps data (ADR 0233): what it holds is backed up before it moves - only-office keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before brother, mesh-files is judged on its first machine - read by no module's build: modules/brother/README.md, modules/brother/cmd/brother/convert_test.go, modules/brother/cmd/brother/documents_test.go, modules/brother/cmd/brother/fetch_test.go, modules/brother/cmd/brother/manifest_test.go, modules/brother/cmd/brother/objects_test.go, modules/brother/cmd/brother/printlink_test.go, modules/brother/cmd/brother/rig_test.go, modules/brother/cmd/brother/scanlink_test.go, modules/brother/cmd/brother/service_test.go, modules/mesh-files/cmd/mesh-files/manifest_test.go, modules/mesh-files/cmd/mesh-files/transfer_test.go, modules/only-office/cmd/only-office/convert.go, modules/only-office/cmd/only-office/convert_test.go, modules/only-office/cmd/only-office/converter.go, modules/only-office/cmd/only-office/converter_integration_test.go, modules/only-office/cmd/only-office/converter_test.go, modules/only-office/cmd/only-office/main.go, modules/only-office/go.mod, modules/only-office/go.sum Run by the build seat on ace as `build-1792593798722564984` (`builds --log build-1792593798722564984`). ``` the sibling novox/mesh-controller#424 (head 227c86ebb388) does not merge cleanly into its base main 12752911b644: in conflict go.mod, go.sum, testdata/beside/CAPTURED, vendor/modules.txt ```

jschoubben added 1 commit 2026-10-21 15:49:59 +00:00

Merge remote-tracking branch 'origin/main' into feat/files-through-the-store aef2a1a91f

jschoubben added 2 commits 2026-10-21 16:05:02 +00:00

Read the upload fake under a lock, since the print runs in the background and the test read it meanwhile: a data race under -race (issue 1598) ad85a979e3

Give the Service its own fetch client and open-document waits instead of reading package variables from background goroutines, which a test or reload changed meanwhile: data races under -race (issue 1601) 6cf51173d5

mesh-tools merged commit 7a7a403485 into main 2026-10-21 16:31:23 +00:00

mesh-tools deleted branch feat/files-through-the-store 2026-10-21 16:31:23 +00:00

mesh-tools referenced this pull request 2026-10-21 18:28:51 +00:00

Make minio's link-key secrets 40 characters and keep every mc argument's secret out of its errors (issue 1766) #422

mesh-tools referenced this pull request 2026-10-21 21:57:48 +00:00

A delivery whose walk was folded into a batch follows that batch's walk and ends delivered (issue 1786) #426

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#417