Start the gitea bundle's binds without awaiting them, so its handshake is answered (issue 1793) #429

Merged

mesh-tools merged 2 commits from fix/1793-bind-after-handshake into main 2026-10-21 22:59:00 +00:00

Conversation 3 Commits 2 Files Changed 4

+93 -14

mesh-tools commented 2026-10-21 22:47:09 +00:00

Member

Copy Link

Copy Source

What

index.ts no longer awaits the binds of mesh-controller.checked and node-build-agent.started at its top level. New bindInBackground (bind.ts) starts both in order inside one void async function, each retried without bound (2/5/10 s, then 30 s), and prints the 'watching' line after the last holds.

Why

Issue 1793. mesh-catalog#428 retried the bind but awaited it at the top of index.ts. The launcher imports the bundle and then answers node-tools' handshake, which has 10 s; after that node-tools kills the bundle and does not start it again. A bind refused for more than about 8 s therefore still ended the bundle exactly as at 00:28:37 (journal: 'index.serve.mjs failed to load: gitea's bundle exited (1): Error: binding gitea's consumer novox_gitea: nats: no responders'). Finding of the review of #428, which merged before it.

How it is checked

• test/bind.test.ts: the caller of bindInBackground returns at once while the first bind is refused; the binds then go in order and the done callback runs after the last; a bind that never holds does not stop the caller from returning.
• test/bundle-import.test.ts: a child process installs a broker that refuses every bind (useBroker) and imports dist/index.js; the import must resolve within 3 s. Seen failing first against #428's index.ts (3015 ms, no 'imported') and passing on this head (73 ms), by the agent and again by the reviewer in a separate worktree.
• mesh-controller.try on 77f3963d against trunk c770f794: pass, build-1792622973062562960.

Reviewed-by: reviewer-1793@shanks at 77f3963d83

## What index.ts no longer awaits the binds of mesh-controller.checked and node-build-agent.started at its top level. New bindInBackground (bind.ts) starts both in order inside one void async function, each retried without bound (2/5/10 s, then 30 s), and prints the 'watching' line after the last holds. ## Why Issue 1793. mesh-catalog#428 retried the bind but awaited it at the top of index.ts. The launcher imports the bundle and then answers node-tools' handshake, which has 10 s; after that node-tools kills the bundle and does not start it again. A bind refused for more than about 8 s therefore still ended the bundle exactly as at 00:28:37 (journal: 'index.serve.mjs failed to load: gitea's bundle exited (1): Error: binding gitea's consumer novox_gitea: nats: no responders'). Finding of the review of #428, which merged before it. ## How it is checked - test/bind.test.ts: the caller of bindInBackground returns at once while the first bind is refused; the binds then go in order and the done callback runs after the last; a bind that never holds does not stop the caller from returning. - test/bundle-import.test.ts: a child process installs a broker that refuses every bind (useBroker) and imports dist/index.js; the import must resolve within 3 s. Seen failing first against #428's index.ts (3015 ms, no 'imported') and passing on this head (73 ms), by the agent and again by the reviewer in a separate worktree. - mesh-controller.try on 77f3963d against trunk c770f794: pass, build-1792622973062562960. Reviewed-by: reviewer-1793@shanks at 77f3963d8338b4c2b742945cbf70dc2d1920ee12

mesh-tools added 1 commit 2026-10-21 22:47:10 +00:00

Start the gitea bundle's binds without awaiting them, so its handshake is answered while a refused bind is asked again (issue 1793) 49a28f8537

mesh-tools commented 2026-10-21 22:47:22 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@77f3963d8338 — delivered since 2026-10-21T23:03:52Z

Delivery plan — builds gitea → novox; no bus step

• tier 0: gitea
• novox: receives gitea
• gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
• gitea keeps data (ADR 0233): what it holds is backed up before it moves

Machines

• gitea on every machine running it: sent

Transitions

• 2026-10-21 22:49 (new) → proposed (announced): novox/mesh-catalog#429's head announced
• 2026-10-21 22:56 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-21 22:56 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-21 22:59 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-21 22:59 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-21 23:03 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@77f3963d8338` — **delivered** since 2026-10-21T23:03:52Z **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - gitea on every machine running it: sent **Transitions** - 2026-10-21 22:49 (new) → proposed (announced): novox/mesh-catalog#429's head announced - 2026-10-21 22:56 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 22:56 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 22:59 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-21 22:59 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 23:03 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben added 1 commit 2026-10-21 22:49:30 +00:00

Test that the gitea bundle's import resolves while its binds are refused (issue 1793) 77f3963d83

mesh-tools commented 2026-10-21 22:53:49 +00:00

Author

Member

Copy Link

Copy Source

Merge check at 49a28f85
Judged: head 49a28f85378b merged into trunk c770f7947d95; read beside it: mesh-controller a929df9b0ec3, mesh-controller-main a929df9b0ec3, mesh-host 4065b45ae84f, mesh-tools e0fadc43d9dd

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds gitea → novox; no bus step

• tier 0: gitea
• novox: receives gitea
• gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
• gitea keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on ace as build-1792622838769934459 (builds --log build-1792622838769934459).

✔ a start heard after the verdict writes nothing (0.566503ms)
✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.685496ms)
✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.059388ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (4.259404ms)
✔ a rechecked head says where its new run is: building on which machine (0.890211ms)
✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.7939ms)
✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.737534ms)
✔ a recheck the forge does not take fails its caller, and the head is as it was (0.603302ms)
✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (13.962098ms)
✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (6.975984ms)
✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (0.439315ms)
✔ a repository as the mesh clones it is told from another (0.33574ms)
✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (5.774096ms)
✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (51.252923ms)
✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (21.141995ms)
✔ gitea_api still writes what an author writes (7.63512ms)
✔ gitea_branch_protection_set only strengthens (14.81047ms)
✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (42.994952ms)
✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (142.821529ms)
✔ gitea_merge_pull_request asks no check of a member that waits for its group's composed check (31.178774ms)
✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (17.240329ms)
✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (12.795457ms)
✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (24.074218ms)
✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (53.833556ms)
✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (21.957164ms)
✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.141554ms)
✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (6.765849ms)
✔ a rule named for a branch is not made weaker than the glob rule that guards it now (12.613716ms)
✔ a repository owner or name is never another path (0.286508ms)
✔ the judges, without a forge (0.365095ms)
✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.246613ms)
✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.737748ms)
✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.307802ms)
✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (6.665512ms)
✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (81.233429ms)
✔ gitea_merge_pull_request refuses a head the Approve did not name (18.041073ms)
✔ a group of two merges in one pass: the sibling's merge of the composed head does not stop the member's merge (issue 1049) (17.658225ms)
✔ gitea_create_repo has no owner argument and posts only to the tools' own user's repositories (1124/AC8) (43.694385ms)
✔ the tools' team cannot create in the organisation and its token holds no write:organization (1124/AC8) (0.386134ms)
✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (15.731259ms)
✔ every page of a pull request's files is read, though the forge caps a page at fifty (32.72227ms)
✔ a pass asks only the repositories that moved since the last look, every one before the first (0.645141ms)
✔ the directories above a merge's files that hold a module at the commit are said, the root never (13.614675ms)
✔ a lookup the forge refuses is thrown, not read as no module (3.729982ms)
✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (5.909412ms)
✔ a new head beyond the newest 20 open pull requests is announced, exactly once (58.366064ms)
✔ a pass pages until it reaches back past its floor, and no further (24.780703ms)
✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (26.470757ms)
✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (12.464806ms)
✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (7.858601ms)
✔ the statuses asked for replace the rule's, and an empty list requires none (4.089917ms)
✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.288692ms)
✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (0.742954ms)
✔ another branch's body carries no merge whitelist (0.263504ms)
✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.353363ms)
✔ each open pull request's new head is announced once, and nothing closed or merged (18.89229ms)
✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.285393ms)
✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.923233ms)
✔ no verdict sets warning on a required check; only a person's decision fails (1.2783ms)
✔ a commit status is set on the commit, under the merge check's context (36.458363ms)
✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.406002ms)
✔ a head announced is pending in the build queue, since the local time it was announced (0.249188ms)
✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.391084ms)
✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.45796ms)
✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.248811ms)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head dddddddddddd onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (2.11487ms)
✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (1.160459ms)
✔ a verdict without siblings is said exactly as before (an older controller) (0.594496ms)
✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (0.74059ms)
✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (1.969637ms)
✔ a sibling closed unmerged puts the member's verdict out of date (0.444384ms)
✔ a move of the sibling's base puts it out of date, naming both commits (2.35467ms)
✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.675078ms)
✔ a merge of another head, or onto another base, is a move (0.889139ms)
✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.727044ms)
✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.618591ms)
✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.287837ms)
✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.254217ms)
✔ without the composed verdict's siblings, a sibling's own merge of its new head is a move (the pin of issue 1049) (0.832372ms)
✔ a composed verdict names the siblings of each member at the heads and base commits it composed, so a sibling's own merge of its new head is no move (issue 1049) (0.876345ms)
✔ a composed verdict keeps nothing for a member it cannot name, and a group of one is none (issue 1049) (0.258095ms)
✔ a consumer that asks nothing, or write, publishes: the package team (2.151378ms)
✔ a consumer that asks to read joins the readers, who write no package (0.477656ms)
✔ a reader is made, put on the readers team, and taken off the package team (0.528151ms)
✔ a publisher is made and put on the package team, as before (0.221185ms)
✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (39.602745ms)
✔ second start: reuses the kept token, mints nothing (21.394439ms)
✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (26.490042ms)
✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (26.438146ms)
✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (26.135707ms)
✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (20.508696ms)
✔ concurrent first calls share one mint (13.159119ms)
✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (14.662703ms)
✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (78.677209ms)
✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (5.059667ms)
✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (16.641708ms)
✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.711996ms)
✔ a second process finds the token the first renewed, and reuses it instead of minting over it (18.423672ms)
✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.091055ms)
✔ nothing to mint with and no token: the client says what is missing (0.155943ms)
[gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-K4FGQe/state/token
✔ the tools register once there is a way to a token, and the first call mints it (27.035565ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-KdCSMz/state/token
✔ a pull request can be closed, read and cleaned up through the tools (35.326739ms)
[gitea] no token kept — minting one
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-YEE2P9/state/token
✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (64.927481ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-q9vgaJ/state/token
✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (46.575333ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-AtQ075/state/token
✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (44.140072ms)
[gitea] the kept token was minted with other scopes than the tools take now — minting one with them
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-zaDzog/state/token
[gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now
✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (42.018951ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-QJCXtC/state/token
✔ a tools' account someone made an administrator is made a plain account again at the next mint (35.727321ms)
✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.69756ms)
✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (0.809219ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-lpvjQb/state/token
✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (39.16872ms)
[gitea] no token kept — minting one
✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (25.647832ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-YgbDE5/state/token
[gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"}
✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (42.593289ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-qr328E/state/token
✔ a team another process made between the look and the create is found, not a failure (39.019771ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-bdGG7Y/state/token
✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (32.686052ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-4bTqNT/state/token
✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (34.162785ms)
✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (12.822337ms)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away
✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (1.892321ms)
✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.750946ms)
✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (3.805302ms)
✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.515057ms)
✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.600296ms)
✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.357351ms)
✔ a verdict that landed out of date keeps its account on the pull request (0.240812ms)
✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.373541ms)
✔ a signed event is published on the bus and acted on once (67.221988ms)
✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (28.899604ms)
✔ an event and the poll seeing the same head announce it once (0.304031ms)
✔ each forge event is named in the module's stream and trimmed (0.470864ms)
✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.072032ms)
✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (0.973908ms)
✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (3.102834ms)
✔ a forge that makes no system webhook is said, never taken as heard (0.574829ms)
✔ the receiver tells what it verified and what it refused (6.236707ms)
✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (0.862659ms)
✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.380414ms)
✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.323618ms)
✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.171862ms)
✔ a pull request's edit event carries its description, and no other pull request event does (issue 1079) (0.1922ms)
ℹ tests 169
ℹ suites 0
ℹ pass 169
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 820.644841

**Merge check** at `49a28f85` Judged: head `49a28f85378b` merged into trunk `c770f7947d95`; read beside it: mesh-controller `a929df9b0ec3`, mesh-controller-main `a929df9b0ec3`, mesh-host `4065b45ae84f`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on ace as `build-1792622838769934459` (`builds --log build-1792622838769934459`). ``` ✔ a start heard after the verdict writes nothing (0.566503ms) ✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (0.685496ms) ✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.059388ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (4.259404ms) ✔ a rechecked head says where its new run is: building on which machine (0.890211ms) ✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.7939ms) ✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.737534ms) ✔ a recheck the forge does not take fails its caller, and the head is as it was (0.603302ms) ✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (13.962098ms) ✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (6.975984ms) ✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (0.439315ms) ✔ a repository as the mesh clones it is told from another (0.33574ms) ✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (5.774096ms) ✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (51.252923ms) ✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (21.141995ms) ✔ gitea_api still writes what an author writes (7.63512ms) ✔ gitea_branch_protection_set only strengthens (14.81047ms) ✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (42.994952ms) ✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (142.821529ms) ✔ gitea_merge_pull_request asks no check of a member that waits for its group's composed check (31.178774ms) ✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (17.240329ms) ✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (12.795457ms) ✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (24.074218ms) ✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (53.833556ms) ✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (21.957164ms) ✔ gitea_api sends the path it judged, and refuses moving a pull request's base (4.141554ms) ✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (6.765849ms) ✔ a rule named for a branch is not made weaker than the glob rule that guards it now (12.613716ms) ✔ a repository owner or name is never another path (0.286508ms) ✔ the judges, without a forge (0.365095ms) ✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.246613ms) ✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (2.737748ms) ✔ gitea_api never approves a pull request nor requests changes: those are the operator's (2.307802ms) ✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (6.665512ms) ✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (81.233429ms) ✔ gitea_merge_pull_request refuses a head the Approve did not name (18.041073ms) ✔ a group of two merges in one pass: the sibling's merge of the composed head does not stop the member's merge (issue 1049) (17.658225ms) ✔ gitea_create_repo has no owner argument and posts only to the tools' own user's repositories (1124/AC8) (43.694385ms) ✔ the tools' team cannot create in the organisation and its token holds no write:organization (1124/AC8) (0.386134ms) ✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (15.731259ms) ✔ every page of a pull request's files is read, though the forge caps a page at fifty (32.72227ms) ✔ a pass asks only the repositories that moved since the last look, every one before the first (0.645141ms) ✔ the directories above a merge's files that hold a module at the commit are said, the root never (13.614675ms) ✔ a lookup the forge refuses is thrown, not read as no module (3.729982ms) ✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (5.909412ms) ✔ a new head beyond the newest 20 open pull requests is announced, exactly once (58.366064ms) ✔ a pass pages until it reaches back past its floor, and no further (24.780703ms) ✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (26.470757ms) ✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (12.464806ms) ✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (7.858601ms) ✔ the statuses asked for replace the rule's, and an empty list requires none (4.089917ms) ✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.288692ms) ✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (0.742954ms) ✔ another branch's body carries no merge whitelist (0.263504ms) ✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.353363ms) ✔ each open pull request's new head is announced once, and nothing closed or merged (18.89229ms) ✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.285393ms) ✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.923233ms) ✔ no verdict sets warning on a required check; only a person's decision fails (1.2783ms) ✔ a commit status is set on the commit, under the merge check's context (36.458363ms) ✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.406002ms) ✔ a head announced is pending in the build queue, since the local time it was announced (0.249188ms) ✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.391084ms) ✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.45796ms) ✔ the vault's token is used, a setting of it is ignored and said once, without its value (2.248811ms) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head dddddddddddd onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) ✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (2.11487ms) ✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (1.160459ms) ✔ a verdict without siblings is said exactly as before (an older controller) (0.594496ms) ✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (0.74059ms) ✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (1.969637ms) ✔ a sibling closed unmerged puts the member's verdict out of date (0.444384ms) ✔ a move of the sibling's base puts it out of date, naming both commits (2.35467ms) ✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.675078ms) ✔ a merge of another head, or onto another base, is a move (0.889139ms) ✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.727044ms) ✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.618591ms) ✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.287837ms) ✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.254217ms) ✔ without the composed verdict's siblings, a sibling's own merge of its new head is a move (the pin of issue 1049) (0.832372ms) ✔ a composed verdict names the siblings of each member at the heads and base commits it composed, so a sibling's own merge of its new head is no move (issue 1049) (0.876345ms) ✔ a composed verdict keeps nothing for a member it cannot name, and a group of one is none (issue 1049) (0.258095ms) ✔ a consumer that asks nothing, or write, publishes: the package team (2.151378ms) ✔ a consumer that asks to read joins the readers, who write no package (0.477656ms) ✔ a reader is made, put on the readers team, and taken off the package team (0.528151ms) ✔ a publisher is made and put on the package team, as before (0.221185ms) ✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (39.602745ms) ✔ second start: reuses the kept token, mints nothing (21.394439ms) ✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (26.490042ms) ✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (26.438146ms) ✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (26.135707ms) ✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (20.508696ms) ✔ concurrent first calls share one mint (13.159119ms) ✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (14.662703ms) ✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (78.677209ms) ✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (5.059667ms) ✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (16.641708ms) ✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.711996ms) ✔ a second process finds the token the first renewed, and reuses it instead of minting over it (18.423672ms) ✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.091055ms) ✔ nothing to mint with and no token: the client says what is missing (0.155943ms) [gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-K4FGQe/state/token ✔ the tools register once there is a way to a token, and the first call mints it (27.035565ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-KdCSMz/state/token ✔ a pull request can be closed, read and cleaned up through the tools (35.326739ms) [gitea] no token kept — minting one [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-YEE2P9/state/token ✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (64.927481ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-q9vgaJ/state/token ✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (46.575333ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-AtQ075/state/token ✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (44.140072ms) [gitea] the kept token was minted with other scopes than the tools take now — minting one with them [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-zaDzog/state/token [gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now ✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (42.018951ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-QJCXtC/state/token ✔ a tools' account someone made an administrator is made a plain account again at the next mint (35.727321ms) ✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.69756ms) ✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (0.809219ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-lpvjQb/state/token ✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (39.16872ms) [gitea] no token kept — minting one ✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (25.647832ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-YgbDE5/state/token [gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"} ✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (42.593289ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-qr328E/state/token ✔ a team another process made between the look and the create is found, not a failure (39.019771ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-bdGG7Y/state/token ✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (32.686052ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-4bTqNT/state/token ✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (34.162785ms) ✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (12.822337ms) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away ✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (1.892321ms) ✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.750946ms) ✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (3.805302ms) ✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.515057ms) ✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.600296ms) ✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.357351ms) ✔ a verdict that landed out of date keeps its account on the pull request (0.240812ms) ✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (0.373541ms) ✔ a signed event is published on the bus and acted on once (67.221988ms) ✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (28.899604ms) ✔ an event and the poll seeing the same head announce it once (0.304031ms) ✔ each forge event is named in the module's stream and trimmed (0.470864ms) ✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.072032ms) ✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (0.973908ms) ✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (3.102834ms) ✔ a forge that makes no system webhook is said, never taken as heard (0.574829ms) ✔ the receiver tells what it verified and what it refused (6.236707ms) ✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (0.862659ms) ✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.380414ms) ✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.323618ms) ✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.171862ms) ✔ a pull request's edit event carries its description, and no other pull request event does (issue 1079) (0.1922ms) ℹ tests 169 ℹ suites 0 ℹ pass 169 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 820.644841 ```

mesh-tools commented 2026-10-21 22:56:36 +00:00

Author

Member

Copy Link

Copy Source

Merge check at 77f3963d
Judged: head 77f3963d8338 merged into trunk c770f7947d95; read beside it: mesh-controller a929df9b0ec3, mesh-controller-main a929df9b0ec3, mesh-host 4065b45ae84f, mesh-tools e0fadc43d9dd

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds gitea → novox; no bus step

• tier 0: gitea
• novox: receives gitea
• gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it
• gitea keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on shanks as build-1792622978195582905 (builds --log build-1792622978195582905).

✔ a start heard after the verdict writes nothing (0.585404ms)
✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (2.863478ms)
✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.24472ms)
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written
[gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written
✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.885933ms)
✔ a rechecked head says where its new run is: building on which machine (3.379441ms)
✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.966743ms)
✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.686917ms)
✔ a recheck the forge does not take fails its caller, and the head is as it was (0.614064ms)
✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (5.79742ms)
✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.427051ms)
✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (1.902576ms)
✔ a repository as the mesh clones it is told from another (0.352098ms)
✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (6.746783ms)
✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (58.704212ms)
✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (26.090758ms)
✔ gitea_api still writes what an author writes (7.820727ms)
✔ gitea_branch_protection_set only strengthens (16.683942ms)
✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (55.812943ms)
✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (159.989758ms)
✔ gitea_merge_pull_request asks no check of a member that waits for its group's composed check (36.676152ms)
✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (16.761684ms)
✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (13.947005ms)
✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (27.753637ms)
✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (54.528412ms)
✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (21.687422ms)
✔ gitea_api sends the path it judged, and refuses moving a pull request's base (3.091864ms)
✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (5.904022ms)
✔ a rule named for a branch is not made weaker than the glob rule that guards it now (11.850975ms)
✔ a repository owner or name is never another path (0.254606ms)
✔ the judges, without a forge (0.343069ms)
✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.249706ms)
✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (1.658869ms)
✔ gitea_api never approves a pull request nor requests changes: those are the operator's (4.415336ms)
✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (3.71285ms)
✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (81.444959ms)
✔ gitea_merge_pull_request refuses a head the Approve did not name (19.102659ms)
✔ a group of two merges in one pass: the sibling's merge of the composed head does not stop the member's merge (issue 1049) (17.177984ms)
✔ gitea_create_repo has no owner argument and posts only to the tools' own user's repositories (1124/AC8) (38.315042ms)
✔ the tools' team cannot create in the organisation and its token holds no write:organization (1124/AC8) (0.40809ms)
✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (20.200867ms)
✔ every page of a pull request's files is read, though the forge caps a page at fifty (42.741549ms)
✔ a pass asks only the repositories that moved since the last look, every one before the first (0.491112ms)
✔ the directories above a merge's files that hold a module at the commit are said, the root never (14.601481ms)
✔ a lookup the forge refuses is thrown, not read as no module (7.120982ms)
✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (8.820042ms)
✔ a new head beyond the newest 20 open pull requests is announced, exactly once (91.485342ms)
✔ a pass pages until it reaches back past its floor, and no further (33.747162ms)
✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (29.955851ms)
✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (10.292077ms)
✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (4.932479ms)
✔ the statuses asked for replace the rule's, and an empty list requires none (4.58795ms)
✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.339018ms)
✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (1.474166ms)
✔ another branch's body carries no merge whitelist (0.395229ms)
✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.336678ms)
✔ each open pull request's new head is announced once, and nothing closed or merged (31.99421ms)
✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.203119ms)
✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.883841ms)
✔ no verdict sets warning on a required check; only a person's decision fails (1.288661ms)
✔ a commit status is set on the commit, under the merge check's context (57.042014ms)
✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.610864ms)
✔ a head announced is pending in the build queue, since the local time it was announced (0.401049ms)
✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.570604ms)
✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.652846ms)
✔ the vault's token is used, a setting of it is ignored and said once, without its value (3.805912ms)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
[gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head dddddddddddd onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382)
✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (3.695839ms)
✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (2.753036ms)
✔ a verdict without siblings is said exactly as before (an older controller) (0.949293ms)
✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (1.2661ms)
✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (3.747791ms)
✔ a sibling closed unmerged puts the member's verdict out of date (0.777469ms)
✔ a move of the sibling's base puts it out of date, naming both commits (0.474732ms)
✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.664736ms)
✔ a merge of another head, or onto another base, is a move (0.80942ms)
✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.601174ms)
✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.700117ms)
✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.388213ms)
✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.255846ms)
✔ without the composed verdict's siblings, a sibling's own merge of its new head is a move (the pin of issue 1049) (0.308378ms)
✔ a composed verdict names the siblings of each member at the heads and base commits it composed, so a sibling's own merge of its new head is no move (issue 1049) (1.23415ms)
✔ a composed verdict keeps nothing for a member it cannot name, and a group of one is none (issue 1049) (0.258137ms)
✔ a consumer that asks nothing, or write, publishes: the package team (1.832144ms)
✔ a consumer that asks to read joins the readers, who write no package (0.515733ms)
✔ a reader is made, put on the readers team, and taken off the package team (0.604925ms)
✔ a publisher is made and put on the package team, as before (0.257656ms)
✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (37.617785ms)
✔ second start: reuses the kept token, mints nothing (21.647621ms)
✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (33.480555ms)
✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (35.404101ms)
✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (28.380543ms)
✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (25.767739ms)
✔ concurrent first calls share one mint (16.163588ms)
✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (19.291004ms)
✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (58.921647ms)
✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (9.280823ms)
✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (17.412859ms)
✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.919312ms)
✔ a second process finds the token the first renewed, and reuses it instead of minting over it (21.815775ms)
✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.340126ms)
✔ nothing to mint with and no token: the client says what is missing (0.187095ms)
[gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-aevMwM/state/token
✔ the tools register once there is a way to a token, and the first call mints it (27.695326ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-H2nYZZ/state/token
✔ a pull request can be closed, read and cleaned up through the tools (38.914896ms)
[gitea] no token kept — minting one
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-KcLWOJ/state/token
✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (96.269497ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nZPPuY/state/token
✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (50.73922ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nL0xhk/state/token
✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (45.971455ms)
[gitea] the kept token was minted with other scopes than the tools take now — minting one with them
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-2aXtfg/state/token
[gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now
✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (43.6554ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-CKY7pP/state/token
✔ a tools' account someone made an administrator is made a plain account again at the next mint (39.9099ms)
✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.938093ms)
✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (1.046155ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-acXWfH/state/token
✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (42.510162ms)
[gitea] no token kept — minting one
✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (29.641913ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-0uf6Pq/state/token
[gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"}
✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (47.563344ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-6EjwKY/state/token
✔ a team another process made between the look and the create is found, not a failure (41.517309ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-097Fok/state/token
✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (38.453254ms)
[gitea] no token kept — minting one
[gitea] the forge already holds a token named "mesh-tools" — replacing it
[gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-mbyZh7/state/token
✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (38.823884ms)
✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (12.693706ms)
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away
[gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
[gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323)
✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (2.522521ms)
✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.705951ms)
✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (7.308206ms)
✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.563444ms)
✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.630035ms)
✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.341098ms)
✔ a verdict that landed out of date keeps its account on the pull request (0.347238ms)
✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (1.24291ms)
✔ a signed event is published on the bus and acted on once (69.325978ms)
✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (38.157538ms)
✔ an event and the poll seeing the same head announce it once (0.438001ms)
✔ each forge event is named in the module's stream and trimmed (0.588404ms)
✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.335712ms)
✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.463015ms)
✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (5.038901ms)
✔ a forge that makes no system webhook is said, never taken as heard (0.798989ms)
✔ the receiver tells what it verified and what it refused (9.487388ms)
✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.213069ms)
✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.554763ms)
✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.456281ms)
✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.277097ms)
✔ a pull request's edit event carries its description, and no other pull request event does (issue 1079) (0.332868ms)
ℹ tests 170
ℹ suites 0
ℹ pass 170
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 917.081412

**Merge check** at `77f3963d` Judged: head `77f3963d8338` merged into trunk `c770f7947d95`; read beside it: mesh-controller `a929df9b0ec3`, mesh-controller-main `a929df9b0ec3`, mesh-host `4065b45ae84f`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: gitea) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds gitea → novox; no bus step - tier 0: gitea - novox: receives gitea - gitea provides npm-package-registry, git, gitea-read, forge-account: its consumers are sent again after it - gitea keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on shanks as `build-1792622978195582905` (`builds --log build-1792622978195582905`). ``` ✔ a start heard after the verdict writes nothing (0.585404ms) ✔ a start from before the check now pending (a run before a recheck, the stream's history) writes nothing (2.863478ms) ✔ an old run's verdict redelivered after a recheck's pending is not written over it (1.24472ms) [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check the forge holds pending; not written [gitea] novox/hq@a6b08de8: the verdict of build-1791680941000000000 is an older run's than the check now pending; not written ✔ an old run's verdict in flight when the recheck comes lands before the recheck's pending (3.885933ms) ✔ a rechecked head says where its new run is: building on which machine (3.379441ms) ✔ the recheck's own verdict is written, even asked a little before the pending by another machine's clock (0.966743ms) ✔ after a restart, an old run's verdict is weighed against the check the forge's history holds open (0.686917ms) ✔ a recheck the forge does not take fails its caller, and the head is as it was (0.614064ms) ✔ the status tool writes the merge check's pending through the writer, and the mesh's other statuses as they were (5.79742ms) ✔ when a check was asked is read from its id; the opening of the check now pending from the gate's history (0.427051ms) ✔ a head this process did not announce (it restarted) is said only while the forge holds its gate pending (1.902576ms) ✔ a repository as the mesh clones it is told from another (0.352098ms) ✔ gitea_api refuses the forge's administration, a branch's protection and the merge check's status, and sends nothing (6.746783ms) ✔ gitea_api refuses a file written to the default branch or one a rule guards, and writes one on a branch of its own (58.704212ms) ✔ a protection rule covers a branch as the forge decides it: classes, alternatives, a plain name in any case (issue 539) (26.090758ms) ✔ gitea_api still writes what an author writes (7.820727ms) ✔ gitea_branch_protection_set only strengthens (16.683942ms) ✔ gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head (55.812943ms) ✔ gitea_merge_pull_request refuses a verdict judged against an earlier trunk, and asks the check once (159.989758ms) ✔ gitea_merge_pull_request asks no check of a member that waits for its group's composed check (36.676152ms) ✔ gitea_merge_pull_request merges only the head it is named, and refuses one that is not the head (16.761684ms) ✔ gitea_merge_pull_request is loud when the forge merged a head other than the one it was handed (13.947005ms) ✔ gitea_merge_pull_request says the merge happened when reading back what landed fails (27.753637ms) ✔ gitea_merge_pull_request reads back a fast-forward, and says it cannot read back a squash or a rebase (54.528412ms) ✔ gitea_delete_repo deletes only the tools' own user's repository, unguarded, untouched for 30 days, named in full (21.687422ms) ✔ gitea_api sends the path it judged, and refuses moving a pull request's base (3.091864ms) ✔ gitea_merge_pull_request merges only into a branch whose protection requires the checks (5.904022ms) ✔ a rule named for a branch is not made weaker than the glob rule that guards it now (11.850975ms) ✔ a repository owner or name is never another path (0.254606ms) ✔ the judges, without a forge (0.343069ms) ✔ main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2) (0.249706ms) ✔ gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused (1.658869ms) ✔ gitea_api never approves a pull request nor requests changes: those are the operator's (4.415336ms) ✔ no tool's caller text becomes another path or another user: `..` and `?sudo=` are refused before the forge (3.71285ms) ✔ gitea_merge_pull_request merges a verdict that read siblings only with its group passed and each head approved (81.444959ms) ✔ gitea_merge_pull_request refuses a head the Approve did not name (19.102659ms) ✔ a group of two merges in one pass: the sibling's merge of the composed head does not stop the member's merge (issue 1049) (17.177984ms) ✔ gitea_create_repo has no owner argument and posts only to the tools' own user's repositories (1124/AC8) (38.315042ms) ✔ the tools' team cannot create in the organisation and its token holds no write:organization (1124/AC8) (0.40809ms) ✔ no ready mark, trusted ready-authors setting or approval-by-mark rule is left in the module (20.200867ms) ✔ every page of a pull request's files is read, though the forge caps a page at fifty (42.741549ms) ✔ a pass asks only the repositories that moved since the last look, every one before the first (0.491112ms) ✔ the directories above a merge's files that hold a module at the commit are said, the root never (14.601481ms) ✔ a lookup the forge refuses is thrown, not read as no module (7.120982ms) ✔ a renamed file is said under its old name too, as gone (novox/hq ADR 0267) (8.820042ms) ✔ a new head beyond the newest 20 open pull requests is announced, exactly once (91.485342ms) ✔ a pass pages until it reaches back past its floor, and no further (33.747162ms) ✔ gitea_branch_protection_get answers every rule, read with the administrator account the tools' token cannot read with (29.955851ms) ✔ gitea_branch_protection_get answers the rule for a branch, null when it has none (10.292077ms) ✔ gitea_branch_protection_set still gets the forge's refusal, as the tools' account (4.932479ms) ✔ the statuses asked for replace the rule's, and an empty list requires none (4.58795ms) ✔ a new rule refuses direct pushes unless asked; an administrator's override only when said (0.339018ms) ✔ main's body always refuses pushes and lets only the tools' account merge, whatever is asked (1.474166ms) ✔ another branch's body carries no merge whitelist (0.395229ms) ✔ the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own (0.336678ms) ✔ each open pull request's new head is announced once, and nothing closed or merged (31.99421ms) ✔ a verdict is the head commit's status; an error is the forge's error, never a success (1.203119ms) ✔ each layer is its own status: the gate with the modules it judged, the repository's own check beside it (0.883841ms) ✔ no verdict sets warning on a required check; only a person's decision fails (1.288661ms) ✔ a commit status is set on the commit, under the merge check's context (57.042014ms) ✔ a change plan is the gate's result: said on the status and, when it builds something, as a comment (0.610864ms) ✔ a head announced is pending in the build queue, since the local time it was announced (0.401049ms) ✔ a composed verdict sets every member's gate at its own head, naming its trunk and the group (0.570604ms) ✔ a member's own verdict with a composed gate layer leaves the gate to the composed verdict, in either order (0.652846ms) ✔ the vault's token is used, a setting of it is ignored and said once, without its value (3.805912ms) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 at bbbbbbbbbbbb, it is now at dddddddddddd: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was closed unmerged: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 merged onto cccccccccccc, its main is now eeeeeeeeeeee: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-host's main moved from 444444444444 to 333333333333: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head bbbbbbbbbbbb onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) [gitea] novox/mesh-controller#346: its verdict was judged beside mesh-host#114 was merged otherwise than its head dddddddddddd onto cccccccccccc: out of date, nothing run (novox/hq ADR 0382) ✔ both statuses name the siblings the verdict read, keeping the verdict word and the start of its reason within 140 characters (3.695839ms) ✔ a verdict that could not learn its siblings says so on the status and in the comment, and names none (2.753036ms) ✔ a verdict without siblings is said exactly as before (an older controller) (0.949293ms) ✔ the siblings a verdict names are kept per member, replaced by its next verdict, and removed by one that read none (1.2661ms) ✔ a sibling's new head puts both statuses of the member back to pending, with the reason, and runs nothing (3.747791ms) ✔ a sibling closed unmerged puts the member's verdict out of date (0.777469ms) ✔ a move of the sibling's base puts it out of date, naming both commits (0.474732ms) ✔ the sibling's own merge of the head read onto the base read does not, in either order of the two merges (0.664736ms) ✔ a merge of another head, or onto another base, is a move (0.80942ms) ✔ only the members whose verdict names the sibling are touched, and a member that moved on is dropped (0.601174ms) ✔ a trunk that moved tells the siblings' weighing; one first seen does not (0.700117ms) ✔ the group rule names every missing thing: the group status at each head read, and each head the Approve does not cover (1.388213ms) ✔ a merged or closed member's entry is dropped, so a sibling's later push never re-pends its merged head (0.255846ms) ✔ without the composed verdict's siblings, a sibling's own merge of its new head is a move (the pin of issue 1049) (0.308378ms) ✔ a composed verdict names the siblings of each member at the heads and base commits it composed, so a sibling's own merge of its new head is no move (issue 1049) (1.23415ms) ✔ a composed verdict keeps nothing for a member it cannot name, and a group of one is none (issue 1049) (0.258137ms) ✔ a consumer that asks nothing, or write, publishes: the package team (1.832144ms) ✔ a consumer that asks to read joins the readers, who write no package (0.515733ms) ✔ a reader is made, put on the readers team, and taken off the package team (0.604925ms) ✔ a publisher is made and put on the package team, as before (0.257656ms) ✔ first start: mints with the admin account, keeps the token at 0600, asks for the tools' scopes only (37.617785ms) ✔ second start: reuses the kept token, mints nothing (21.647621ms) ✔ the forge rejects the kept token (its data was restored): minted afresh, once, and the call goes through (33.480555ms) ✔ a token kept with write:admin by an earlier build is minted again without it at the next start, and the forge drops the old one (35.404101ms) ✔ a kept token lacking a scope the tools need: the forge refuses the call for the scope, the token is re-minted with the whole list, and the call goes through (28.380543ms) ✔ the kept file is gone but the forge still holds a token by that name: replaced, not refused (25.767739ms) ✔ concurrent first calls share one mint (16.163588ms) ✔ two tokens hold the name (two mints raced): both are deleted by their id, and one fresh token is minted (19.291004ms) ✔ two processes on one kept file, both without a token, mint once: the second waits for the first and reuses it (58.921647ms) ✔ a lock left by a process that died mid-mint is taken over, not waited on for ever (9.280823ms) ✔ the admin account is refused: said plainly, nothing kept, and the next call fails the same way rather than crashing (17.412859ms) ✔ one process shares one source per kept file — the watcher and the tools never renew against each other (0.919312ms) ✔ a second process finds the token the first renewed, and reuses it instead of minting over it (21.815775ms) ✔ a configured token wins, and is reported rather than minted over when the forge rejects it (2.340126ms) ✔ nothing to mint with and no token: the client says what is missing (0.187095ms) [gitea] no tools — no Gitea token, and nothing to mint one with — set MESH_GITEA_TOKEN, or MESH_GITEA_ADMIN_USER, MESH_GITEA_ADMIN_PASSWORD_FILE, MESH_GITEA_STATE_DIR [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-aevMwM/state/token ✔ the tools register once there is a way to a token, and the first call mints it (27.695326ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-H2nYZZ/state/token ✔ a pull request can be closed, read and cleaned up through the tools (38.914896ms) [gitea] no token kept — minting one [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-KcLWOJ/state/token ✔ the tools' token is minted for an account of their own, which is no administrator and writes through its team (96.269497ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nZPPuY/state/token ✔ with the tools' token, the forge writes a status and refuses a protection edit — the forge itself, not a guard (50.73922ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-nL0xhk/state/token ✔ what a base's protection asks is read from the branch, which the tools' account may read, not from the rules' list it may not (45.971455ms) [gitea] the kept token was minted with other scopes than the tools take now — minting one with them [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-2aXtfg/state/token [gitea] deleted 1 token(s) named "mesh-tools" the admin account "mesh-admin" held: the tools act as "mesh-tools" now ✔ the administrator's token from before goes: a kept admin token is minted again for the tools' account, and the forge drops the old one (43.6554ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-CKY7pP/state/token ✔ a tools' account someone made an administrator is made a plain account again at the next mint (39.9099ms) ✔ the tools never act as the administrator: MESH_GITEA_TOOLS_USER naming it is refused (0.938093ms) ✔ the manifest hands the tools their account, and the Go forge bundle holds no administrator password (1.046155ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-acXWfH/state/token ✔ a repository check said as a warning on a head without merge-check.sh reads the base's protection from the branch (42.510162ms) [gitea] no token kept — minting one ✔ a mint that fails leaves the administrator's old token in place: the tools are never left without one (29.641913ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-0uf6Pq/state/token [gitea] FAILED to delete the token(s) named "mesh-tools" the admin account "mesh-admin" holds — tried again at the next start: Gitea DELETE /users/mesh-admin/tokens/902 (named mesh-tools): 500 {"message":"the forge is not well"} ✔ an old token that cannot be deleted after the mint is said, the new token kept, and deleted at the next start (47.563344ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-6EjwKY/state/token ✔ a team another process made between the look and the create is found, not a failure (41.517309ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-097Fok/state/token ✔ setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948) (38.453254ms) [gitea] no token kept — minting one [gitea] the forge already holds a token named "mesh-tools" — replacing it [gitea] minted a token for "mesh-tools" (write:repository, write:issue, read:user), kept at /tmp/gitea-tools-account-mbyZh7/state/token ✔ a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1) (38.823884ms) ✔ a start with the token kept still puts main's rules right: the module's start asks for it each time (issue 948, review round 1) (12.693706ms) [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 25 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host's main moved from d28ca95ccccc to ffffffffffff: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-host: whether a trunk moved could not be weighed, so it is weighed again on the next pass — the forge is away [gitea] novox/mesh-host's main moved from a2c2c35bbbbb to d28ca95ccccc: 0 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) [gitea] novox/mesh-controller's feat/57-config-and-provisioning moved from eeeeeeeeeeee to d28ca95ccccc: 1 open pull request(s) into it put out of date, nothing run (novox/hq ADR 0323) ✔ both statuses say the head and the trunk commit the verdict judged, first, whatever the summary's length (2.522521ms) ✔ a trunk's move puts an open head's merge check out of date, naming both commits, unless a check is on its way (1.705951ms) ✔ a push to a trunk puts every open pull request into it out of date — twenty-five of them — and none into another (7.308206ms) ✔ a trunk that cannot be read is weighed again on the next pass, never recorded half (0.563444ms) ✔ the trunk's move takes its turn after a verdict in flight, and weighs what the forge holds then (0.630035ms) ✔ a verdict judged against a trunk newer than the pass's first read is not put out of date (0.341098ms) ✔ a verdict that landed out of date keeps its account on the pull request (0.347238ms) ✔ a release branch's move puts every open pull request into it out of date, as a trunk's does (ADR 0358 §5) (1.24291ms) ✔ a signed event is published on the bus and acted on once (69.325978ms) ✔ an unsigned event, or one whose signature does not verify, is refused and published nowhere (38.157538ms) ✔ an event and the poll seeing the same head announce it once (0.438001ms) ✔ each forge event is named in the module's stream and trimmed (0.588404ms) ✔ the webhook is made a system webhook, which the forge sends every repository's events to (1.335712ms) ✔ default webhooks left at the receiver by an earlier start are replaced by one system webhook (1.463015ms) ✔ a repository's copy of a default webhook at the receiver is deleted, on every page, and said (5.038901ms) ✔ a forge that makes no system webhook is said, never taken as heard (0.798989ms) ✔ the receiver tells what it verified and what it refused (9.487388ms) ✔ a forge that never delivers is said loudly once, and unhealthy, when the poll finds what no event said (1.213069ms) ✔ a forge whose events stop after one delivery is said loudly once per silent spell, and refusals are unhealthy (0.554763ms) ✔ without a receiver by configuration the polls alone watch, healthy; a receiver that failed is unhealthy (0.456281ms) ✔ the polls look every 30 s until events are heard, every five minutes while they are, and 30 s again on a miss (0.277097ms) ✔ a pull request's edit event carries its description, and no other pull request event does (issue 1079) (0.332868ms) ℹ tests 170 ℹ suites 0 ℹ pass 170 ℹ fail 0 ℹ cancelled 0 ℹ skipped 0 ℹ todo 0 ℹ duration_ms 917.081412 ```

mesh-tools merged commit 3bbae41037 into main 2026-10-21 22:59:00 +00:00

mesh-tools deleted branch fix/1793-bind-after-handshake 2026-10-21 22:59:00 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#429