The bus runs its upstream image with the mesh's programs mounted (issues 1640, 1641, 1642, ADR 0480 §1-§3, §5, §6; ADR 0497 §5; ADR 0506) #434

Merged

mesh-tools merged 10 commits from feat/r4d into main 2026-10-22 12:05:13 +00:00

Conversation 3 Commits 10 Files Changed 20

+588 -272

mesh-tools commented 2026-10-22 08:20:59 +00:00

Member

Copy Link

Copy Source

Part of design 47's milestone R4d: route-proxy and the bus stop being built from a Dockerfile and run a pinned upstream image with the mesh's own program mounted in (ADR 0480). One delivery group on branch feat/r4d in mesh-sdk, mesh-controller and mesh-catalog (ADR 0497, waiting for the operator's Approve): one check, one Approve, one plan; the bus upgrade waits for the operator's moment right after the merge.

Issues of this member: issue 1640, issue 1641, issue 1642.

n8n is not in this change (the operator, 2026-10-22 11:55; ADR 0506): since ADR 0487 a module may ship its own Dockerfile, so n8n keeps its Dockerfile, its container and its data exactly as they run today; no config value media-gid is needed. Its files on this branch equal main's.

Review: one review of the whole milestone, three rounds (reviewer-r4d@shanks, records in hq .work), then one more cycle after main moved (reviewer-r4d-merge@shanks: the merge of main, the image check turned into ADR 0487 clause 13's place check, n8n taken out). Tries before opening: mesh-sdk build-1792656380513304370 pass; mesh-controller build-1792656384769477658 pass (1504 unit tests, 2.03 s); mesh-catalog build-1792657124911732181 pass.

This member:

• nats (1640, 1641): the snapshot program in the module's own Go module (cmd/mesh-nats-snapshot), mounted at /opt/mesh; the entrypoint as a second archive at /opt/mesh-entrypoint (ADR 0497 §5); both under a declared state directory and in restart-on; the server is nats:2.11.17-alpine@sha256:e4bf19f1…, the digest running today; the release test reads the tag from module.json.
• The way there and back (1642): written in the module's README. The bus upgrade is the operator's moment (ADR 0480 §6).
• The image check: checks/images (only build-agent may declare an image) is gone; main's checks/imageplace is the check ADR 0487 clause 13 asks for. automx's manifest test now cites clause 13.
• Proof of ADR 0480 §5 and §6, said plainly: the five tests that start throwaway bus containers on the pinned digest (the dump, the reload without dropping a client, the new declaration then the old then the new on one store, snapshot restore, the snapshot user) do NOT run in this check: the Go toolchain has no docker, so they print "NOT RUN" (the tracker's 1823 asks for a docker step). They passed in a run by hand on a workstation at b4e90e5f and again at c948f3a6's test code; that run broke the rule that tests run only through a check, and is named here so nobody reads the green check as the proof. merge-check.sh gains a step that runs them where MESH_CHECK_DOCKER=1 (nothing sets it yet). A rehearsal on a copy of the live store is the tracker's 1819.

Reviewed-by: reviewer-r4d-merge@shanks at 68183ee441

Part of design 47's milestone R4d: route-proxy and the bus stop being built from a Dockerfile and run a pinned upstream image with the mesh's own program mounted in (ADR 0480). One delivery group on branch `feat/r4d` in mesh-sdk, mesh-controller and mesh-catalog (ADR 0497, waiting for the operator's Approve): one check, one Approve, one plan; the bus upgrade waits for the operator's moment right after the merge. Issues of this member: issue 1640, issue 1641, issue 1642. **n8n is not in this change** (the operator, 2026-10-22 11:55; ADR 0506): since ADR 0487 a module may ship its own Dockerfile, so n8n keeps its Dockerfile, its container and its data exactly as they run today; no config value `media-gid` is needed. Its files on this branch equal main's. Review: one review of the whole milestone, three rounds (reviewer-r4d@shanks, records in hq .work), then one more cycle after main moved (reviewer-r4d-merge@shanks: the merge of main, the image check turned into ADR 0487 clause 13's place check, n8n taken out). Tries before opening: mesh-sdk build-1792656380513304370 pass; mesh-controller build-1792656384769477658 pass (1504 unit tests, 2.03 s); mesh-catalog build-1792657124911732181 pass. This member: - **nats (1640, 1641):** the snapshot program in the module's own Go module (cmd/mesh-nats-snapshot), mounted at /opt/mesh; the entrypoint as a second archive at /opt/mesh-entrypoint (ADR 0497 §5); both under a declared `state` directory and in restart-on; the server is `nats:2.11.17-alpine@sha256:e4bf19f1…`, the digest running today; the release test reads the tag from module.json. - **The way there and back (1642):** written in the module's README. The bus upgrade is the operator's moment (ADR 0480 §6). - **The image check:** checks/images (only build-agent may declare an image) is gone; main's checks/imageplace is the check ADR 0487 clause 13 asks for. automx's manifest test now cites clause 13. - **Proof of ADR 0480 §5 and §6, said plainly:** the five tests that start throwaway bus containers on the pinned digest (the dump, the reload without dropping a client, the new declaration then the old then the new on one store, snapshot restore, the snapshot user) do NOT run in this check: the Go toolchain has no docker, so they print "NOT RUN" (the tracker's 1823 asks for a docker step). They passed in a run by hand on a workstation at b4e90e5f and again at c948f3a6's test code; that run broke the rule that tests run only through a check, and is named here so nobody reads the green check as the proof. merge-check.sh gains a step that runs them where MESH_CHECK_DOCKER=1 (nothing sets it yet). A rehearsal on a copy of the live store is the tracker's 1819. Reviewed-by: reviewer-r4d-merge@shanks at 68183ee4413d756f25b15bdca3b8f4c51e471dd6

mesh-tools added 7 commits 2026-10-22 08:20:59 +00:00

n8n runs its upstream image with uuid mounted and the media group joined, in place of a Dockerfile (issue 1639, ADR 0480 clauses 1, 3, 7, 8) 3c0496d1d3

n8n's media-gid is a required config value: a machine that does not say it refuses n8n (issue 1639) 0ec446ab75

Run the bus from its pinned upstream image with the snapshot program and the entrypoint mounted, and write and rehearse the way there and back (issues 1640, 1641, 1642, ADR 0480 clauses 1-3, 5, 6, 11) b4e90e5fce

Rehearse the bus upgrade on a copy of the last snapshot with a tool of the nats module, and run the docker tests only as integration tests (issue 1642, ADR 0480 clause 6) e7ca330e1f

Take the rehearsal tool out of the nats module: a new nats build is held until the bus upgrade itself, so it could only run after the step it rehearses (ADR 0236 section 36) 77b89ff182

Put the bus's two mounted programs under a directory the module declares, as the controller's module check requires (review round 1, C1) 91877e3421

Skip the bus's docker tests loudly where there is no docker, and run them by name in a docker step of the merge check where there is (ADR 0480 clause 6) c948f3a61c

mesh-tools commented 2026-10-22 08:21:06 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@68183ee4413d — delivered since 2026-10-22T12:45:51Z

Delivery plan — builds mailu, nats, sent nowhere; merging this needs a person's bus upgrade; 2 wait(s) for a person

• tier 0: mailu, nats
• novox: waits for a person: mailu, nats
• mailu waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends
• mailu provides smtp: its consumers are sent again after it
• mailu keeps data (ADR 0233): what it holds is backed up before it moves
• merging this needs a person's bus upgrade: nats is never sent by an ordinary send, and until mesh_call mesh-controller.bus {"upgrade": "true", "why": "…", "reversible" or "irreversible": "true"} runs, nothing else is sent to novox either — unless the new build turns out the same as the one running there (issue 280)
• nats provides mesh-bus: its consumers are sent again after it
• nats keeps data (ADR 0233): what it holds is backed up before it moves

Group feat/r4d: novox/mesh-catalog@68183ee441, novox/mesh-controller@01f615aa0a, novox/mesh-sdk@c61212eba7

• composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Machines

• mesh-controller on every machine running it: sent
• mesh-sdk on every machine running it: sent
• build-agent on every machine running it: sent
• mesh-tools on every machine running it: sent
• route-proxy on every machine running it: sent
• audit-logger on every machine running it: sent
• baserow on every machine running it: sent
• bazarr on every machine running it: sent
• bookshelf on every machine running it: sent
• confluence on every machine running it: sent
• gitea on every machine running it: sent
• gitlab on every machine running it: sent
• grafana on every machine running it: sent
• home-assistant on every machine running it: sent
• icecast on every machine running it: sent
• influxdb on every machine running it: sent
• jackett on every machine running it: sent
• jira on every machine running it: sent
• kometa on every machine running it: sent
• lab on every machine running it: sent
• letta on every machine running it: sent
• lidarr on every machine running it: sent
• mesh-catalog on every machine running it: sent
• model-usage on every machine running it: sent
• mosquitto on every machine running it: sent
• netcheck on every machine running it: sent
• nextcloud on every machine running it: sent
• nodered on every machine running it: sent
• ombi on every machine running it: sent
• openai-consumer on every machine running it: sent
• radarr on every machine running it: sent
• redis on every machine running it: sent
• route-adapter on every machine running it: sent
• searxng on every machine running it: sent
• showcase on every machine running it: sent
• sonarr on every machine running it: sent
• tautulli on every machine running it: sent
• umami on every machine running it: sent
• unifi on every machine running it: sent
• zsh on every machine running it: sent

Transitions

• 2026-10-22 09:49 (new) → proposed (announced): novox/mesh-catalog#434's head announced
• 2026-10-22 09:52 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-22 09:52 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-22 12:21 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-22 12:21 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-22 12:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@68183ee4413d` — **delivered** since 2026-10-22T12:45:51Z **Delivery plan** — builds mailu, nats, sent nowhere; merging this needs a person's bus upgrade; 2 wait(s) for a person - tier 0: mailu, nats - novox: waits for a person: mailu, nats - mailu waits for a person: its policy records (module) — unless on a machine its move recreates none of its containers and moves none of its data, which the walk judges and then sends - mailu provides smtp: its consumers are sent again after it - mailu keeps data (ADR 0233): what it holds is backed up before it moves - merging this needs a person's bus upgrade: nats is never sent by an ordinary send, and until `mesh_call mesh-controller.bus {"upgrade": "true", "why": "…", "reversible" or "irreversible": "true"}` runs, nothing else is sent to novox either — unless the new build turns out the same as the one running there (issue 280) - nats provides mesh-bus: its consumers are sent again after it - nats keeps data (ADR 0233): what it holds is backed up before it moves **Group** `feat/r4d`: novox/mesh-catalog@68183ee4413d, novox/mesh-controller@01f615aa0ad6, novox/mesh-sdk@c61212eba77c - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - mesh-controller on every machine running it: sent - mesh-sdk on every machine running it: sent - build-agent on every machine running it: sent - mesh-tools on every machine running it: sent - route-proxy on every machine running it: sent - audit-logger on every machine running it: sent - baserow on every machine running it: sent - bazarr on every machine running it: sent - bookshelf on every machine running it: sent - confluence on every machine running it: sent - gitea on every machine running it: sent - gitlab on every machine running it: sent - grafana on every machine running it: sent - home-assistant on every machine running it: sent - icecast on every machine running it: sent - influxdb on every machine running it: sent - jackett on every machine running it: sent - jira on every machine running it: sent - kometa on every machine running it: sent - lab on every machine running it: sent - letta on every machine running it: sent - lidarr on every machine running it: sent - mesh-catalog on every machine running it: sent - model-usage on every machine running it: sent - mosquitto on every machine running it: sent - netcheck on every machine running it: sent - nextcloud on every machine running it: sent - nodered on every machine running it: sent - ombi on every machine running it: sent - openai-consumer on every machine running it: sent - radarr on every machine running it: sent - redis on every machine running it: sent - route-adapter on every machine running it: sent - searxng on every machine running it: sent - showcase on every machine running it: sent - sonarr on every machine running it: sent - tautulli on every machine running it: sent - umami on every machine running it: sent - unifi on every machine running it: sent - zsh on every machine running it: sent **Transitions** - 2026-10-22 09:49 (new) → proposed (announced): novox/mesh-catalog#434's head announced - 2026-10-22 09:52 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-22 09:52 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-22 12:21 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-22 12:21 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-22 12:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented 2026-10-22 08:57:45 +00:00

Author

Member

Copy Link

Copy Source

Merge check at c948f3a6
Judged: head c948f3a61c74 merged into trunk 5a6d082e8c55

• mesh/merge-gate: FAIL — head c948f3a61c does not merge cleanly into trunk 5a6d082e8c: in conflict merge-check.sh
• mesh/repo-check: FAIL — head c948f3a61c does not merge cleanly into trunk 5a6d082e8c: in conflict merge-check.sh

Delivery plan — builds n8n, nats → ace; merging this needs a person's bus upgrade; 1 wait(s) for a person

• tier 0: n8n, nats
• ace: receives n8n
• novox: waits for a person: nats
• n8n keeps data (ADR 0233): what it holds is backed up before it moves
• merging this needs a person's bus upgrade: nats is never sent by an ordinary send, and until mesh_call mesh-controller.bus {"upgrade": "true", "why": "…", "reversible" or "irreversible": "true"} runs, nothing else is sent to novox either — unless the new build turns out the same as the one running there (issue 280)
• nats provides mesh-bus: its consumers are sent again after it
• nats keeps data (ADR 0233): what it holds is backed up before it moves
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before n8n is judged on its first machine
• read by no module's build: checks/images/go.mod, checks/images/main.go, checks/images/main_test.go, merge-check.sh

Run by the build seat on ace as build-1792659436217806462 (builds --log build-1792659436217806462).

head c948f3a61c74 does not merge cleanly into trunk 5a6d082e8c55: in conflict merge-check.sh

**Merge check** at `c948f3a6` Judged: head `c948f3a61c74` merged into trunk `5a6d082e8c55` - `mesh/merge-gate`: **FAIL** — head c948f3a61c74 does not merge cleanly into trunk 5a6d082e8c55: in conflict merge-check.sh - `mesh/repo-check`: **FAIL** — head c948f3a61c74 does not merge cleanly into trunk 5a6d082e8c55: in conflict merge-check.sh **Delivery plan** — builds n8n, nats → ace; merging this needs a person's bus upgrade; 1 wait(s) for a person - tier 0: n8n, nats - ace: receives n8n - novox: waits for a person: nats - n8n keeps data (ADR 0233): what it holds is backed up before it moves - merging this needs a person's bus upgrade: nats is never sent by an ordinary send, and until `mesh_call mesh-controller.bus {"upgrade": "true", "why": "…", "reversible" or "irreversible": "true"}` runs, nothing else is sent to novox either — unless the new build turns out the same as the one running there (issue 280) - nats provides mesh-bus: its consumers are sent again after it - nats keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before n8n is judged on its first machine - read by no module's build: checks/images/go.mod, checks/images/main.go, checks/images/main_test.go, merge-check.sh Run by the build seat on ace as `build-1792659436217806462` (`builds --log build-1792659436217806462`). ``` head c948f3a61c74 does not merge cleanly into trunk 5a6d082e8c55: in conflict merge-check.sh ```

mesh-tools commented 2026-10-22 08:57:45 +00:00

Author

Member

Copy Link

Copy Source

mesh-delivery: not merged. This pull request's checks passed at c948f3a61c, and now its check failed: head c948f3a61c does not merge cleanly into trunk 5a6d082e8c: in conflict merge-check.sh (head c948f3a61c merged into trunk 5a6d082e8c). A new head, or a recheck that passes, asks the operator again.

mesh-delivery: **not merged.** This pull request's checks passed at c948f3a61c74257e6e3147effb396d9d6434f491, and now its check failed: head c948f3a61c74 does not merge cleanly into trunk 5a6d082e8c55: in conflict merge-check.sh (head c948f3a61c74 merged into trunk 5a6d082e8c55). A new head, or a recheck that passes, asks the operator again.

mesh-tools referenced this pull request from novox/mesh-controller 2026-10-22 09:39:07 +00:00

Move route-proxy's program into its module and run it on the pinned alpine image (issues 1633, 1634, 1635, ADR 0480 §1-§4, §11) #433

mesh-tools referenced this pull request from novox/mesh-controller 2026-10-22 09:39:10 +00:00

Move route-proxy's program into its module and run it on the pinned alpine image (issues 1633, 1634, 1635, ADR 0480 §1-§4, §11) #433

jschoubben added 1 commit 2026-10-22 09:41:17 +00:00

Merge main into feat/r4d: keep the image check beside the image builder's two checks (ADR 0487 clause 13) 7451e7edf4

jschoubben added 1 commit 2026-10-22 09:46:40 +00:00

Check an image's Dockerfile place instead of refusing the image kind (ADR 0487 clause 13) cff5ed46b7

mesh-tools changed title from n8n and the bus run their upstream images with the mesh's programs mounted (issues 1639, 1640, 1641, 1642, ADR 0480 §1-§3, §5-§8; ADR 0497 §5) to The bus runs its upstream image with the mesh's programs mounted (issues 1640, 1641, 1642, ADR 0480 §1-§3, §5, §6; ADR 0497 §5; ADR 0506) 2026-10-22 09:49:43 +00:00

jschoubben added 1 commit 2026-10-22 09:49:44 +00:00

Keep n8n on its own Dockerfile: since ADR 0487 a module may ship one, and the move to the upstream image only added a config value and a uuid mount (the operator, 2026-10-22) 68183ee441

mesh-tools merged commit 7bf63b0ac5 into main 2026-10-22 12:05:13 +00:00

mesh-tools deleted branch feat/r4d 2026-10-22 12:05:14 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#434