Make buildah's runtime directory before every buildah run, so mesh-build-image's health does not fail for want of it (issue 1884) #456

Merged

mesh-tools merged 1 commits from fix/1884-runtime-dir into main 2026-10-22 21:48:47 +00:00

Conversation 2 Commits 1 Files Changed 3

+108 -8

mesh-tools commented 2026-10-22 21:42:39 +00:00

Member

Copy Link

Copy Source

Issue 1884 (acceptance 1884/AC1-AC2 in note 2). After buildah and mesh-build-image were assigned to ace again (the operator's yes 23:32, ADR 0513 §1, the last prerequisite of R4e), mesh-build-image on ace failed every health look: "buildah --version failed: lstat /var/lib/mesh-build-image-store/xdg: no such file or directory". look() made /xdg only after running buildah --version, which refuses when its XDG_RUNTIME_DIR is missing, so the directory was never made; shanks was healthy only because its xdg existed from before.

• modules/mesh-build-image/cmd/mesh-build-image probe.go, module.go: ensureRuntimeDir() makes the store and /xdg (0700, the module's own account) first in look() and in env(), which every buildah call takes; an existing directory is never widened; a store that cannot be made is refused naming its path. The manifest is unchanged.
• Tests runtimedir_test.go: TestHealthMakesTheRuntimeDirectoryBeforeBuildah and TestEveryBuildahRunMakesTheRuntimeDirectoryAgain, both failed first with ace's exact error.

Try build-1792705205146418263 PASS. Merges cleanly into feat/r4e.

What the operator sees after delivery: mesh-build-image goes to ace and shanks; ace's 'mesh-build-image not working' alert clears, and R4e's group pull requests can be opened.

Reviewed-by: review-1884@shanks at b53b0e7e2c

Issue 1884 (acceptance 1884/AC1-AC2 in note 2). After buildah and mesh-build-image were assigned to ace again (the operator's yes 23:32, ADR 0513 §1, the last prerequisite of R4e), mesh-build-image on ace failed every health look: "`buildah --version` failed: lstat /var/lib/mesh-build-image-store/xdg: no such file or directory". look() made <store>/xdg only after running `buildah --version`, which refuses when its XDG_RUNTIME_DIR is missing, so the directory was never made; shanks was healthy only because its xdg existed from before. - modules/mesh-build-image/cmd/mesh-build-image probe.go, module.go: ensureRuntimeDir() makes the store and <store>/xdg (0700, the module's own account) first in look() and in env(), which every buildah call takes; an existing directory is never widened; a store that cannot be made is refused naming its path. The manifest is unchanged. - Tests runtimedir_test.go: TestHealthMakesTheRuntimeDirectoryBeforeBuildah and TestEveryBuildahRunMakesTheRuntimeDirectoryAgain, both failed first with ace's exact error. Try build-1792705205146418263 PASS. Merges cleanly into feat/r4e. What the operator sees after delivery: mesh-build-image goes to ace and shanks; ace's 'mesh-build-image not working' alert clears, and R4e's group pull requests can be opened. Reviewed-by: review-1884@shanks at b53b0e7e2cc436f11bc9190a937167299f532d9e

mesh-tools added 1 commit 2026-10-22 21:42:39 +00:00

Make buildah's runtime directory before every buildah run, so a machine without it is not unhealthy forever (issue 1884) ... b53b0e7e2c

The look made <store>/xdg only after `buildah --version`, which refuses first
when its XDG_RUNTIME_DIR is missing: the directory was never made on ace.

mesh-tools commented 2026-10-22 21:42:51 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-catalog@b53b0e7e2cc4 — delivered since 2026-10-22T21:51:20Z

Delivery plan — builds mesh-build-image → ace, shanks; no bus step

• tier 0: mesh-build-image
• ace: receives mesh-build-image
• shanks: receives mesh-build-image
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-image is judged on its first machine

Machines

• mesh-build-image on every machine running it: sent

Transitions

• 2026-10-22 21:42 (new) → proposed (announced): novox/mesh-catalog#456's head announced
• 2026-10-22 21:48 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-22 21:48 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-22 21:48 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-22 21:48 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-22 21:51 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-catalog@b53b0e7e2cc4` — **delivered** since 2026-10-22T21:51:20Z **Delivery plan** — builds mesh-build-image → ace, shanks; no bus step - tier 0: mesh-build-image - ace: receives mesh-build-image - shanks: receives mesh-build-image - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-image is judged on its first machine **Machines** - mesh-build-image on every machine running it: sent **Transitions** - 2026-10-22 21:42 (new) → proposed (announced): novox/mesh-catalog#456's head announced - 2026-10-22 21:48 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-22 21:48 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-22 21:48 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-22 21:48 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-22 21:51 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented 2026-10-22 21:48:05 +00:00

Author

Member

Copy Link

Copy Source

Merge check at b53b0e7e
Judged: head b53b0e7e2cc4 merged into trunk 48dd41db91a6; read beside it: mesh-controller f2a4363a1a77, mesh-controller-main f2a4363a1a77, mesh-host 48c3e3834c69, mesh-tools e0fadc43d9dd

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-image)
• mesh/repo-check: PASS — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)

Delivery plan — builds mesh-build-image → ace, shanks; no bus step

• tier 0: mesh-build-image
• ace: receives mesh-build-image
• shanks: receives mesh-build-image
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-image is judged on its first machine
• read by no module's build: modules/mesh-build-image/cmd/mesh-build-image/runtimedir_test.go

Run by the build seat on shanks as build-1792705363920326566 (builds --log build-1792705363920326566).

--- the gate: mesh-build-image
mesh-build-image: ok, 6 tool(s), keeps state keys, steps, ready: mesh-build-image.own-runtime by its tool build_image_health every 1m0s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T21:36:54Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-22T21:36:54Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-image

notes:
  - modules/mesh-build-image/cmd/mesh-build-image/runtimedir_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	git.novox.be/novox/mesh-catalog/checks/words	0.003s
words: 12 retired words and 70 daemons' lines, none in the 62033 strings of 959 files
ok  	git.novox.be/novox/mesh-catalog/checks/particulars	0.037s
particulars: none of 4 node names in the 2 covered modules
ok  	git.novox.be/novox/mesh-catalog/checks/toolchains	0.012s
toolchains: go, nodejs, npm and buildah are declared only by their owners
ok  	git.novox.be/novox/mesh-catalog/checks/imagebuild	0.011s
imagebuild: rootless-image-build is provided only by buildah
ok  	git.novox.be/novox/mesh-catalog/checks/imageplace	0.011s
imageplace: every image builds from a Dockerfile in its own module's directory
ok  	git.novox.be/novox/mesh-catalog/checks/agenthome	0.014s
agent-home: no archive and no file written into under the agent's home
ok  	git.novox.be/novox/mesh-catalog/checks/mailstore	0.010s
mail-store: claimed only by mesh-mail
ok  	git.novox.be/novox/mesh-catalog/checks/sshdir	0.021s
~/.ssh: named only by ssh-client
ok  	git.novox.be/novox/mesh-catalog/checks/owned	0.027s
owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's
ok  	git.novox.be/novox/mesh-catalog/checks/secrets	0.015s
secrets: no setting can replace a vault secret in a mergeable file (1 known, nested)
ok  	git.novox.be/novox/mesh-catalog/checks/predefined	0.278s
predefined.json: 3 key(s), none removed that a module names
ok  	git.novox.be/novox/mesh-catalog/checks/config	0.019s
config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved)
ok  	git.novox.be/novox/mesh-catalog/checks/templates	0.013s
templates: no module keeps a file's text inline but the 0 listed
ok  	git.novox.be/novox/mesh-catalog/checks/paths	0.006s
paths: no module names another's state on its machine (3 known, listed to go)
long-running resources without health: 58, as kept
ok  	git.novox.be/novox/mesh-catalog/checks/deps	0.235s
testing modules/mesh-build-image
ok  	meshbuildimage/cmd/mesh-build-image	1.494s
--- its merge-check-typescript.sh (typescript toolchain)

**Merge check** at `b53b0e7e` Judged: head `b53b0e7e2cc4` merged into trunk `48dd41db91a6`; read beside it: mesh-controller `f2a4363a1a77`, mesh-controller-main `f2a4363a1a77`, mesh-host `48c3e3834c69`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-build-image) - `mesh/repo-check`: **PASS** — its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript) **Delivery plan** — builds mesh-build-image → ace, shanks; no bus step - tier 0: mesh-build-image - ace: receives mesh-build-image - shanks: receives mesh-build-image - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-build-image is judged on its first machine - read by no module's build: modules/mesh-build-image/cmd/mesh-build-image/runtimedir_test.go Run by the build seat on shanks as `build-1792705363920326566` (`builds --log build-1792705363920326566`). ``` --- the gate: mesh-build-image mesh-build-image: ok, 6 tool(s), keeps state keys, steps, ready: mesh-build-image.own-runtime by its tool build_image_health every 1m0s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T21:36:54Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-22T21:36:54Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-build-image notes: - modules/mesh-build-image/cmd/mesh-build-image/runtimedir_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok git.novox.be/novox/mesh-catalog/checks/words 0.003s words: 12 retired words and 70 daemons' lines, none in the 62033 strings of 959 files ok git.novox.be/novox/mesh-catalog/checks/particulars 0.037s particulars: none of 4 node names in the 2 covered modules ok git.novox.be/novox/mesh-catalog/checks/toolchains 0.012s toolchains: go, nodejs, npm and buildah are declared only by their owners ok git.novox.be/novox/mesh-catalog/checks/imagebuild 0.011s imagebuild: rootless-image-build is provided only by buildah ok git.novox.be/novox/mesh-catalog/checks/imageplace 0.011s imageplace: every image builds from a Dockerfile in its own module's directory ok git.novox.be/novox/mesh-catalog/checks/agenthome 0.014s agent-home: no archive and no file written into under the agent's home ok git.novox.be/novox/mesh-catalog/checks/mailstore 0.010s mail-store: claimed only by mesh-mail ok git.novox.be/novox/mesh-catalog/checks/sshdir 0.021s ~/.ssh: named only by ssh-client ok git.novox.be/novox/mesh-catalog/checks/owned 0.027s owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's ok git.novox.be/novox/mesh-catalog/checks/secrets 0.015s secrets: no setting can replace a vault secret in a mergeable file (1 known, nested) ok git.novox.be/novox/mesh-catalog/checks/predefined 0.278s predefined.json: 3 key(s), none removed that a module names ok git.novox.be/novox/mesh-catalog/checks/config 0.019s config: no moved module says settings, takes-settings or ${setting:<key>}, or takes a whole layer (0 not yet moved) ok git.novox.be/novox/mesh-catalog/checks/templates 0.013s templates: no module keeps a file's text inline but the 0 listed ok git.novox.be/novox/mesh-catalog/checks/paths 0.006s paths: no module names another's state on its machine (3 known, listed to go) long-running resources without health: 58, as kept ok git.novox.be/novox/mesh-catalog/checks/deps 0.235s testing modules/mesh-build-image ok meshbuildimage/cmd/mesh-build-image 1.494s --- its merge-check-typescript.sh (typescript toolchain) ```

mesh-tools merged commit a21da33d48 into main 2026-10-22 21:48:47 +00:00

mesh-tools deleted branch fix/1884-runtime-dir 2026-10-22 21:48:48 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#456