Every forge account the mesh's parts use reads every repository (the operator, 2026-10-26) #500

2026-10-26T14:38:07Z

mesh-tools commented

2026-10-26 14:38:07 +00:00

The operator decided the mesh reads every repository on its forge. #495 covered the tools' account (mesh-tools); the build modules fetch as nox-builder and machines' agents as nox-agent (ADR 0466 §3), which still could not read a user's private repositories: car-hunter's try failed at the fetch on ace and g14. Group fix/fetch-reads-all with mesh-sdk.

modules/gitea: meshAccounts() = [mesh-tools, nox-builder, nox-agent] (a Go test keeps the names in step with internal/forgeaccount); readall's start pass, forge events and tools cover every account; gitea_unreadable_repos answers per account; gitea_grant_read takes repositories and/or accounts (only the mesh's own; anything else is refused). Read only, as collaborator, through the module's admin login. An account the forge does not hold yet is skipped and the start pass re-runs every 10 minutes until all exist (bent rule: no forge event when a user is made; the forge-account provider could say it on the bus later — a note).
mesh-build-go/node/image pin mesh-sdk ff81bdf8 and use forgekey.Said for their own git reasons.

After delivery: gitea logs which repositories it granted per account; car-hunter and snake fetch on ace and g14; a refused fetch shows the forge's full sentence.

Tests: rows in test/tools-account.test.ts (nox-builder grants, read only, absent account, per-account events and refusals), the mesh-build-go mirror row. npm test 204/204; go tests and vet clean. Try try-1793024878516005758 passed.

Reviewed-by: review-fetchread@shanks at 071c6885d9

The operator decided the mesh reads every repository on its forge. #495 covered the tools' account (`mesh-tools`); the build modules fetch as `nox-builder` and machines' agents as `nox-agent` (ADR 0466 §3), which still could not read a user's private repositories: car-hunter's try failed at the fetch on ace and g14. Group fix/fetch-reads-all with mesh-sdk. - modules/gitea: `meshAccounts()` = [mesh-tools, nox-builder, nox-agent] (a Go test keeps the names in step with internal/forgeaccount); readall's start pass, forge events and tools cover every account; `gitea_unreadable_repos` answers per account; `gitea_grant_read` takes `repositories` and/or `accounts` (only the mesh's own; anything else is refused). Read only, as collaborator, through the module's admin login. An account the forge does not hold yet is skipped and the start pass re-runs every 10 minutes until all exist (bent rule: no forge event when a user is made; the forge-account provider could say it on the bus later — a note). - mesh-build-go/node/image pin mesh-sdk ff81bdf8 and use forgekey.Said for their own git reasons. After delivery: gitea logs which repositories it granted per account; car-hunter and snake fetch on ace and g14; a refused fetch shows the forge's full sentence. Tests: rows in test/tools-account.test.ts (nox-builder grants, read only, absent account, per-account events and refusals), the mesh-build-go mirror row. npm test 204/204; go tests and vet clean. Try try-1793024878516005758 passed. Reviewed-by: review-fetchread@shanks at 071c6885d923321054a55648fcc160185262bc82

mesh-tools added 1 commit 2026-10-26 14:38:08 +00:00

The mesh's forge accounts all read every repository, and a build's fetch says the forge's own words

mesh/delivery merged: source.main moved to novox/mesh-catalog@61563abf2f93

Details

mesh/delivery-group group fix/fetch-reads-all merged: every member is merged

Details

mesh/check checking 071c6885d923 on 8393e2962193

071c6885d9

mesh-catalog #495 gave read on every repository to the tools' account alone. The build modules
fetch over ssh as nox-builder (the forge-account provider's builders account, ADR 0466 §3), so
ace's and g14's fetch of jschoubben/car-hunter and jschoubben/snake still failed; the machines'
agents (nox-agent, ADR 0410 §1) could not read them either.

- gitea: readall.ts grants every account of one list, meshAccounts in tools-account.ts (mesh-tools,
  nox-builder, nox-agent; a Go test holds the two Go names to internal/forgeaccount's constants),
  on the same start pass, forge events and tools. gitea_unreadable_repos answers per account and
  names the accounts the forge does not hold yet; gitea_grant_read takes accounts as well as
  repositories. An absent account is asked nothing; the start pass runs again ten minutes apart
  until every account was there once.
- mesh-build-go, mesh-build-node, mesh-build-image: pin mesh-sdk ff81bdf8 (fix/fetch-reads-all),
  whose forgekey.Said keeps git's words past the bare "error:" line: the mirror's line said only
  "git -C: error:". Their own git reasons (ls-files, ls-remote, rev-parse, repack) go through it too.

mesh-tools commented

2026-10-26 14:38:16 +00:00

Delivery novox/mesh-catalog@071c6885d923 — merged since 2026-10-26T14:47:31Z

Source — source.main moved to novox/mesh-catalog@61563abf2f. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group fix/fetch-reads-all: novox/mesh-catalog@071c6885d9, novox/mesh-sdk@ff81bdf8cc

composed together: pass — the checker's verdict at the members' heads (28ee9bdbc120)

Transitions

2026-10-26 14:38 (new) → proposed (announced): novox/mesh-catalog#500's head announced
2026-10-26 14:38 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-26 14:47 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@071c6885d923` — **merged** since 2026-10-26T14:47:31Z **Source** — source.main moved to novox/mesh-catalog@61563abf2f93. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `fix/fetch-reads-all`: novox/mesh-catalog@071c6885d923, novox/mesh-sdk@ff81bdf8cc8f - composed together: pass — the checker's verdict at the members' heads (28ee9bdbc120) **Transitions** - 2026-10-26 14:38 (new) → proposed (announced): novox/mesh-catalog#500's head announced - 2026-10-26 14:38 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-26 14:47 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 61563abf2f into main

2026-10-26 14:47:30 +00:00

mesh-tools deleted branch fix/fetch-reads-all

2026-10-26 14:47:30 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#500