mesh-tools
652b00b25b
mesh/merge-gate checking again: the gate refused `unknown` because the controller judged with a node-engine validator pinned before mesh-host #117; mesh-co…
mesh/repo-check checking again: the gate refused `unknown` because the controller judged with a node-engine validator pinned before mesh-host #117; mesh-co…
mesh/delivery-group group feat/owned-paths checking: 0 of 2 member(s) ready
mesh/delivery superseded: a newer head of the same pull request
Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.
43 lines
2.9 KiB
Markdown
43 lines
2.9 KiB
Markdown
# build-agent
|
|
|
|
The mesh's build machine as a role every machine can hold (novox/hq ADR 0190). It holds the node seat
|
|
`node-build-agent`: every holder pulls one build at a time from the role's one work queue when it is
|
|
idle, so a tier of many images is built by as many machines as hold the seat and are online, and a
|
|
machine that is off builds nothing and blocks nothing. The controller asks the role, never a machine;
|
|
the outcome names the machine that built it.
|
|
|
|
What a holding machine needs is what the builder always needed, said here once: a container runtime
|
|
(the socket is mounted), the artifact store as a provision, a workspace, and the bus credential. The code is `cmd/mesh-builder` in the mesh-controller repository, compiled from
|
|
that repository's main (`build.artifacts[].context`); this module ships the packaging.
|
|
|
|
Assign it to every machine with a container runtime. It replaces `builder`, the one-holder form of the
|
|
same thing; retire that once this is assigned where it was.
|
|
|
|
A send that replaces the agent's container does not throw away the build it runs: the container declares
|
|
`busy` as `/usr/local/bin/mesh-builder busy` (novox/hq ADR 0335). The node-engine asks it before replacing it; from that
|
|
ask the agent takes no new build, the node-engine leaves it running while it says a build is in hand, and
|
|
replaces it once it says idle, or after 15 minutes at the latest.
|
|
|
|
## The package registry (novox/hq ADR 0336)
|
|
|
|
The package registry (`npm-package-registry`, provided by the gitea module) is an optional requirement.
|
|
Genesis assigns the build agent before anything provides it, so the agent is assignable on a mesh with no
|
|
registry, and `mesh-controller.plan` and `node` list the requirement as unbound until the gitea module is
|
|
assigned; it then binds with no further act.
|
|
|
|
Until it binds, the agent on genesis's node reads the `genesis-package-registry` own-secret, which the
|
|
installer seals to it at the packages step: the forge it raised, the port, the npm path, the account
|
|
`mesh-builder` and its password. Issued outside the mesh, so no other machine is given one. A real binding
|
|
wins over it, and each build's log says which the build resolved from. A build that needs the registry (a
|
|
`package` artifact, an image whose Dockerfile names `.npmrc`, a TypeScript artifact with an `@novox/`
|
|
dependency) on an agent with neither fails before building, naming the machine. Go artifacts and images
|
|
that do not name `.npmrc` build without it. `manifest_test.go` holds the manifest to this.
|
|
|
|
## Files it does not know
|
|
|
|
Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
|
|
|
|
- `${dir:mesh-state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
|
|
- `${dir:workspace}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
|
|
- `${dir:judge-cache}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
|