mesh-adminandClaude Opus 5.5
47ef2644ac
Every merge check's judge is built where no pull request can reach (hq ADR 0358 §6, issue 704): the build agent needs a directory beside its workspace, mounted at the same path, that only judge builds mount. ADR 0358 §5 already holds in the forge's holder; this test keeps it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
build-agent
The mesh's build machine as a role every machine can hold (novox/hq ADR 0190). It holds the node seat
node-build-agent: every holder pulls one build at a time from the role's one work queue when it is
idle, so a tier of many images is built by as many machines as hold the seat and are online, and a
machine that is off builds nothing and blocks nothing. The controller asks the role, never a machine;
the outcome names the machine that built it.
What a holding machine needs is what the builder always needed, said here once: a container runtime
(the socket is mounted), the artifact store as a provision, a workspace, and the bus credential. The code is cmd/mesh-builder in the mesh-controller repository, compiled from
that repository's main (build.artifacts[].context); this module ships the packaging.
Assign it to every machine with a container runtime. It replaces builder, the one-holder form of the
same thing; retire that once this is assigned where it was.
A send that replaces the agent's container does not throw away the build it runs: the container declares
busy as /usr/local/bin/mesh-builder busy (novox/hq ADR 0335). The node-engine asks it before replacing it; from that
ask the agent takes no new build, the node-engine leaves it running while it says a build is in hand, and
replaces it once it says idle, or after 15 minutes at the latest.
The package registry (novox/hq ADR 0336)
The package registry (npm-package-registry, provided by the gitea module) is an optional requirement.
Genesis assigns the build agent before anything provides it, so the agent is assignable on a mesh with no
registry, and mesh-controller.plan and node list the requirement as unbound until the gitea module is
assigned; it then binds with no further act.
Until it binds, the agent on genesis's node reads the genesis-package-registry own-secret, which the
installer seals to it at the packages step: the forge it raised, the port, the npm path, the account
mesh-builder and its password. Issued outside the mesh, so no other machine is given one. A real binding
wins over it, and each build's log says which the build resolved from. A build that needs the registry (a
package artifact, an image whose Dockerfile names .npmrc, a TypeScript artifact with an @novox/
dependency) on an agent with neither fails before building, naming the machine. Go artifacts and images
that do not name .npmrc build without it. manifest_test.go holds the manifest to this.