2026-10-13 - 2026-11-13
Overview
1 Release published by 1 user
Published
modules/route-proxy/contract/v0.1.0
178 Pull requests merged by 2 users
Merged
#491 sdk1: the controller's repository is emptied (ADR 0593 §11)
Merged
#490 An unissued bus account holds back only its own module, never the whole node
Merged
#489 The controller takes the indexer's verdict instead of judging manifests; route-proxy declares its credential form (ADR 0578, 0579)
Merged
#488 route-proxy dials the machine port its plans now carry (issue 774)
Merged
#487 route-proxy from the provisioner's plans with its own contract; the controller forwards accounts to the vault (issue 774)
Merged
#486 The web front's route helper reads the seat's plans, so a route-only module's route is provided (issue 774)
Merged
#485 The web front keeps what it serves, its certificates and what it refuses on the bus, with tools to read them (issue 774)
Merged
#483 Accept the credential form none in a provisioner's plan, so design 47's release delivers (issue 774)
Merged
#482 Pin the release's mesh-sdk in the controller, so it reads design 47's catalog until its lease is handed away (issue 774)
Merged
#481 Pin the parse-only mesh-sdk in the controller, so it reads design 47's manifests (issue 774)
Merged
#480 Pin mesh-sdk dbcaa29, so the controller composes with the group fix/1960-no-hold-spread's SDK (issue 1960)
Merged
#479 Pin mesh-sdk 38dbe1d, so the controller knows the seat mesh-placement (issue 1126, delivery 2 of 2)
Merged
#478 The controller gives its lease back at the stop signal and says a takeover once, so a controller delivery raises no urgent alarm (issue 906, ADR 0558)
Merged
#477 Broker tests read a consumer's pending count through pendingOf wherever they expect a count after a publish (issue 1126)
Merged
#476 Pin mesh-sdk main, whose seats promise own and settle, so the catalogue passes the module check again (issue 1126)
Merged
#475 Pin the mesh-sdk whose vault seat promises own, so the catalogue passes the module check again (issue 1126)
Merged
#474 The controller answers each node's placement from its own store, the one verb of its exit (issue 1126)
Merged
#473 The controller takes mesh-sdk a7a1fbd3, so its composer gives build modules the node's CPU share (issue 1806, ADR 0553/0554 change B)
Merged
#472 Seat users pulled by kind may read their own seat's dead letters (issue 734)
Merged
#471 Declarations test: the indexer stand-in answers the trunk value at the trunk's commit alone (issue 1945)
Merged
#470 Broker: the bus node may follow the grants part's sealed user list and the grants part may write it, the operator's second one-grant exception (issue 1945)
Merged
#469 Broker: the grants part may create a placed module's declared buckets, logs and streams, creation only (issue 1790; the operator's one-grant exception)
Merged
#468 The bus composer grants mesh-grants publishing memberships, nothing more (ADR 0547, the operator's one grant of 2026-10-25 22:31)
Merged
#467 A bus account counts as issued only once sealed, stale accounts are forgotten, and grants name sealed accounts only (issue 1945 note 35)
Merged
#466 Kept compositions follow config changes from a durable consumer, so going back to an earlier build keeps today's config (issue 1945, ADR 0545)
Merged
#465 Take new builds in from a durable queue on the bus, register on the fingerprint, and issue a node's bus accounts when its assignment stands (issue 1945, ADR 0543, ADR 0544)
Merged
#464 Compose the packages mirror only on a change, end every serve goroutine before serve returns, and raise no alarm for a cancellation (issue 1945)
Merged
#463 Share the controller's stores and take in at most 16 done keys at once, so a burst of builds cannot fill the store (issue 1277, issue 1945)
Merged
#462 Keep the declarations retired once their stream is gone, so the bus is not called unhealthy for a stream release 6 deleted (issue 1945)
Merged
#461 Never put a module whose want names its own composition into the node's own, and read a re-registered module's fingerprint from the indexer (issue 1945)
Merged
#460 Compose each machine once per pass, so take-ins of done builds stop colliding and every new build gets its composition and credential (issue 1945)
Merged
#459 Register every done key once at the start, and write a node's own composition last (issue 1945)
Merged
#458 Keep moved modules' filled paths in the node's own composition, put every file object, grant access-act and the provisioner's have read (issue 1944)
Merged
#457 R6: the controller writes signed per-node compositions and their digests; plans, pushes and their verbs go (issue 1945)
Merged
#454 R4g finish: reads-outside markers (issue 1935)
Merged
#456 The bus's user list grants what release 6 uses before the switch, so the new controller, node-engines, assigner and the operator's way back are not refused after it (issue 1945)
Merged
#455 The planner puts the new node-engine and the new controller in one tier for release 6's switch, and orders every other plan as today (issue 1942)
Merged
#453 Answer held and say artifacts-gone; write the grants again; integration tests match R4g (issues 1937, 1938, 1931)
Merged
#452 Give route-proxy a build the fixed controller takes in, dropping the incident note #450 added (issue 1933)
Merged
#451 The sweep keeps a fresh build's files, and a take-in holds every file before it records a build (issue 1933)
Merged
#450 Give route-proxy a new build: the controller's sweep removed its last build's files from the store, so novox and ace cannot apply (issue 1933)
Merged
#449 A module the catalogue no longer holds ends deleted instead of failing the plan; vendor/ goes; tests name verbs that exist (issues 1922, 1305, 1931)
Merged
#448 R4g+R5 (mesh-controller): the controller asks no build, build-agent and the merge gate go, register by reference (design 47)
Merged
#447 Wait out a resolver that does not answer in a build's registry step, and say it was the resolver (issue 1748)
Merged
#446 Keep every refused build by its id, so a plan never settles a refused build built and sends the old version (issue 1713)
Merged
#445 Keep the admin address's query in a test database's address, so store tests reach the checker's socket store (issue 1889)
Merged
#444 Judge each machine on a plan's last send and resume a plan lost to silence with plans retry, so a resumed plan is not failed by its own old sends (issue 1886, ADR 0531)
Merged
#443 Resume a delivery plan stopped by hand with plans retry, so a stop is not the end of what its tier waited on (issue 1886)
Merged
#442 Ask build-agent until the builder says it writes references, so a plan never waits on a key nothing can reference (issue 1886, ADR 0522)
Merged
#441 R4e (mesh-controller): deliver from the builder's keys, ask build-agent only for its own modules, follow the forge's protection for checks, announce the controller's states
Merged
#440 Clone from the forge again when the resolver does not answer, so a passing lookup failure does not fail a build (issue 1773)
Merged
#439 Keep each node's declared packages in a state the pacman module reads (upgrade safety, issue 1840, ADR 0507 §5)
Merged
#437 Pin mesh-sdk at the fix that refuses an unresolvable machine alone (issue 1833)
Merged
#438 Hold a first merge whose new module the running build-agent refuses for an unknown manifest word, name it, and ask it again when build-agent is delivered (issue 1173)
Merged
#436 Say a delivery's start and end with the machines its merges declare, and word a needed new head as its author's (ADR 0505)
Merged
#433 Move route-proxy's program into its module and run it on the pinned alpine image (issues 1633, 1634, 1635, ADR 0480 §1-§4, §11)
Merged
#435 A build node leaves its builds' images behind no more, and takes no work under a floor of free space (issue 1834)
Merged
#434 Compose a pull request's check with the config values held for it (issue 1826, ADR 0502)
Merged
#432 Limit what a build or check starts on a build node: a per-node build slice (issue 1798)
Merged
#430 The checker runs beside today's check: checks wait while a delivery builds; a group's SDK member merges; a flaky test fixed
Merged
#431 Remove a check's throwaway containers with their anonymous volumes, so a build node's disk does not fill (issue 1772)
Merged
#429 Judge a duplicate hand-out before marking a build in hand, and never hand every build back over a stale mark (issue 1768)
Merged
#428 Ask the operator for a held move and a failed release, and send no image the store lacks (issues 1732, 1320, 1742)
Merged
#420 Take mesh-sdk at 07a6592: an item's text places a config value (issue 1658), and fit the unit level in its bound (issue 1763)
Merged
#427 Issue a bus process's account when its module is assigned or gains it, and warn of one still missing instead of composing it silently (issue 1226)
Merged
#423 Name the failing line in a failed check's summary, not the warning count printed last (issue 1310)
Merged
#426 Say a building plan's refusal in its line, not 'building' with LATE, once its tier is built (issue 920)
Merged
#425 Send a declaration's large files by reference through a bucket per node, and hold no check twice on the build seat
Merged
#424 Take mesh-sdk 90b20f5, so node-files' contract names upload and download (issue 1718, design 60 F3 group)
Merged
#419 Pin route-proxy to a mesh-sdk commit on main, so a fresh go mod download resolves it once the feature branch goes (issue 1669)
Merged
#422 Send a container's supplementary groups only to a node that reports container-groups, holding the module elsewhere (issue 1638, R4d)
Merged
#421 Keep a build's outcome off the controller's event loop when the plans are busy, so a slow send no longer leaves the controller deaf (issue 1708)
Merged
#418 Send the vault's export compact and measure every declaration against the bus's limit, raising a condition from 90%, so novox's declaration fits again and cannot fail silently (issue 1689)
Merged
#417 Ask a new module's first build when its merge is heard, not when its batch is cut, so it can be assigned right after its delivery (issue 1617)
Merged
#416 Take the mesh-sdk that knows shares on an s3-bucket requirement, and prove the controller composes and checks it (issue 1593)
Merged
#415 Refuse a build whose module directory, archive or bundle output leads out of the module through a link, so a repository cannot make build-agent pack files from the build node (issue 1609)
Merged
#414 Hold a merge for any failure to record it, so the bus hands it over again and no merge is lost (issue 1583)
Merged
#413 Do not ask the operator to stop a delivery that is already stopped; say what ends it (issue 1581)
Merged
#412 Count only the controller's own consumers in the deaf look, not the check workers a builder holds (issues 1063, 1543)
Merged
#411 Read the forge's address again before calling a source not on the forge, within one bound (issue 1277)
Merged
#410 Read mesh-config's values for a config module that has no settings row (issue 1493)
Merged
#409 Write the facts snapshot in format 2 with each machine's grants and credential bindings (design 47 R4c-2, issue 1394)
Merged
#408 Let the catch-up read the router, and look only for pull request merges into the trunk since the records began (issue 1336, ADR 0457, ADR 0463)
Merged
#407 Catch up merges the controller did not hear, on the operator's Approve of each (ADR 0457, issue 1336)
Merged
#406 Wait out a bus that briefly refuses a build's ask instead of failing the delivery (issue 1334)
Merged
#405 Take the composition, catalogue and validator from mesh-sdk and delete the controller's copies (design 47 R4b, issues 1337, 1381-1391)
Merged
#404 Carry a module on the tool runner only when the runner serves something of it, so a part on its own credential has one writer (issues 1329, 1338)
Merged
#403 Answer a single pull request's check with its request id on clean standard output (issue 1311)
Merged
#402 Ask a failed delivery's Retry on the phone, tell a refused answer, and pass a seat to its only claimant (ADR 0449, ADR 0451)
Merged
#401 Answer the what-if as data, let the build seat read the gate's pull keys, and prove the parts' and the gate's grants (design 47 R3d, ADR 0450)
Merged
#400 Make a module's consumer from now and refuse a start word in consumes (issue 1279, ADR 0443)
Merged
#399 Raise a delivery stalled line with the severity it says, so a held group reaches the operator as urgent (issue 1278)
Merged
#398 Hand a group's members to the delivery verbs in a file when they are long, not as one argument (issue 1272)
Merged
#396 Pass a check's changed paths in a file, so a change of thousands of files can start and a check that cannot start says why (issue 1247)
Merged
#397 Announce a plan from a copy that shares nothing with the walk (issue 1260)
Merged
#395 Count a module's own stream events beside its emits in the catalogue agreement (issue 1249)
Merged
#394 Find the delivery seat's holder by its claim, and record each build's fingerprint inputs (design 47 R3b: issues 1210-1216)
Merged
#393 The builds list carries each build's source fingerprint, so builds shows it (issue 1208)
Merged
#392 builds says each build's source fingerprint (issue 1204)
Merged
#391 A delivery does not send to or wait for a machine already away when its tier is sent (issue 1161)
Merged
#390 A module's process may hold a bus account of its own, and a module stream may be a work queue (ADR 0436, issues 1170, 1177-1181)
Merged
#389 The controller says when it last heard a machine from presence, and no longer hears the alive message (design 47 R2c, issue 1183)
Merged
#388 The controller takes what the watchman says: key-ttl buckets, the checks running readable, stuck keys raised, silence from presence (design 47 R2b)
Merged
#387 An approved merge's first build passes the guard of a build through a verb, and a failed one is recorded (issues 1146, 1169)
Merged
#386 An approved merge into a repository nothing is built from asks its modules' first builds (issue 1146)
Merged
#385 The have bucket takes a node's whole facts, as large as a chain value, never cut (issue 1162)
Merged
#384 A delivery plan passes a machine silent past its bound at a middle tier, as at the last (issue 1160)
Merged
#383 The have bucket and its grants, a module and build per resource, the bus's connect events for the watchman, and a new module registered at its merge's Approve (issues 1136, 1145, 1147, 1146)
Merged
#382 Lay the builds out before the start reads them, so the controller does not exit on its own start (issue 1121)
Merged
#381 The chain lives on the bus alone: the store's tables of builds, rollouts and assignments are dropped (design 47 milestone 5, delivery 2: issues 1094, 1108, 1109, 1110, 1096, 1111)
Merged
#380 Keep builds on the bus under their module, so no lookup reads the bucket whole (issue 1121, ADR 0427)
Merged
#379 Builds, rollouts and assignments live on the bus, each assignment naming its commit, build and rollout (design 47 milestone 5, issues 1089-1095)
Merged
#377 A plan cut from a batch takes its backups before asking its first tier (issue 1086)
Merged
#376 A delivery plan backs up the data it moves before its first tier; a failed backup holds it and is said (issues 1065, 1066)
Merged
#374 A group is one batch and one delivery plan, ordered by the module graph and gated by its composed check; unit and integration tests split (issues 977, 895)
Merged
#373 merge-check.sh runs the integration level with the integration tag and times each level, before any test carries the tag (issue 895)
Merged
#370 build-agent and route-proxy live whole in mesh-controller (issue 1019, ADR 0420)
Merged
#372 Judge machines with the node-engine that knows unknown and knows (issue 1024)
Merged
#369 The controller accepts a reviewed move of a module between repositories on the operator's Approve (issue 1025, ADR 0420)
Merged
#368 Rollouts advance on events, and builds and checks wait on three work queues (issue 974, design 47 milestone 2)
Merged
#367 No merge is dropped, and the merge window lives on the bus (issues 973 step 2, 921)
Merged
#366 A batch that shares nothing with a running rollout starts beside it (issue 973, step 1)
Merged
#365 The merge gate composes each machine with its engine's contract, so moved modules are handed there as on the mesh (issue 969)
Merged
#364 Test the refusal of a jail whose pattern names the host twice
Merged
#363 Feature providers-after-switch-on, step 1: plans keep their route names and name the credential tool (issues 923, 928)
Merged
#362 Give a channel's verified sender back when the root-free judgement passes again (issue 930)
Merged
#361 Grant the controller mesh-config's config verb in its own name (issue 925)
Merged
#360 The seat node-files: write, copy, move and delete a file on a node through the mesh, with trash and owned paths (issue 900, ADR 0394)
Merged
#359 Issue the provisioner client its own account when its module declares no broker (issue 917)
Merged
#357 The delivery seat promises mark-ready: a reviewer marks a head ready through one audited verb (issue 913)
Merged
#358 The controller's catalogue tests judge the catalogue as the merge check does, so main passes again (issue 914)
Merged
#356 Seal core credentials by the controller while the vault does not hold them (issue 908, ADR 0396)
Merged
#355 Feature 57 (config and provisioning): release mesh-controller
Merged
#353 The merge gate judges a moved module as a real build hands it its templates (issue 876)
Merged
#346 Feature 57 (config and provisioning): the controller's part, into its release branch
Merged
#352 Judge a delivery group's composed check by the group's own controller, release branch included (issue 867, ADR 0239 §14)
Merged
#351 Ask mesh-delivery for a recheck's group on a bus connection of its own (issue 867, ADR 0382 §1)
Merged
#350 Find a rechecked pull request's group by its repository and number (issue 867, ADR 0382 §1)
Merged
#348 Check a delivery group's member beside its siblings' merges (issue 867, ADR 0382)
Merged
#349 Compose the forge in its manifest tests with the operator's account (issue 869)
Merged
#345 Mail seats: a declared seat carries needs; a secret given is told once (issues 802, 835)
Merged
#344 Mail and bus hardening: restricted streams, recorded moves that restart nothing, desk prompts, abandoned calls (issues 727, 728, 785, 789, 711)
Merged
#343 Read the borrowed-words log without the logger's clock (issue 752)
Merged
#342 Let the tool runner's account hear the event families its manifest names (issue 745, ADR 0367)
Merged
#341 Say a read-only mesh-cli call in no line of its own, and count them hourly (hq issue 762)
Merged
#340 Take no rebuild into a waiting rollout, and ask what a tier left unasked (hq issue 754)
Merged
#339 End the check of a pull request's old head when a new head is checked (hq issue 726)
Merged
#336 A module moves only when its program changes (hq issue 721)
Merged
#338 A module may declare a stream of its own, heard only by the consumers its trusted config value grants (hq issue 718, ADR 0363)
Merged
#335 A one-machine walk says its report was its run (hq issue 720)
Merged
#334 Run the slow test packages in shards and build judges from a warm Go cache (hq issue 717)
Merged
#333 Build a check's builds where the host's engine sees them, a tier at once and beside the tests (hq issues 713, 716)
Merged
#329 Judge a pull request into a release branch by that branch's controller and repositories (issue 704, ADR 0358)
Merged
#332 Send a merge's builds to every machine at once, with no first-machine gate (hq ADR 0360)
Merged
#331 Keep the controller lease through a stalled renewal until its TTL passes (hq issue 477)
Merged
#330 A module may declare its unhealthy urgent, with why (hq ADR 0355, issue 691)
Merged
#328 A fresh check keeps a build whose key is unchanged instead of building it again (hq issue 703)
Merged
#326 S9 raises every bus user's slow consumer and closed connection, from the bus module's events (hq issue 270, ADR 0357)
Merged
#323 57/K2: The controller reads, judges against and keeps the catalogue's list of predefined keys (issue 661)
Merged
#324 Release 57: bring main into the integration branch (conflicts resolved)
Merged
#320 57/K1: A module declares its config with type, description and validation (issue 660)
Merged
#319 List the provider-hold tests among the store tests (hq issue 145, to-be 48 Phase C)
Merged
#321 57/F2b: A settings layer no longer replaces what a provider serves (issue 696)
Merged
#318 Link a build's bases into its repository before pushing it (issue 694)
Merged
#317 57/V1: The vault's seat promises get (issue 674)
Merged
#316 57/F2: Placement leaves the settings layers, held beside the assignment (issue 651)
Merged
#313 57/T1: A file resource may name a template file in its module's repository (issue 654)
Merged
#314 Try a pushed branch on the build seat before its pull request (hq issue 686)
Merged
#309 A no-move tier waits for no new report, so its walk asks the next tier (issue 648)
Merged
#312 The rest go at once after the first passes, and a gate survives a new controller (hq ADR 0353)
Merged
#283 A walk's first-machine gate waits for a busy container, and mesh-builder busy drains the agent (issue 594, hq ADR 0335)
Merged
#311 One build per change: the check builds what its merge moves, the walk takes it by key (ADR 0350, issue 649)
Merged
#310 The controller passes its first-node gate on one reading (ADR 0351)
Merged
#304 A settings proposal reads at a glance, its values whole where the sender is proven (issues 383 and 639)
Merged
#306 A provider serves its consumers its own composed names (ADR 0346, issue 624)
Merged
#308 settings: no layer replaces a value the vault fills, at any depth (issue 610)
Merged
#307 List the settings walk's store tests, and drop a refusal check that never matched (issue 641 review)
Merged
#305 Send an approved settings layer by a walk at once, so the operator's Approve takes effect (issue 641, ADR 0344)