2025-11-13 - 2026-11-13
Overview
1 Release published by 1 user
Published
modules/route-proxy/contract/v0.1.0
464 Pull requests merged by 3 users
Merged
#491 sdk1: the controller's repository is emptied (ADR 0593 §11)
Merged
#490 An unissued bus account holds back only its own module, never the whole node
Merged
#489 The controller takes the indexer's verdict instead of judging manifests; route-proxy declares its credential form (ADR 0578, 0579)
Merged
#488 route-proxy dials the machine port its plans now carry (issue 774)
Merged
#487 route-proxy from the provisioner's plans with its own contract; the controller forwards accounts to the vault (issue 774)
Merged
#486 The web front's route helper reads the seat's plans, so a route-only module's route is provided (issue 774)
Merged
#485 The web front keeps what it serves, its certificates and what it refuses on the bus, with tools to read them (issue 774)
Merged
#483 Accept the credential form none in a provisioner's plan, so design 47's release delivers (issue 774)
Merged
#482 Pin the release's mesh-sdk in the controller, so it reads design 47's catalog until its lease is handed away (issue 774)
Merged
#481 Pin the parse-only mesh-sdk in the controller, so it reads design 47's manifests (issue 774)
Merged
#480 Pin mesh-sdk dbcaa29, so the controller composes with the group fix/1960-no-hold-spread's SDK (issue 1960)
Merged
#479 Pin mesh-sdk 38dbe1d, so the controller knows the seat mesh-placement (issue 1126, delivery 2 of 2)
Merged
#478 The controller gives its lease back at the stop signal and says a takeover once, so a controller delivery raises no urgent alarm (issue 906, ADR 0558)
Merged
#477 Broker tests read a consumer's pending count through pendingOf wherever they expect a count after a publish (issue 1126)
Merged
#476 Pin mesh-sdk main, whose seats promise own and settle, so the catalogue passes the module check again (issue 1126)
Merged
#475 Pin the mesh-sdk whose vault seat promises own, so the catalogue passes the module check again (issue 1126)
Merged
#474 The controller answers each node's placement from its own store, the one verb of its exit (issue 1126)
Merged
#473 The controller takes mesh-sdk a7a1fbd3, so its composer gives build modules the node's CPU share (issue 1806, ADR 0553/0554 change B)
Merged
#472 Seat users pulled by kind may read their own seat's dead letters (issue 734)
Merged
#471 Declarations test: the indexer stand-in answers the trunk value at the trunk's commit alone (issue 1945)
Merged
#470 Broker: the bus node may follow the grants part's sealed user list and the grants part may write it, the operator's second one-grant exception (issue 1945)
Merged
#469 Broker: the grants part may create a placed module's declared buckets, logs and streams, creation only (issue 1790; the operator's one-grant exception)
Merged
#468 The bus composer grants mesh-grants publishing memberships, nothing more (ADR 0547, the operator's one grant of 2026-10-25 22:31)
Merged
#467 A bus account counts as issued only once sealed, stale accounts are forgotten, and grants name sealed accounts only (issue 1945 note 35)
Merged
#466 Kept compositions follow config changes from a durable consumer, so going back to an earlier build keeps today's config (issue 1945, ADR 0545)
Merged
#465 Take new builds in from a durable queue on the bus, register on the fingerprint, and issue a node's bus accounts when its assignment stands (issue 1945, ADR 0543, ADR 0544)
Merged
#464 Compose the packages mirror only on a change, end every serve goroutine before serve returns, and raise no alarm for a cancellation (issue 1945)
Merged
#463 Share the controller's stores and take in at most 16 done keys at once, so a burst of builds cannot fill the store (issue 1277, issue 1945)
Merged
#462 Keep the declarations retired once their stream is gone, so the bus is not called unhealthy for a stream release 6 deleted (issue 1945)
Merged
#461 Never put a module whose want names its own composition into the node's own, and read a re-registered module's fingerprint from the indexer (issue 1945)
Merged
#460 Compose each machine once per pass, so take-ins of done builds stop colliding and every new build gets its composition and credential (issue 1945)
Merged
#459 Register every done key once at the start, and write a node's own composition last (issue 1945)
Merged
#458 Keep moved modules' filled paths in the node's own composition, put every file object, grant access-act and the provisioner's have read (issue 1944)
Merged
#457 R6: the controller writes signed per-node compositions and their digests; plans, pushes and their verbs go (issue 1945)
Merged
#454 R4g finish: reads-outside markers (issue 1935)
Merged
#456 The bus's user list grants what release 6 uses before the switch, so the new controller, node-engines, assigner and the operator's way back are not refused after it (issue 1945)
Merged
#455 The planner puts the new node-engine and the new controller in one tier for release 6's switch, and orders every other plan as today (issue 1942)
Merged
#453 Answer held and say artifacts-gone; write the grants again; integration tests match R4g (issues 1937, 1938, 1931)
Merged
#452 Give route-proxy a build the fixed controller takes in, dropping the incident note #450 added (issue 1933)
Merged
#451 The sweep keeps a fresh build's files, and a take-in holds every file before it records a build (issue 1933)
Merged
#450 Give route-proxy a new build: the controller's sweep removed its last build's files from the store, so novox and ace cannot apply (issue 1933)
Merged
#449 A module the catalogue no longer holds ends deleted instead of failing the plan; vendor/ goes; tests name verbs that exist (issues 1922, 1305, 1931)
Merged
#448 R4g+R5 (mesh-controller): the controller asks no build, build-agent and the merge gate go, register by reference (design 47)
Merged
#447 Wait out a resolver that does not answer in a build's registry step, and say it was the resolver (issue 1748)
Merged
#446 Keep every refused build by its id, so a plan never settles a refused build built and sends the old version (issue 1713)
Merged
#445 Keep the admin address's query in a test database's address, so store tests reach the checker's socket store (issue 1889)
Merged
#444 Judge each machine on a plan's last send and resume a plan lost to silence with plans retry, so a resumed plan is not failed by its own old sends (issue 1886, ADR 0531)
Merged
#443 Resume a delivery plan stopped by hand with plans retry, so a stop is not the end of what its tier waited on (issue 1886)
Merged
#442 Ask build-agent until the builder says it writes references, so a plan never waits on a key nothing can reference (issue 1886, ADR 0522)
Merged
#441 R4e (mesh-controller): deliver from the builder's keys, ask build-agent only for its own modules, follow the forge's protection for checks, announce the controller's states
Merged
#440 Clone from the forge again when the resolver does not answer, so a passing lookup failure does not fail a build (issue 1773)
Merged
#439 Keep each node's declared packages in a state the pacman module reads (upgrade safety, issue 1840, ADR 0507 §5)
Merged
#437 Pin mesh-sdk at the fix that refuses an unresolvable machine alone (issue 1833)
Merged
#438 Hold a first merge whose new module the running build-agent refuses for an unknown manifest word, name it, and ask it again when build-agent is delivered (issue 1173)
Merged
#436 Say a delivery's start and end with the machines its merges declare, and word a needed new head as its author's (ADR 0505)
Merged
#433 Move route-proxy's program into its module and run it on the pinned alpine image (issues 1633, 1634, 1635, ADR 0480 §1-§4, §11)
Merged
#435 A build node leaves its builds' images behind no more, and takes no work under a floor of free space (issue 1834)
Merged
#434 Compose a pull request's check with the config values held for it (issue 1826, ADR 0502)
Merged
#432 Limit what a build or check starts on a build node: a per-node build slice (issue 1798)
Merged
#430 The checker runs beside today's check: checks wait while a delivery builds; a group's SDK member merges; a flaky test fixed
Merged
#431 Remove a check's throwaway containers with their anonymous volumes, so a build node's disk does not fill (issue 1772)
Merged
#429 Judge a duplicate hand-out before marking a build in hand, and never hand every build back over a stale mark (issue 1768)
Merged
#428 Ask the operator for a held move and a failed release, and send no image the store lacks (issues 1732, 1320, 1742)
Merged
#420 Take mesh-sdk at 07a6592: an item's text places a config value (issue 1658), and fit the unit level in its bound (issue 1763)
Merged
#427 Issue a bus process's account when its module is assigned or gains it, and warn of one still missing instead of composing it silently (issue 1226)
Merged
#423 Name the failing line in a failed check's summary, not the warning count printed last (issue 1310)
Merged
#426 Say a building plan's refusal in its line, not 'building' with LATE, once its tier is built (issue 920)
Merged
#425 Send a declaration's large files by reference through a bucket per node, and hold no check twice on the build seat
Merged
#424 Take mesh-sdk 90b20f5, so node-files' contract names upload and download (issue 1718, design 60 F3 group)
Merged
#419 Pin route-proxy to a mesh-sdk commit on main, so a fresh go mod download resolves it once the feature branch goes (issue 1669)
Merged
#422 Send a container's supplementary groups only to a node that reports container-groups, holding the module elsewhere (issue 1638, R4d)
Merged
#421 Keep a build's outcome off the controller's event loop when the plans are busy, so a slow send no longer leaves the controller deaf (issue 1708)
Merged
#418 Send the vault's export compact and measure every declaration against the bus's limit, raising a condition from 90%, so novox's declaration fits again and cannot fail silently (issue 1689)
Merged
#417 Ask a new module's first build when its merge is heard, not when its batch is cut, so it can be assigned right after its delivery (issue 1617)
Merged
#416 Take the mesh-sdk that knows shares on an s3-bucket requirement, and prove the controller composes and checks it (issue 1593)
Merged
#415 Refuse a build whose module directory, archive or bundle output leads out of the module through a link, so a repository cannot make build-agent pack files from the build node (issue 1609)
Merged
#414 Hold a merge for any failure to record it, so the bus hands it over again and no merge is lost (issue 1583)
Merged
#413 Do not ask the operator to stop a delivery that is already stopped; say what ends it (issue 1581)
Merged
#412 Count only the controller's own consumers in the deaf look, not the check workers a builder holds (issues 1063, 1543)
Merged
#411 Read the forge's address again before calling a source not on the forge, within one bound (issue 1277)
Merged
#410 Read mesh-config's values for a config module that has no settings row (issue 1493)
Merged
#409 Write the facts snapshot in format 2 with each machine's grants and credential bindings (design 47 R4c-2, issue 1394)
Merged
#408 Let the catch-up read the router, and look only for pull request merges into the trunk since the records began (issue 1336, ADR 0457, ADR 0463)
Merged
#407 Catch up merges the controller did not hear, on the operator's Approve of each (ADR 0457, issue 1336)
Merged
#406 Wait out a bus that briefly refuses a build's ask instead of failing the delivery (issue 1334)
Merged
#405 Take the composition, catalogue and validator from mesh-sdk and delete the controller's copies (design 47 R4b, issues 1337, 1381-1391)
Merged
#404 Carry a module on the tool runner only when the runner serves something of it, so a part on its own credential has one writer (issues 1329, 1338)
Merged
#403 Answer a single pull request's check with its request id on clean standard output (issue 1311)
Merged
#402 Ask a failed delivery's Retry on the phone, tell a refused answer, and pass a seat to its only claimant (ADR 0449, ADR 0451)
Merged
#401 Answer the what-if as data, let the build seat read the gate's pull keys, and prove the parts' and the gate's grants (design 47 R3d, ADR 0450)
Merged
#400 Make a module's consumer from now and refuse a start word in consumes (issue 1279, ADR 0443)
Merged
#399 Raise a delivery stalled line with the severity it says, so a held group reaches the operator as urgent (issue 1278)
Merged
#398 Hand a group's members to the delivery verbs in a file when they are long, not as one argument (issue 1272)
Merged
#396 Pass a check's changed paths in a file, so a change of thousands of files can start and a check that cannot start says why (issue 1247)
Merged
#397 Announce a plan from a copy that shares nothing with the walk (issue 1260)
Merged
#395 Count a module's own stream events beside its emits in the catalogue agreement (issue 1249)
Merged
#394 Find the delivery seat's holder by its claim, and record each build's fingerprint inputs (design 47 R3b: issues 1210-1216)
Merged
#393 The builds list carries each build's source fingerprint, so builds shows it (issue 1208)
Merged
#392 builds says each build's source fingerprint (issue 1204)
Merged
#391 A delivery does not send to or wait for a machine already away when its tier is sent (issue 1161)
Merged
#390 A module's process may hold a bus account of its own, and a module stream may be a work queue (ADR 0436, issues 1170, 1177-1181)
Merged
#389 The controller says when it last heard a machine from presence, and no longer hears the alive message (design 47 R2c, issue 1183)
Merged
#388 The controller takes what the watchman says: key-ttl buckets, the checks running readable, stuck keys raised, silence from presence (design 47 R2b)
Merged
#387 An approved merge's first build passes the guard of a build through a verb, and a failed one is recorded (issues 1146, 1169)
Merged
#386 An approved merge into a repository nothing is built from asks its modules' first builds (issue 1146)
Merged
#385 The have bucket takes a node's whole facts, as large as a chain value, never cut (issue 1162)
Merged
#384 A delivery plan passes a machine silent past its bound at a middle tier, as at the last (issue 1160)
Merged
#383 The have bucket and its grants, a module and build per resource, the bus's connect events for the watchman, and a new module registered at its merge's Approve (issues 1136, 1145, 1147, 1146)
Merged
#382 Lay the builds out before the start reads them, so the controller does not exit on its own start (issue 1121)
Merged
#381 The chain lives on the bus alone: the store's tables of builds, rollouts and assignments are dropped (design 47 milestone 5, delivery 2: issues 1094, 1108, 1109, 1110, 1096, 1111)
Merged
#380 Keep builds on the bus under their module, so no lookup reads the bucket whole (issue 1121, ADR 0427)
Merged
#379 Builds, rollouts and assignments live on the bus, each assignment naming its commit, build and rollout (design 47 milestone 5, issues 1089-1095)
Merged
#377 A plan cut from a batch takes its backups before asking its first tier (issue 1086)
Merged
#376 A delivery plan backs up the data it moves before its first tier; a failed backup holds it and is said (issues 1065, 1066)
Merged
#374 A group is one batch and one delivery plan, ordered by the module graph and gated by its composed check; unit and integration tests split (issues 977, 895)
Merged
#373 merge-check.sh runs the integration level with the integration tag and times each level, before any test carries the tag (issue 895)
Merged
#370 build-agent and route-proxy live whole in mesh-controller (issue 1019, ADR 0420)
Merged
#372 Judge machines with the node-engine that knows unknown and knows (issue 1024)
Merged
#369 The controller accepts a reviewed move of a module between repositories on the operator's Approve (issue 1025, ADR 0420)
Merged
#368 Rollouts advance on events, and builds and checks wait on three work queues (issue 974, design 47 milestone 2)
Merged
#367 No merge is dropped, and the merge window lives on the bus (issues 973 step 2, 921)
Merged
#366 A batch that shares nothing with a running rollout starts beside it (issue 973, step 1)
Merged
#365 The merge gate composes each machine with its engine's contract, so moved modules are handed there as on the mesh (issue 969)
Merged
#364 Test the refusal of a jail whose pattern names the host twice
Merged
#363 Feature providers-after-switch-on, step 1: plans keep their route names and name the credential tool (issues 923, 928)
Merged
#362 Give a channel's verified sender back when the root-free judgement passes again (issue 930)
Merged
#361 Grant the controller mesh-config's config verb in its own name (issue 925)
Merged
#360 The seat node-files: write, copy, move and delete a file on a node through the mesh, with trash and owned paths (issue 900, ADR 0394)
Merged
#359 Issue the provisioner client its own account when its module declares no broker (issue 917)
Merged
#357 The delivery seat promises mark-ready: a reviewer marks a head ready through one audited verb (issue 913)
Merged
#358 The controller's catalogue tests judge the catalogue as the merge check does, so main passes again (issue 914)
Merged
#356 Seal core credentials by the controller while the vault does not hold them (issue 908, ADR 0396)
Merged
#355 Feature 57 (config and provisioning): release mesh-controller
Merged
#353 The merge gate judges a moved module as a real build hands it its templates (issue 876)
Merged
#346 Feature 57 (config and provisioning): the controller's part, into its release branch
Merged
#352 Judge a delivery group's composed check by the group's own controller, release branch included (issue 867, ADR 0239 §14)
Merged
#351 Ask mesh-delivery for a recheck's group on a bus connection of its own (issue 867, ADR 0382 §1)
Merged
#350 Find a rechecked pull request's group by its repository and number (issue 867, ADR 0382 §1)
Merged
#348 Check a delivery group's member beside its siblings' merges (issue 867, ADR 0382)
Merged
#349 Compose the forge in its manifest tests with the operator's account (issue 869)
Merged
#345 Mail seats: a declared seat carries needs; a secret given is told once (issues 802, 835)
Merged
#344 Mail and bus hardening: restricted streams, recorded moves that restart nothing, desk prompts, abandoned calls (issues 727, 728, 785, 789, 711)
Merged
#343 Read the borrowed-words log without the logger's clock (issue 752)
Merged
#342 Let the tool runner's account hear the event families its manifest names (issue 745, ADR 0367)
Merged
#341 Say a read-only mesh-cli call in no line of its own, and count them hourly (hq issue 762)
Merged
#340 Take no rebuild into a waiting rollout, and ask what a tier left unasked (hq issue 754)
Merged
#339 End the check of a pull request's old head when a new head is checked (hq issue 726)
Merged
#336 A module moves only when its program changes (hq issue 721)
Merged
#338 A module may declare a stream of its own, heard only by the consumers its trusted config value grants (hq issue 718, ADR 0363)
Merged
#335 A one-machine walk says its report was its run (hq issue 720)
Merged
#334 Run the slow test packages in shards and build judges from a warm Go cache (hq issue 717)
Merged
#333 Build a check's builds where the host's engine sees them, a tier at once and beside the tests (hq issues 713, 716)
Merged
#329 Judge a pull request into a release branch by that branch's controller and repositories (issue 704, ADR 0358)
Merged
#332 Send a merge's builds to every machine at once, with no first-machine gate (hq ADR 0360)
Merged
#331 Keep the controller lease through a stalled renewal until its TTL passes (hq issue 477)
Merged
#330 A module may declare its unhealthy urgent, with why (hq ADR 0355, issue 691)
Merged
#328 A fresh check keeps a build whose key is unchanged instead of building it again (hq issue 703)
Merged
#326 S9 raises every bus user's slow consumer and closed connection, from the bus module's events (hq issue 270, ADR 0357)
Merged
#323 57/K2: The controller reads, judges against and keeps the catalogue's list of predefined keys (issue 661)
Merged
#324 Release 57: bring main into the integration branch (conflicts resolved)
Merged
#320 57/K1: A module declares its config with type, description and validation (issue 660)
Merged
#319 List the provider-hold tests among the store tests (hq issue 145, to-be 48 Phase C)
Merged
#321 57/F2b: A settings layer no longer replaces what a provider serves (issue 696)
Merged
#318 Link a build's bases into its repository before pushing it (issue 694)
Merged
#317 57/V1: The vault's seat promises get (issue 674)
Merged
#316 57/F2: Placement leaves the settings layers, held beside the assignment (issue 651)
Merged
#313 57/T1: A file resource may name a template file in its module's repository (issue 654)
Merged
#314 Try a pushed branch on the build seat before its pull request (hq issue 686)
Merged
#309 A no-move tier waits for no new report, so its walk asks the next tier (issue 648)
Merged
#312 The rest go at once after the first passes, and a gate survives a new controller (hq ADR 0353)
Merged
#283 A walk's first-machine gate waits for a busy container, and mesh-builder busy drains the agent (issue 594, hq ADR 0335)
Merged
#311 One build per change: the check builds what its merge moves, the walk takes it by key (ADR 0350, issue 649)
Merged
#310 The controller passes its first-node gate on one reading (ADR 0351)
Merged
#304 A settings proposal reads at a glance, its values whole where the sender is proven (issues 383 and 639)
Merged
#306 A provider serves its consumers its own composed names (ADR 0346, issue 624)
Merged
#308 settings: no layer replaces a value the vault fills, at any depth (issue 610)
Merged
#307 List the settings walk's store tests, and drop a refusal check that never matched (issue 641 review)
Merged
#305 Send an approved settings layer by a walk at once, so the operator's Approve takes effect (issue 641, ADR 0344)
Merged
#299 Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)
Merged
#301 seat: a push to a named machine waits for the machine's answer, so its call says how it went (issue 629)
Merged
#300 catalogue: say in the comments that a package may be declared by several modules (issue 628)
Merged
#298 Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)
Merged
#296 A built module keeps its build edges: a new SDK plans the toolchain and its TypeScript bundles (hq issue 614)
Merged
#295 Say which modules a walk left unchanged, so a merge that moved nothing is not read as stranded (hq issue 611)
Merged
#294 Add the replay of issue 239: a module's name is not taken over by another repository (hq issue 239)
Merged
#293 Add the replay of issue 363: a README-only merge made a new digest of an unchanged Go program (hq issue 363)
Merged
#292 Stamp no commit into a Go bundle, so one build source is one digest (hq issue 363, ADR 0267 rule 6)
Merged
#291 Add the replay of issue 348, and refuse bind-dynamic now the catalogue binds once (hq issue 348)
Merged
#289 mesh-builder: read the genesis document until the registry binds, and refuse a registry build with neither (hq issue 121, ADR 0336)
Merged
#290 Add the replay of issue 349: a merge acted on late superseded the merge after it (hq issue 349)
Merged
#286 Let a trusted file that names its keys hold only those keys at the terminal (hq issue 586, ADR 0329 §5)
Merged
#288 Add the replay of issue 340: a verb set what every agent session obeys (hq issue 340)
Merged
#285 Add the replays of issues 279 and 412 (hq issues 279, 412)
Merged
#287 Replay issue 166 with only what the catalogue had before its fix (for mesh-lab R166)
Merged
#281 Let a requirement be optional, binding only a provider that already runs (hq issue 166, ADR 0330)
Merged
#282 Refuse a declaring module's mergeable file that names no keys (hq issue 574, ADR 0326 §3)
Merged
#284 Read the one genesis bundle mesh-host carries now (issue 146)
Merged
#280 Say a build handed out again restarted: its log, the queue and the check's verdict (issue 594, part)
Merged
#279 The controller's check stops waiting on fixtures and fixed intervals (issue 591)
Merged
#272 Let a mergeable file name the setting keys it takes (hq issue 168, ADR 0326)
Merged
#278 End a walk's apply phase at each machine's own report of its send (hq issue 582)
Merged
#276 Hand a delivery build out before pull-request checks (issue 558)
Merged
#269 node shows what a machine said it is made of, with its age (issue 160)
Merged
#275 Replay issue 201 with only what the controller had before its fix (for mesh-lab R201)
Merged
#277 Mark that the build agent takes work, so its health check can see it ready (hq issue 544)
Merged
#265 Say the class of what a change plan moves, for a fix's budget (issue 403, hq ADR 0313)
Merged
#267 A seat names the paths its holder owns, and a claim or a declaration without the seat is refused (issue 412, hq ADR 0287)
Merged
#273 Keep the controller and node-engine at the build a machine was last sent over an older record (hq issue 201)
Merged
#274 Add issue 401's replay, written with what the controller had before its fix (hq issue 401)
Merged
#264 Read an xz release in Go, so the build seat needs no xz tool (hq issue 345)
Merged
#266 Let plans wait for a plan to move and answer it as data (issue 229)
Merged
#268 Read a plan by its id as a parameter, never as SQL (issue 561)
Merged
#271 A merge check judges the head merged into its trunk, and names the trunk commit (hq ADR 0323, issue 341)
Merged
#262 Make no value for an own secret issued outside the mesh that nobody gave (issue 401)
Merged
#270 Stop composing ADR 0312's group grant, so deliveries to the media machine pass again (hq issue 567)
Merged
#256 Compose each read-write access's grant for the node-engine (hq ADR 0312, issue 537)
Merged
#263 Raise a machine that refuses or only partly applies its declarations past one apply interval (issue 233)
Merged
#260 A directory's owner may follow the account its module runs as (issue 279)
Merged
#253 An act's answer is said from one resolution after its write (hq issue 237)
Merged
#257 The node-reads seat: its verbs, its holder's own account, and the node's secret places (hq ADR 0310, issue 418)
Merged
#259 The build queue answers as data too (issue 455)
Merged
#258 Ask a node's engine which of its directories the walk would refuse, read-only (issue 358)
Merged
#255 An archive may be an upstream release pinned by URL and sha256, mirrored by the build seat (hq issue 345, ADR 0316)
Merged
#254 Advise a recheck for an unanswered check on a ready or rejected delivery (issue 451)
Merged
#250 A merge that shares nothing with the assembling batch, and whose group waits for no one, is cut at once (hq issue 525, ADR 0304 §1, ADR 0306 §2-3)
Merged
#188 Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353)
Merged
#252 closedNames waits for the verb's own connection by name, not the first closed one (issue 543)
Merged
#247 plan-moved says what a walk touches, its bound and its outcome when it starts and ends (ADR 0308, issue 532)
Merged
#248 Require the service manager's reset-failed, wanted-by and unlink-dangling verbs (issue 332)
Merged
#249 Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)
Merged
#246 Give the unheld log test its own writer and memory, so it passes on a repeat (issue 486)
Merged
#245 plans names the hold a waiting walk waits on (issue 529)
Merged
#244 Wait out a forge not served for a moment when registering a build (issue 486)
Merged
#243 Say a unit's restart count as what it counts, not since its state began (issue 458)
Merged
#231 Let a module keep a log the controller creates and never removes, and warn before a bucket or log is full (ADR 0297)
Merged
#242 Say what relates two changes, before anything acts on it (hq issue 525)
Merged
#241 Hold a leaf delivery to three minutes (hq ADR 0304 decision 4, issue 525)
Merged
#240 Judge a leaf module on one healthy reading, a core module on three (hq issue 524)
Merged
#239 A provider's software-issued credential is taken from the provider, sealed (issue 526, ADR 0305)
Merged
#238 The store-tests step fails on a malformed line, a failed go test and a shortened list (issue 515)
Merged
#237 Let several modules declare one package, and refuse only present beside absent (hq ADR 0303)
Merged
#232 delivery-stop leaves merges out and walks the others again (hq issue 459, ADR 0299)
Merged
#236 A build-log bus test waits for the stream to store both lines (hq issue 507)
Merged
#235 Stop tracking built binaries at the repository root (issue 470)
Merged
#234 Say each machine's last send in status and node show (hq issue 485)
Merged
#233 Fail the repo check when a listed store test did not run against the store (hq issue 459)
Merged
#230 A walk sends the bus's user list alone before its gate, so a new grant is on the bus when the first machine is judged (issue 490)
Merged
#228 Issue 496: a definition's resolved directory and file paths are judged by the node-engine's rules where the definition is judged
Merged
#223 Say a module assigned and left out of its machine's declaration as a condition (issue 380)
Merged
#227 A declaration says the assignment generation it came from, and every send is recorded (issue 234)
Merged
#229 A controller test judges the runtime's daemon.json by the docker module's own keys, not live-restore alone (issue 498)
Merged
#226 A check never sees the forge credential, and what it publishes is redacted (issue 462)
Merged
#224 broker: each credential may call tools only in its own name on the caller-named subjects (hq issue 365)
Merged
#225 A build waits out a registry held still, and a retry asks every failed build of the tier (issue 457)
Merged
#220 The SDK conformance test reads the SDK the controller pins, never a desktop's checkout (issue 449)
Merged
#222 A failed repository check names what failed, from its whole output (issue 460)
Merged
#219 Deliver again an ask the controller made, removing the original from its queue (issue 334, part)
Merged
#221 A provider whose wait fails its check lists who waits on it (issue 450)
Merged
#218 Say an unanswered merge check's time in the operator's zone (issue 443)
Merged
#216 A provider waiting for the operator holds its consumers, and a wait beside another condition is said (issue 405)
Merged
#217 A test that reads another repository judges what the check clones, never the desktop's checkout (issue 432)
Merged
#215 make check runs merge-check.sh, so it and the gate agree (issue 431)
Merged
#214 A consumer's max-deliveries condition has one watcher and counts what was given up (issue 440)
Merged
#213 Say an unanswered merge check in its own words, with no action it cannot take (issue 438)
Merged
#211 A misspelled placeholder is refused, never written out as text (issue 231)
Merged
#212 A bus refusal is counted by what the bus said, not by the controller's looks (issue 402)
Merged
#210 A kept call holds a command's first word, never the line (issue 397)
Merged
#209 Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, ADR 0283)
Merged
#208 Say a walk's phases out of order unknown, never a negative time (hq issue 382)
Merged
#207 Test that times is optional on the delivery seat (hq issue 382)
Merged
#206 Keep each walk's phases and say a delivery over its budget (hq ADR 0282 slice 1, issue 382)
Merged
#205 Say where a command line's quote is left open and how a quote is written (hq issue 294)
Merged
#204 A shrink is read against the item's own path: a moved directory starts its size history again (hq issue 368)
Merged
#201 A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)
Merged
#200 An own-path merge never shares a batch with a catalogue merge, and plans names a walk by what it moves (tracker issues 377, 378)
Merged
#199 A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)
Merged
#198 Ask again after a refusal, with a growing wait (issues 369 and 373)
Merged
#197 Merges are assembled in a rolling window, and each batch is walked once (hq ADR 0276, issue 362)
Merged
#196 A plan says why each module is in it (hq ADR 0267, issue 363)
Merged
#194 Record a module's act on the operator's warrant from the router's own record (hq ADR 0274)
Merged
#195 The gate's module check notes a seat another module declares, which it was not given (hq issue 364)
Merged
#193 A merge moves a module only when its build source holds a changed file (hq ADR 0267, issue 363)
Merged
#192 A build says its build source; an image compiling Go is handed only that (hq ADR 0267, issue 363)
Merged
#191 Ask a node's engine for a fresh setuid search at the terminal (hq issue 361)
Merged
#190 Keep quiet for the setuid search the engine now runs to completion (hq issue 361)
Merged
#189 Say a secret given in plain words, and log words the keeper refuses (hq issue 359)
Merged
#187 node hand-over: the terminal hands a directory used as found to the mesh, asked of the node's engine (hq issue 356)
Merged
#186 Ask the operator only once the bus holds the controller's grant to ask (hq issue 353)
Merged
#185 A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)
Merged
#184 mesh-cli: give a terminal line the standard input mesh-cli carried, refuse it to any other, keep it nowhere (hq ADR 0259 §10, ADR 0272)
Merged
#156 give: take a module's own secret through a hidden prompt at the operator's desk (hq ADR 0259 §10)
Merged
#154 Kinded benches, verbs named by their caller, proofs and records (hq ADR 0259 §3)
Merged
#183 Test the newest merge's order, a second reopening's gaps and sub-second merge times (hq issues 348, 349)
Merged
#179 Judge a send by when a fault began, not when it was last raised (hq issue 348)
Merged
#181 plan --diff says which modules a push would leave out, and why
Merged
#180 Say the terminal explicitly, only from a login session, and name the unannounced pull request (hq ADR 0272)
Merged
#178 Say a pull request the forge never announced as one, with what to do (hq issue 347)
Merged
#176 Answer mesh-cli: the control-node's operator is the terminal, everyone else is not (hq ADR 0272)
Merged
#177 Judge the one protection rule the forge applies, and keep a recorded repository id (#174 follow-up)
Merged
#175 Do not raise agent-can-become-root while the first setuid search is within its bound (hq ADR 0266, note E)
Merged
#174 Register a module only from the repository the catalogue builds it from (hq ADR 0266 §7, route A)
Merged
#164 Name the account agents run as on a node, and say whether it can become root (hq ADR 0266)
Merged
#172 A mergeable file's own keys are the terminal's (hq issue 340)
Merged
#173 Tell the operator at once when sends wait for the bus's planned step, and say it before the merge (hq issue 336)
Merged
#171 Fill ${setting:} in a service's unit name, and refuse a value that makes no unit name
Merged
#170 Issue 339 follow-ups: only step-ca's root may hold lines, every line end refused, the runtime's data and any .ssh refused
Merged
#148 Switch the memory store's failure under its lock, so a test cannot race the keeper
Merged
#169 Make the login shell's execute optional, so a machine may withhold it (hq ADR 0268)
Merged
#168 Issue 339: places and accesses only at the terminal, never at the machine's own trees; a setting is one line
Merged
#166 Describe node-nfs-server's exports and test as per-node addresses (hq ADR 0263, review follow-up)
Merged
#167 Hold the delivery planner to its recorded rules (table + property); a false cycle report found
Merged
#165 Keep a passed gate's verdict when the first machine's later reports go quiet (hq issue 335)
Merged
#161 Serve the read verbs on the serving controller's own connection, and name every connection (hq issue 327, ADR 0265)
Merged
#159 Keep what a consumer gives up on until a person delivers it again or drops it (hq issue 330, ADR 0264)
Merged
#163 Add the node-nfs-server and node-mounts seats (hq ADR 0263)
Merged
#162 Keep a left-out module's provisions and backups, and refuse more identity keys (hq ADR 0262)
Merged
#153 Fill a preference's ${setting:} from its manifest default (hq ADR 0262)
Merged
#160 Promise unlink-dangling on the service manager, optional (hq issue 332)
Merged
#158 Promise reset-failed and wanted-by on the service manager, optional (hq issue 332)
Merged
#155 Name what a held release holds, and where it is released (ADR 0258)
Merged
#150 Say why assign finds no module, and keep an assignment pending on its build (hq issue 325)
Merged
#151 Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)
Merged
#144 Record the bases a build copies, keep them by the builds that stood on them, copy each image once (hq ADR 0257, issue 321)
Merged
#152 Excuse no wait for a move from a build not known, and test the tier path's at-once put-back (hq issue 318 review)
Merged
#149 Let a block show a value its module keeps on the bus, and grant the bar the read (hq ADR 0260)
Merged
#146 Give every module of a failed send a verdict, and excuse only the wait a build's own send brought (hq issue 318 review)
Merged
#143 Let a seat receive blocks as data its holder renders, placed where the machine has the hardware (hq ADR 0255)
Merged
#147 Say where an answer no notification can give is given; never offer to silence data loss (hq ADR 0258)
Merged
#145 Offer only acknowledgements, keep a refused verdict, say a change of words (hq ADR 0258, issue 324)
Merged
#142 Pass a wait for a person's new login, and keep the pass of a module healthy beside a failure (hq ADR 0254, issue 318)
Merged
#141 Give every condition a headline, an explanation and a resolved line in plain words (hq ADR 0253, issue 320)
Merged
#138 Page an answer larger than one message of the bus, and keep overviews brief (hq issue 314)
Merged
#140 Three verbs for the registries: artifacts, collect, images (hq ADR 0251)
Merged
#139 Compose an account given only groups where its module wrote it (hq ADR 0252, issue 247)
Merged
#137 Raise a failed unit, the module's and the machine's (hq issue 315)
Merged
#136 Promise retire-history on the delivery seat (hq issue 313)
Merged
#134 Resolve a group's order rules by precedence, not as a cycle (hq issue 309)
Merged
#135 The base branch's merge-check.sh judges a pull request, not the change's own copy (hq issue 310)
Merged
#133 A check's store needs no durability; a starting holder removes what earlier holders left (hq issue 306)
Merged
#132 A machine joins through the tunnel: a token issued for its tunnel key (hq ADR 0169)
Merged
#130 The build verb takes on and behind, the command's other two shapes
Merged
#112 Vendor the node-engine's validator at its merged Phase B, not the branch commit
Merged
#131 Cite the derived-value record as ADR 0202, not 0201
Merged
#128 Cite the gate issues by their real numbers, 285 and 286
Merged
#50 No change to a machine takes effect unseen (hq ADR 0217)
Merged
#129 Replay issues 292 and 298 as tests the commit before each fix fails (hq ADR 0237)
Merged
#126 Record a push that only moves recorded builds as the person's word, not a repair (hq issue 301)
Merged
#125 Run each part of a repository's own check in the toolchain it declares (hq issue 302)
Merged
#124 Replay issues 296, 299 and 300 as tests the commit before each fix fails (hq ADR 0237)
Merged
#123 Say what a person's push recreates before it is sent (hq ADR 0245)
Merged
#122 Build and register a new module when its merge lands (hq issue 300)
Merged
#121 Judge a seat's holder silent only on verbs it must serve (hq issue 299)
Merged
#120 The machine's own resolver is a node seat, and the uplink steps back from the resolver file where it is held (hq ADR 0247)
Merged
#116 Give the uplink seat its verbs, optional until its holders serve them (hq ADR 0241 rule 8)
Merged
#119 Count a plan's time from its tier, and save it only when a step changed it (hq issue 296)
Merged
#118 Say what each verb replaces, so the agent is pointed at it instead of a shell command (hq ADR 0245)
Merged
#114 The service manager's journal reads a window; failed moves onto the seat
Merged
#113 Raise a machine's network from what its engine says, once (hq ADR 0241)
Merged
#117 Promise the delivery seat's checks verb, optional until its holder serves it (hq ADR 0239)
Merged
#115 Keep a recorded module at the build its machine runs on every send but a person's push; say what a send recreates (hq issue 294, ADR 0242)
Merged
#111 Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)
Merged
#110 Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)
Merged
#109 A drill is recorded through its own verb, and S15 never counts it (hq issue 292)
Merged
#108 Run a verb from the controller's own running image; refuse what it cannot run as a handover (hq issue 289)
Merged
#107 Keep what each machine says of what it runs, raise it, and gate on it (hq ADR 0240, to-be 48 Phase A)
Merged
#106 The seat calls a gate that raised no machine the mesh composes an error, whatever judged it (hq issue 285)
Merged
#105 Facts: name a repository owner/repository, without the forge's address (hq issue 288)
Merged
#104 The gate raises the mesh as it is, and a baseline that does not compose is an error; check-here runs a check as the seat does (hq issues 285, 286)
Merged
#103 Say a walk that waits too long (S16), and a delivery's own stalls (D14, H2) — hq ADR 0239
Merged
#102 A walk waits for its delivery's word; the verbs mesh-delivery asks with (hq ADR 0239)
Merged
#101 The module graph decides what a pull request's check runs; one commit, one change plan; publish only the trunk (hq ADR 0238)
Merged
#100 Send a plan's tier to each machine once, and blame no module for its machine (hq issue 281)
Merged
#99 A rebuild of an unchanged source is no move, whatever image digest it made (hq issue 280)
Merged
#98 Phase 5 (4/4): replay issues 263 and 273 (hq ADR 0237)
Merged
#97 Phase 5 (3/4): every test on a bus of its own, at the release the mesh runs (hq ADR 0237)
Merged
#96 Phase 5 (2/4): judge every pull request against the mesh that runs, before it merges (hq ADR 0237)
Merged
#95 Phase 5 (1/4): keep a facts snapshot for merge checks, and say when it goes stale (hq ADR 0237, S14)
Merged
#93 A module's directory is never shared code, held or not (hq issue 278)
Merged
#94 S15: a hand act a person decides by design is no repair, read from the verb that recorded it (hq to-be 45 §7)
Merged
#92 Phase 4: gate a plan's first machine, roll a failed build back there, roll out by default, the bus as a planned step (hq ADR 0236)
Merged
#91 Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)
Merged
#90 Grant the bus's own module the snapshot API and nothing else (hq ADR 0235)
Merged
#89 A machine waiting for its push is waiting, not uncomposable (hq issue 275)
Merged
#88 A module declares the data it holds; protection and D13 derived from it (hq ADR 0233)
Merged
#87 Grant a provider only the consumers bound to it (hq issue 274)
Merged
#86 Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)
Merged
#77 Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)
Merged
#84 Retire, approve, reject, cleanup: the controller's half of hq ADR 0230
Merged
#85 Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)
Merged
#83 Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)
Merged
#82 Replace a value given by hand like one the mesh made (hq ADR 0228)
Merged
#81 Assert the bus's objects on every send, not only at start (hq issue 208)
Merged
#80 Grant the self-check its ban-list question, say a refusal at once, judge the engine by its delivered version (hq to-be 45 Phase 1)
Merged
#79 Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)
Merged
#78 Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)
Merged
#76 Bound a consumer's identity by the provision it requires (hq issue 263, ADR 0225)
Merged
#75 rotate: narrow a pair credential to one consuming module (hq issue 268)
Merged
#74 Keep the account of the sent declaration over an older one (hq issue 267)
Merged
#73 Catch up on merges the bus announced and never handed over (hq issue 266)
Merged
#72 Answer every seat call within ten seconds and keep what came of it (hq issue 265)
Merged
#71 Refuse a verb argument the seat would pass over; a push without a machine says it is the whole mesh (hq issue 244)
Merged
#70 Report a provider that keeps failing a consumer in status (hq ADR 0224)
Merged
#69 Rename node-hosts-file to node-hostname, and refuse one seat claimed under two names (hq ADR 0223 part 3)
Merged
#68 Retire node-resolver-config and the seat need only it used (hq ADR 0223 part 2, step 2 of 2)
Merged
#67 Test resolv.conf as the uplink's, and refuse a second writer of a fact's path (hq ADR 0223 part 2, step 1 of 2)
Merged
#65 A mesh seat may be replicated: the resolver held on two machines (hq ADR 0223)
Merged
#63 The private network writes nothing into the runtime's file; generated resources are collision-checked (hq ADR 0222, issue 190 — 3 of 3)
Merged
#62 Tell a module where a mesh seat's holder is reached: ${seat:<seat>:reach} (hq ADR 0222, issue 190 — 1 of 3)
Merged
#64 A named push sends no build a policy or a plan holds back (hq issue 259, ADR 0221)
Merged
#61 Delete node-dns-resolver; resolver config needs the uplink (hq ADR 0220)
Merged
#60 The controller writes no /etc/hosts (hq ADR 0199)
Merged
#59 A mesh seat's holder elsewhere answers before this machine's own provider (hq issue 258)
Merged
#57 The build queue is controlled through the controller and the build seat (hq ADR 0219)
Merged
#56 Say a plan's first send in the machine's own time
Merged
#55 Judge each machine's report from its own send, so a first machine opens the gate (hq issue 256)
Merged
#54 Delivery in order: grants before code, one machine first, a newer plan takes over (ADR 0218; hq issues 249, 252, 254)
Merged
#53 Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)
Merged
#52 Two tests that main broke: bus users after issue 195, and the event consumer made from now (issue 248)
Merged
#51 Make the controller's event consumer from now, and give a stuck one a reset (hq issue 248)
Merged
#49 The node-backup seat (hq ADR 0214, to-be 43)
Merged
#48 node-message-bus: the machine's D-Bus is a node seat (hq ADR 0215)
Merged
#47 A dry-run build is taken in by nothing (hq issue 240)
Merged
#46 A container's environment follows a moved port, as a file already does (hq issue 088)
Merged
#45 Hold the forge to being an ordinary provider, in tests (hq issue 085)
Merged
#44 Adoption mode: a node in use is adopted before it is converged (hq ADR 0100–0103)
Merged
#43 Nothing the control queue carries is lost while the store restarts (issue 083)
Merged
#42 A report that arrives while the store restarts is kept, not lost (issue 082)
Merged
#41 Every machine was named twice over; only a machine on the private network is named (issue 079)
Merged
#40 Multiple fixes: a run-once step may name what it reads (ADR 0099); secret accept refuses an undeclared name (078)
Merged
#39 The control plane's recipe declares its base, and an undeclared FROM is refused (ADR 0097 live)
Merged
#38 Multiple fixes: several secrets per module (069), ask a module's tool (049), copy an upstream image (046), declare a vendor image (064)
Merged
#37 Multiple fixes: a stuck machine is said to be one (065), an undeclared mount is refused (026), an operator delivers a pair credential (070)
Merged
#36 The link knows a superseded report (issue 031)
Merged
#35 A secret reaches a process as a file (ADR 0086, closes issue 041)
Merged
#34 Secrets vault: operator key, a second seal on every secret, recovery and export
Merged
#33 The catalogue moves out, to novox/mesh-catalog
Merged
#32 The consistency cascade sends tolerantly and stops loudly (057 review)
Merged
#31 One push leaves the mesh consistent; the foundation's ports are forwarded (057, 063)
Merged
#30 The broker credential resolves the seat, not the hub (issue 059)
Merged
#29 The network carries the registry trust (ADR 0082, issues 042/048/062)
Merged
#28 The controller's seat is mesh-controller; second-node assignment refused
Merged
#27 A cross-node module reaches the broker by the hub's overlay name
Merged
#26 Self-upgrade installer: SDK-by-version, mesh-controller rename, foundation adopted
Merged
#25 Only a thing built and never run is unassignable
Merged
#24 ssh is never left without a rule
Merged
#23 The firewall governs what is forwarded, and never closes ssh
Merged
#22 A module that puts nothing on a machine cannot be assigned to one
Merged
#21 An artifact may name which stage of its recipe to stop at
Merged
#20 A module is a repository and a path, the builder announces what it made, and the mesh acts on it
Merged
#19 resolve: one un-hostable assignment no longer takes down a whole node's push
Merged
#18 catalogue: deliver a keyless same-node provider's served facts
Merged
#17 adapters: openai is a static-key vendor
Merged
#16 catalogue: give host-network containers the mesh's names too
Merged
#15 model-access: refreshable-grant — manager holds the refresh token, control plane never reads it
Merged
#14 model-access B: the refreshable-grant machinery (ADR 0050 carve-out)
Merged
#13 model-access A: provider→vendor + adapter dispatch + static-key (ADR 0050 foundation)
Merged
#12 fix: a require-only consumer of a parameterless provision still asks (mint gap)
Merged
#11 schedule: parse + validate a cron on a container, refuse run-once+schedule (ADR 0053)
Merged
#10 fix: a ${secret:} placeholder must fill from the file-owner's credential (provider-seal-key gate)
Merged
#9 run-once: a container the host runs to completion (ADR 0052)
Merged
#8 A module accesses operator-owned data, it does not own it (ADR 0051)
Merged
#7 A bare alive moves last_seen and nothing else (convergence race fix)
Merged
#6 Resync hq ADR references (0044-0054 -> 0039-0049)
Merged
#5 broker: a module account scopes its tool serve queues + mesh.rpc (ADR 0052)