Bring build-agent and route-proxy in whole (issue 1019)

2026-10-17 18:15:33 +02:00
parent c43772fd94
commit 1586bd1134
17 changed files with 1032 additions and 0 deletions
@@ -0,0 +1,34 @@
+# build-agent
+
+The mesh's build machine as a role every machine can hold (novox/hq ADR 0190). It holds the node seat
+`node-build-agent`: every holder pulls one build at a time from the role's one work queue when it is
+idle, so a tier of many images is built by as many machines as hold the seat and are online, and a
+machine that is off builds nothing and blocks nothing. The controller asks the role, never a machine;
+the outcome names the machine that built it.
+
+What a holding machine needs is what the builder always needed, said here once: a container runtime
+(the socket is mounted), the artifact store as a provision, a workspace, and the bus credential. The code is `cmd/mesh-builder`, in this same repository beside the module, compiled from
+the repository's main (`build.artifacts[].context`).
+
+Assign it to every machine with a container runtime. It replaces `builder`, the one-holder form of the
+same thing; retire that once this is assigned where it was.
+
+A send that replaces the agent's container does not throw away the build it runs: the container declares
+`busy` as `/usr/local/bin/mesh-builder busy` (novox/hq ADR 0335). The node-engine asks it before replacing it; from that
+ask the agent takes no new build, the node-engine leaves it running while it says a build is in hand, and
+replaces it once it says idle, or after 15 minutes at the latest.
+
+## The package registry (novox/hq ADR 0336)
+
+The package registry (`npm-package-registry`, provided by the gitea module) is an optional requirement.
+Genesis assigns the build agent before anything provides it, so the agent is assignable on a mesh with no
+registry, and `mesh-controller.plan` and `node` list the requirement as unbound until the gitea module is
+assigned; it then binds with no further act.
+
+Until it binds, the agent on genesis's node reads the `genesis-package-registry` own-secret, which the
+installer seals to it at the packages step: the forge it raised, the port, the npm path, the account
+`mesh-builder` and its password. Issued outside the mesh, so no other machine is given one. A real binding
+wins over it, and each build's log says which the build resolved from. A build that needs the registry (a
+`package` artifact, an image whose Dockerfile names `.npmrc`, a TypeScript artifact with an `@novox/`
+dependency) on an agent with neither fails before building, naming the machine. Go artifacts and images
+that do not name `.npmrc` build without it. `manifest_test.go` holds the manifest to this.