A command opens each store once, not once per machine

Working out what a machine should be reaches the identity context for its
certificate and the licence context for its model access. Both were opened —
and waited on — inside functions called for every node in a push. Two machines
hid it. Fifty would be fifty connect-and-wait cycles for data that does not
change while the push runs.

So a command holds what it has open, and passes it. Each context is opened on
first use rather than up front, because most commands need one and paying to
reach three would be the same waste from the other side.

The contexts stay separate, which is the point: this is one struct holding
three connections to three databases, not one connection to a shared one. No
context reaches another's store, and each still holds only its own credential
(novox/hq ADR 0008).

A pure move again — the gate is green before and after, and no test changed.
This commit is contained in:
2026-08-31 13:35:39 +02:00
parent 8623613704
commit 6eeb10f066
11 changed files with 177 additions and 91 deletions
+13 -9
View File
@@ -50,11 +50,12 @@ func moduleCommand(ctx context.Context, args []string) error {
if len(args) == 0 {
return errors.New("module add <file>, module list, or module forget <name>")
}
inv, err := openInventory(ctx)
open, err := openStores(ctx)
if err != nil {
return err
}
defer inv.Close()
defer open.Close()
inv := open.inventory
switch args[0] {
case "add":
@@ -202,11 +203,12 @@ func assignCommand(ctx context.Context, verb string, args []string) error {
if len(args) != 2 {
return fmt.Errorf("%s <node> <module>", verb)
}
inv, err := openInventory(ctx)
open, err := openStores(ctx)
if err != nil {
return err
}
defer inv.Close()
defer open.Close()
inv := open.inventory
if verb == "unassign" {
if err := inv.Unassign(ctx, args[0], args[1]); err != nil {
@@ -223,7 +225,7 @@ func assignCommand(ctx context.Context, verb string, args []string) error {
// Resolved immediately, because an assignment that cannot be applied should be said now
// rather than at the next push. The assignment is kept either way: it is what a person meant,
// and the refusal is about the set rather than about this one.
if _, _, err := planFor(ctx, inv, args[0]); err != nil {
if _, _, err := planFor(ctx, open, args[0]); err != nil {
fmt.Println()
return err
}
@@ -235,11 +237,12 @@ func settingsCommand(ctx context.Context, args []string) error {
if len(args) == 0 {
return errors.New("settings set <module> <file> [--node <node>], or settings clear <module> [--node <node>]")
}
inv, err := openInventory(ctx)
open, err := openStores(ctx)
if err != nil {
return err
}
defer inv.Close()
defer open.Close()
inv := open.inventory
set := flag.NewFlagSet("settings", flag.ContinueOnError)
node := set.String("node", "", "one machine, rather than the whole mesh")
@@ -321,11 +324,12 @@ func pinCommand(ctx context.Context, args []string, setting bool) error {
if !setting && len(args) != 2 {
return errors.New("unpin <node> <provision>")
}
inv, err := openInventory(ctx)
open, err := openStores(ctx)
if err != nil {
return err
}
defer inv.Close()
defer open.Close()
inv := open.inventory
if !setting {
if err := inv.UnpinProvision(ctx, args[0], args[1]); err != nil {