mesh/merge-gate head 14c1e3bb9e7d merged into trunk fcdecb436117 — fail: head 14c1e3bb9e7d does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
mesh/repo-check head 14c1e3bb9e7d merged into trunk fcdecb436117 — fail: head 14c1e3bb9e7d does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
mesh/merge-gate head d1a80accbe07 merged into trunk fcdecb436117 — fail: head d1a80accbe07 does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
mesh/repo-check head d1a80accbe07 merged into trunk fcdecb436117 — fail: head d1a80accbe07 does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
mesh/merge-gate head 6a5b3cadbca9 merged into trunk fcdecb436117 — fail: head 6a5b3cadbca9 does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
mesh/repo-check head 6a5b3cadbca9 merged into trunk fcdecb436117 — fail: head 6a5b3cadbca9 does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
mesh/merge-gate head e0f3d82239d6 merged into trunk fcdecb436117 — fail: head e0f3d82239d6 does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
mesh/repo-check head e0f3d82239d6 merged into trunk fcdecb436117 — fail: head e0f3d82239d6 does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
mesh/merge-gate head ecb385d73879 merged into trunk fcdecb436117 — fail: head ecb385d73879 does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
mesh/repo-check head ecb385d73879 merged into trunk fcdecb436117 — fail: head ecb385d73879 does not merge cleanly into trunk fcdecb436117: in conflict cmd/…
The merge is too large for one commit through the forge's tool, so it lands in parts; the tree after the last part is the merge plus the declared-config mirror carrying every declaration field.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review 257 of mesh-controller#315 (hq issue 652): the test that only the audit
and a mirror's writer read a mirror (ADR 0289 §19, ADR 0356 §2) matched only
names qualified as broker. or recordmirror., so a reader inside package broker,
or one importing broker under another name, passed. It now matches by import
path and bare names in the defining packages, proves it on planted readers,
and names what it cannot see.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mesh/repo-check head 35c7662f895f merged into trunk dc36536e199e — fail: its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheContro…
Reviews 251 of mesh-controller#315 and ADR 0356 v4 (hq issue 652): a removal
without the lease removes nothing; a module no longer registered loses its
declared-config key with its event; a listed mirror is never reported as
undeclared state; only the audit and a mirror's own writer name a mirror's
bucket; and the mirrors' list and the writers table agree. The store test's
line moves where it merges with the integration branch's own new lines.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review of mesh-controller#315 (hq issue 652): the writer trusted the bucket as
it read it once, so a former lease holder's write stayed for good; it wrote
without the lease, asking only after a refused compare-and-set; and the
declared config carried a manifest's declarations whole, so a field the
manifest gains would reach the bus unreviewed (ADR 0289 §9, §10, §12). Every
pass now reads the bucket and writes back the store's value where it differs,
asks for the lease before the pass and before every write, and a declaration
is mirrored as its listed fields (kind, default, why), with a test that fails
on a declaration field the list does not name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The template at mesh-host c8920622 carries the controller's grant to write the
two record mirrors and say their events; the genesis template test holds the
controller's composition to it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The controller's composition gains the two mirror buckets and their events, so
the golden composition moves, and the genesis template is captured again from
mesh-host's branch of this package, whose installer user list carries them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An assignment and a registration each change exactly one key and raise exactly
one event; the same records written again change nothing (hq issue 652, the
package's done-when). Listed as a store test, so the merge check runs it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The writer behind the assignments and declared-config mirrors (hq issue 652,
ADR 0289, design 54 §2-3): filled from the bucket on its first pass, it
compares each value byte for byte, writes by compare-and-set, purges a key
whose record is gone with a marker that lives a day, and says each write once
after it succeeded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mesh-config resolves a module's config values per node from which module runs
where and what each registered module declares, and both lived only in the
controller's store (hq issue 652, design 57 F3). The controller now keeps two
record mirrors, mesh-controller_assignments (<node>.<module>) and
mesh-controller_declared-config (<module>), built from the store by the lease
holder every ten seconds and written only where a value differs, by
compare-and-set, with one assignment-changed or declared-config-changed per
write and a purge said as removed (ADR 0289, design 54 §2-3). A module reads
them through `reads` as mesh-controller.<mirror>; the writers table keeps every
other writer out. Neither holds a secret: an assignment names its node and
module, a declaration is what the public manifest declares.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mesh/merge-gate head bf6beec465c2 merged into trunk 9f3aa91e812b — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
A mergeable file's protected keys were checked at the top level only, so a layer could still set searxng's server.secret_key under the server key its file takes. The merge now refuses any layer value that would replace a ${secret:} placeholder in the file's own content, at any depth, whatever the module's protected list says.
mesh/merge-gate head ae0b384497c2 merged into trunk f3875a6b6019 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
mesh/merge-gate head f09c5ebdec6c merged into trunk 584aa2d7d7a5 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
The operator's rule: a wait is never hard-coded, at most a default is configured. The push verb takes `wait`; without it the controller's setting `push-wait` (module default 2m) applies; a setting that cannot be read waits for nothing, as a push did before, and says so.
mesh/merge-gate head 6d2e4c299a34 merged into trunk 584aa2d7d7a5 — pass: builds mesh-controller → novox; no bus step; every machine composes with the chang…
The seat ran `push <node> --wait 0`, so a push's call ended at "sent" and nobody learned whether the machine applied it. The caller is answered before a push starts (answersFirst, issue 265), so waiting holds nobody: the call now waits up to two minutes for the machine's own report and keeps it, applied, refused with the machine's reason, or each failed resource with its error.
mesh/merge-gate head b654b320a18a merged into trunk 584aa2d7d7a5 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
The resolver follows ADR 0303, but four comments still stated ADR 0210's retired rule that two modules declaring one package collide, and an agent took them as the rule. What stays exclusive is what a module owns: a path, a unit, a name, and a package declared present by one module and absent by another.
mesh-adminandClaude Opus 5.5