5 Commits

Include renames

Author	SHA1	Message	Date
mesh-admin	f09c5ebdec	push: the wait is the call's or the controller's setting push-wait, never a length in the code (issue 629) ... The operator's rule: a wait is never hard-coded, at most a default is configured. The push verb takes `wait`; without it the controller's setting `push-wait` (module default 2m) applies; a setting that cannot be read waits for nothing, as a push did before, and says so.	2026-10-13 12:09:43 +00:00
mesh-admin	6d2e4c299a	seat: a push to a named machine waits for the machine's answer, so its call says how it went (issue 629) ... The seat ran `push <node> --wait 0`, so a push's call ended at "sent" and nobody learned whether the machine applied it. The caller is answered before a push starts (answersFirst, issue 265), so waiting holds nobody: the call now waits up to two minutes for the machine's own report and keeps it, applied, refused with the machine's reason, or each failed resource with its error.	2026-10-13 12:03:53 +00:00
jochen	20d4f1ae71	Let the generic command verb only read, and keep keys and tokens at the terminal ... Review found a chain through the command verb: set the operator's key to one the caller holds, rotate secrets so they are sealed to it too, read the sealed copies, open them. Whoever may call a verb includes agents (hq ADR 0266), so command now runs an allow list of reading forms, and operator, identity, token, broker, api, licence and every secret command but rotate are refused through any verb.	2026-10-09 10:12:05 +02:00
jochen	2799e95035	Record a drill through its own verb, so S15 never counts a deliberate test as a repair ... Two ADR 0240 drills recorded with hand-act record --cause drill raised mesh.hand-acts.drill.healer-wanted. hand-act drill (seat verb drill) records them as a person's decision; hand-act record now refuses the cause, so the two recorded before it clear on the next tick and a repair cannot pass for a drill by the word it gives.	2026-10-07 13:55:31 +02:00
jochen	e74c32ed50	Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0) ... A controller restart lost every call's outcome, `status` composed the mesh while its caller waited (18.6s live on 2026-10-06, past the 10s window), a repair by hand left no trace, and the core's bounds had nothing measured to be set from. - calls: kept in the controller's bucket mesh-controller_calls (last 1000 or 14 days, answers bounded to 64 KiB), read by id across a restart; a controller starting marks a stopped one's running calls abandoned; each call names its caller from the inbox its answer goes to. - status: the serving controller composes it at start, after news from a machine, a build or an acting verb, and every minute; the verb answers the last composition at once with when and how long it took. Composing resolves each machine once instead of twice. - hand-act log in mesh-controller_hand-acts: push (required through the seat), plans stop/close, broker consumer-reset and the new hand-act record take --why/--cause/--condition; `hand-acts` lists them and repeated causes; status counts the week's. - durations (migration 0066): apply (send to first report), heartbeat gap, plan tier and build, recorded as heard; `durations` summarises them. - the controller's seat row takes this binary's definition of its own verbs, so the console no longer judges calls against an older build's schema. - the controller is granted its two buckets' subjects.	2026-10-06 02:59:36 +02:00