novox/mesh-controller
Archived
9
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260) #151

Merged
mesh-admin merged 1 commits from fix/state-grants-per-key into main 2026-10-08 14:09:25 +00:00
Conversation 2 Commits 1 Files Changed 12
+242 -51
mesh-admin commented 2026-10-08 13:51:31 +00:00
Contributor
Copy Link
Copy Source

Review of #149: the derived read reached the whole bucket and power could write every machine's key. Fixed:

  • Keyed reads. ReadsGranted now answers {read, key}: the key the block names, the holder's machine when it names none (keys [a-z0-9-] only, refused at registration otherwise). The bus records carry them as Declared.KeyedReads, and the grants are the key alone: $JS.API.DIRECT.GET.KV_<b>.$KV.<b>.<key> and $JS.API.CONSUMER.CREATE.KV_<b>.*.$KV.<b>.<key> (the create-with-filter form, which nats.go uses for a one-key watch and the server holds to the filter). STREAM.INFO, CONSUMER.DELETE and flow control stay per bucket: binding, deleting a randomly named consumer and flow control read and write no value.
  • Per-machine state. A state may declare "per-machine": true; its owner on a machine is granted write, direct get and filtered consumer on $KV.<b>.<machine> only. The machine's runtime account, which carries every module there, gets the union, which is still that one key (tested).
  • Membership. StateIssued.Key names the one key, for the runtime to refuse before the bus does. The runtime (mesh-tools) does not read it yet; until it does, a call for another key is refused by the bus, as a timeout.

Tests: TestPerMachineStateAndAKeyedReadReachOneKey, TestAMembershipNamesTheOneKeyOfKeyedState, TestPerMachineStateIsDeclaredAndKeptInItsLongForm, the keyed ReadsGranted and TestABarIsGrantedTheStateItsMachinesModulesOfferIt (real store). merge-check.sh passes locally.

mesh-catalog #127 declares power's draw per-machine once this is live. Do not merge without the operator's approval.

Review of #149: the derived read reached the whole bucket and power could write every machine's key. Fixed: - **Keyed reads.** `ReadsGranted` now answers `{read, key}`: the key the block names, the holder's machine when it names none (keys `[a-z0-9-]` only, refused at registration otherwise). The bus records carry them as `Declared.KeyedReads`, and the grants are the key alone: `$JS.API.DIRECT.GET.KV_<b>.$KV.<b>.<key>` and `$JS.API.CONSUMER.CREATE.KV_<b>.*.$KV.<b>.<key>` (the create-with-filter form, which nats.go uses for a one-key watch and the server holds to the filter). STREAM.INFO, CONSUMER.DELETE and flow control stay per bucket: binding, deleting a randomly named consumer and flow control read and write no value. - **Per-machine state.** A state may declare `"per-machine": true`; its owner on a machine is granted write, direct get and filtered consumer on `$KV.<b>.<machine>` only. The machine's runtime account, which carries every module there, gets the union, which is still that one key (tested). - **Membership.** `StateIssued.Key` names the one key, for the runtime to refuse before the bus does. The runtime (mesh-tools) does not read it yet; until it does, a call for another key is refused by the bus, as a timeout. Tests: `TestPerMachineStateAndAKeyedReadReachOneKey`, `TestAMembershipNamesTheOneKeyOfKeyedState`, `TestPerMachineStateIsDeclaredAndKeptInItsLongForm`, the keyed `ReadsGranted` and `TestABarIsGrantedTheStateItsMachinesModulesOfferIt` (real store). merge-check.sh passes locally. mesh-catalog #127 declares power's `draw` per-machine once this is live. Do not merge without the operator's approval.
mesh-admin added 1 commit 2026-10-08 13:51:31 +00:00
Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
b74268fb08 
A derived read reached the whole bucket, and the power module could write every
machine's draw. A read granted for a block now reaches that block's key alone, by the
direct get of its subject and a consumer filtered to it, and state declared per-machine
is written and read at the machine's own key only.
mesh-admin commented 2026-10-08 13:52:09 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-controller@b74268fb08f1 — delivered since 2026-10-08T14:24:36Z

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Machines

  • mesh-controller on novox: passed — healthy 3 times over 3m54s
  • mesh-controller on the rest running it: sent
  • build-agent on ace: passed — healthy 3 times over 3m26s
  • build-agent on the rest running it: sent
  • route-proxy on ace: passed — healthy 3 times over 3m16s
  • route-proxy on the rest running it: sent

Transitions

  • 2026-10-08 13:52 (new) → proposed (announced): novox/mesh-controller#151's head announced
  • 2026-10-08 14:00 proposed → checked (checked): the verdict names this commit
  • 2026-10-08 14:00 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-08 14:09 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-08 14:09 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
  • 2026-10-08 14:24 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@b74268fb08f1` — **delivered** since 2026-10-08T14:24:36Z **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - mesh-controller on novox: passed — healthy 3 times over 3m54s - mesh-controller on the rest running it: sent - build-agent on ace: passed — healthy 3 times over 3m26s - build-agent on the rest running it: sent - route-proxy on ace: passed — healthy 3 times over 3m16s - route-proxy on the rest running it: sent **Transitions** - 2026-10-08 13:52 (new) → proposed (announced): novox/mesh-controller#151's head announced - 2026-10-08 14:00 proposed → checked (checked): the verdict names this commit - 2026-10-08 14:00 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-08 14:09 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-08 14:09 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-08 14:24 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-admin commented 2026-10-08 14:00:37 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at b74268fb

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on ace as build-1791467524172530458 (builds --log build-1791467524172530458).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 50 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T13:48:06Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-08T13:48:06Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.029s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	148.365s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.016s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.018s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.015s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.111s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.035s
ok  	github.com/novox/mesh-controller/internal/broker	2.521s
ok  	github.com/novox/mesh-controller/internal/builder	2.088s
ok  	github.com/novox/mesh-controller/internal/catalogue	4.221s
ok  	github.com/novox/mesh-controller/internal/conditions	2.281s
ok  	github.com/novox/mesh-controller/internal/envfile	1.059s
ok  	github.com/novox/mesh-controller/internal/facts	1.101s
ok  	github.com/novox/mesh-controller/internal/identity	4.605s
ok  	github.com/novox/mesh-controller/internal/inventory	68.040s
ok  	github.com/novox/mesh-controller/internal/lease	17.755s
ok  	github.com/novox/mesh-controller/internal/licences	4.123s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.096s
ok  	github.com/novox/mesh-controller/internal/link	43.760s
ok  	github.com/novox/mesh-controller/internal/lint	2.032s
ok  	github.com/novox/mesh-controller/internal/outward	1.129s
ok  	github.com/novox/mesh-controller/internal/overlay	1.071s
ok  	github.com/novox/mesh-controller/internal/secrets	1.487s
ok  	github.com/novox/mesh-controller/internal/store	3.435s
ok  	github.com/novox/mesh-controller/internal/testbus	1.238s
ok  	github.com/novox/mesh-controller/internal/token	1.021s
**Merge check** at `b74268fb` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on ace as `build-1791467524172530458` (`builds --log build-1791467524172530458`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 50 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T13:48:06Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-08T13:48:06Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.029s ok github.com/novox/mesh-controller/cmd/mesh-controller 148.365s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.016s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.018s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.015s ok github.com/novox/mesh-controller/examples/route-proxy 1.111s ok github.com/novox/mesh-controller/internal/artifacts 1.035s ok github.com/novox/mesh-controller/internal/broker 2.521s ok github.com/novox/mesh-controller/internal/builder 2.088s ok github.com/novox/mesh-controller/internal/catalogue 4.221s ok github.com/novox/mesh-controller/internal/conditions 2.281s ok github.com/novox/mesh-controller/internal/envfile 1.059s ok github.com/novox/mesh-controller/internal/facts 1.101s ok github.com/novox/mesh-controller/internal/identity 4.605s ok github.com/novox/mesh-controller/internal/inventory 68.040s ok github.com/novox/mesh-controller/internal/lease 17.755s ok github.com/novox/mesh-controller/internal/licences 4.123s ok github.com/novox/mesh-controller/internal/licences/adapters 1.096s ok github.com/novox/mesh-controller/internal/link 43.760s ok github.com/novox/mesh-controller/internal/lint 2.032s ok github.com/novox/mesh-controller/internal/outward 1.129s ok github.com/novox/mesh-controller/internal/overlay 1.071s ok github.com/novox/mesh-controller/internal/secrets 1.487s ok github.com/novox/mesh-controller/internal/store 3.435s ok github.com/novox/mesh-controller/internal/testbus 1.238s ok github.com/novox/mesh-controller/internal/token 1.021s ```
mesh-admin merged commit fe00fec52c into main 2026-10-08 14:09:25 +00:00
mesh-admin deleted branch fix/state-grants-per-key 2026-10-08 14:09:25 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#151