The view: one read-only bus user for a page in a browser, composed like every other (hq research 036) #203

Closed

mesh-admin wants to merge 2 commits from feat/bus-view-principal into main

pull from: feat/bus-view-principal

merge into: :main

:main

:fix/sweep-2026-10-30

:fix/checker-full-failure

:feat/1945-user-list-switch

:fix/1945-mesh-grants-publishes-memberships

:fix/issued-states-follow-the-module

:fix/1945-credential-on-assignment

:fix/r6-mirror-on-change

:fix/store-forge-address

:fix/r6-look-again-after-unlock

:fix/r6-key-waits-said

:fix/1931-reconnects-verb

:fix/forge-requires-no-status

:fix/906-lease-renewal

:feat/r4e-controller

:fix/1106-sdk-member-merges

:fix/1399-person-word-test

:fix/1652-checks-wait

:feat/files-through-the-store-files-verbs

:fix/1649-held-ask-handed-out-twice

:fix/1658-sdk-items

:fix/1334-a-bus-reload-fails-a-tier

:feat/chain-on-the-bus

:fix/701-a-name-nothing-answers-is-not-used

:fix/270-a-dead-bus-watch-is-heard

:fix/630-config-values-from-four-sources

:fix/613-node-smb-server

:feat/328-libraries-and-module-users

:feat/325-identities-and-kept-folders

:feat/bus-view-principal

:test/plan-diff-left-out-line

:fix/the-registry-trust-test-reads-the-runtimes-module

:fix/the-runtime-file-is-the-runtimes

:feat/build-edges-are-recorded

:fix/several-contributions-collide-in-grants-v2

Conversation 7 Commits 2 Files Changed 10

+591 -3

mesh-admin commented 2026-10-10 14:02:00 +00:00

Contributor

Copy Link

Copy Source

hq research 036 names the gap (G1): no way for a browser to reach the bus. mesh-catalog #181 gives the bus module a WebSocket listener on the overlay; this is who connects there: the read-only user the issue tracker's local view page holds. No hq record by the operator's word; code only. Goes with #181 (merge order free: the user is composed only once minted, and the listener is live only after a person's bus upgrade).

What changes

• internal/broker: KindView is one fixed principal, user view, composed into the same file as every user (ADR 0234) once its credential is minted (Records.View) and left out once forgotten. Its whole authority is two lists beside it.
  • subscribe (ViewHears): mesh.mod.mesh-issues.event.{opened,moved,noted,linked}, mesh.seat.mesh-controller.event.{plan-moved,condition-raised,condition-changed,condition-cleared}, mesh.mod.mesh-delivery.event.{transition,group}, and its own inbox _INBOX.view.>.
  • publish (ViewReads), three read requests on the tracker's stream KV_mesh-issues_issues and no other: $JS.API.STREAM.INFO.KV_mesh-issues_issues (bind), $JS.API.DIRECT.GET.KV_mesh-issues_issues (the batch read, multi_last, which lists the newest value of every key) and $JS.API.DIRECT.GET.KV_mesh-issues_issues.> (one key). There is no allow_responses, no deny, no $KV.* write, and no consumer.
  • Why no consumer (and so no KV watch), measured in review on 2.11.17. With CONSUMER.CREATE on this stream (what a KV watcher needs), the view made a push consumer whose deliver_subject was mesh.mod.mesh-issues.event.opened. A module subscribed there received the bucket's entry as the tracker's event. The server does not check a deliver subject against its creator's permissions, so a consumer grant is a publish to any subject. CONSUMER.DELETE would also let the view delete a module's consumer. The page therefore lists with the batch read and re-reads the key a tracker event names (every event carries number).
  • The bucket is mesh-issues_issues (the bus's name for mesh-issues's state issues, read live with nats_buckets), not issues.
• internal/inventory: a bus-user kind view; BusRecords sets View when the row view of that kind exists. No schema change: the row is the record.
• cmd/mesh-controller: bus view-credential mints the credential and prints it once (the hash is kept, as with operator issue). It prints the WebSocket URL (ws://<bus host>:4223; the port is mirrored from the nats module's opening, see the note below), the bus URL and fingerprint, user, password, the inbox prefix the client must use (_INBOX.view), what it hears, what it reads and how to read it. bus view-revoke forgets the row and is revoked at the next composition, said as operator revoke says it. The credential works after the next push to the bus's machine; while a new bus build waits there (after #181), that push is held and the step is bus upgrade, and the printed text says so. These are terminal lines only; the bus seat verb is unchanged.

Tests

• view_test.go: the composed user's subscribe and publish lists are exactly the two lists, and every publish grant is one of the three reads. Mutation: putting CONSUMER.CREATE.<stream>.> back fails three tests (the exact-list check, a named watch subject, and the live watch). It names 22 refused publishes (put, delete, other buckets, STREAM.CREATE/PURGE/DELETE/MSG.DELETE, a watch, an unnamed consumer, a module consumer's delete, flow control, events, tools, seat verbs) and 7 refused subscribes. It also checks the view is composed only once minted, and is named as missing without a hash.
• view_live_test.go: the composed file is read by nats-server itself, with a WebSocket listener as the bus module declares it (no TLS, compression). The controller defines the bucket and the tracker writes it. The view connects over ws:// with its credential, binds the bucket, reads a key, and lists every key with one batch read. It hears a moved event and re-reads the key it names. It is refused a consumer delivering onto event.opened and a watch, and nothing reaches a subscriber there. It is refused a put, a delete and an event (permission violations from the server), and the bucket is unchanged.
• The golden composition gains the view (testdata/composed.conf, +4 lines; read it).

Reviewers' checklist (an independent review was run on the first head)

• The view can publish nothing but the three reads above and can write no KV: see ViewReads, the mutation, and the live refusals.
• Revocation works as for other users: the row is forgotten and the next composition drops the user (bus view-revoke, ForgetBusUser).
• Nothing here touches the bus's configuration or its step; the listener is #181's, gated by the bus module's record policy.

Notes, not blockers

• busWebSocketPort = 4223 is mirrored by hand from the nats manifest, and no test ties the two repositories. #181's test holds the manifest's three places to one port.
• A per-node expose setting (ADR 0046) could widen a from: mesh opening to anywhere, and nothing refuses that for a listener without TLS. This was there before this change.

For the page: use nats.js v3 or nats.ws and connect to ws://novox.internal:4223 (the control-node's overlay name; its address is 10.10.0.1). Use user view, the printed password, and inboxPrefix: "_INBOX.view". Open the bucket with kvm.open("mesh-issues_issues", {allow_direct: true}), never create, and use only get. Do not call watch, keys or history: each makes a consumer, which is refused. List with a request to $JS.API.DIRECT.GET.KV_mesh-issues_issues carrying {"multi_last":["$KV.mesh-issues_issues.>"]}; replies arrive in the inbox until a Status: 204 header. Subscribe to the events and get the key each event's number names. Open the page from file:// or http://: an https page cannot open ws://.

Checks. go vet, and go test of ./internal/broker/ ./cmd/mesh-controller/ ./internal/inventory/, pass locally; merge-check.sh against a throwaway store passed on the first head.

Do not merge without review.

hq research 036 names the gap (G1): no way for a browser to reach the bus. mesh-catalog #181 gives the bus module a WebSocket listener on the overlay; this is who connects there: the read-only user the issue tracker's local view page holds. No hq record by the operator's word; code only. Goes with #181 (merge order free: the user is composed only once minted, and the listener is live only after a person's `bus upgrade`). **What changes** - `internal/broker`: `KindView` is one fixed principal, user `view`, composed into the same file as every user (ADR 0234) once its credential is minted (`Records.View`) and left out once forgotten. Its whole authority is two lists beside it. - **subscribe** (`ViewHears`): `mesh.mod.mesh-issues.event.{opened,moved,noted,linked}`, `mesh.seat.mesh-controller.event.{plan-moved,condition-raised,condition-changed,condition-cleared}`, `mesh.mod.mesh-delivery.event.{transition,group}`, and its own inbox `_INBOX.view.>`. - **publish** (`ViewReads`), three read requests on the tracker's stream `KV_mesh-issues_issues` and no other: `$JS.API.STREAM.INFO.KV_mesh-issues_issues` (bind), `$JS.API.DIRECT.GET.KV_mesh-issues_issues` (the batch read, `multi_last`, which lists the newest value of every key) and `$JS.API.DIRECT.GET.KV_mesh-issues_issues.>` (one key). There is no `allow_responses`, no deny, no `$KV.*` write, and **no consumer**. - **Why no consumer (and so no KV watch), measured in review on 2.11.17.** With CONSUMER.CREATE on this stream (what a KV watcher needs), the view made a push consumer whose `deliver_subject` was `mesh.mod.mesh-issues.event.opened`. A module subscribed there received the bucket's entry as the tracker's event. The server does not check a deliver subject against its creator's permissions, so a consumer grant is a publish to any subject. CONSUMER.DELETE would also let the view delete a module's consumer. The page therefore lists with the batch read and re-reads the key a tracker event names (every event carries `number`). - The bucket is `mesh-issues_issues` (the bus's name for mesh-issues's state `issues`, read live with `nats_buckets`), not `issues`. - `internal/inventory`: a bus-user kind `view`; `BusRecords` sets `View` when the row `view` of that kind exists. No schema change: the row is the record. - `cmd/mesh-controller`: `bus view-credential` mints the credential and prints it once (the hash is kept, as with `operator issue`). It prints the WebSocket URL (`ws://<bus host>:4223`; the port is mirrored from the nats module's opening, see the note below), the bus URL and fingerprint, user, password, the inbox prefix the client must use (`_INBOX.view`), what it hears, what it reads and how to read it. `bus view-revoke` forgets the row and is revoked at the next composition, said as `operator revoke` says it. The credential works after the next push to the bus's machine; while a new bus build waits there (after #181), that push is held and the step is `bus upgrade`, and the printed text says so. These are terminal lines only; the `bus` seat verb is unchanged. **Tests** - `view_test.go`: the composed user's subscribe and publish lists are exactly the two lists, and every publish grant is one of the three reads. **Mutation: putting `CONSUMER.CREATE.<stream>.>` back fails three tests** (the exact-list check, a named watch subject, and the live watch). It names 22 refused publishes (put, delete, other buckets, STREAM.CREATE/PURGE/DELETE/MSG.DELETE, a watch, an unnamed consumer, a module consumer's delete, flow control, events, tools, seat verbs) and 7 refused subscribes. It also checks the view is composed only once minted, and is named as missing without a hash. - `view_live_test.go`: the composed file is read by nats-server itself, with a WebSocket listener as the bus module declares it (no TLS, compression). The controller defines the bucket and the tracker writes it. The view connects over `ws://` with its credential, binds the bucket, reads a key, and lists every key with one batch read. It hears a `moved` event and re-reads the key it names. It is refused a consumer delivering onto `event.opened` and a watch, and nothing reaches a subscriber there. It is refused a put, a delete and an event (permission violations from the server), and the bucket is unchanged. - The golden composition gains the view (`testdata/composed.conf`, +4 lines; read it). **Reviewers' checklist (an independent review was run on the first head)** - The view can publish nothing but the three reads above and can write no KV: see `ViewReads`, the mutation, and the live refusals. - Revocation works as for other users: the row is forgotten and the next composition drops the user (`bus view-revoke`, `ForgetBusUser`). - Nothing here touches the bus's configuration or its step; the listener is #181's, gated by the bus module's `record` policy. **Notes, not blockers** - `busWebSocketPort = 4223` is mirrored by hand from the nats manifest, and no test ties the two repositories. #181's test holds the manifest's three places to one port. - A per-node `expose` setting (ADR 0046) could widen a `from: mesh` opening to `anywhere`, and nothing refuses that for a listener without TLS. This was there before this change. **For the page**: use nats.js v3 or nats.ws and connect to `ws://novox.internal:4223` (the control-node's overlay name; its address is `10.10.0.1`). Use user `view`, the printed password, and **`inboxPrefix: "_INBOX.view"`**. Open the bucket with `kvm.open("mesh-issues_issues", {allow_direct: true})`, never `create`, and use only `get`. Do not call `watch`, `keys` or `history`: each makes a consumer, which is refused. List with a request to `$JS.API.DIRECT.GET.KV_mesh-issues_issues` carrying `{"multi_last":["$KV.mesh-issues_issues.>"]}`; replies arrive in the inbox until a `Status: 204` header. Subscribe to the events and `get` the key each event's `number` names. Open the page from `file://` or `http://`: an https page cannot open `ws://`. **Checks.** `go vet`, and `go test` of `./internal/broker/ ./cmd/mesh-controller/ ./internal/inventory/`, pass locally; `merge-check.sh` against a throwaway store passed on the first head. Do not merge without review.

mesh-admin added 1 commit 2026-10-10 14:02:00 +00:00

The view: one read-only bus user for a page in a browser, composed like every other (hq research 036) ... a5a355aeec

Research 036 names the gap (G1): no way for a browser to reach the bus. The bus module now listens
over WebSocket (mesh-catalog, nats); this is who connects there. The view is a fixed principal
(broker.KindView, user `view`) composed into the user list like every user once its credential is
minted, and left out once it is forgotten: it subscribes the issue tracker's events (opened, moved,
noted, linked), the controller's plan-moved and condition-raised/changed/cleared, and the delivery
owner's transition and group; it publishes only the JetStream API requests a read-only watcher of
the tracker's bucket (mesh-issues_issues) makes — STREAM.INFO, DIRECT.GET, CONSUMER.CREATE/INFO/
DELETE, flow control — answered in its own inbox; no reply, no tool, no event, no `$KV` write.

`bus view-credential` mints and prints it once (hash kept, like a person's); `bus view-revoke`
forgets it, real at the next composition. Tests: the composed grants are exactly these and a write
grant of any shape fails; the view is composed only once minted; and against a real server read from
the composed file over WebSocket, the view binds the bucket, reads a key, watches a put land, and is
refused a put, a delete and an event, the bucket unchanged.

mesh-admin commented 2026-10-10 14:02:10 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-controller@dc5a8208a213 — closed since 2026-10-25T19:33:26Z

Transitions

• 2026-10-10 14:15 (new) → proposed (announced): novox/mesh-controller#203's head announced
• 2026-10-10 14:23 proposed → checked (checked): the verdict names this commit
• 2026-10-10 14:23 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-25 19:33 ready → closed (closed): the pull request closed unmerged

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@dc5a8208a213` — **closed** since 2026-10-25T19:33:26Z **Transitions** - 2026-10-10 14:15 (new) → proposed (announced): novox/mesh-controller#203's head announced - 2026-10-10 14:23 proposed → checked (checked): the verdict names this commit - 2026-10-10 14:23 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-25 19:33 ready → closed (closed): the pull request closed unmerged The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-admin commented 2026-10-10 14:08:09 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at a5a355ae

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
• mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

• tier 0: mesh-controller
• tier 1: build-agent
• tier 2: route-proxy
• ace: receives build-agent, route-proxy
• g14: receives build-agent
• novox: receives mesh-controller, build-agent, route-proxy
• shanks: receives build-agent
• build-agent keeps data (ADR 0233): what it holds is backed up before it moves
• route-proxy provides route: its consumers are sent again after it
• route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go, internal/broker/view_test.go

Run by the build seat on g14 as build-1791640925568845903 (builds --log build-1791640925568845903).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 56 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-10T13:56:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-10T13:56:57Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy

notes:
  - internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go and internal/broker/view_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.035s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	221.345s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.012s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.021s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.014s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.172s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.075s
ok  	github.com/novox/mesh-controller/internal/broker	8.875s
ok  	github.com/novox/mesh-controller/internal/builder	2.686s
ok  	github.com/novox/mesh-controller/internal/catalogue	4.732s
ok  	github.com/novox/mesh-controller/internal/conditions	2.423s
ok  	github.com/novox/mesh-controller/internal/envfile	1.033s
ok  	github.com/novox/mesh-controller/internal/facts	1.037s
ok  	github.com/novox/mesh-controller/internal/identity	4.401s
ok  	github.com/novox/mesh-controller/internal/inventory	78.462s
ok  	github.com/novox/mesh-controller/internal/lease	17.676s
ok  	github.com/novox/mesh-controller/internal/licences	4.078s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.013s
ok  	github.com/novox/mesh-controller/internal/link	51.305s
ok  	github.com/novox/mesh-controller/internal/lint	2.189s
ok  	github.com/novox/mesh-controller/internal/outward	1.062s
ok  	github.com/novox/mesh-controller/internal/overlay	1.049s
ok  	github.com/novox/mesh-controller/internal/secrets	1.506s
ok  	github.com/novox/mesh-controller/internal/store	3.340s
ok  	github.com/novox/mesh-controller/internal/testbus	1.174s
ok  	github.com/novox/mesh-controller/internal/token	1.016s

**Merge check** at `a5a355ae` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go, internal/broker/view_test.go Run by the build seat on g14 as `build-1791640925568845903` (`builds --log build-1791640925568845903`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 56 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-10T13:56:57Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-10T13:56:57Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy notes: - internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go and internal/broker/view_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.035s ok github.com/novox/mesh-controller/cmd/mesh-controller 221.345s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.012s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.021s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.014s ok github.com/novox/mesh-controller/examples/route-proxy 1.172s ok github.com/novox/mesh-controller/internal/artifacts 1.075s ok github.com/novox/mesh-controller/internal/broker 8.875s ok github.com/novox/mesh-controller/internal/builder 2.686s ok github.com/novox/mesh-controller/internal/catalogue 4.732s ok github.com/novox/mesh-controller/internal/conditions 2.423s ok github.com/novox/mesh-controller/internal/envfile 1.033s ok github.com/novox/mesh-controller/internal/facts 1.037s ok github.com/novox/mesh-controller/internal/identity 4.401s ok github.com/novox/mesh-controller/internal/inventory 78.462s ok github.com/novox/mesh-controller/internal/lease 17.676s ok github.com/novox/mesh-controller/internal/licences 4.078s ok github.com/novox/mesh-controller/internal/licences/adapters 1.013s ok github.com/novox/mesh-controller/internal/link 51.305s ok github.com/novox/mesh-controller/internal/lint 2.189s ok github.com/novox/mesh-controller/internal/outward 1.062s ok github.com/novox/mesh-controller/internal/overlay 1.049s ok github.com/novox/mesh-controller/internal/secrets 1.506s ok github.com/novox/mesh-controller/internal/store 3.340s ok github.com/novox/mesh-controller/internal/testbus 1.174s ok github.com/novox/mesh-controller/internal/token 1.016s ```

jschoubben added 1 commit 2026-10-10 14:15:18 +00:00

The view reads directly and makes no consumer: a consumer's deliver subject publishes anywhere ... dc5a8208a2

Review of the view (research 036): granted CONSUMER.CREATE on the bucket's stream, the view made a
push consumer delivering to mesh.mod.mesh-issues.event.opened, and a module subscribed there
received the bucket's entry as the tracker's event — measured on 2.11.17. The server does not hold a
deliver subject to its creator's permissions, so a consumer grant is a publish to any subject.

The view now binds and reads directly, nothing else: STREAM.INFO, DIRECT.GET by key, and the batch
DIRECT.GET (multi_last) that lists every key's newest value into its inbox. No watch: the page
re-reads the key a tracker event names (every event carries the number). The live test lists with
the batch, follows a moved event to the re-read, and is refused the consumer and the watch with
nothing reaching the event subject; the mutation (CONSUMER.CREATE back) fails three tests.

The credential says how to read, and that the step making it work is the next `bus upgrade` while
a new bus build waits, not a push.

mesh-admin commented 2026-10-10 14:23:18 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at dc5a8208

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
• mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

• tier 0: mesh-controller
• tier 1: build-agent
• tier 2: route-proxy
• ace: receives build-agent, route-proxy
• g14: receives build-agent
• novox: receives mesh-controller, build-agent, route-proxy
• shanks: receives build-agent
• build-agent keeps data (ADR 0233): what it holds is backed up before it moves
• route-proxy provides route: its consumers are sent again after it
• route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
• read by no module's build: internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go, internal/broker/view_test.go

Run by the build seat on novox as build-1791641749753159970 (builds --log build-1791641749753159970).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 56 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-10T14:06:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-10T14:06:57Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy

notes:
  - internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go and internal/broker/view_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.044s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	269.850s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.021s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.032s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.024s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.130s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.059s
ok  	github.com/novox/mesh-controller/internal/broker	17.623s
ok  	github.com/novox/mesh-controller/internal/builder	3.442s
ok  	github.com/novox/mesh-controller/internal/catalogue	5.659s
ok  	github.com/novox/mesh-controller/internal/conditions	2.507s
ok  	github.com/novox/mesh-controller/internal/envfile	1.036s
ok  	github.com/novox/mesh-controller/internal/facts	1.032s
ok  	github.com/novox/mesh-controller/internal/identity	5.397s
ok  	github.com/novox/mesh-controller/internal/inventory	104.177s
ok  	github.com/novox/mesh-controller/internal/lease	17.717s
ok  	github.com/novox/mesh-controller/internal/licences	4.928s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.011s
ok  	github.com/novox/mesh-controller/internal/link	57.443s
ok  	github.com/novox/mesh-controller/internal/lint	2.408s
ok  	github.com/novox/mesh-controller/internal/outward	1.039s
ok  	github.com/novox/mesh-controller/internal/overlay	1.028s
ok  	github.com/novox/mesh-controller/internal/secrets	1.503s
ok  	github.com/novox/mesh-controller/internal/store	3.493s
ok  	github.com/novox/mesh-controller/internal/testbus	1.213s
ok  	github.com/novox/mesh-controller/internal/token	1.020s

**Merge check** at `dc5a8208` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - read by no module's build: internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go, internal/broker/view_test.go Run by the build seat on novox as `build-1791641749753159970` (`builds --log build-1791641749753159970`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 56 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-10T14:06:57Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-10T14:06:57Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy notes: - internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go and internal/broker/view_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.044s ok github.com/novox/mesh-controller/cmd/mesh-controller 269.850s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.021s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.032s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.024s ok github.com/novox/mesh-controller/examples/route-proxy 1.130s ok github.com/novox/mesh-controller/internal/artifacts 1.059s ok github.com/novox/mesh-controller/internal/broker 17.623s ok github.com/novox/mesh-controller/internal/builder 3.442s ok github.com/novox/mesh-controller/internal/catalogue 5.659s ok github.com/novox/mesh-controller/internal/conditions 2.507s ok github.com/novox/mesh-controller/internal/envfile 1.036s ok github.com/novox/mesh-controller/internal/facts 1.032s ok github.com/novox/mesh-controller/internal/identity 5.397s ok github.com/novox/mesh-controller/internal/inventory 104.177s ok github.com/novox/mesh-controller/internal/lease 17.717s ok github.com/novox/mesh-controller/internal/licences 4.928s ok github.com/novox/mesh-controller/internal/licences/adapters 1.011s ok github.com/novox/mesh-controller/internal/link 57.443s ok github.com/novox/mesh-controller/internal/lint 2.408s ok github.com/novox/mesh-controller/internal/outward 1.039s ok github.com/novox/mesh-controller/internal/overlay 1.028s ok github.com/novox/mesh-controller/internal/secrets 1.503s ok github.com/novox/mesh-controller/internal/store 3.493s ok github.com/novox/mesh-controller/internal/testbus 1.213s ok github.com/novox/mesh-controller/internal/token 1.020s ```

mesh-admin referenced this pull request 2026-10-12 09:55:01 +00:00

plan-moved says what a walk touches, its bound and its outcome when it starts and ends (ADR 0308, issue 532) #247

mesh-admin referenced this pull request 2026-10-12 10:12:13 +00:00

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420) #249

mesh-admin referenced this pull request 2026-10-12 12:05:11 +00:00

The node-reads seat: its verbs, its holder's own account, and the node's secret places (hq ADR 0310, issue 418) #257

mesh-admin referenced this pull request 2026-10-12 12:17:15 +00:00

Ask a node's engine which of its directories the walk would refuse, read-only (issue 358) #258

mesh-admin referenced this pull request 2026-10-12 12:36:45 +00:00

Ask a node's engine which of its directories the walk would refuse, read-only (issue 358) #258

mesh-admin referenced this pull request 2026-10-14 01:00:55 +00:00

57/F2: Placement leaves the settings layers, held beside the assignment (issue 651) #316

mesh-admin referenced this pull request 2026-10-14 06:07:35 +00:00

57/K2: The controller reads, judges against and keeps the catalogue's list of predefined keys (issue 661) #323

mesh-tools closed this pull request 2026-10-17 18:51:34 +00:00

mesh-tools commented 2026-10-17 20:23:33 +00:00

Member

Copy Link

Copy Source

Merge check at dc5a8208
Judged: head dc5a8208a213 merged into trunk 7c9c187ca6e2

• mesh/merge-gate: FAIL — head dc5a8208a2 does not merge cleanly into trunk 7c9c187ca6: in conflict internal/broker/nats.go, internal/inventory/bususers.go (modules: build-agent, mesh-controller, route-proxy)
• mesh/repo-check: FAIL — head dc5a8208a2 does not merge cleanly into trunk 7c9c187ca6: in conflict internal/broker/nats.go, internal/inventory/bususers.go

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

• tier 0: mesh-controller, route-proxy
• tier 1: build-agent
• ace: receives route-proxy, build-agent
• g14: receives build-agent
• novox: receives mesh-controller, route-proxy, build-agent
• shanks: receives build-agent
• route-proxy provides route: its consumers are sent again after it
• route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
• build-agent keeps data (ADR 0233): what it holds is backed up before it moves
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine
• read by no module's build: internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go, internal/broker/view_test.go

Run by the build seat on ace as build-1792268602106987822 (builds --log build-1792268602106987822).

head dc5a8208a213 does not merge cleanly into trunk 7c9c187ca6e2: in conflict internal/broker/nats.go, internal/inventory/bususers.go

**Merge check** at `dc5a8208` Judged: head `dc5a8208a213` merged into trunk `7c9c187ca6e2` - `mesh/merge-gate`: **FAIL** — head dc5a8208a213 does not merge cleanly into trunk 7c9c187ca6e2: in conflict internal/broker/nats.go, internal/inventory/bususers.go (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **FAIL** — head dc5a8208a213 does not merge cleanly into trunk 7c9c187ca6e2: in conflict internal/broker/nats.go, internal/inventory/bususers.go **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller, route-proxy - tier 1: build-agent - ace: receives route-proxy, build-agent - g14: receives build-agent - novox: receives mesh-controller, route-proxy, build-agent - shanks: receives build-agent - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine - read by no module's build: internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go, internal/broker/view_test.go Run by the build seat on ace as `build-1792268602106987822` (`builds --log build-1792268602106987822`). ``` head dc5a8208a213 does not merge cleanly into trunk 7c9c187ca6e2: in conflict internal/broker/nats.go, internal/inventory/bususers.go ```

mesh-tools commented 2026-10-17 22:20:59 +00:00

Member

Copy Link

Copy Source

Merge check at dc5a8208
Judged: head dc5a8208a213 merged into trunk 47f9290b37aa

• mesh/merge-gate: FAIL — head dc5a8208a2 does not merge cleanly into trunk 47f9290b37: in conflict internal/broker/nats.go, internal/inventory/bususers.go (modules: mesh-controller)
• mesh/repo-check: FAIL — head dc5a8208a2 does not merge cleanly into trunk 47f9290b37: in conflict internal/broker/nats.go, internal/inventory/bususers.go

Delivery plan — builds mesh-controller → novox; no bus step

• tier 0: mesh-controller
• novox: receives mesh-controller

Run by the build seat on shanks as build-1792275635760693285 (builds --log build-1792275635760693285).

head dc5a8208a213 does not merge cleanly into trunk 47f9290b37aa: in conflict internal/broker/nats.go, internal/inventory/bususers.go

**Merge check** at `dc5a8208` Judged: head `dc5a8208a213` merged into trunk `47f9290b37aa` - `mesh/merge-gate`: **FAIL** — head dc5a8208a213 does not merge cleanly into trunk 47f9290b37aa: in conflict internal/broker/nats.go, internal/inventory/bususers.go (modules: mesh-controller) - `mesh/repo-check`: **FAIL** — head dc5a8208a213 does not merge cleanly into trunk 47f9290b37aa: in conflict internal/broker/nats.go, internal/inventory/bususers.go **Delivery plan** — builds mesh-controller → novox; no bus step - tier 0: mesh-controller - novox: receives mesh-controller Run by the build seat on shanks as `build-1792275635760693285` (`builds --log build-1792275635760693285`). ``` head dc5a8208a213 does not merge cleanly into trunk 47f9290b37aa: in conflict internal/broker/nats.go, internal/inventory/bususers.go ```

mesh-tools commented 2026-10-18 00:17:31 +00:00

Member

Copy Link

Copy Source

Merge check at dc5a8208
Judged: head dc5a8208a213 merged into trunk 54070f5bc32b

• mesh/merge-gate: FAIL — head dc5a8208a2 does not merge cleanly into trunk 54070f5bc3: in conflict internal/broker/nats.go, internal/inventory/bususers.go (modules: build-agent, mesh-controller, route-proxy)
• mesh/repo-check: FAIL — head dc5a8208a2 does not merge cleanly into trunk 54070f5bc3: in conflict internal/broker/nats.go, internal/inventory/bususers.go

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

• tier 0: mesh-controller, route-proxy
• tier 1: build-agent
• ace: receives route-proxy, build-agent
• g14: receives build-agent
• novox: receives mesh-controller, route-proxy, build-agent
• shanks: receives build-agent
• route-proxy provides route: its consumers are sent again after it
• route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
• build-agent keeps data (ADR 0233): what it holds is backed up before it moves
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine
• read by no module's build: internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go, internal/broker/view_test.go

Run by the build seat on shanks as build-1792282621077532731 (builds --log build-1792282621077532731).

head dc5a8208a213 does not merge cleanly into trunk 54070f5bc32b: in conflict internal/broker/nats.go, internal/inventory/bususers.go

**Merge check** at `dc5a8208` Judged: head `dc5a8208a213` merged into trunk `54070f5bc32b` - `mesh/merge-gate`: **FAIL** — head dc5a8208a213 does not merge cleanly into trunk 54070f5bc32b: in conflict internal/broker/nats.go, internal/inventory/bususers.go (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **FAIL** — head dc5a8208a213 does not merge cleanly into trunk 54070f5bc32b: in conflict internal/broker/nats.go, internal/inventory/bususers.go **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller, route-proxy - tier 1: build-agent - ace: receives route-proxy, build-agent - g14: receives build-agent - novox: receives mesh-controller, route-proxy, build-agent - shanks: receives build-agent - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine - read by no module's build: internal/broker/nats_golden_test.go, internal/broker/testdata/composed.conf, internal/broker/view_live_test.go, internal/broker/view_test.go Run by the build seat on shanks as `build-1792282621077532731` (`builds --log build-1792282621077532731`). ``` head dc5a8208a213 does not merge cleanly into trunk 54070f5bc32b: in conflict internal/broker/nats.go, internal/inventory/bususers.go ```

mesh-tools commented 2026-10-25 19:33:29 +00:00

Member

Copy Link

Copy Source

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: its head dc5a8208a2 is no longer the pull request's head, or the pull request closed. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: its head dc5a8208a213 is no longer the pull request's head, or the pull request closed. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

This repo is archived. You cannot comment on pull requests.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

3 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#203