mesh-builder: read the genesis document until the registry binds, and refuse a registry build with neither (hq issue 121, ADR 0336) #289
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: novox/mesh-controller#289
Reference in New Issue
Block a user
after: novox/mesh-catalog
What
cmd/mesh-builderpackagesFrom(machine): the npm-package-registry binding wins; a binding file named in the environment and absent is an unbound optional requirement, not a fault (before, every build failed reading it). Without a binding it reads the genesis document (MESH_GENESIS_PACKAGE_REGISTRY, JSON: scheme, at, port, npm-path, as, password). The person-run environment comes last. Each build's log says which it resolved from, or thatnpm-package-registryis unbound on this machine (§4).internal/builder:NpmrccarriesFromandMachine. A build that needs the registry (apackageartifact, an image whose Dockerfile names.npmrc, a TypeScript artifact with an@novox/dependency, §5) on an agent with none is refused before anything is built, mirrored or published, naming the machine,npm-package-registryunbound, andgiteaas its provider (§6). No public-registry fallback.testdata/besiderecaptured at mesh-catalog e0bc919 (the head of mesh-catalog #263) so the catalogue tests judge build-agent as changed.Tests (fail on main, pass here)
internal/catalogue/genesis_registry_test.go: over the real catalogue, build-agent is assigned with no registry provider, nothing installed,npm-package-registrylisted absent; composes with no binding, no secret, no genesis file; the genesis file is delivered once given; binds to gitea once offered.internal/builder/registry_unbound_test.go: package /.npmrcimage /@novoxTypeScript each refused before any docker build/run/pull or publish, naming workstation, npm-package-registry, unbound, gitea; a Go bundle and a plain image build; the log saysfrom the genesis document/from the npm-package-registry binding; the named provider provides the requirement in the catalogue.cmd/mesh-builder/packages_test.go: genesis document read when no binding; binding wins over it; neither gives no registry and says where; a document missing a field is refused by name.go vet ./...,go test -raceon cmd/mesh-builder, internal/builder, internal/catalogue, andsh merge-check.sh: pass.Order
After mesh-catalog #263 (declared above): in a merge check these tests read the catalogue's main, so they fail until that merges, then pass on a recheck.
Fixes issue 121 (with mesh-catalog #263 and mesh-host #102).
Delivery
novox/mesh-controller@a641ed7d15c7— delivered since 2026-10-13T04:31:18ZDelivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
Group
fix/121-genesis-package-registry, in order: novox/hq@39830983cc → novox/mesh-host@5f147fe6b9after: novox/mesh-catalogin novox/mesh-controller#289's description, orafter: novox/mesh-controllerin novox/mesh-catalog#263'sMachines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
a641ed7dJudged: head
a641ed7d15c7merged into trunk49102e1645c9; read beside it: mesh-catalogf88e3452f8b8, mesh-controller-main49102e1645c9, mesh-host7a41e120635b, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestGenesisAssignsTheBuildAgentWithNothingProvidingTheRegistry (0.00s)Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791853012743670615(builds --log build-1791853012743670615).Verdict: approve at
a641ed7d15Independent review against ADR 0336 (read whole, with reasoning) and ADR 0330.
No blocking finding in the code. Merge preconditions outside the code: (1) mesh-catalog #263 merges first, as the
after: novox/mesh-catalogline declares; (2) the delivery group fix/121-genesis-package-registry is rechecked and reads green, because it was judged rejected with the order contradiction and has not been judged since this line; (3) mesh/merge-gate and mesh/repo-check are rechecked against trunk584ee991, since both read "out of date". The earlier repo-check failed only TestGenesisAssignsTheBuildAgentWithNothingProvidingTheRegistry, judged against catalogue main, which is expected until #263 merges.What I checked:
packagesFrom(machine)reads the binding first, takes a named-but-absent binding file as unbound rather than as a fault, then reads the genesis document, and only then the environment of a person-run builder. Each build's log carries apackagesline saying "resolved from the npm-package-registry binding", "the genesis document", or that the requirement is unbound on the named machine. The genesis document's fields (scheme, at, port, npm-path, as, password) match mesh-host #102's GenesisRegistry exactly, and a document missing a field is refused by name.internal/builderthe check runs after the manifest is read and before the .npmrc, the base mirroring and any docker build/run/pull or publish. It names the machine,npm-package-registryunbound, andgiteaas the provider, and a test holdsgiteato the catalogue's provider. Nothing falls back to the public registry: with no registry, the refusal covers package artifacts, .npmrc images and@novox/TypeScript, and installOwn's existing guard still refuses a scoped dependency.go test ./...with MESH_CHECK_BESIDE holding mesh-catalog at main f88e3452 fails only TestGenesisAssignsTheBuildAgentWithNothingProvidingTheRegistry ("npm-package-registry is hard"). With mesh-catalog at e0bc919d (the head of #263), mesh-host main and mesh-sdk 33917f91 beside it, the whole suite passes. It also passes on a local merge of this head into current main584ee991.go vetis clean on the three packages.The builder's two choices, judged against the ADR:
(a) Binds and secrets cannot be marked only-when-bound. I accept this: ADR 0330 §6 already composes no binding or secret for an absent requirement, and genesis_registry_test.go shows neither file in the declaration while unbound. ADR 0336 §1 and its How it is checked say otherwise, though, and need a progressive insight (knowledge-base.propose with
insight). This is not blocking for this PR.(b) A TypeScript build that depends only on @novox/mesh-sdk is refused with no registry. This is what ADR 0336 §5 says ("a TypeScript artifact with an
@novox/dependency"), so the code conforms. It is stricter than the build needs, though: dependencies.go takes the SDK out of what is installed and resolves it from the toolchain image, so such a bundle never reaches the registry. My check in item 3 confirms it: without the refusal, the SDK-only bundle builds. The impact is that on a mesh without the gitea module, every SDK-only TypeScript module is refused on every build agent except genesis's. I am not blocking on it, because the code follows an accepted clause. If the operator wants SDK-only bundles to build unbound, that needs a progressive insight on §5 (the fact that the SDK is never fetched) and then a narrower check,scopedDependenciesminus the SDK.Non-blocking:
scopedDependenciesreads onlydependencies. installSteps also installsoptionalDependencies, so a module with an@novox/package only there is neither refused nor guarded. installOwn's existing guard has the same gap.planandnodeto list the requirement unbound. The resolution test checksResolution.Absent, which feeds them, but does not call either verb.Statuses at this head:
49102e1645, the trunk is now 584ee991961c; judged again on a recheck or when it is merged" (its earlier verdict: PASS, 4 of 4 compose)Merge check at
a641ed7dJudged: head
a641ed7d15c7merged into trunk584ee991961c; read beside it: mesh-catalogf88e3452f8b8, mesh-controller-main584ee991961c, mesh-host7a41e120635b, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestGenesisAssignsTheBuildAgentWithNothingProvidingTheRegistry (0.00s)Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
Run by the build seat on novox as
build-1791862416404943235(builds --log build-1791862416404943235).Out of date when it landed: out of date: judged against trunk
584ee99196, the trunk is now 1c9bc9cf0041; judged again on a recheck or when it is mergedMerge check at
a641ed7dJudged: head
a641ed7d15c7merged into trunk1c9bc9cf0041; read beside it: mesh-catalog53e51864969f, mesh-controller-main1c9bc9cf0041, mesh-host7a41e120635b, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
Run by the build seat on novox as
build-1791863526333004108(builds --log build-1791863526333004108).Out of date when it landed: out of date: judged against trunk
1c9bc9cf00, the trunk is now b12c4b82e820; judged again on a recheck or when it is mergedMerge check at
a641ed7dJudged: head
a641ed7d15c7merged into trunkb12c4b82e820; read beside it: mesh-catalog53e51864969f, mesh-controller-mainb12c4b82e820, mesh-host7a41e120635b, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1791864426673755817(builds --log build-1791864426673755817).