A settings proposal reads at a glance, its values whole where the sender is proven (issues 383 and 639) #304
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: novox/mesh-controller#304
Reference in New Issue
Block a user
after: novox/mesh-catalog
Replaces #202 (issue 383), rebased on main and reshaped for issue 639. Answers the review (reviews 212-215) at head
52bcef159d.Acceptance. A settings proposal on Telegram reads: bold "Set mounts on shanks?", one summary line ("Changes 3 setting(s) of mounts on shanks; approved, the layer is set at once and shanks takes it at its next push."), at most three key points (more keys: the first two and "and N more, each whole in the note: "; a long point ends "… (cut: whole in the note)"), the buttons, and a collapsed note that lists every key with its whole value (masked on the desk), then who proposed it, the fingerprint and how to read it at the terminal.
What.
settingsProposal.ask: explanation =summary()+ at most three points fromchange(). The Details list every key uncut, masked under the content rule;WholeDetails(mesh-sdk #25) holds them whole for a channel that proves who answers.Wholecarries the glance whole, as in #202. A value shaped like a secret is withheld in every form. The how-to line names no dotted verb, which the router's content rule would withhold. The controller keeps the ask it sent, so an open proposal is decided as asked.Vendors mesh-sdk at f474544 (mesh-sdk #25:
Message.Note,asks.Glance,Ask.WholeDetails) and captures its conformance events there (testdata/beside/CAPTURED).Merge order: mesh-sdk #25, then mesh-catalog #278 (the router must know
WholeandWholeDetailsbefore the controller sends them, or the digests differ and the warrant is refused), then this. Theafter:line above declares it to the delivery group.Tested.
merge-check.sh: all green. Tests fail on main:TestAProposalAsksAtTheLevelApproveWithTheExactChange,TestAProposalShowsItsValuesWholeOnlyWhereTheSenderIsProvenAndNeverASecret,TestAMeshWideLayerIsProposed,TestAClearIsProposedAndShowsWhatItRemoves, andTestEveryKeyAndItsWholeValueReachTheOperator(5 keys, one value 300 characters: every key and full value in what a proving channel shows, every key in the masked Details, the cut said).Fixes issue 383 (with mesh-catalog and hq); part of issue 639. Decisions: ADR 0345 (accepted), ADR 0347 (proposed, needs the operator).
Delivery
novox/mesh-controller@deef9421a276— delivered since 2026-10-13T20:07:01ZDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Group
fix/383-an-ask-reads-at-a-glance, in order: novox/mesh-catalog@f09daabec3 → novox/mesh-controller@deef9421a2Machines
Transitions
332fbaa9b1, the trunk is now cef22a25264b; judged again on a recheck or when it is mergedThe commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
35232c85Judged: head
35232c853483merged into trunk6f1a05366c1d; read beside it: mesh-catalog5f491e0c097d, mesh-controller-main6f1a05366c1d, mesh-host0e92ef3d1b21, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791902225449633841(builds --log build-1791902225449633841).Verdict: request changes at
35232c8534Independent review (issues 383 and 639, ADR 0345 clause 6).
BLOCKING: with more than 3 keys, the operator approves values that are never shown on the phone, not even in the collapsible part.
change()replaces every key from the third on with "and N more: c, d, e" (key names only). It does this in both forms, the masked and the exact one, because line 168 calls the samechange(machines, true). SoAsk.Whole, which is shown only on a channel that proves who answers, also carries no value for those keys.What would satisfy it: on a channel that proves who answers, the operator can read every key and its exact value (secret shapes withheld) before Approve, at least in the collapsed note, and a cut value is marked as cut. Clause 6 of ADR 0345 says "the first two, then the names of the rest" for the explanation. Carrying the remaining keys whole in the note needs either a progressive insight or a new clause, and likely router support for whole words in the note (mesh-catalog #278). That is the owner's call, but the merge should wait for it.
Correct as far as it goes:
wholeValuewithholds a secret's shape whole.outward.Secretrefuses before asking (proposals.go:488 onward). TheSecretvsChecksplit mirrors the messenger'sCheckSecretone for one.go test -mod=vendor ./...passes niced. New or changed tests fail on main: I checked out main's non-test code with the PR's tests, and the build fails (outward.Secret,Ask.Whole,DetailsandGlanceare undefined).Statuses at this head: mesh/merge-gate success ("head
35232c8534merged into trunk6f1a05366c— pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus…"), mesh/repo-check success ("… pass: its merge-check.sh passed"), mesh/delivery success ("ready: it delivers once merged"), mesh/delivery-group PENDING ("group fix/383-an-ask-reads-at-a-glance checking: composed check out of date: novox/mesh-catalog@ea1dfdce5b was judged against trunk 5f491…").New head
52bcef159danswers the review (reviews 212-215). The Details now list every key with its value, one line each and uncut. The values are masked inDetailsand whole inWholeDetails(mesh-sdk f474544), which the router shows in the note on a proving channel. The glance keeps its shape and says what it leaves out: "and N more, each whole in the note: ...", and a long point ends "... (cut: whole in the note)". New test:TestEveryKeyAndItsWholeValueReachTheOperator. A 5-key proposal with a 300-character value: every key and full value is in Whole+WholeDetails, every key is masked in Details, the cut is said. It fails on the earlier head. Decision: ADR 0347 (changes ADR 0345 §6; proposed, needs the operator). Local merge-check.sh passed.Merge check at
52bcef15Judged: head
52bcef159d95merged into trunk6f1a05366c1d; read beside it: mesh-cataloge209d46faf3d, mesh-controller-main6f1a05366c1d, mesh-host0e92ef3d1b21, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791903915795552180(builds --log build-1791903915795552180).52bcef159dto5b014e75b7Merge check at
5b014e75Judged: head
5b014e75b7d5merged into trunk8ddf8b700558; read beside it: mesh-catalog9c166398f204, mesh-controller-main8ddf8b700558, mesh-host0e92ef3d1b21, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (run 3) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passed (run 3)Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791912326769990180(builds --log build-1791912326769990180).Out of date when it landed: out of date: judged against trunk
8ddf8b7005, the trunk is now 9f3aa91e812b; judged again on a recheck or when it is mergedMerge check at
5b014e75Judged: head
5b014e75b7d5merged into trunk9f3aa91e812b; read beside it: mesh-catalog9c166398f204, mesh-controller-main9f3aa91e812b, mesh-host0e92ef3d1b21, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on novox as
build-1791913248258955138(builds --log build-1791913248258955138).Verdict: request changes at
5b014e75b7Independent review of the issue 383/639 group under ADR 0345 and ADR 0347.
Blocking: a key past the second is never checked at propose, so its value can be unreadable before Approve. propose holds only Headline, Explanation, OnExpiry and the options to outward.Check (cmd/mesh-controller/proposals.go:502-510), and only q.Whole to outward.Secret (:512). The key lines past the second are only in Details and WholeDetails (:177-198), which are checked by nothing here. Before this change, those lines were in the explanation, and a line such as "+ password: hunter2" was refused at once, in words. That still happens when the key is the first or second. I probed it at this head with a throwaway test:
The value "hunter2" passes sayableValue and wholeValue because the secret's shape is the key and value together, not the value alone. Fix: hold every line of q.Details to outward.Check and every line of q.WholeDetails to outward.Secret at propose, and refuse in words as for the explanation. Better still, mask per line, so a secret-named key shows "+ password: ‹withheld›" in both, and name it in the Details line as ADR 0347 §2 says. Add a case with a secret-named key past the second to TestEveryKeyAndItsWholeValueReachTheOperator.
Checked and fine:
pushleft is the ADR 0344 error path when a walk cannot be opened (proposals.go:891), which belongs to #305 and is not a promise in the ask.go test ./cmd/mesh-controller/ ./internal/outward/pass at the head (run niced). The new tests fail on main (build: asks.Glance, outward.Secret) and onfffafac, the earlier-review head (build: no WholeDetails).Statuses at this head: mesh/merge-gate success ("head
5b014e75b7merged into trunk9f3aa91e81, pass"), mesh/repo-check success, mesh/delivery success ("ready: it delivers once merged"), mesh/delivery-group success ("group fix/383-an-ask-reads-at-a-glance ready: every member ready, and composed together they pass").Note: mesh-sdk #25 is asked to change its digest encoding. This PR will need to re-vendor that head and update testdata/beside/CAPTURED.
5b014e75b7todd89b6e800New head
dd89b6e800answers review 225, rebased on main9f3aa91. Each change line is now judged the way the router judges it: masked lines under the content rule, whole lines under the secret rule. A refused line becomes+ <key> (value withheld), so the key is still named. A line the router would still refuse is refused at propose, in the controller's own words (judgeLinesover Details and WholeDetails); a key shaped like a secret is never echoed. New tests:TestASecretNamedKeyIsNamedAndItsValueWithheld({a:1, b:2, c:3, password:hunter2}: hunter2 appears nowhere,+ password (value withheld)is in both details forms, nothing the router would withhold or refuse is left; a key shaped like a secret is refused at propose) andTestARefusalNamesTheKeyAndNeverASecret. Re-pinned to mesh-sdk 5933eb7: go.mod, vendor and testdata/beside/CAPTURED. Local merge-check.sh passed.Merge check at
dd89b6e8Judged: head
dd89b6e800eamerged into trunk9f3aa91e812b; read beside it: mesh-catalog9c166398f204, mesh-controller-main9f3aa91e812b, mesh-host0e92ef3d1b21, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791916377675647477(builds --log build-1791916377675647477).Out of date when it landed: out of date: judged against trunk
9f3aa91e81, the trunk is now 332fbaa9b175; judged again on a recheck or when it is mergedThe operator could not read the settings proposals on the phone: the change, the fingerprint and a how-to paragraph in one wall of plain text, and the values masked as ‹path› and ‹address›, so the approval was blind. The ask is now a summary of what changes where ("Changes 3 setting(s) of mounts on shanks; approved, the layer is set at once and shanks takes it at its next push."), then at most three points, one key each (more keys: the first two and the names of the rest). Who proposed it, the fingerprint and how to read it whole are its Details, which the router notes after the answers. The change is carried twice: under the content rule, and whole (asks.Ask.Whole), shown only on a channel that proves who answers, a value shaped like a secret withheld in both (from the earlier work on issue 383, #202). Vendors mesh-sdk at 9588871 (fix/639-an-ask-reads-at-a-glance: Message.Note, asks.Glance), and captures its conformance events at that commit.{a:1, b:2, c:3, password:hunter2} was proposed with "+ password: hunter2" in its Details: the router withheld the line unnamed and Approve set a value the operator never saw (ADR 0347 §1, §3, §4). Each line is now judged as the router judges it, masked under the content rule and whole under the secret rule; a line refused is said "+ password (value withheld)", and any line the router would still refuse is refused at propose in the controller's words, never echoing a secret-shaped key. SDK at mesh-sdk 5933eb7 (no two asks digest the same).dd89b6e800todeef9421a2Merge check at
deef9421Judged: head
deef9421a276merged into trunk332fbaa9b175; read beside it: mesh-catalog9c166398f204, mesh-controller-main332fbaa9b175, mesh-host0e92ef3d1b21, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on novox as
build-1791917151437726334(builds --log build-1791917151437726334).Verdict: approve at
deef9421a2Re-review after review 225. This head is rebased onto main
332fbaa.I reran the probe at this head:
Every key is named and the note holds what the glance says, as ADR 0347 §1, §3 and §4 require.
Other checks:
go test ./cmd/mesh-controller/ ./internal/outward/pass (run niced). The new tests (TestASecretNamedKeyIsNamedAndItsValueWithheld, TestARefusalNamesTheKeyAndNeverASecret) do not build on5b014e75, the previous head.Statuses at this head: mesh/merge-gate success ("head
deef9421a2merged into trunk332fbaa9b1— pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks"), mesh/repo-check success ("… pass: its merge-check.sh passed"), mesh/delivery success ("ready: it delivers once merged"), mesh/delivery-group success ("group fix/383-an-ask-reads-at-a-glance ready: every member ready, and composed together they pass").Merge check at
deef9421Judged: head
deef9421a276merged into trunkcef22a25264b; read beside it: mesh-catalogfaebc3569acf, mesh-controller-maincef22a25264b, mesh-host0e92ef3d1b21, mesh-tools954e1a53eef9mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on novox as
build-1791918683588956052(builds --log build-1791918683588956052).