Multiple fixes: a stuck machine is said to be one (065), an undeclared mount is refused (026), an operator delivers a pair credential (070) #37

2026-09-21T15:57:46Z

jschoubben commented

2026-09-21 15:57:46 +00:00

Three issues, one branch, as asked. Each is its own commit and its own decision record (hq MR #64 on the same branch name).

065 — a failure that repeats is said to be stuck (ADR 0090)

The node report kept one row per machine, replaced, so a resource nothing can ever apply looked like a failure that had just happened, every reconcile interval, for ever. Migration 0025 adds failing_since and failures; RecordDoing keeps them across identical reports (same outcome, refusal and failed resources), restarts on a different one, clears on a clean apply. status prints stuck: the same failure N times since … after three, and the JSON carries since, times, stuck. The host keeps trying; stuck is what the mesh knows.

026 — a container may not mount a path the module never declared (ADR 0091)

Brought back from 53eb000, withdrawn because it refused the builder. A path is declared as the module's own (directory/file resource, or where a secret, grant or contribution lands), the operator's (accesses, ADR 0051), or the machine's (a facility a declared capability grants: container-runtime grants its socket). The check names the path and the three remedies. A new test parses every manifest in the catalogue beside the checkout; all pass.

070 — an operator delivers a pair credential (ADR 0092)

secret accept <node> <module> <name> --provider <node> seals the value to both ends and the operator key; migration 0026 gives the pair an origin. An accepted pair is not remade when a key changes (the mesh does not hold the value; the read is refused naming the remedy) and rotate refuses it (accepting a new value is the rotation).

Proven

go test ./... green with MESH_TEST_POSTGRES (all inventory tests run). Lab: assigned-tools-confluence and assigned-vault (4/4: the vault's pair credential, rotation of a made pair, operator recovery, seeded file) green against a controller image built from this branch — receipts name mesh-controller 396e05b.

Three issues, one branch, as asked. Each is its own commit and its own decision record (hq MR #64 on the same branch name). ## 065 — a failure that repeats is said to be stuck (ADR 0090) The node report kept one row per machine, replaced, so a resource nothing can ever apply looked like a failure that had just happened, every reconcile interval, for ever. Migration 0025 adds `failing_since` and `failures`; `RecordDoing` keeps them across identical reports (same outcome, refusal and failed resources), restarts on a different one, clears on a clean apply. `status` prints `stuck: the same failure N times since …` after three, and the JSON carries `since`, `times`, `stuck`. The host keeps trying; stuck is what the mesh knows. ## 026 — a container may not mount a path the module never declared (ADR 0091) Brought back from 53eb000, withdrawn because it refused the builder. A path is declared as the module's own (directory/file resource, or where a secret, grant or contribution lands), the operator's (`accesses`, ADR 0051), or the machine's (a facility a declared capability grants: `container-runtime` grants its socket). The check names the path and the three remedies. A new test parses every manifest in the catalogue beside the checkout; all pass. ## 070 — an operator delivers a pair credential (ADR 0092) `secret accept <node> <module> <name> --provider <node>` seals the value to both ends and the operator key; migration 0026 gives the pair an `origin`. An accepted pair is not remade when a key changes (the mesh does not hold the value; the read is refused naming the remedy) and `rotate` refuses it (accepting a new value is the rotation). ## Proven `go test ./...` green with `MESH_TEST_POSTGRES` (all inventory tests run). Lab: assigned-tools-confluence and assigned-vault (4/4: the vault's pair credential, rotation of a made pair, operator recovery, seeded file) green against a controller image built from this branch — receipts name mesh-controller 396e05b.

jschoubben added 3 commits 2026-09-21 15:57:47 +00:00

A failure that repeats is said to be stuck fcaad7271a

The mesh kept one report per machine, replaced, so a resource nothing can ever apply
looked like a failure that had just happened, every reconcile interval, for ever.
The row now keeps when the current failure began and how many reports in a row have
said it — the same outcome, refusal and failed resources; anything different starts
again and a clean apply clears it. Three make the machine stuck, and status says so
beside the failure, in words and in JSON (novox/hq 04-ISSUES/065, ADR 0090).

A container may not mount a path the module never declared — and three things declare one 537ad544d3

Brought back from 53eb000, withdrawn because it refused the builder's mount of the
container runtime's socket. A path is declared as the module's own (a directory or
file resource, or where a secret, grant or contribution lands), as the operator's
(an accesses entry, ADR 0051), or as the machine's (a facility a declared capability
grants: container-runtime grants its socket). Every catalogue manifest passes, and
a test says so (novox/hq 04-ISSUES/026, ADR 0091).

An operator delivers a pair credential, and the mesh never replaces it 396e05bb65

secret accept grows --provider: the value is sealed to the consumer's node, the
provider's node and the operator's key, and the pair records origin 'accepted'.
An accepted pair is not remade when a key changes (the mesh does not hold the
value; the read is refused naming the remedy) and rotate refuses it (accepting a
new value is the rotation). The vault's third species has its entry
(novox/hq 04-ISSUES/070, ADR 0092).

jschoubben added 1 commit 2026-09-21 17:23:05 +00:00

Review: a failure is the same by resource id, not by the host's words; bound files and /run/docker.sock are declared 53a79a17a1

The host's error text may carry a duration or a counter, and a resource looping on
it would never have read as stuck. The previous row is read and compared here.
Stuck needs a start to say. A container may mount the file a binding lands in; the
runtime socket is declared under both of its spellings; the catalogue-wide test
takes MESH_CATALOG.

jschoubben merged commit f3bfc11565 into main

2026-09-21 17:23:34 +00:00

jschoubben deleted branch feat/multiple-fixes

2026-09-21 17:23:34 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#37