Release 1 of feature mail-sender (hq ADR 0436 clauses 1, 2, 3, 5, 6 and the owner of §7). Fixes hq issues 1170, 1177, 1179, 1178, 1180, 1181 (1170 split into six).
1170: an own secret may name its owner (a user its module makes; never root or the operator account), composed onto the wire File's existing owner; placedManifest no longer drops an own secret's owner and prompt.
1177: a module stream may declare retention work-queue, max-deliveries (1-10) and duplicates (hours, at most its age): work-queue retention, discard new, the duplicate window; refusals.
1179: a process may declare bus {emits, queues, state, asks, invokes}; refusals (no own account, another module's names, serves/holds/claims/seat); bus never reaches the node-engine's declaration (no node-engine release).
1178: exactly one durable consumer per work-queue stream, also for a module the runtime carries; refusals; its dead letters restricted and drop-only, decided by a mesh-work-queue metadata key set only for a declared module work-queue stream, so SEAT_* work queues keep delivering dead asks again.
1180: KindProcess, account .. granted exactly its declaration and its inbox, invokes on the caller-named subject; grant test: no process account answers a call or verb, publishes a warrant, holds a seat or hears a restricted stream; other principals unchanged.
1181: module issue (and rollout mint) mints and delivers broker- to the module's own secret and the vault; acceptance test on a real bus and store: the minted account consumes its queue, emits, uses its state, calls operator-channel.tell, and is refused answering a tool or publishing a warrant.
Try: build-1792373811608004442 passed (5m7s; unit 2351 tests 2.85 s). The first try (d8249dad) found a regression the review had not: drop-only keyed on the bus retention, which SEAT_* streams share; fixed in 1991fe93.
Delivery: moves mesh-controller (novox). Nothing reaches a machine's files until a manifest declares a bus process (release 3, mesh-mail).
Reviewed-by: review-ctl-mail-sender@g14 at 4104d49ec8
Release 1 of feature mail-sender (hq ADR 0436 clauses 1, 2, 3, 5, 6 and the owner of §7). Fixes hq issues 1170, 1177, 1179, 1178, 1180, 1181 (1170 split into six).
- 1170: an own secret may name its owner (a user its module makes; never root or the operator account), composed onto the wire File's existing owner; placedManifest no longer drops an own secret's owner and prompt.
- 1177: a module stream may declare retention work-queue, max-deliveries (1-10) and duplicates (hours, at most its age): work-queue retention, discard new, the duplicate window; refusals.
- 1179: a process may declare bus {emits, queues, state, asks, invokes}; refusals (no own account, another module's names, serves/holds/claims/seat); bus never reaches the node-engine's declaration (no node-engine release).
- 1178: exactly one durable consumer <machine>_<module>_<process id> per work-queue stream, also for a module the runtime carries; refusals; its dead letters restricted and drop-only, decided by a mesh-work-queue metadata key set only for a declared module work-queue stream, so SEAT_* work queues keep delivering dead asks again.
- 1180: KindProcess, account <machine>.<module>.<process id> granted exactly its declaration and its inbox, invokes on the caller-named subject; grant test: no process account answers a call or verb, publishes a warrant, holds a seat or hears a restricted stream; other principals unchanged.
- 1181: module issue (and rollout mint) mints and delivers broker-<process id> to the module's own secret and the vault; acceptance test on a real bus and store: the minted account consumes its queue, emits, uses its state, calls operator-channel.tell, and is refused answering a tool or publishing a warrant.
Try: build-1792373811608004442 passed (5m7s; unit 2351 tests 2.85 s). The first try (d8249dad) found a regression the review had not: drop-only keyed on the bus retention, which SEAT_* streams share; fixed in 1991fe93.
Delivery: moves mesh-controller (novox). Nothing reaches a machine's files until a manifest declares a bus process (release 3, mesh-mail).
Reviewed-by: review-ctl-mail-sender@g14 at 4104d49ec8b9f6b3f78956a70069a6b1adc5d587
mayIssue no longer requires a module's own broker secret when one of its
processes declares bus: mesh-mail's real manifest has none, its tools
served by the tool runner. rollout mint gained a KindProcess case, so a
process's account rotates the same way every other bus account does. The
release's acceptance test now composes its principals the real way
(inventory.ProcessesOf -> broker.Users -> broker.ComposeAccounts), mints
through the store as module issue does, and sets each connection's own
inbox prefix so replies are not refused; it moved from internal/broker
(which cannot import inventory) to cmd/mesh-controller. Added an
integration test proving the mint, accept and vault hand-off, and that
issuing again rotates the password.
ConsumersOf's carried-module path (a module the tool runner carries, no
account of its own — mesh-mail's real shape) was not passing Queues
through, so its work-queue consumer was missing from the composed list
and PruneHeard would have removed what issueProcess made for it. Fixed,
with a test through Users -> ConsumersOf.
Extracted EnsureStream's config building into StreamConfigFor, a pure
function, so the dead-letters test can assert the restricted metadata
EnsureStream would actually send for a work-queue stream instead of
setting the dead letter's header by hand, which passed whether or not
modstreams.go's out.Restricted = true was there at all.
Step 3 published mesh.stream.mesh-mail.event.mail.send.approved on the
controller's connection, which the controller is never granted. Added
the runtime module to the fixture's assigned set, gave mesh-mail its
Streams so the carried-module path grants ownStreamGrants, minted the
runtime's password through aMesh like the other principals, and publish
over that connection with its own inbox prefix.
sourceAge keyed AgainTo's clause-6 refusal on the stream's bus retention
policy, which SEAT_* and other mesh-internal work queues share without
being one of ADR 0436 §6's module streams — so every seat's ask, once
given up on, was refused delivery again. Added a dedicated metadata key
(WorkQueueMetadata), set only by ModuleStream.Stream() when the
catalogue declared retention: work-queue, and read sourceAge from that
instead of the stream's retention policy. New test proves a seat's own
work queue carries neither that metadata nor the restricted one.
The test set MESH_BROKER_ADDRESS to a literal and asserted it, but
issueOnTheNewBus works out the machine's reachable address from the
catalogue's network records, not from this process's environment — the
real try found a different, correct address. Calls issueProcess
directly now, with a known broker and reachable address of its own
choosing, exactly as issued_to_vault_test.go calls issueWith and
issueProvisionerClient directly; the asserted url is that same input.
No production code changed — issueOnTheNewBus reads the right address.
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine
Machines
mesh-controller on every machine running it: sent
route-proxy on every machine running it: sent
build-agent on every machine running it: sent
Transitions
2026-10-19 01:42 (new) → proposed (announced): novox/mesh-controller#390's head announced
2026-10-19 01:49 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-19 01:49 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-19 02:01 ready → proposed (trunk moved): out of date: judged against trunk 89cfa9431d, the trunk is now 1490c3b0756a; judged again on a recheck or when it is merged
2026-10-19 02:07 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-19 02:07 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-19 02:08 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-19 02:08 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-19 02:18 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-controller@4104d49ec8b9` — **delivered** since 2026-10-19T02:18:28Z
**Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller, route-proxy
- tier 1: build-agent
- ace: receives route-proxy, build-agent
- g14: receives build-agent
- novox: receives mesh-controller, route-proxy, build-agent
- shanks: receives build-agent
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine
**Machines**
- mesh-controller on every machine running it: sent
- route-proxy on every machine running it: sent
- build-agent on every machine running it: sent
**Transitions**
- 2026-10-19 01:42 (new) → proposed (announced): novox/mesh-controller#390's head announced
- 2026-10-19 01:49 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
- 2026-10-19 01:49 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-19 02:01 ready → proposed (trunk moved): out of date: judged against trunk 89cfa9431d8f, the trunk is now 1490c3b0756a; judged again on a recheck or when it is merged
- 2026-10-19 02:07 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
- 2026-10-19 02:07 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-19 02:08 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-19 02:08 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
- 2026-10-19 02:18 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine
read by no module's build: cmd/mesh-controller/process_issue_integration_test.go, cmd/mesh-controller/process_issue_test.go, cmd/mesh-controller/process_live_test.go, internal/broker/modstream_work_queue_test.go, internal/broker/modstreams_workqueue_integration_test.go, internal/broker/process_grants_test.go, internal/catalogue/own_secret_owner_test.go, internal/catalogue/process_bus_test.go, internal/catalogue/stream_work_queue_test.go, internal/catalogue/work_queue_consumer_test.go, internal/inventory/streams_test.go, internal/link/deadletters_work_queue_test.go
Run by the build seat on ace as build-1792374145403651736 (builds --log build-1792374145403651736).
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine
read by no module's build: cmd/mesh-controller/process_issue_integration_test.go, cmd/mesh-controller/process_issue_test.go, cmd/mesh-controller/process_live_test.go, internal/broker/modstream_work_queue_test.go, internal/broker/modstreams_workqueue_integration_test.go, internal/broker/process_grants_test.go, internal/catalogue/own_secret_owner_test.go, internal/catalogue/process_bus_test.go, internal/catalogue/stream_work_queue_test.go, internal/catalogue/work_queue_consumer_test.go, internal/inventory/streams_test.go, internal/link/deadletters_work_queue_test.go
Run by the build seat on ace as build-1792375277867463406 (builds --log build-1792375277867463406).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Release 1 of feature mail-sender (hq ADR 0436 clauses 1, 2, 3, 5, 6 and the owner of §7). Fixes hq issues 1170, 1177, 1179, 1178, 1180, 1181 (1170 split into six).
Try: build-1792373811608004442 passed (5m7s; unit 2351 tests 2.85 s). The first try (
d8249dad) found a regression the review had not: drop-only keyed on the bus retention, which SEAT_* streams share; fixed in1991fe93.Delivery: moves mesh-controller (novox). Nothing reaches a machine's files until a manifest declares a bus process (release 3, mesh-mail).
Reviewed-by: review-ctl-mail-sender@g14 at
4104d49ec8Delivery
novox/mesh-controller@4104d49ec8b9— delivered since 2026-10-19T02:18:28ZDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Machines
Transitions
89cfa9431d, the trunk is now 1490c3b0756a; judged again on a recheck or when it is mergedThe commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
4104d49eJudged: head
4104d49ec8b9merged into trunk89cfa9431d8f; read beside it: mesh-catalogb4527d9091e9, mesh-controller-main89cfa9431d8f, mesh-host89025ad004d4, mesh-tools7412c5b6c9c5mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1792374145403651736(builds --log build-1792374145403651736).Merge check at
4104d49eJudged: head
4104d49ec8b9merged into trunk1490c3b0756a; read beside it: mesh-catalogb4527d9091e9, mesh-controller-main1490c3b0756a, mesh-host89025ad004d4, mesh-tools7412c5b6c9c5mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1792375277867463406(builds --log build-1792375277867463406).