Answer the what-if as data, let the build seat read the gate's pull keys, and prove the parts' and the gate's grants (design 47 R3d, ADR 0450) #401

Merged

mesh-tools merged 4 commits from feat/r3d-sdk-and-controller into main 2026-10-19 22:33:11 +00:00

Conversation 1 Commits 4 Files Changed 11

+993 -48

mesh-tools commented 2026-10-19 21:54:00 +00:00

Member

Copy Link

Copy Source

Design 47 release R3d, mesh-controller member of the group feat/r3d-sdk-and-controller (with mesh-sdk).

• issue 1324: plans with data: true answers the delivery's plan as data, from the same function delivery-plan uses; the text answer and delivery-plan are unchanged (ADR 0450 §2, §8).
• issue 1325: build-agent reads mesh-delivery-gate.pulls beside today's; a running check watches its pull key in every bucket that exists (ADR 0450 §1).
• issue 1243: a broker test proves the forge bridge's, the indexer's and the teller's credentials grant exactly what their manifests declare (ADR 0437 §4).
• issue 1326: a broker test proves the gate's buckets are writable by its machine's tool runner account only (ADR 0437 §3).

Found while building, not in this release: issue 1329 (the tool runner can write the parts' buckets). Tried before this pull request: build-1792446522574729445 pass. After the delivery: the build agent's credential must carry its new read (note on 1325).

Reviewed-by: review-r3d@shanks at 0aac89f4e2

Design 47 release R3d, mesh-controller member of the group feat/r3d-sdk-and-controller (with mesh-sdk). - issue 1324: `plans` with `data: true` answers the delivery's plan as data, from the same function `delivery-plan` uses; the text answer and `delivery-plan` are unchanged (ADR 0450 §2, §8). - issue 1325: build-agent reads `mesh-delivery-gate.pulls` beside today's; a running check watches its pull key in every bucket that exists (ADR 0450 §1). - issue 1243: a broker test proves the forge bridge's, the indexer's and the teller's credentials grant exactly what their manifests declare (ADR 0437 §4). - issue 1326: a broker test proves the gate's buckets are writable by its machine's tool runner account only (ADR 0437 §3). Found while building, not in this release: issue 1329 (the tool runner can write the parts' buckets). Tried before this pull request: build-1792446522574729445 pass. After the delivery: the build agent's credential must carry its new read (note on 1325). Reviewed-by: review-r3d@shanks at 0aac89f4e22cb986ef1d2af10290ccf890db4331

mesh-tools added 4 commits 2026-10-19 21:54:00 +00:00

Answer plans what-if as data, the document delivery-plan answers (issue 1324) ... 23a209f3d0

The gate reads a delivery's plan as data once delivery-plan goes (ADR 0450 §2). The data form is an explicit
switch, `data: true`, as plans wait asks for its data: a person still gets the text. Both verbs build their
document from one function, deliveryPlanDocument, so they cannot differ; delivery-plan is unchanged (ADR 0450 §8).

Let the build agent read the gate's pull keys and watch both buckets (issue 1325) ... 4083755ca1

From R3e the gate writes mesh-delivery-gate_pulls and today's bucket stops (ADR 0450 §1). The build agent's manifest
reads both, and a running check's watch listens in every bucket that exists, so a move is heard whichever holds the key.

Test that the forge bridge's, indexer's and teller's credentials grant exactly their manifests (issue 1243) ... d8c13d97ca

ADR 0437 §4's check: the three manifests, copied from mesh-delivery's main, are composed through Users and
PermissionsFor; each may do what it declares and is refused another module's bucket, another module's name and a seat's
verb subject.

Test that the gate's buckets are writable by its machine's tool runner account only (issue 1326) ... 0aac89f4e2

ADR 0437 §3's check: the gate, written in the test as the clause declares it, is composed with the parts and the view
through Users; its seven buckets are writable by its machine's tool runner and by no other account, and each part
reads only the gate buckets its manifest declares.

mesh-tools commented 2026-10-19 21:54:06 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-controller@0aac89f4e22c — failed since 2026-10-19T22:48:50Z

Covered: covered after its failure: a later walk that contains it was delivered: plan-1792449194411267197 (novox/mesh-controller at 1f708e2d into main, done, contains its merge 1f708e2d)

Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step

• tier 0: mesh-controller
• tier 1: build-agent
• ace: receives build-agent
• g14: receives build-agent
• novox: receives mesh-controller, build-agent
• shanks: receives build-agent
• build-agent keeps data (ADR 0233): what it holds is backed up before it moves
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine

Group feat/r3d-sdk-and-controller: novox/mesh-controller@0aac89f4e2, novox/mesh-sdk@2f1454699a

• composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Machines

• mesh-controller on every machine running it: sent
• mesh-sdk on every machine running it: sent
• build-agent on every machine running it: sent
• mesh-tools on every machine running it: sent
• audit-logger on every machine running it: sent
• confluence on every machine running it: sent
• gitlab on every machine running it: sent
• jira on every machine running it: sent
• mesh-catalog on every machine running it: sent
• model-usage on every machine running it: sent
• openai-consumer on every machine running it: sent
• route-adapter on every machine running it: sent
• showcase on every machine running it: sent

Transitions

• 2026-10-19 21:54 (new) → proposed (announced): novox/mesh-controller#401's head announced
• 2026-10-19 21:59 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-19 21:59 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-19 22:34 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-19 22:34 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-19 22:48 delivering → failed (failed): its walk failed, carrying its own commit: a gate on a first machine (what it carried put back), a build, a machine

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@0aac89f4e22c` — **failed** since 2026-10-19T22:48:50Z **Covered**: covered after its failure: a later walk that contains it was delivered: plan-1792449194411267197 (novox/mesh-controller at 1f708e2d into main, done, contains its merge 1f708e2d) **Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - ace: receives build-agent - g14: receives build-agent - novox: receives mesh-controller, build-agent - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine **Group** `feat/r3d-sdk-and-controller`: novox/mesh-controller@0aac89f4e22c, novox/mesh-sdk@2f1454699a49 - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - mesh-controller on every machine running it: sent - mesh-sdk on every machine running it: sent - build-agent on every machine running it: sent - mesh-tools on every machine running it: sent - audit-logger on every machine running it: sent - confluence on every machine running it: sent - gitlab on every machine running it: sent - jira on every machine running it: sent - mesh-catalog on every machine running it: sent - model-usage on every machine running it: sent - openai-consumer on every machine running it: sent - route-adapter on every machine running it: sent - showcase on every machine running it: sent **Transitions** - 2026-10-19 21:54 (new) → proposed (announced): novox/mesh-controller#401's head announced - 2026-10-19 21:59 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-19 21:59 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-19 22:34 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-19 22:34 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-19 22:48 delivering → failed (failed): its walk failed, carrying its own commit: a gate on a first machine (what it carried put back), a build, a machine The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools merged commit 1f708e2d8d into main 2026-10-19 22:33:11 +00:00

mesh-tools deleted branch feat/r3d-sdk-and-controller 2026-10-19 22:33:11 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#401