Issue 1329 (a fault against ADR 0436 §1 and ADR 0437 §4): every module without runs-as was carried by its machine's tool runner, which was then granted its buckets, streams, consumers and seat traffic. On novox the runner could write the teller's answers, the forge bridge's and the indexer's keys and the watchman's, and raise asks as mesh-delivery-teller.
internal/broker/users.go: a module is carried only when the runner serves something of it: the runtime module, a module with no account of its own, tools, a bundle the runtime loads (route-proxy's helper), a held seat, waits or a check.
Dropped from the runner: mesh-delivery-forge-bridge, -indexer, -teller, -watchman, -view (each keeps its own credential's grants). route-proxy stays carried (its loaded helper writes on the runner's account).
Tests: TestTheToolRunnerCarriesNoneOfTheDeliverysParts (manifests copied from mesh-delivery main 9c15112d), TestTheToolRunnerStillCarriesAModuleWithToolsAndItsOwnCredential, TestTheToolRunnerStillCarriesAModuleWhoseBundleItLoads; the gate's grant test no longer lets the runner write the teller's answers.
Issue 1338: the rollout tests wait for the plan look to return before their cleanups restore what it reads (a race that failed this branch's first try).
Live after delivery (1329/AC4): nats.nats_users shows novox.node-tools with no grant on KV_mesh-delivery-teller_answers; the parts keep running. Tried: build-1792452314954595620 pass (full suite).
Issue 1329 (a fault against ADR 0436 §1 and ADR 0437 §4): every module without runs-as was carried by its machine's tool runner, which was then granted its buckets, streams, consumers and seat traffic. On novox the runner could write the teller's answers, the forge bridge's and the indexer's keys and the watchman's, and raise asks as mesh-delivery-teller.
- internal/broker/users.go: a module is carried only when the runner serves something of it: the runtime module, a module with no account of its own, tools, a bundle the runtime loads (route-proxy's helper), a held seat, waits or a check.
- Dropped from the runner: mesh-delivery-forge-bridge, -indexer, -teller, -watchman, -view (each keeps its own credential's grants). route-proxy stays carried (its loaded helper writes on the runner's account).
- Tests: TestTheToolRunnerCarriesNoneOfTheDeliverysParts (manifests copied from mesh-delivery main 9c15112d), TestTheToolRunnerStillCarriesAModuleWithToolsAndItsOwnCredential, TestTheToolRunnerStillCarriesAModuleWhoseBundleItLoads; the gate's grant test no longer lets the runner write the teller's answers.
- Issue 1338: the rollout tests wait for the plan look to return before their cleanups restore what it reads (a race that failed this branch's first try).
Live after delivery (1329/AC4): nats.nats_users shows novox.node-tools with no grant on KV_mesh-delivery-teller_answers; the parts keep running. Tried: build-1792452314954595620 pass (full suite).
Reviewed-by: review-1329@shanks at c07f604047be28350792ffed1a3ffb49237a3480
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine
Machines
mesh-controller on every machine running it: sent
route-proxy on every machine running it: sent
build-agent on every machine running it: sent
Transitions
2026-10-19 23:31 (new) → proposed (announced): novox/mesh-controller#404's head announced
2026-10-19 23:38 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-19 23:38 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-19 23:41 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-19 23:41 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-19 23:50 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-controller@c07f604047be` — **delivered** since 2026-10-19T23:50:46Z
**Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller, route-proxy
- tier 1: build-agent
- ace: receives route-proxy, build-agent
- g14: receives build-agent
- novox: receives mesh-controller, route-proxy, build-agent
- shanks: receives build-agent
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine
**Machines**
- mesh-controller on every machine running it: sent
- route-proxy on every machine running it: sent
- build-agent on every machine running it: sent
**Transitions**
- 2026-10-19 23:31 (new) → proposed (announced): novox/mesh-controller#404's head announced
- 2026-10-19 23:38 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
- 2026-10-19 23:38 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-19 23:41 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-19 23:41 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
- 2026-10-19 23:50 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before route-proxy, build-agent is judged on its first machine
read by no module's build: cmd/mesh-controller/away_integration_test.go, cmd/mesh-controller/rollout_events_test.go, cmd/mesh-controller/silent_mid_tier_integration_test.go, internal/broker/delivery_gate_grant_test.go, internal/broker/delivery_parts_grant_test.go, internal/broker/modstreams_test.go
Run by the build seat on shanks as build-1792452671800714772 (builds --log build-1792452671800714772).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Issue 1329 (a fault against ADR 0436 §1 and ADR 0437 §4): every module without runs-as was carried by its machine's tool runner, which was then granted its buckets, streams, consumers and seat traffic. On novox the runner could write the teller's answers, the forge bridge's and the indexer's keys and the watchman's, and raise asks as mesh-delivery-teller.
Live after delivery (1329/AC4): nats.nats_users shows novox.node-tools with no grant on KV_mesh-delivery-teller_answers; the parts keep running. Tried: build-1792452314954595620 pass (full suite).
Reviewed-by: review-1329@shanks at
c07f604047Delivery
novox/mesh-controller@c07f604047be— delivered since 2026-10-19T23:50:46ZDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
c07f6040Judged: head
c07f604047bemerged into trunk70cb217601f9; read beside it: mesh-catalogc0880c4dc271, mesh-controller-main70cb217601f9, mesh-host2474bf28330f, mesh-tools7412c5b6c9c5mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1792452671800714772(builds --log build-1792452671800714772).