R4g+R5 (mesh-controller): the controller asks no build, build-agent and the merge gate go, register by reference (design 47) #448

Merged

jschoubben merged 38 commits from feat/r4g into main 2026-10-23 17:50:22 +00:00

Conversation 1 Commits 38 Files Changed 829

+18335 -47870

mesh-tools commented 2026-10-23 15:00:58 +00:00

Member

Copy Link

Copy Source

Design 47's last milestone, R4g+R5, one delivery group on feat/r4g.

• build-agent, cmd/mesh-builder, internal/builder, the build queue and its hold, the merge gate and replays deleted; every plan module taken from the builder's done key (issue 1851, issue 1299, issue 1318, issue 1294).
• The catalogue repository found in the take-in by either form of its address; a lookup error fails the plan loudly (issue 1902).
• register --reference at the terminal, recorded as a build and a hand act (issue 1888; ADR 0526).
• Broker: one worker per kind for the build seats, capped deliveries, named grants for the builder, view and asks (issue 1887, issue 1907); the controller's grant keys (issue 1394).
• Registration trusts a trunk that requires no status (ADR 0534 §6).
• vendor/ kept, regenerated: R4g's tier 0 is built offline by today's build-agent; it goes after the delivery (issue 1305 noted; ADR 0538).
• The catalogue agreement tests set aside, and say, a consume of a retired seat's event: the check judges against the catalogue's trunk (ADR 0484 clause 4), which still consumes the build seats this group retires (ADR 0524 §5) until mesh-catalog #464 merges.

Reviewed-by: review-r4g-2@shanks at c9a7102bc5
Pushed-by: lead-47@shanks

Design 47's last milestone, R4g+R5, one delivery group on feat/r4g. - build-agent, cmd/mesh-builder, internal/builder, the build queue and its hold, the merge gate and replays deleted; every plan module taken from the builder's done key (issue 1851, issue 1299, issue 1318, issue 1294). - The catalogue repository found in the take-in by either form of its address; a lookup error fails the plan loudly (issue 1902). - `register --reference` at the terminal, recorded as a build and a hand act (issue 1888; ADR 0526). - Broker: one worker per kind for the build seats, capped deliveries, named grants for the builder, view and asks (issue 1887, issue 1907); the controller's grant keys (issue 1394). - Registration trusts a trunk that requires no status (ADR 0534 §6). - vendor/ kept, regenerated: R4g's tier 0 is built offline by today's build-agent; it goes after the delivery (issue 1305 noted; ADR 0538). - The catalogue agreement tests set aside, and say, a consume of a retired seat's event: the check judges against the catalogue's trunk (ADR 0484 clause 4), which still consumes the build seats this group retires (ADR 0524 §5) until mesh-catalog #464 merges. Reviewed-by: review-r4g-2@shanks at c9a7102bc53bac96b55a3336da380db07514f396 Pushed-by: lead-47@shanks

mesh-tools added 32 commits 2026-10-23 15:00:59 +00:00

Move the Go build source reader out of internal/builder so the builder can go (issue 1851, C1a) b506852388

Drop the toolchain image from the facts and the dependency edges: no module is compiled in one any more (issue 1851, C1b) 526eed99fa

Delete the build-agent module and the builder program: the build module builds, the checker checks (issue 1851, C2a) 72186815e3

Register a module at artifacts the store holds, by hand, recorded as a build and a hand act, so the controller can be delivered without the builder (issue 1888, C8a and C8b) 505694c424

Delete merge-check.sh, check-nested-modules.sh, the store-tests list and RELEASE-57: the checker runs the build module's steps, nested modules by convention (issue 1294, C7a and C7b) 6300a5b31c

Delete vendor/ and the route proxy's: the build module fetches the modules, the root image builds with -mod=mod (issue 1305, C6) 9c4bf1f08b

Declare the controller's grants bucket, written by the controller alone and readable through mesh-controller.grants, so the assigner can read its sixth rule's key (issue 1394, subtask C9a; ADR 0528 clause 2); the SDK pin moves to the layouts' commit, captured beside 548681cc4e

Write grants.<module>.<fp> once the bus's user list carrying a module's manifest at that fingerprint is sent, so the assigner's sixth rule reads that its credential exists (issue 1394, subtask C9b; ADR 0528 clause 2, ADR 0429 §6) c43883910d

Derive a worker per kind for the build seats and grant their users to put asks, so a build node pulls delivery, check and recheck in order and a session cannot ask (issue 1887 A6, ADR 0525 §2) 5ca4f14479

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10) ... e419d0182f

The controller asks no build of anybody (ADR 0501 §5, ADR 0525 clause 6, ADR 0503 §3). Every module of a walk is taken from the
builder's done key; a key not done yet waits, named in the plan, and never fails it.

- C2b/C2c: internal/builder and cmd/mesh-controller's asks go (askABuild, onlyTheBuildersOwn, buildOneAsked, takeIn from an
  outcome, buildAgentsOwn, the builder's say and its fallback, the daemon hearing an outcome). The server follows the retired
  seats' built subjects only to let go of them, because the installer's carried user list names them.
- C2d: replay, queue, cancel, clear, kill, pause, resume, delivery-check, check-here and merge-gate are refused by name.
- C3: the check queues (CHECKS_READY, CHECKS_OTHER) and their workers, the checks-running and plans-building buckets and
  their grants, the build queue and its hold (plans_building.go, queue.go, link/holds.go, builds_nats.go, checks_nats.go).
- C4: merge_gate*.go, the pull request's repo-check path, the Checked event and its layers; a pull request asks the
  controller nothing but to tell mesh-config what its head declares.
- C5: the builds bucket is written only by key_takein.
- C10 (help and refusals): the terminal's help lists only what is served.

Integration tests of the plan's tiers, sends, stops and retries now run on a stand-in builder with a done key for every
module (walk_keys_scaffold_integration_test.go); the tests of the asks, the queue, the merge gate and the replays are deleted.

Find the catalogue's repository by its URL or seat source, and fail a plan whose catalogue repository is nowhere, so a take-in from a key no longer waits for ever (issue 1902) 5540fd4f85

Merge feat/r4g-assigner into feat/r4g: lane B's grants bucket and its writer beside lane C's deletions ... eb8286fc68

The controller's readable states, its bucket lists and the composed golden file keep lane C's removal of the
checks-running and plans-building buckets and the build agent's check subjects, and add lane B's grants bucket.

Pin mesh-sdk at feat/r4g's head c3915ffb, the merge of lane B's layouts, so every r4g module builds against one SDK ... 2e36a63096

go.sum gains its lines from go mod tidy once mesh-sdk feat/r4g is pushed.

Test that the builder, a build module and the controller are taken from the builder's keys and nothing reaches node-build-agent (issue 1851, C2 criterion) dec3b83e66

Test that the builder's record names its key and fingerprint after a plan that moves it (issue 1851, C5 criterion) d9cdb3615d

Write the hand act of register --reference after the registration was made, not before, and test the why and the record (issue 1888, C8b) 2db5dcdcb4

Prove the grant through the send of the bus's machine (overTheBus.declare), so removing the write from the live path fails the test (issue 1394, review round 1 item 4) f60c742d93

Take the controller's publish grants on node-build-agent and mesh-build-machine away, with the cancelled sets and the redelivery of its own asks: it asks no build seat (ADR 0525 §10, C3a) df70ca43a7

Merge branch 'feat/r4g-assigner' into feat/r4g d7d70cd539

Merge branch 'feat/r4g-asks' into feat/r4g 5b5cd6160a

Pin mesh-sdk at feat/r4g's head 9205222a, the merge of lanes A, B, S8 and F1, and capture its conformance events there ... 68c1220e87

go.sum gains its lines from go mod tidy once mesh-sdk feat/r4g is pushed.

Capture mesh-catalog at feat/r4g (2246ccc4) with the templates its manifests name and its predefined.json, and lay the copy out as a repository's root ... 5ccc87f4d0

The catalogue's manifests moved their content into template files and fall back to predefined keys, so a copy of
module.json alone no longer passes the catalogue's own check; the bus's Dockerfile is gone from the catalogue.

Record the checksums of mesh-sdk feat/r4g 9205222a for the group's modules (R4g) 24ad859629

Grant the watchman the build seats' accept subjects and the view the seat workers' information, each by name, so the backlog and the waiting-ask pulse read live (issue 1887 A8) bb0d5e17db

Fix the view grant test's consumer subjects (issue 1887 A8) 3c247e80af

Prove the registration by hand reads back as a build and is held by the sweep, and name the store check as the test's limit (issue 1888, C8b) ef211faefb

Take the watchman's grant on the build seats back: a waiting ask has no pulse, a taken one is read from the steps (issue 1908) ff543d3def

Revert "Delete vendor/ and the route proxy's: the build module fetches the modules, the root image builds with -mod=mod (issue 1305, C6)" ... c5b8fca8bd

This reverts commit 9c4bf1f08b.

Vendor the dependencies again for R4g's go.mod (mesh-sdk 9205222a, the mesh-host replace as before), so build-agent compiles the controller offline in the group's first tier (issue 1305) 9222575ae9

Bound the build seats' workers' deliveries, so an ask no run ends is offered at most five times even when the holder that says it is poison dies too (issue 1907) 758c8e84e5

Pin mesh-sdk at feat/r4g's head a9560890, re-vendor it and capture its conformance events there (R4g) 4238318601

Grant the builder the build seats' streams' information and messages by name, so its take-over at start can tell an ask its key names is on its stream (issue 1910) 13842a7234

mesh-tools commented 2026-10-23 15:01:12 +00:00

Author

Member

Copy Link

Copy Source

Delivery novox/mesh-controller@c9a7102bc53b — failed since 2026-10-23T17:59:26Z

Delivery plan — builds build-agent, mesh-controller → novox; no bus step

• tier 0: mesh-controller
• novox: receives mesh-controller

Group feat/r4g: novox/hq@e8bd9171cd, novox/mesh-catalog@454fb8a918, novox/mesh-controller@c9a7102bc5, novox/mesh-delivery@b2c545c40a, novox/mesh-host@4b4bb09a05, novox/mesh-lab@4653b17e18, novox/mesh-media-catalog@f4f0bbcfe5, novox/mesh-sdk@a2c813a6b4, novox/mesh-tools-go@5023de36fd, novox/mesh-tools@860043fd7f, novox/okioki@e67d21e8b4

Transitions

• 2026-10-23 16:06 (new) → proposed (announced): novox/mesh-controller#448's head announced
• 2026-10-23 16:14 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-23 16:14 checked → rejected (refused): the gate failed or could not run, or the repository's own check failed
• 2026-10-23 17:50 rejected → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on
• 2026-10-23 17:55 held → delivering (go): its walk started on a word that was not this owner's: the controller's own path, which waits for nobody, or a person's plans go
• 2026-10-23 17:59 delivering → failed (failed): its walk failed, carrying its own commit: a gate on a first machine (what it carried put back), a build, a machine

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@c9a7102bc53b` — **failed** since 2026-10-23T17:59:26Z **Delivery plan** — builds build-agent, mesh-controller → novox; no bus step - tier 0: mesh-controller - novox: receives mesh-controller **Group** `feat/r4g`: novox/hq@e8bd9171cdbc, novox/mesh-catalog@454fb8a918ad, novox/mesh-controller@c9a7102bc53b, novox/mesh-delivery@b2c545c40aec, novox/mesh-host@4b4bb09a05a0, novox/mesh-lab@4653b17e18a7, novox/mesh-media-catalog@f4f0bbcfe59c, novox/mesh-sdk@a2c813a6b468, novox/mesh-tools-go@5023de36fded, novox/mesh-tools@860043fd7fa0, novox/okioki@e67d21e8b448 **Transitions** - 2026-10-23 16:06 (new) → proposed (announced): novox/mesh-controller#448's head announced - 2026-10-23 16:14 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-23 16:14 checked → rejected (refused): the gate failed or could not run, or the repository's own check failed - 2026-10-23 17:50 rejected → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on - 2026-10-23 17:55 held → delivering (go): its walk started on a word that was not this owner's: the controller's own path, which waits for nobody, or a person's `plans go` - 2026-10-23 17:59 delivering → failed (failed): its walk failed, carrying its own commit: a gate on a first machine (what it carried put back), a build, a machine The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben added 1 commit 2026-10-23 15:06:10 +00:00

Pin mesh-sdk at feat/r4g's head a2c813a6, its test fixture fix, with go.sum tidied b345d10bec

jschoubben added 4 commits 2026-10-23 15:19:42 +00:00

Trust a module's trunk for who can merge into it, not for a required status (ADR 0534 §6) ... 7676e67c5e

The forge requires no status to merge any more (ADR 0534 §1); a trunk is
trusted when it takes no push, its merge whitelist names mesh-tools alone and
no administrator merges past its rule, so only mesh-delivery lands a commit
there, on a passing mesh/check and the operator's Approve. The old rule failed
the 11:51 delivery plan once mesh-catalog's status was unticked.

Trust a trunk whose whitelist adds the operator's own login, never an agent's (ADR 0534 §2, §6) ... b2af3d654f

The gitea module keeps the operator's login beside mesh-tools on every main so
the operator can merge by hand; an agent's account there is still refused.

Merge remote-tracking branch 'origin/fix/forge-requires-no-status' into feat/r4g 9d2a9e62d1

Say the trunk rule as ADR 0534 §6 has it in the registration's comment 67279199e9

jschoubben added 1 commit 2026-10-23 16:06:41 +00:00

Set aside a retired seat's consume the trunk catalogue still holds, and say it, so a group that retires a seat passes its check c9a7102bc5

jschoubben merged commit 5831eec770 into main 2026-10-23 17:50:22 +00:00

jschoubben deleted branch feat/r4g 2026-10-23 17:50:23 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#448