R6: the controller writes signed per-node compositions and their digests; plans, pushes and their verbs go (issue 1945) #457

2026-10-24T22:17:20Z

mesh-tools commented

2026-10-24 22:17:20 +00:00

The controller of release 6 (issue 1945): compositions are written per module per node as keys with their digest and move judgement, and signed; credentials and grants.<module>.<fp> are written when a module's newest build is done, not at a send; the bus's user list travels as a composition change; placement stays in assignments. Plans, batches, the merge window, tiers, the plan and node holds, backups before a send, retries, healers and the verbs plans, plan, push, deliver, delivery-stop, delivery-backups-again, delivery-walks and delivery-order are deleted. The bus step stays as a person's step that writes a want.

Tries: try-1792879572084166563 passed on 9c38aed7.

Delivery group feat/r6 (design 47, milestone R6; ADR 0539, ADR 0540): mesh-sdk, mesh-host, mesh-delivery, mesh-catalog, hq, mesh-controller. One Approve for the group; its delivery is the last delivery plan the controller runs, and after it a merged change reaches each machine through its wants alone.

After the delivery: the operator's signing key is set as mesh-host's operator-signers setting, and acceptance test 18 is read live.

Release-switch: 6
Reviewed-by: reviewer-r6m@shanks at 9c38aed789
Pushed-by: lead-47@shanks

The controller of release 6 (issue 1945): compositions are written per module per node as keys with their digest and move judgement, and signed; credentials and `grants.<module>.<fp>` are written when a module's newest build is done, not at a send; the bus's user list travels as a composition change; placement stays in assignments. Plans, batches, the merge window, tiers, the plan and node holds, backups before a send, retries, healers and the verbs `plans`, `plan`, `push`, `deliver`, `delivery-stop`, `delivery-backups-again`, `delivery-walks` and `delivery-order` are deleted. The bus step stays as a person's step that writes a want. Tries: try-1792879572084166563 passed on 9c38aed7. Delivery group feat/r6 (design 47, milestone R6; ADR 0539, ADR 0540): mesh-sdk, mesh-host, mesh-delivery, mesh-catalog, hq, mesh-controller. One Approve for the group; its delivery is the last delivery plan the controller runs, and after it a merged change reaches each machine through its wants alone. After the delivery: the operator's signing key is set as mesh-host's operator-signers setting, and acceptance test 18 is read live. Release-switch: 6 Reviewed-by: reviewer-r6m@shanks at 9c38aed7890532e6f2e8e24418b640f1df6faeb7 Pushed-by: lead-47@shanks

mesh-tools added 67 commits 2026-10-24 22:17:20 +00:00

Delete the controller's plan machinery: plans, batches, merge window, tiers, gate, retry and healers H1 and H2 (release 6, issue 1945 B7) dc456d5660

Pin mesh-sdk to release 6's head, with its compositions, wants by digest and removed plan verbs (issue 1945) 96d7784bce

Drop the plan state from the store and the assignments: migration 0108 and placement-only assignments (release 6, issue 1945 B9, B4) 788fb681ec

Answer the verbs release 6 removed by name, and drop the merge window and push settings from the manifest (release 6, issue 1945 B10) 4f95be7e08

Write each module's composition per node, signed, with its digest and the move's judgement beside it (issue 1945, B1) aee0a2718f

Every act that sent a declaration now writes compositions instead, by compare-and-set under the lease, and a
module's compositions are kept for its five newest fingerprints and whatever its want or have names (ADR 0539
clauses 1 to 5 and 14). A module the mesh provides itself, which no want can name, rides in the node's own.

Take the removed release 6 verbs out of the schema test's flag checks 0f8c47842a

Compose where a declaration was sent: secrets, credentials, acceptances, the hub's peers, adoption, assignments and the bus's user list (issue 1945, B2, B6) c40e15268e

Each act that changed what a node runs now writes that node's compositions, and its wants follow by the assigner's
rules; a bus upgrade composes the bus's machines and answers the want the operator writes, since the assigner never
moves the bus (ADR 0539 clauses 5, 7 and 15). A node-engine may ask its own backup holder before a data module moves.

Take a registered module's new done key in, compose it and grant it; at start delete the plans' buckets and compose every node and the replaced controller (issue 1945, B3, B5, B13) 66650e315c

With no plan left to take a done key in, a write of the builder's keys registers the new fingerprint, composes the
module's nodes and the bus's user list, and writes its grant, so the assigner's rules can name it (ADR 0539 clauses
5 and 7). The new controller composes every node at its start, and the controller it replaced at its own
fingerprint, the operator's way back (clause 10); the merge window's, silent sends' and building plans' buckets are
no longer asserted and are deleted once, each said as the event bucket-deleted (clause 13). The assigner may read
the compositions' digests, and a node-engine hears its backup holder's backed-up.

Delete the push and the declaration: the send stub and node holds, link declare and its order, the sent readers, and the sweep judged by compositions (release 6, issue 1945 B8) f56458da32

Judge each move against what the node runs, again when its have or the module's policy changes; carry the operator's keys in the node-engine's composition (issue 1945, B11, B12) 73a31eb205

The assigner holds a move of a module of policy record from the judgement beside its digest, so it is judged by ADR
0377 §3's tests against the composition the node's have names, a held one never taking its place, and written again
when the have changes or a person sets the policy (ADR 0539 clauses 2 and 14). The node-engine's own file
operator-keys, from its setting operator-signers, carries the operator's public keys (clause 3).

Keep B8's upgrades.go, which the commit before overwrote from an older copy; only the policy's rejudgement is added (issue 1945, B11) aaadb5695c

Prove the compositions on a real bus and store: a done key composed and granted, a change rewriting only what reads it, a fresh start composing every node and deleting the plans' buckets once (issue 1945, AC2, AC3, AC6, AC14) a8d63653fb

Keep the builds every want names and each composition's provisioner plans; find the replaced controller in the build records (issue 1945) c19d4516ef

With no plan left to name a build or a send to keep the plans, a want names what a collection must keep, and the
composition is where the provisioner's plans are composed for the assignments mirror (ADR 0539 clauses 1 and 5);
the assignments no longer name a node's build, so the controller replaced is the newest earlier build of it.

Read what a bus machine runs from its have, not from a send kept (issue 1945, B6) 565de8c46a

No send is kept any more (ADR 0539 clause 9), so SentBuilds has no last caller and B8 can delete it.

Delete whatTheMergeTouched, IsStaleRefusal and WriterEpoch, unused since the push went (release 6, issue 1945 B8) 03894e5e51

Delete the declarations' stream once every node runs the new node-engine, and assert it no more (issue 1945, B13) b4a62e9e6e

A node away during the switch finds its last declaration on the stream; once every node's have names the
node-engine registered, no node reads one, so the stream and the nodes' consumers on it go, said once, and a raise
leaves them out (ADR 0539 clause 11).

Drop what a send carried from the node row (migration 0109) and read an image list from the compositions (release 6, issue 1945 B8) 8f90d3ecd6

Read what a machine has from its haves: reported-and-current, the bus list, a given value's first good start; drop the digest of a send (migration 0110) (release 6, issue 1945 B8) fe3faaef83

Merge main (the planner's switch tier, issue 1942) into release 6, which deletes the planner it changed (issue 1945) ad0aabc2a9

A node with no want that has reported is current; with the bus out of reach it is not known, and the flip says so; no 'push' hint is left in adoption (release 6, issue 1945 B8) 0e85230769

Keep every column and table the controller of before reads: no migration 0108-0110, and a test that its queries still run (release 6, issue 1945 review H1) 9d0798a1c0

Say the send columns are kept for the controller of before and never read (issue 1945 note 8) 29ef458d89

Ask a backup holder once its module's have is running, not once a send was reported (release 6, issue 1945 B8) 3db472ce56

Judge a revision that changes only the bus's user list as no move, and say so beside it (issue 1945; the review's A2) df6aab6f44

The user list is a file in a directory the bus's container mounts, so it read as moving data and held every new
credential for a person's yes, against ADR 0539 clause 7; mesh-sdk's UserListOnly lets the assigner write such a
revision at once.

Keep the files of every composition a want still names, not only each key's newest (issue 1945; the review's C1) 76c48fa074

A node applies exactly the composition its want names (ADR 0539 clause 1), which may be a revision a newer one
replaced: its files over 64 KiB stay until no want names it.

Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes) f20d221a60

With no send left nothing else writes a missed grant, so the take-in of a done key returns it and tries again every
half minute under an urgent condition until it is written. plan-moved and sent go with the plans. The controller's
first-start deletions are said on a granted subject, a node hears only its backup holder, and the operator's account
writes the hand path, an object replaced included (ADR 0539 clauses 2, 7, 10 and 13).

Format the done-key tests (issue 1945) 49fc8b6d7d

Prove the compositions through serve() whole, on a bus running the composed user list: the start, a done key, a real rotation (issue 1945; the review's G1) af6bcea41e

The tests no longer call the writer on a bus without permissions: the controller runs as it serves, the builder and
the indexer write their own keys as their own accounts, and the operator's rotate is the real verb, so a subject the
user list does not grant fails them as it would fail the mesh.

Find a want's have by the have's own key: want.<node>.<module> against <node>.<module> (release 6, issue 1945) aa7e53112b

Say what a node's bucket holds when a served composition test waits in vain (issue 1945) 35e330c7f0

Judge a preview and a refused flip from after the performed take, which composes the node; test that a take composes only when performed (release 6, issue 1945) f6e78c837f

Fix the test that has no sent list 3ad12f8ec7

Put the served test's registrations on the bus's chain, and keep the seat-row test on a verb release 6 keeps (issue 1945) 370673195c

Assignments and builds live on the bus (ADR 0408), so a fixture written before the chain was attached was not what
the serving controller read; and push, which the row test used, went with the plans.

Read the stored manifest through the record's own reader in the silent-file test 4ab4529440

Assert the controller's buckets before the served test's fixture writes the chain (issue 1945) a78f244621

Assert notes among the assigned modules, which an assignment may bring others to 38523c6509

Say what composing the node answers when a served test waits in vain (issue 1945) 1ed5afe679

Assign the private network on the chain in the served test, as aMesh does on the store (issue 1945) dd58fbcb2c

Compose a module that has no resource of its own as an empty composition (issue 1945) e05481e992

Its want names a composition (ADR 0539 clauses 1 and 6), so a module whose needs others meet must still have one at
its fingerprint, or no want could ever be written for it. Found by the served test.

Give the served done key a fingerprint a key holds, and wait for the store's grants in the rotation (issue 1945) f18bac4533

Give the served board its credential in a file, so a rotation shows in its composition (issue 1945) 98e948e30e

Say each composition's resources and the credential's holders when a served test waits in vain (issue 1945) 7fccba4658

Say what rotate printed when the served rotation test fails (issue 1945) 36704abc08

Drop the epoch-reading assertions and the two readers B8 left without a writer 9641b88725

Say rotate's output on one line when the served rotation test fails (issue 1945) b879128efb

Say the credential's state and what composing the consumer gives when the served rotation test fails (issue 1945) 8fab4d8b22

Say the serving controller's lines on the credential while the served rotation lands (issue 1945) 6ed5de186d

Trace a rotation's credential writes and compositions, record the bindings a composition carries, drop SchemaReachOf, and re-pin mesh-sdk to e45bdc0891bb (issue 1945) 8c54139905

Re-capture the catalogue at mesh-catalog feat/r6 3a1017f5 and excuse a derived subject whose module lives in another repository (issue 1945) dfd81d8daf

Re-pin mesh-sdk to 7f9cc0e55c37 (issue 1945) 72bbdeed35

A bare alive keeps the last real apply: assert that, not a Current the store no longer holds f0815c4f18

Drop the test of the digest-sent rule for an older account; the ordered tests hold it by the node-engine's own order 28e1b29e0c

The report's contract names the ordered test d640ef15ec

Judge a have with no composition against the module's slice of the declaration the node last applied: equal is unchanged (issue 1945; ADR 0540 clause 9) 9372733861

The first want at the switch skips the record hold only where it changes nothing on the node. A slice differing only in
the bus's user list is marked user-list-only, so no yes waits on it at the switch; any other change at the same
fingerprint is judged as any move, against the declaration's digest.

Say the rotation test's whole trace on its failure's first line, and each judgement in it; an unreadable last declaration is cannot-judge (issue 1945) 53d9c4de19

The verdict keeps only a failure's first line (issue 1921), so the trace that names the cause rode on lines it dropped.

Run the served rotation's verb on the bus chain the controller keeps, as its child process does (issue 1945) 6e4bca7fce

Merge main (#456 , the pre-switch grants) into feat/r6 (issue 1945) 3c50e80972

Every grant #456 gives was already feat/r6's, by the SDK's names: each conflict takes feat/r6's side, with main's
test of the user list before the switch kept beside feat/r6's, and the duplicate assertion of the digests' bucket
dropped.

Let go of the hand-act log's connection when serving ends (issue 1945) fad3d7ee71

A controller served in the test process left it pointing at a closed connection, so the next test's conditions verb
failed with "connection closed".

Assert the controller's buckets in the builder-on-the-bus fixture (issue 1945) 183d7a99ff

A merge the controller hears is now kept in the bucket of the merges (ADR 0539 §17); the test that sends one passed
only when an earlier test on the shared bus had made that bucket.

Give back the connection name a test's in-process command line set (issue 1945) 9abe0b59fa

runLine runs the controller's dispatch in the test process, which names every later connection after the line's verb:
the proposals tests left "mesh-controller verb settings", and the conditions verb's test later in the same process
read that name instead of its own.

Let a later test's verb run after the served controller stops (issue 1945) 7a64075702

serve marks the process as handing over once it stops, and refuses every verb from then on; the served tests run it in
the test process, so the connection test's conditions verb was refused without its own process ever starting.

Give back everything serve sets once the served tests' controller stops (issue 1945) ca25e4ab45

The served mark in the environment made every later test in the process read as the serving controller's: the
registration test was refused as "never through a verb". The fixture now restores the mark, the hand-act log's
connection, the keeper, the status and the event publishers serve sets.

Merge main (the R4g finish: reads-outside markers) into feat/r6 (issue 1945) e42818a0ab

The silent mid-tier plan test main changed stays deleted with the plans (ADR 0539); the SDK is pinned to the feat/r6
head that merged mesh-sdk's main, 748c564c, whose hand path tool is now mesh-hand-compose.

Re-capture the converged declaration for release 6: every resource says its module (issue 1945) e338b1f0f4

readNode sets ReadsModules, since release 6 composes only for node-engines that read a module per resource (issue 1145);
the failure says the bytes on its first line, the one the verdict keeps (issue 1921).

Wait for the done key's grant, which the take-in writes after the compositions (issue 1945) 0af12b369b

Wait for the whole start pass before serving a served test, so a rotation test never reads it midway (issue 1945) a3f1d0460d

Read the declaration a served-key test checks from the composition, since the plan verb is gone (issue 1945)

mesh/delivery-group group feat/r6 merged: every member is merged

Details

mesh/delivery delivering: 0 machine step(s) passed

Details

mesh/check checking 9c38aed78905 on bdb8193456e1 | novox/mesh-controller#457 in group feat/r6

9c38aed789

mesh-tools commented

2026-10-24 22:17:29 +00:00

Delivery novox/mesh-controller@9c38aed78905 — delivering since 2026-10-24T23:19:25Z

Delivery plan — builds mesh-controller → novox; no bus step

tier 0: mesh-controller
novox: receives mesh-controller

Group feat/r6: novox/hq@ba09497092, novox/mesh-catalog@d09cbf1523, novox/mesh-controller@9c38aed789, novox/mesh-delivery@3e863884fd, novox/mesh-host@81758b24a8, novox/mesh-sdk@748c564cdf

composed together: pass — the checker's verdict at the members' heads (d2bc2f317716)

Transitions

2026-10-24 22:17 (new) → proposed (announced): novox/mesh-controller#457's head announced
2026-10-24 22:59 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-24 22:59 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-24 23:19 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-24 23:19 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@9c38aed78905` — **delivering** since 2026-10-24T23:19:25Z **Delivery plan** — builds mesh-controller → novox; no bus step - tier 0: mesh-controller - novox: receives mesh-controller **Group** `feat/r6`: novox/hq@ba09497092ec, novox/mesh-catalog@d09cbf152317, novox/mesh-controller@9c38aed78905, novox/mesh-delivery@3e863884fda8, novox/mesh-host@81758b24a8e4, novox/mesh-sdk@748c564cdf7c - composed together: pass — the checker's verdict at the members' heads (d2bc2f317716) **Transitions** - 2026-10-24 22:17 (new) → proposed (announced): novox/mesh-controller#457's head announced - 2026-10-24 22:59 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-24 22:59 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-24 23:19 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-24 23:19 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools merged commit ba4d156573 into main

2026-10-24 23:00:31 +00:00

mesh-tools deleted branch feat/r6

2026-10-24 23:00:32 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#457