route-proxy from the provisioner's plans with its own contract; the controller forwards accounts to the vault (issue 774) #487

2026-10-31T10:00:43Z

mesh-tools commented

2026-10-31 10:00:43 +00:00

This repository:

Keep the controller on main's mesh-sdk pin and mint until the grants part takes over, so its impact stays small and no account is minted that the bus it loads refuses (issue 774)
Pin route-proxy at the group's mesh-sdk head acbf80a and its contract at the published tag v0.1.0, so it builds and reads the contributed payload; refresh its manifest digest for the events its contract names (issue 774)
Forward module issue and an assignment's issue to the vault once one is installed, so the controller mints no bus account and none waits on a node reporting here (issue 774; research 072, the controller NATS-native: gap "vault mints after the lease", the minting piece moves to the vault)
Serve route-proxy's routes through its own contract: decode each plan entry's opaque contribution with it, say each name served, withdrawn or refused on the bus, and take who is inside from the seat mesh-placement, since the membership went with the assignments stream (issue 774, research 072 rows 33 and 34)
Publish route-proxy's contract as a Go module of its own: the route a consumer asks, its schema, the events the proxy says, what it keeps on the bus and its tools' arguments, so other modules use the contract by its version and the provisioner carries a route unread (issue 774, research 072 row 34)
Serve route-proxy's routes from the seat mesh-provisioner's plans alone and drop its received routes file, since a route is a provision and the file is the deprecated path (issue 774, research 072 row 34; needs the mesh-sdk pin carrying plan entries' given and Conn.Read)

Research "The controller, NATS-native": this moves the piece "vault mints after the lease" (the minting goes to the vault; the controller only forwards) and drops the controller's ASSIGNMENTS declaration; nothing else of the controller changes.

Issue 774 (L3 of design 47: nothing is left with the controller), research 072 rows 11, 26, 33, 34 and 37.

Delivery group feat/072-moves, one check and one Approve: mesh-sdk acbf80ad, mesh-catalog 8439ec11, mesh-delivery a313c3e8, mesh-tools be2fc2e9, mesh-host 8bdfddab, mesh-control 7a169eae. Every member pins mesh-sdk acbf80ad, except the controller root, which stays on main's pin on purpose (the controller is deprecated; its change is kept minimal). route-proxy's contract is the published tag modules/route-proxy/contract/v0.1.0; these pins are set by hand one last time (ADR 0573; issue 1585 builds the automatic rebuild).

What it does: the seat mesh-placement keeps one key per node (<node>.node) and per module (<node>.<module>), the legacy placement.<node> mirrored while readers move; the ASSIGNMENTS stream is no longer declared and mesh-grants reads memberships from its own state; mesh-hand-acts copies the controller's hand acts once; route-proxy serves routes from the provisioner's plans through its own contract; the vault is the only issuer of bus accounts, the controller forwarding to it since the take-over (2026-10-27).

Quick fix vs thorough fix (review round 2): the reviewer found that the vault and the controller could both mint an account before the take-over. The take-over was recorded on 2026-10-27, and the operator ruled out a hand-back (2026-10-31), so the window cannot recur; no change. The manifest of mesh-grants claiming no seat mesh-grants (ADR 0547 §5) is noted on issue 774 for the controller's removal.

Before delivery: no membership is held back (grants_membership: 0 at pass 140611). Do not roll mesh-delivery back after the key conversion.

Tests: each repository's unit suite, go vet and go vet -tags integration are clean at these heads (review round 2, 2026-10-31 10:40).

Reviewed-by: rev-072@shanks at 7a169eae76

**This repository:** - Keep the controller on main's mesh-sdk pin and mint until the grants part takes over, so its impact stays small and no account is minted that the bus it loads refuses (issue 774) - Pin route-proxy at the group's mesh-sdk head acbf80a and its contract at the published tag v0.1.0, so it builds and reads the contributed payload; refresh its manifest digest for the events its contract names (issue 774) - Forward module issue and an assignment's issue to the vault once one is installed, so the controller mints no bus account and none waits on a node reporting here (issue 774; research 072, the controller NATS-native: gap "vault mints after the lease", the minting piece moves to the vault) - Serve route-proxy's routes through its own contract: decode each plan entry's opaque contribution with it, say each name served, withdrawn or refused on the bus, and take who is inside from the seat mesh-placement, since the membership went with the assignments stream (issue 774, research 072 rows 33 and 34) - Publish route-proxy's contract as a Go module of its own: the route a consumer asks, its schema, the events the proxy says, what it keeps on the bus and its tools' arguments, so other modules use the contract by its version and the provisioner carries a route unread (issue 774, research 072 row 34) - Serve route-proxy's routes from the seat mesh-provisioner's plans alone and drop its received routes file, since a route is a provision and the file is the deprecated path (issue 774, research 072 row 34; needs the mesh-sdk pin carrying plan entries' given and Conn.Read) Research "The controller, NATS-native": this moves the piece "vault mints after the lease" (the minting goes to the vault; the controller only forwards) and drops the controller's ASSIGNMENTS declaration; nothing else of the controller changes. Issue 774 (L3 of design 47: nothing is left with the controller), research 072 rows 11, 26, 33, 34 and 37. **Delivery group `feat/072-moves`, one check and one Approve:** mesh-sdk acbf80ad, mesh-catalog 8439ec11, mesh-delivery a313c3e8, mesh-tools be2fc2e9, mesh-host 8bdfddab, mesh-control 7a169eae. Every member pins mesh-sdk acbf80ad, except the controller root, which stays on main's pin on purpose (the controller is deprecated; its change is kept minimal). route-proxy's contract is the published tag `modules/route-proxy/contract/v0.1.0`; these pins are set by hand one last time (ADR 0573; issue 1585 builds the automatic rebuild). **What it does:** the seat mesh-placement keeps one key per node (`<node>.node`) and per module (`<node>.<module>`), the legacy `placement.<node>` mirrored while readers move; the ASSIGNMENTS stream is no longer declared and mesh-grants reads memberships from its own state; mesh-hand-acts copies the controller's hand acts once; route-proxy serves routes from the provisioner's plans through its own contract; the vault is the only issuer of bus accounts, the controller forwarding to it since the take-over (2026-10-27). **Quick fix vs thorough fix (review round 2):** the reviewer found that the vault and the controller could both mint an account before the take-over. The take-over was recorded on 2026-10-27, and the operator ruled out a hand-back (2026-10-31), so the window cannot recur; no change. The manifest of mesh-grants claiming no seat `mesh-grants` (ADR 0547 §5) is noted on issue 774 for the controller's removal. **Before delivery:** no membership is held back (`grants_membership`: 0 at pass 140611). Do not roll mesh-delivery back after the key conversion. **Tests:** each repository's unit suite, `go vet` and `go vet -tags integration` are clean at these heads (review round 2, 2026-10-31 10:40). Reviewed-by: rev-072@shanks at 7a169eae76ef9f0cd5b0b29898a0b66454fe26d1

mesh-tools added 6 commits 2026-10-31 10:00:43 +00:00

Serve route-proxy's routes from the seat mesh-provisioner's plans alone and drop its received routes file, since a route is a provision and the file is the deprecated path (issue 774, research 072 row 34; needs the mesh-sdk pin carrying plan entries' given and Conn.Read) ff912d0972

Publish route-proxy's contract as a Go module of its own: the route a consumer asks, its schema, the events the proxy says, what it keeps on the bus and its tools' arguments, so other modules use the contract by its version and the provisioner carries a route unread (issue 774, research 072 row 34) efe745f2be

Serve route-proxy's routes through its own contract: decode each plan entry's opaque contribution with it, say each name served, withdrawn or refused on the bus, and take who is inside from the seat mesh-placement, since the membership went with the assignments stream (issue 774, research 072 rows 33 and 34) 22935b9202

Forward module issue and an assignment's issue to the vault once one is installed, so the controller mints no bus account and none waits on a node reporting here (issue 774; research 072, the controller NATS-native: gap "vault mints after the lease", the minting piece moves to the vault) d791052f77

Pin route-proxy at the group's mesh-sdk head acbf80a and its contract at the published tag v0.1.0, so it builds and reads the contributed payload; refresh its manifest digest for the events its contract names (issue 774) a07621d761

Keep the controller on main's mesh-sdk pin and mint until the grants part takes over, so its impact stays small and no account is minted that the bus it loads refuses (issue 774)

mesh/delivery merged: source.main moved to novox/mesh-controller@c58b311ea774

Details

mesh/delivery-group group feat/072-moves merged: every member is merged

Details

mesh/check failed: shanks: the check of novox/mesh-controller#487 failed: go mod download in modules/route-proxy: go: git.novox.be/novox/mesh-controll…

7a169eae76

The controller is being removed, so its root module goes back to origin/main's mesh-sdk pin (2da0de7) and
testdata/beside's capture; route-proxy keeps its own pins. Its one functional change stays the account issue:

- Before the grants part's take-over (its key user-list.sealed not saying FollowGrants) the bus loads the
  controller's list, whose hashes come only from its store, so the controller mints as before and hands every
  account it mints, covered or not, to an installed vault at once: no account waits on a node reporting its hash.
- From the take-over it forwards the issue to the vault's issue-account (d791052f) and mints nothing.

And the controller no longer declares or asserts the ASSIGNMENTS stream, which the bus module's tools delete at the
lease write and nothing may make again (research 072 row 33); the verified-sender re-issue stops once it is gone.

Research 072 piece: the gap "vault mints after the lease", the minting piece moves to the vault from the take-over.

mesh-tools commented

2026-10-31 10:00:48 +00:00

Delivery novox/mesh-controller@7a169eae76ef — merged since 2026-10-31T10:31:08Z

Source — source.main moved to novox/mesh-controller@c58b311ea7. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group feat/072-moves: novox/mesh-catalog@8439ec117c, novox/mesh-controller@7a169eae76, novox/mesh-delivery@a313c3e843, novox/mesh-host@8bdfddab4a, novox/mesh-sdk@acbf80ad91, novox/mesh-tools@be2fc2e9b6

composed together: fail — the checker's verdict at the members' heads (10e5c18979c3): shanks

Transitions

2026-10-31 10:00 (new) → proposed (announced): novox/mesh-controller#487's head announced
2026-10-31 10:00 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-31 10:31 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@7a169eae76ef` — **merged** since 2026-10-31T10:31:08Z **Source** — source.main moved to novox/mesh-controller@c58b311ea774. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `feat/072-moves`: novox/mesh-catalog@8439ec117cb9, novox/mesh-controller@7a169eae76ef, novox/mesh-delivery@a313c3e84380, novox/mesh-host@8bdfddab4aab, novox/mesh-sdk@acbf80ad910a, novox/mesh-tools@be2fc2e9b6ac - composed together: fail — the checker's verdict at the members' heads (10e5c18979c3): shanks **Transitions** - 2026-10-31 10:00 (new) → proposed (announced): novox/mesh-controller#487's head announced - 2026-10-31 10:00 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-31 10:31 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit c58b311ea7 into main

2026-10-31 10:31:07 +00:00

mesh-tools deleted branch feat/072-moves

2026-10-31 10:31:07 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#487