Delivery in order: grants before code, one machine first, a newer plan takes over (ADR 0218; hq issues 249, 252, 254) #54

2026-10-05T16:20:42Z

mesh-admin commented

2026-10-05 16:20:42 +00:00

Implements ADR 0218.

Grants before code (249): the bus's machine is sent first when its composed user list moved (digest kept in node.sent_bus_users), then buckets are raised and memberships issued, then the rest is sent. A membership that fails holds back only its own machine; a failure that names none holds back all but the bus's machine (already sent). Grant failures are retried (ErrTryAgain in following.Upgraded).
One machine first (249): unless the module's policy is together, a plan sends the first machine (by name, among those heard from lately) and the rest only after its applied and current report; a first machine that fails, or is silent past the plan bound, stops the module's rollout with a note naming it.
A newer plan takes over (254): open plans of the same repository and branch are superseded, their unbuilt and built-but-unsent modules folded in; plans close <id>; an ended plan's note says what it built and never sent.
Merge-touched set (252): a changed path in a sibling of known module directories is that module's own when its module.json is among the changed paths.
The catalogue's upgraded announcement defers to an open plan still sending the module.
Migration 0058 (release_plan.branch, node.sent_bus_users). Note: the open hq ADR 0217 branch carries a 0057; it must be renumbered to land after this.

Independently reviewed; every must/should-fix addressed. Full suite with fresh postgres + NATS: all packages pass.

Implements ADR 0218. - **Grants before code** (249): the bus's machine is sent first when its composed user list moved (digest kept in `node.sent_bus_users`), then buckets are raised and memberships issued, then the rest is sent. A membership that fails holds back only its own machine; a failure that names none holds back all but the bus's machine (already sent). Grant failures are retried (`ErrTryAgain` in `following.Upgraded`). - **One machine first** (249): unless the module's policy is `together`, a plan sends the first machine (by name, among those heard from lately) and the rest only after its applied and current report; a first machine that fails, or is silent past the plan bound, stops the module's rollout with a note naming it. - **A newer plan takes over** (254): open plans of the same repository and branch are superseded, their unbuilt and built-but-unsent modules folded in; `plans close <id>`; an ended plan's note says what it built and never sent. - **Merge-touched set** (252): a changed path in a sibling of known module directories is that module's own when its `module.json` is among the changed paths. - The catalogue's `upgraded` announcement defers to an open plan still sending the module. - Migration **0058** (`release_plan.branch`, `node.sent_bus_users`). Note: the open hq ADR 0217 branch carries a 0057; it must be renumbered to land after this. Independently reviewed; every must/should-fix addressed. Full suite with fresh postgres + NATS: all packages pass.

mesh-admin added 7 commits 2026-10-05 16:20:42 +00:00

Read a new module's directory as its own, not as shared code (hq issue 252) d7f359c498

A merge adding a module the mesh has not registered rebuilt every module
built from the repository. A path under a directory known to hold modules
belongs to that module when its module.json is among the changed files.

Issue grants before code, and the bus's machine first (hq issue 249) 22660dc274

A module's new state reached every machine before the permissions to use
it, which came only with a later push. Memberships and buckets now go
before declarations, the machine holding mesh-broker goes first when its
user list must change, and a grant that fails sends nothing and is an
error so the rollout is retried.

Roll a plan's module out to one machine first (hq issue 249, ADR 0218) 4ac5cfe3a7

A plan sent every machine running a module at once, ignoring the module's
upgrade policy. Unless the policy says together, the first machine by name
is sent, recorded in the plan, and the rest follow only once its report
after the send says it applied; a failed first machine stops the plan.

Let a newer plan supersede the older open plans of its repository (hq issue 254, ADR 0218) 208901c6cc

A merge planned without looking at open plans, so two plans worked the
same modules and a stuck plan stayed open for ever. The newer plan folds
in what older plans of the same repository and branch had not built or
sent, and closes them as superseded. A person can close a stuck plan by
id with `plans close <id>`.

Leave an announced move to the plan rolling the module out (hq issue 249) 672d1f4ca1

The catalogue's upgrade announcement sent every machine one after another
without waiting for any to apply, beside the plan that now sends one
machine first. A module an open plan has not finished sending is the
plan's to roll out.

Send the bus's machine before the grants, and only when its user list moved (hq issue 249) ed90771382

Grants first could hold back the very declaration that lets the controller
issue them. The holder now goes first, then buckets and memberships, then
the rest; a membership that fails holds back only its own machine, and an
announcement whose send stopped at its grants is asked again. Whether the
holder must go first is read from a digest of the user list it was last
sent, not its whole declaration. Migration renumbered to 0058.

Stop a rollout whose first machine is silent, and choose one that is heard from (hq issue 249, ADR 0218) 16c5e78fa8

A first machine that does not report within the bound now stops the
module's rollout, naming it. The first machine is the first by name heard
from lately; reports are judged by what the store says was last sent. A
plan that ends says what it built and never sent, and a failed send's
error is kept in the plan's note.

mesh-admin merged commit bdfbd0254f into main

2026-10-05 16:21:06 +00:00

mesh-admin deleted branch fix/delivery-in-order

2026-10-05 16:21:06 +00:00

mesh-admin referenced this pull request

2026-10-05 16:31:51 +00:00

Judge each machine's report from its own send, so a first machine opens the gate (hq issue 256) #55

mesh-admin commented

2026-10-06 23:10:14 +00:00

Delivery novox/mesh-controller@bdfbd0254fa5 — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#54 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@bdfbd0254fa5` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#54 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin referenced this pull request

2026-10-08 10:03:01 +00:00

Compose an account given only groups where its module wrote it (hq ADR 0252, issue 247) #139

mesh-tools referenced this pull request

2026-10-21 10:05:44 +00:00

Take the mesh-sdk that knows shares on an s3-bucket requirement, and prove the controller composes and checks it (issue 1593) #416

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#54