novox/mesh-controller
Archived
9
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3) #85

Merged
mesh-admin merged 1 commits from feat/a-core-that-cannot-fail-silently-phase-3 into main 2026-10-06 12:29:15 +00:00
Conversation 1 Commits 1 Files Changed 31
+2154 -21
mesh-admin commented 2026-10-06 12:28:37 +00:00
Contributor
Copy Link
Copy Source

hq to-be 45 Phase 3, ADR 0231 (hq PR on the same branch).

Healer registry (cmd/mesh-controller/healers.go), compiled in, with a test generated from it (every row answers a kind the signals table / probe registry / a provider event raises, has budget, settle, event, and an induced-failure test):

answers repair budget, settle
H1 sent-not-reported (S2) ask the node-engine to report (mesh.node.<n>.ask.report); not reported current within 45 s → send again, never moving a held build (ADR 0221) 2 / 6 h, 3 min
H2 stalled (S3) on a superseded or finished wait close the plan (superseded / done) with its note 1 / 24 h, 2 min
H3 holder-silent (D3), consumer-lost (D6, S9) assertOnSend (issue 208) 1 / object / h, 6 min
H4 consumer-behind (D6, new kind) on a consumer marked Resettable — only the controller's EVENTS consumer ResetConsumer 1 / 24 h, 6 min
H5 identity provider admin refusing the secret ADR 0224 §5, in the module (registered, not run here) the module's
  • Acts begun in the store before they are made (migration 0070, table heal), under the lease/epoch; only the lease holder heals, none while unleased.
  • Success only by observation; act kept in tried (by: healer Hn), resolver healer:Hn; budget spent → resolver operator + urgent (an observation no longer lowers an escalated severity), and no healer touches it again.
  • Every act said as seat event healer-acted (granted; genesis lock in mesh-host #37). Heals are never hand acts.
  • Mesh-wide brake: 12 acts/hour → every healer stops, mesh.healers.braked urgent, until an hour after the last act.
  • S15 live (mesh.hand-acts.<cause>.healer-wanted, names the healer that was not enough).
  • healers verb (CLI + seat), status counts the week's heals, conditions show prints who tried.
  • Node grant: subscribe mesh.node.<n>.ask.report.

Tests (MESH_TEST_POSTGRES postgres:17 + MESH_TEST_NATS nats:2.11, -race -p 1, vet, gofmt): all green. Integration against a real bus: H3 (consumer deleted → asserted → cleared by D6's next run → deleted again → escalated), H4 (EVENTS consumer 1200 behind → reset → D6 clears → the controller's bound subscription still receives).

Merge order: mesh-host #37 first or together (genesis test reads its lock). Migration: 0070; the retire feature (ADR 0230, feat/retired-consumers) has none yet — one it adds must be 0069 merged before this, or above 0070 after. Merging with that branch conflicts trivially in main.go and testdata/composed.conf (regenerate with -update).

Rollout: controller; then push the machine holding the bus so the user list grants healer-acted and nodes' ask subject (until then the event is refused, acts and tried still say it; H1 falls back to sending again). No dependency changes, vendor untouched.

hq to-be 45 Phase 3, ADR 0231 (hq PR on the same branch). **Healer registry** (`cmd/mesh-controller/healers.go`), compiled in, with a test generated from it (every row answers a kind the signals table / probe registry / a provider event raises, has budget, settle, event, and an induced-failure test): | | answers | repair | budget, settle | |---|---|---|---| | H1 | `sent-not-reported` (S2) | ask the node-engine to report (`mesh.node.<n>.ask.report`); not reported current within 45 s → send again, never moving a held build (ADR 0221) | 2 / 6 h, 3 min | | H2 | `stalled` (S3) on a superseded or finished wait | close the plan (`superseded` / `done`) with its note | 1 / 24 h, 2 min | | H3 | `holder-silent` (D3), `consumer-lost` (D6, S9) | `assertOnSend` (issue 208) | 1 / object / h, 6 min | | H4 | `consumer-behind` (D6, new kind) on a consumer marked `Resettable` — only the controller's EVENTS consumer | `ResetConsumer` | 1 / 24 h, 6 min | | H5 | identity provider admin refusing the secret | ADR 0224 §5, in the module (registered, not run here) | the module's | - Acts begun in the store before they are made (migration **0070**, table `heal`), under the lease/epoch; only the lease holder heals, none while unleased. - Success only by observation; act kept in `tried` (`by: healer Hn`), resolver `healer:Hn`; budget spent → resolver operator + urgent (an observation no longer lowers an escalated severity), and no healer touches it again. - Every act said as seat event `healer-acted` (granted; genesis lock in mesh-host #37). Heals are never hand acts. - Mesh-wide brake: 12 acts/hour → every healer stops, `mesh.healers.braked` urgent, until an hour after the last act. - S15 live (`mesh.hand-acts.<cause>.healer-wanted`, names the healer that was not enough). - `healers` verb (CLI + seat), `status` counts the week's heals, `conditions show` prints who tried. - Node grant: subscribe `mesh.node.<n>.ask.report`. Tests (MESH_TEST_POSTGRES postgres:17 + MESH_TEST_NATS nats:2.11, `-race -p 1`, vet, gofmt): all green. Integration against a real bus: H3 (consumer deleted → asserted → cleared by D6's next run → deleted again → escalated), H4 (EVENTS consumer 1200 behind → reset → D6 clears → the controller's bound subscription still receives). **Merge order:** mesh-host #37 first or together (genesis test reads its lock). **Migration:** 0070; the retire feature (ADR 0230, `feat/retired-consumers`) has none yet — one it adds must be 0069 merged before this, or above 0070 after. Merging with that branch conflicts trivially in `main.go` and `testdata/composed.conf` (regenerate with `-update`). **Rollout:** controller; then push the machine holding the bus so the user list grants `healer-acted` and nodes' ask subject (until then the event is refused, acts and `tried` still say it; H1 falls back to sending again). No dependency changes, vendor untouched.
mesh-admin added 1 commit 2026-10-06 12:28:38 +00:00
Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3) 751e39186c 
Research 031 counted the repairs people made by hand: a push to unstick a
plan waiting on a report, a controller restarted to make an object again, a
plan closed, a consumer re-made from now. Each was the ordinary path taken
again by someone who noticed. The healer registry makes each a registered
response to one condition kind, with a budget, a settle and its event:

- H1 sent-not-reported: ask the machine's node-engine to report again
  (mesh.node.<n>.ask.report); if it does not report what it was sent, send
  it again, never moving a build a policy or a plan holds back
- H2 stalled: close a plan whose wait is superseded or finished
- H3 holder-silent / consumer-lost: the send's own assertion of the bus's
  objects (issue 208's note)
- H4 consumer-behind: consumer-reset, only for a consumer the stream table
  marks resettable (the controller's own events consumer)
- H5 is the identity provider's own repair (ADR 0224 §5), registered only

Success is the observation clearing the condition, never the healer; a spent
budget hands the condition to the operator, urgent, with what was tried, and
no healer touches it again. Every act is begun in the store before it is made
(migration 0070), kept in the condition's tried as "healer Hn" and said as
the seat event healer-acted; a heal is never a hand act. More than twelve acts
in an hour stop every healer until an hour after the last, said urgently.
Only the lease holder heals.

S15 is live: a cause repaired by hand twice in a fortnight raises
healer-wanted, naming the healer that was not enough where one exists. D6's
far-behind finding has its own kind, consumer-behind. Nodes are granted the
question; the controller's grant gains healer-acted (genesis lock in
mesh-host). `healers` lists the registry, the acts and the brake; status
counts the week's heals.
mesh-admin merged commit 298daa6fbe into main 2026-10-06 12:29:15 +00:00
mesh-admin deleted branch feat/a-core-that-cannot-fail-silently-phase-3 2026-10-06 12:29:15 +00:00
mesh-admin commented 2026-10-06 23:09:38 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-controller@298daa6fbeb6 — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

  • 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#85 merged; its head was not heard by this owner, so it is made from the forge's word
  • 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@298daa6fbeb6` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#85 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#85