The gate raises the mesh as it is, and a baseline that does not compose is an error; check-here runs a check as the seat does (hq issues 285, 286)
#104
Merged
mesh-adminmerged 2 commits from fix/gate-baseline-composes into main2026-10-06 23:59:43 +00:00
(The hq issues were renumbered from 282/283 to 285/286, because 282 was taken on main. The test names and code comments follow, in commit 8bf7026.)
Issue 285: the gate judged nothing. Every gated check said PASS … (0 of 4 compose): no machine composed in the gate's store, with the change or without, so "breaks what composed" could never fire. The causes:
each module's broker secret was raised without its bus account (issue 203);
no outward links were raised (ADR 0140);
settings layers were judged one at a time on the way in, and a withheld path was not absolute;
composition printed lines on stdout ahead of the --json verdict.
Fixed by:
minting the account with the credential;
carrying outward links in the facts, with a stand-in for an older snapshot;
KeepSettings for raised layers;
a withheld path keeping a path's shape;
writing nothing but the verdict to stdout in --json mode.
A machine the mesh composes that the gate cannot raise now makes the verdict error, never a pass. The facts also scrub resource names.
On the live facts: 4 of 4 compose.
Issue 286: the repository check disagreed with the agents' machines.mesh-controller check-here runs builder.Check on the checkout's HEAD exactly as the seat would be asked to: the planner's scope from the facts, the siblings at the refs the facts carry (beside), the toolchain the facts name (versions.toolchains), as root, against a throwaway store and bus. Check containers set safe.directory. A failed script is summarised by what failed.
Verified: check-here on this branch → 4 of 4 compose, repo-check PASS. Live seat: build-1791330541277252555 → PASS (4 of 4 compose), repository PASS.
(The hq issues were renumbered from 282/283 to **285/286**, because 282 was taken on main. The test names and code comments follow, in commit 8bf7026.)
**Issue 285: the gate judged nothing.** Every gated check said `PASS … (0 of 4 compose)`: no machine composed in the gate's store, with the change or without, so "breaks what composed" could never fire. The causes:
- each module's `broker` secret was raised without its bus account (issue 203);
- no outward links were raised (ADR 0140);
- settings layers were judged one at a time on the way in, and a withheld path was not absolute;
- composition printed lines on stdout ahead of the `--json` verdict.
Fixed by:
- minting the account with the credential;
- carrying outward links in the facts, with a stand-in for an older snapshot;
- `KeepSettings` for raised layers;
- a withheld path keeping a path's shape;
- writing nothing but the verdict to stdout in `--json` mode.
**A machine the mesh composes that the gate cannot raise now makes the verdict `error`, never a pass.** The facts also scrub resource names.
On the live facts: **4 of 4 compose**.
**Issue 286: the repository check disagreed with the agents' machines.** `mesh-controller check-here` runs `builder.Check` on the checkout's HEAD exactly as the seat would be asked to: the planner's scope from the facts, the siblings at the refs the facts carry (`beside`), the toolchain the facts name (`versions.toolchains`), as root, against a throwaway store and bus. Check containers set `safe.directory`. A failed script is summarised by what failed.
Verified: `check-here` on this branch → 4 of 4 compose, repo-check PASS. Live seat: build-1791330541277252555 → PASS (4 of 4 compose), repository PASS.
Tests: `TestIssue285AModuleOnTheBusComposesInTheGate`, `TestIssue285AMachineTheGateCannotRaiseIsAnErrorNeverAPass`, `TestAWithheldPathIsStoodInForByAPath`, `TestAWithheldPathStaysAPath`, `TestAFailedScriptIsSaidByWhatFailed`, `TestACheckByHandClonesWhatTheSeatClones`.
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
The gate composed 0 of 4 machines with the change and without, and passed every change: the store it
raised held each module's bus credential but no account for it (issue 203's refusal), no outward links
(so no filter could be composed), and refused settings the mesh holds. Now the account is minted with
its credential, the facts carry each machine's outward links (a stand-in for an older snapshot), the
mesh's layers are kept as held, and a withheld path keeps a path's shape. A machine the mesh composes
that the gate cannot raise makes the verdict an error, never a pass; the verdict alone is on stdout.
A merge-check.sh that passed on an agent's machine failed on the build seat: a newer gofmt, siblings at
a feature branch, another user. `mesh-controller check-here` runs builder.Check with the ask the
controller would make, from facts that now name the toolchains and the refs cloned beside; a failed
script is said by what failed. (novox/hq issues 282, 283)
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Machines
mesh-controller on novox: passed — healthy 3 times over 3m39s
mesh-controller on the rest running it: sent
build-agent on ace: passed — healthy 3 times over 2m25s
build-agent on the rest running it: sent
route-proxy on ace: passed — healthy 3 times over 2m26s
route-proxy on the rest running it: sent
Transitions
2026-10-06 23:49 (new) → proposed (announced): novox/mesh-controller#104's head announced
2026-10-06 23:58 proposed → checked (checked): the verdict names this commit
2026-10-06 23:58 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-07 00:00 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-07 00:00 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
2026-10-07 00:12 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-controller@0d2fd2c5bb34` — **delivered** since 2026-10-07T00:12:46Z
**Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- tier 2: route-proxy
- ace: receives build-agent, route-proxy
- g14: receives build-agent
- novox: receives mesh-controller, build-agent, route-proxy
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
**Machines**
- mesh-controller on novox: passed — healthy 3 times over 3m39s
- mesh-controller on the rest running it: sent
- build-agent on ace: passed — healthy 3 times over 2m25s
- build-agent on the rest running it: sent
- route-proxy on ace: passed — healthy 3 times over 2m26s
- route-proxy on the rest running it: sent
**Transitions**
- 2026-10-06 23:49 (new) → proposed (announced): novox/mesh-controller#104's head announced
- 2026-10-06 23:58 proposed → checked (checked): the verdict names this commit
- 2026-10-06 23:58 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-07 00:00 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-07 00:00 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
- 2026-10-07 00:12 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Run by the build seat on ace as build-1791329980791165731 (builds --log build-1791329980791165731).
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 45 tool(s)
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-06T23:08:02Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-06T23:08:02Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.031s
ok github.com/novox/mesh-controller/cmd/mesh-controller 377.361s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.012s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.017s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.046s
ok github.com/novox/mesh-controller/examples/route-proxy 1.111s
ok github.com/novox/mesh-controller/internal/artifacts 1.029s
ok github.com/novox/mesh-controller/internal/broker 2.367s
ok github.com/novox/mesh-controller/internal/builder 1.331s
ok github.com/novox/mesh-controller/internal/catalogue 3.530s
ok github.com/novox/mesh-controller/internal/conditions 1.996s
ok github.com/novox/mesh-controller/internal/envfile 1.050s
ok github.com/novox/mesh-controller/internal/facts 1.080s
ok github.com/novox/mesh-controller/internal/identity 32.462s
ok github.com/novox/mesh-controller/internal/inventory 242.403s
ok github.com/novox/mesh-controller/internal/lease 17.703s
ok github.com/novox/mesh-controller/internal/licences 31.430s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.075s
ok github.com/novox/mesh-controller/internal/link 76.573s
ok github.com/novox/mesh-controller/internal/lint 1.760s
ok github.com/novox/mesh-controller/internal/outward 1.076s
ok github.com/novox/mesh-controller/internal/overlay 1.055s
ok github.com/novox/mesh-controller/internal/secrets 1.421s
ok github.com/novox/mesh-controller/internal/store 15.492s
ok github.com/novox/mesh-controller/internal/testbus 1.207s
ok github.com/novox/mesh-controller/internal/token 1.018s
**Merge check** at `a011743c`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Change plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- tier 2: route-proxy
- ace: receives build-agent, route-proxy
- g14: receives build-agent
- novox: receives mesh-controller, build-agent, route-proxy
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Run by the build seat on ace as `build-1791329980791165731` (`builds --log build-1791329980791165731`).
```
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 45 tool(s)
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-06T23:08:02Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-06T23:08:02Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.031s
ok github.com/novox/mesh-controller/cmd/mesh-controller 377.361s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.012s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.017s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.046s
ok github.com/novox/mesh-controller/examples/route-proxy 1.111s
ok github.com/novox/mesh-controller/internal/artifacts 1.029s
ok github.com/novox/mesh-controller/internal/broker 2.367s
ok github.com/novox/mesh-controller/internal/builder 1.331s
ok github.com/novox/mesh-controller/internal/catalogue 3.530s
ok github.com/novox/mesh-controller/internal/conditions 1.996s
ok github.com/novox/mesh-controller/internal/envfile 1.050s
ok github.com/novox/mesh-controller/internal/facts 1.080s
ok github.com/novox/mesh-controller/internal/identity 32.462s
ok github.com/novox/mesh-controller/internal/inventory 242.403s
ok github.com/novox/mesh-controller/internal/lease 17.703s
ok github.com/novox/mesh-controller/internal/licences 31.430s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.075s
ok github.com/novox/mesh-controller/internal/link 76.573s
ok github.com/novox/mesh-controller/internal/lint 1.760s
ok github.com/novox/mesh-controller/internal/outward 1.076s
ok github.com/novox/mesh-controller/internal/overlay 1.055s
ok github.com/novox/mesh-controller/internal/secrets 1.421s
ok github.com/novox/mesh-controller/internal/store 15.492s
ok github.com/novox/mesh-controller/internal/testbus 1.207s
ok github.com/novox/mesh-controller/internal/token 1.018s
```
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Run by the build seat on shanks as build-1791330541277252555 (builds --log build-1791330541277252555).
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 45 tool(s)
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-06T23:48:02Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-06T23:48:02Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.033s
ok github.com/novox/mesh-controller/cmd/mesh-controller 444.721s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.031s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.042s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.034s
ok github.com/novox/mesh-controller/examples/route-proxy 1.257s
ok github.com/novox/mesh-controller/internal/artifacts 1.079s
ok github.com/novox/mesh-controller/internal/broker 2.594s
ok github.com/novox/mesh-controller/internal/builder 1.533s
ok github.com/novox/mesh-controller/internal/catalogue 4.171s
ok github.com/novox/mesh-controller/internal/conditions 2.023s
ok github.com/novox/mesh-controller/internal/envfile 1.064s
ok github.com/novox/mesh-controller/internal/facts 1.071s
ok github.com/novox/mesh-controller/internal/identity 58.158s
ok github.com/novox/mesh-controller/internal/inventory 295.803s
ok github.com/novox/mesh-controller/internal/lease 17.703s
ok github.com/novox/mesh-controller/internal/licences 56.399s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.064s
ok github.com/novox/mesh-controller/internal/link 80.996s
ok github.com/novox/mesh-controller/internal/lint 1.928s
ok github.com/novox/mesh-controller/internal/outward 1.071s
ok github.com/novox/mesh-controller/internal/overlay 1.066s
ok github.com/novox/mesh-controller/internal/secrets 1.501s
ok github.com/novox/mesh-controller/internal/store 26.053s
ok github.com/novox/mesh-controller/internal/testbus 1.222s
ok github.com/novox/mesh-controller/internal/token 1.013s
**Merge check** at `0d2fd2c5`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Change plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- tier 2: route-proxy
- ace: receives build-agent, route-proxy
- g14: receives build-agent
- novox: receives mesh-controller, build-agent, route-proxy
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
Run by the build seat on shanks as `build-1791330541277252555` (`builds --log build-1791330541277252555`).
```
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 45 tool(s)
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-06T23:48:02Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-06T23:48:02Z
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.033s
ok github.com/novox/mesh-controller/cmd/mesh-controller 444.721s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.031s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.042s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.034s
ok github.com/novox/mesh-controller/examples/route-proxy 1.257s
ok github.com/novox/mesh-controller/internal/artifacts 1.079s
ok github.com/novox/mesh-controller/internal/broker 2.594s
ok github.com/novox/mesh-controller/internal/builder 1.533s
ok github.com/novox/mesh-controller/internal/catalogue 4.171s
ok github.com/novox/mesh-controller/internal/conditions 2.023s
ok github.com/novox/mesh-controller/internal/envfile 1.064s
ok github.com/novox/mesh-controller/internal/facts 1.071s
ok github.com/novox/mesh-controller/internal/identity 58.158s
ok github.com/novox/mesh-controller/internal/inventory 295.803s
ok github.com/novox/mesh-controller/internal/lease 17.703s
ok github.com/novox/mesh-controller/internal/licences 56.399s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.064s
ok github.com/novox/mesh-controller/internal/link 80.996s
ok github.com/novox/mesh-controller/internal/lint 1.928s
ok github.com/novox/mesh-controller/internal/outward 1.071s
ok github.com/novox/mesh-controller/internal/overlay 1.066s
ok github.com/novox/mesh-controller/internal/secrets 1.501s
ok github.com/novox/mesh-controller/internal/store 26.053s
ok github.com/novox/mesh-controller/internal/testbus 1.222s
ok github.com/novox/mesh-controller/internal/token 1.013s
```
mesh-admin
changed title from The gate raises the mesh as it is, and a baseline that does not compose is an error; check-here runs a check as the seat does (hq issues 282, 283) to The gate raises the mesh as it is, and a baseline that does not compose is an error; check-here runs a check as the seat does (hq issues 285, 286)2026-10-07 00:05:09 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
(The hq issues were renumbered from 282/283 to 285/286, because 282 was taken on main. The test names and code comments follow, in commit 8bf7026.)
Issue 285: the gate judged nothing. Every gated check said
PASS … (0 of 4 compose): no machine composed in the gate's store, with the change or without, so "breaks what composed" could never fire. The causes:brokersecret was raised without its bus account (issue 203);--jsonverdict.Fixed by:
KeepSettingsfor raised layers;--jsonmode.A machine the mesh composes that the gate cannot raise now makes the verdict
error, never a pass. The facts also scrub resource names.On the live facts: 4 of 4 compose.
Issue 286: the repository check disagreed with the agents' machines.
mesh-controller check-hererunsbuilder.Checkon the checkout's HEAD exactly as the seat would be asked to: the planner's scope from the facts, the siblings at the refs the facts carry (beside), the toolchain the facts name (versions.toolchains), as root, against a throwaway store and bus. Check containers setsafe.directory. A failed script is summarised by what failed.Verified:
check-hereon this branch → 4 of 4 compose, repo-check PASS. Live seat: build-1791330541277252555 → PASS (4 of 4 compose), repository PASS.Tests:
TestIssue285AModuleOnTheBusComposesInTheGate,TestIssue285AMachineTheGateCannotRaiseIsAnErrorNeverAPass,TestAWithheldPathIsStoodInForByAPath,TestAWithheldPathStaysAPath,TestAFailedScriptIsSaidByWhatFailed,TestACheckByHandClonesWhatTheSeatClones.Delivery
novox/mesh-controller@0d2fd2c5bb34— delivered since 2026-10-07T00:12:46ZDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
a011743cmesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedChange plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1791329980791165731(builds --log build-1791329980791165731).Merge check at
0d2fd2c5mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedChange plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791330541277252555(builds --log build-1791330541277252555).The gate raises the mesh as it is, and a baseline that does not compose is an error; check-here runs a check as the seat does (hq issues 282, 283)to The gate raises the mesh as it is, and a baseline that does not compose is an error; check-here runs a check as the seat does (hq issues 285, 286)