Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C) #111

Merged

mesh-admin merged 1 commits from feat/health-the-provider-hold into main 2026-10-07 16:32:35 +00:00

Conversation 2 Commits 1 Files Changed 4

+459 -4

mesh-admin commented 2026-10-07 13:07:29 +00:00

Contributor

Copy Link

Copy Source

Stacked on #110 (Phase B) — this branch carries #110's commit; review the last commit only, merge after #110.

Phase C of to-be 48 (ADR 0240 rule 5):

• A consumer resource's finding is held when it is a finding of its declared check (not down/restarting), the check names a provision in needs, and that provision's provider for this consumer is unhealthy on the record (its condition open, or its machine's newest statement says it unhealthy). The provider for a consumer is its recorded binding (ADR 0232), else the machine its pair credential for the provision is from and the module there that offers it (issue 181's record is not built yet; the grant is the record, as to-be 48 §6 says).
• A held consumer raises nothing of its own (an open one is cleared, saying it is held under the provider). The provider's condition is observed again with waiting on it — <module> on <machine>, … in its evidence, N consumer(s) wait on it in its summary, severity urgent — whichever machine's statement arrives first.
• The gate: a new judging word healthWaiting — not a pass, and never a failure at the bound: the judging waits while the provider's own condition says what is wrong.
• Provider healthy again: a consumer still failing is raised at once on its next statement (its streak stood).

Done-when test TestOneProviderDownAndThreeConsumersFailingAreOneCondition: one database provider down, three consumers (two machines) failing their needs: postgres-database checks → exactly one condition, at the provider, urgent, listing all three; each consumer's gate word is waiting; a full judgeMoves past the bound puts nothing back; after recovery only the consumer still failing is raised. Mutation check: with the hold disabled the test fails with four conditions. TestAConsumerFailingBesideAHealthyProviderIsItsOwn.

Full suite with a test store passes. check-here: merge-gate PASS (4 of 4 compose), repo-check PASS.

**Stacked on #110 (Phase B)** — this branch carries #110's commit; review the last commit only, merge after #110. Phase C of to-be 48 (ADR 0240 rule 5): - A consumer resource's finding is **held** when it is a finding of its declared check (not `down`/`restarting`), the check names a provision in `needs`, and that provision's provider *for this consumer* is unhealthy on the record (its condition open, or its machine's newest statement says it unhealthy). The provider for a consumer is its recorded binding (ADR 0232), else the machine its pair credential for the provision is from and the module there that offers it (issue 181's record is not built yet; the grant is the record, as to-be 48 §6 says). - A held consumer raises nothing of its own (an open one is cleared, saying it is held under the provider). The provider's condition is observed again with `waiting on it — <module> on <machine>, …` in its evidence, `N consumer(s) wait on it` in its summary, severity **urgent** — whichever machine's statement arrives first. - The gate: a new judging word `healthWaiting` — not a pass, and never a failure at the bound: the judging waits while the provider's own condition says what is wrong. - Provider healthy again: a consumer still failing is raised at once on its next statement (its streak stood). Done-when test `TestOneProviderDownAndThreeConsumersFailingAreOneCondition`: one database provider down, three consumers (two machines) failing their `needs: postgres-database` checks → exactly one condition, at the provider, urgent, listing all three; each consumer's gate word is `waiting`; a full `judgeMoves` past the bound puts nothing back; after recovery only the consumer still failing is raised. Mutation check: with the hold disabled the test fails with four conditions. `TestAConsumerFailingBesideAHealthyProviderIsItsOwn`. Full suite with a test store passes. check-here: merge-gate PASS (4 of 4 compose), repo-check PASS.

jschoubben added 2 commits 2026-10-07 14:17:54 +00:00

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B) ... b98fd0f396

A module could say nothing about what ready means for what it runs, so a web
application with its port open and its requests hanging passed everything for
eleven hours (issue 145). A long-running resource now carries `health` — the
image's own check adopted by name, http, tcp, exec, unit or a module's own tool,
with its timing — refused near its author when it names a port or an address,
an endpoint the module does not declare, a tool it does not serve, a tool check
alone, or a timing outside the record's bounds. It is composed with the endpoint
as the port this machine published it on, and sent only to a node-engine whose
statement says it reads it: an older one would refuse the whole declaration.
The engine is granted its own machine's instance of each health tool. `module
check` warns of every long-running resource without `health`, counts them for
the catalogue, and refuses them from 2026-11-18. A check's findings stay out of
a condition's summary. The node-engine's validator is vendored at its Phase B
commit, so what is composed is judged by the words the engine takes.

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C) ... 4291fee68e

With twelve consumers of the database provision, one provider down would be
twelve conditions for one fault and twelve gates failed for something none of
them did. A consumer's check names the provision it exercises; while the
provider composed for it — its recorded binding, or the machine its credential
comes from — is unhealthy on the record, what that check finds raises nothing
of its own: the provider's condition lists it as waiting and is urgent, and
the consumer's gate waits, past its bound too, rather than putting a build
back. Liveness findings and checks naming no provision stay the consumer's own,
and once the provider is healthy a consumer still failing is raised at once.

jschoubben force-pushed feat/health-the-provider-hold from cada9d8307 to 4291fee68e 2026-10-07 14:17:54 +00:00 Compare

mesh-admin commented 2026-10-07 14:18:39 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-controller@4291fee68e95 — delivered since 2026-10-07T16:47:26Z

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

• tier 0: mesh-controller
• tier 1: build-agent
• tier 2: route-proxy
• ace: receives build-agent, route-proxy
• g14: receives build-agent
• novox: receives mesh-controller, build-agent, route-proxy
• shanks: receives build-agent
• build-agent keeps data (ADR 0233): what it holds is backed up before it moves
• route-proxy provides route: its consumers are sent again after it
• route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Machines

• mesh-controller on novox: passed — healthy 3 times over 3m38s
• mesh-controller on the rest running it: sent
• build-agent on ace: passed — healthy 3 times over 3m30s
• build-agent on the rest running it: sent
• route-proxy on ace: passed — healthy 3 times over 3m25s
• route-proxy on the rest running it: sent

Transitions

• 2026-10-07 14:18 (new) → proposed (announced): novox/mesh-controller#111's head announced
• 2026-10-07 14:28 proposed → checked (checked): the verdict names this commit
• 2026-10-07 14:28 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-07 16:32 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-07 16:32 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
• 2026-10-07 16:47 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@4291fee68e95` — **delivered** since 2026-10-07T16:47:26Z **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - mesh-controller on novox: passed — healthy 3 times over 3m38s - mesh-controller on the rest running it: sent - build-agent on ace: passed — healthy 3 times over 3m30s - build-agent on the rest running it: sent - route-proxy on ace: passed — healthy 3 times over 3m25s - route-proxy on the rest running it: sent **Transitions** - 2026-10-07 14:18 (new) → proposed (announced): novox/mesh-controller#111's head announced - 2026-10-07 14:28 proposed → checked (checked): the verdict names this commit - 2026-10-07 14:28 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-07 16:32 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-07 16:32 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-07 16:47 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented 2026-10-07 14:28:32 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 4291fee6

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
• mesh/repo-check: PASS — its merge-check.sh passed

Change plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

• tier 0: mesh-controller
• tier 1: build-agent
• tier 2: route-proxy
• ace: receives build-agent, route-proxy
• g14: receives build-agent
• novox: receives mesh-controller, build-agent, route-proxy
• shanks: receives build-agent
• build-agent keeps data (ADR 0233): what it holds is backed up before it moves
• route-proxy provides route: its consumers are sent again after it
• route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on shanks as build-1791382696137130628 (builds --log build-1791382696137130628).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 46 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T13:56:37Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T13:56:37Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.039s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	446.420s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.051s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.063s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.051s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.234s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.074s
ok  	github.com/novox/mesh-controller/internal/broker	2.520s
ok  	github.com/novox/mesh-controller/internal/builder	1.518s
ok  	github.com/novox/mesh-controller/internal/catalogue	4.187s
ok  	github.com/novox/mesh-controller/internal/conditions	2.020s
ok  	github.com/novox/mesh-controller/internal/envfile	1.051s
ok  	github.com/novox/mesh-controller/internal/facts	1.057s
ok  	github.com/novox/mesh-controller/internal/identity	41.523s
ok  	github.com/novox/mesh-controller/internal/inventory	274.970s
ok  	github.com/novox/mesh-controller/internal/lease	17.690s
ok  	github.com/novox/mesh-controller/internal/licences	37.865s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.052s
ok  	github.com/novox/mesh-controller/internal/link	83.521s
ok  	github.com/novox/mesh-controller/internal/lint	1.936s
ok  	github.com/novox/mesh-controller/internal/outward	1.081s
ok  	github.com/novox/mesh-controller/internal/overlay	1.067s
ok  	github.com/novox/mesh-controller/internal/secrets	1.489s
ok  	github.com/novox/mesh-controller/internal/store	18.308s
ok  	github.com/novox/mesh-controller/internal/testbus	1.221s
ok  	github.com/novox/mesh-controller/internal/token	1.013s

**Merge check** at `4291fee6` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Change plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on shanks as `build-1791382696137130628` (`builds --log build-1791382696137130628`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 46 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T13:56:37Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-07T13:56:37Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.039s ok github.com/novox/mesh-controller/cmd/mesh-controller 446.420s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.051s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.063s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.051s ok github.com/novox/mesh-controller/examples/route-proxy 1.234s ok github.com/novox/mesh-controller/internal/artifacts 1.074s ok github.com/novox/mesh-controller/internal/broker 2.520s ok github.com/novox/mesh-controller/internal/builder 1.518s ok github.com/novox/mesh-controller/internal/catalogue 4.187s ok github.com/novox/mesh-controller/internal/conditions 2.020s ok github.com/novox/mesh-controller/internal/envfile 1.051s ok github.com/novox/mesh-controller/internal/facts 1.057s ok github.com/novox/mesh-controller/internal/identity 41.523s ok github.com/novox/mesh-controller/internal/inventory 274.970s ok github.com/novox/mesh-controller/internal/lease 17.690s ok github.com/novox/mesh-controller/internal/licences 37.865s ok github.com/novox/mesh-controller/internal/licences/adapters 1.052s ok github.com/novox/mesh-controller/internal/link 83.521s ok github.com/novox/mesh-controller/internal/lint 1.936s ok github.com/novox/mesh-controller/internal/outward 1.081s ok github.com/novox/mesh-controller/internal/overlay 1.067s ok github.com/novox/mesh-controller/internal/secrets 1.489s ok github.com/novox/mesh-controller/internal/store 18.308s ok github.com/novox/mesh-controller/internal/testbus 1.221s ok github.com/novox/mesh-controller/internal/token 1.013s ```

mesh-admin merged commit a5a132ac15 into main 2026-10-07 16:32:35 +00:00

mesh-admin deleted branch feat/health-the-provider-hold 2026-10-07 16:32:36 +00:00

mesh-admin referenced this pull request 2026-10-14 01:22:12 +00:00

List the provider-hold tests among the store tests (hq issue 145, to-be 48 Phase C) #319

This repo is archived. You cannot comment on pull requests.

Reviewers

No Reviewers

Labels

Clear labels

mesh/ready

Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent

No Assignees

2 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#111