novox/mesh-controller
Archived
9
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

The machine's own resolver is a node seat, and the uplink steps back from the resolver file where it is held (hq ADR 0247) #120

Merged
mesh-admin merged 2 commits from feat/node-resolver-seat into main 2026-10-07 19:46:09 +00:00
Conversation 2 Commits 2 Files Changed 7
+359 -7
mesh-admin commented 2026-10-07 19:34:20 +00:00
Contributor
Copy Link
Copy Source

hq ADR 0247, to-be 50 phase A.

  • New node seat node-resolver (internal/catalogue/node_resolver.go), with verbs routes, route {link, domains, servers} and unroute {link}. They are required from the start, because nothing holds the seat yet (ADR 0246). The closed set grows from 37 to 38.
  • The uplink steps back. On a machine where a module holds node-resolver and renders /etc/resolv.conf, the uplink holder's rendering of that path is not composed (stepsBack, used in Declaration and in checkResources). Only the uplink's holder steps back. A third module writing the file is still refused. Every machine without the seat composes exactly as before.
  • Tests: the seat and its verbs; composition with and without the resolver; only the uplink steps back; the catalogue's holders provide split-dns at the machine's reach. One test composes the catalogue's systemd-resolved beside an uplink and is skipped while the catalogue has none. TestTheCataloguesUplinksWriteTheResolverFileAndNothingElseDoes now allows a node-resolver holder.

merge-check.sh passes locally (without a test store).

Order: this must be merged and running before mesh-catalog's systemd-resolved PR can pass its check, because that check reads manifests with the controller the mesh runs, which does not know the seat yet.

hq ADR 0247, to-be 50 phase A. - **New node seat `node-resolver`** (`internal/catalogue/node_resolver.go`), with verbs `routes`, `route {link, domains, servers}` and `unroute {link}`. They are required from the start, because nothing holds the seat yet (ADR 0246). The closed set grows from 37 to 38. - **The uplink steps back.** On a machine where a module holds `node-resolver` and renders `/etc/resolv.conf`, the uplink holder's rendering of that path is not composed (`stepsBack`, used in `Declaration` and in `checkResources`). Only the uplink's holder steps back. A third module writing the file is still refused. Every machine without the seat composes exactly as before. - **Tests:** the seat and its verbs; composition with and without the resolver; only the uplink steps back; the catalogue's holders provide `split-dns` at the machine's reach. One test composes the catalogue's `systemd-resolved` beside an uplink and is skipped while the catalogue has none. `TestTheCataloguesUplinksWriteTheResolverFileAndNothingElseDoes` now allows a `node-resolver` holder. `merge-check.sh` passes locally (without a test store). **Order:** this must be merged and **running** before mesh-catalog's `systemd-resolved` PR can pass its check, because that check reads manifests with the controller the mesh runs, which does not know the seat yet.
mesh-admin added 2 commits 2026-10-07 19:34:20 +00:00
The machine's own resolver is a node seat, and the uplink steps back from the resolver file where it is held (hq ADR 0247) 036b6cc873 
A machine with a VPN client that writes /etc/resolv.conf needs its domains
routed to the VPN's servers while every other name still goes to the mesh's
resolvers. node-resolver's holder does that on the machine, owns the resolver
file there, and serves routes, route and unroute. The uplink's holder steps
back from the file only where the resolver is held; every other machine
composes as before.
Compose the catalogue's systemd-resolved beside an uplink in a test (hq ADR 0247)
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
697395af32
mesh-admin commented 2026-10-07 19:34:39 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-controller@697395af32b3 — delivered since 2026-10-07T20:04:20Z

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Machines

  • mesh-controller on novox: passed — healthy 3 times over 3m39s
  • mesh-controller on the rest running it: sent
  • build-agent on ace: passed — healthy 3 times over 3m21s
  • build-agent on the rest running it: sent
  • route-proxy on ace: passed — healthy 3 times over 3m34s
  • route-proxy on the rest running it: sent

Transitions

  • 2026-10-07 19:34 (new) → proposed (announced): novox/mesh-controller#120's head announced
  • 2026-10-07 19:43 proposed → checked (checked): the verdict names this commit
  • 2026-10-07 19:43 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-07 19:46 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-07 19:46 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
  • 2026-10-07 20:04 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@697395af32b3` — **delivered** since 2026-10-07T20:04:20Z **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - mesh-controller on novox: passed — healthy 3 times over 3m39s - mesh-controller on the rest running it: sent - build-agent on ace: passed — healthy 3 times over 3m21s - build-agent on the rest running it: sent - route-proxy on ace: passed — healthy 3 times over 3m34s - route-proxy on the rest running it: sent **Transitions** - 2026-10-07 19:34 (new) → proposed (announced): novox/mesh-controller#120's head announced - 2026-10-07 19:43 proposed → checked (checked): the verdict names this commit - 2026-10-07 19:43 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-07 19:46 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-07 19:46 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-07 20:04 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-admin commented 2026-10-07 19:43:51 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at 697395af

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on ace as build-1791401662660883922 (builds --log build-1791401662660883922).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 46 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T19:29:04Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T19:29:04Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.031s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	452.658s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.013s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.016s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.013s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.142s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.031s
ok  	github.com/novox/mesh-controller/internal/broker	2.385s
ok  	github.com/novox/mesh-controller/internal/builder	1.381s
ok  	github.com/novox/mesh-controller/internal/catalogue	3.699s
ok  	github.com/novox/mesh-controller/internal/conditions	2.012s
ok  	github.com/novox/mesh-controller/internal/envfile	1.051s
ok  	github.com/novox/mesh-controller/internal/facts	1.053s
ok  	github.com/novox/mesh-controller/internal/identity	49.609s
ok  	github.com/novox/mesh-controller/internal/inventory	289.404s
ok  	github.com/novox/mesh-controller/internal/lease	17.690s
ok  	github.com/novox/mesh-controller/internal/licences	46.523s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.094s
ok  	github.com/novox/mesh-controller/internal/link	86.593s
ok  	github.com/novox/mesh-controller/internal/lint	1.806s
ok  	github.com/novox/mesh-controller/internal/outward	1.082s
ok  	github.com/novox/mesh-controller/internal/overlay	1.060s
ok  	github.com/novox/mesh-controller/internal/secrets	1.440s
ok  	github.com/novox/mesh-controller/internal/store	24.208s
ok  	github.com/novox/mesh-controller/internal/testbus	1.219s
ok  	github.com/novox/mesh-controller/internal/token	1.014s
**Merge check** at `697395af` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on ace as `build-1791401662660883922` (`builds --log build-1791401662660883922`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 46 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T19:29:04Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-07T19:29:04Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.031s ok github.com/novox/mesh-controller/cmd/mesh-controller 452.658s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.013s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.016s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.013s ok github.com/novox/mesh-controller/examples/route-proxy 1.142s ok github.com/novox/mesh-controller/internal/artifacts 1.031s ok github.com/novox/mesh-controller/internal/broker 2.385s ok github.com/novox/mesh-controller/internal/builder 1.381s ok github.com/novox/mesh-controller/internal/catalogue 3.699s ok github.com/novox/mesh-controller/internal/conditions 2.012s ok github.com/novox/mesh-controller/internal/envfile 1.051s ok github.com/novox/mesh-controller/internal/facts 1.053s ok github.com/novox/mesh-controller/internal/identity 49.609s ok github.com/novox/mesh-controller/internal/inventory 289.404s ok github.com/novox/mesh-controller/internal/lease 17.690s ok github.com/novox/mesh-controller/internal/licences 46.523s ok github.com/novox/mesh-controller/internal/licences/adapters 1.094s ok github.com/novox/mesh-controller/internal/link 86.593s ok github.com/novox/mesh-controller/internal/lint 1.806s ok github.com/novox/mesh-controller/internal/outward 1.082s ok github.com/novox/mesh-controller/internal/overlay 1.060s ok github.com/novox/mesh-controller/internal/secrets 1.440s ok github.com/novox/mesh-controller/internal/store 24.208s ok github.com/novox/mesh-controller/internal/testbus 1.219s ok github.com/novox/mesh-controller/internal/token 1.014s ```
mesh-admin merged commit 7dbe80ad63 into main 2026-10-07 19:46:09 +00:00
mesh-admin deleted branch feat/node-resolver-seat 2026-10-07 19:46:10 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#120