give: take a module's own secret through a hidden prompt at the operator's desk (hq ADR 0259 §10) #156

2026-10-08T15:12:28Z

mesh-admin commented

2026-10-08 15:12:28 +00:00

Step 6 of hq ADR 0259 (hq #211): the operator gives a module's own secret, such as the Telegram bot token, without it ever passing through an agent's session, a chat or a call record.

What

New mesh-controller verb give {node, module, secret, at}. It runs secret accept <node> <module> <secret> --at-desk <at>. The value is never an argument and never in the answer.
secret accept --at-desk <machine>:
1. refuses a module the mesh does not know, or a name its definition does not declare as an own secret, before anybody is asked to type;
2. makes a sealing keypair for this one call;
3. asks node-launcher.secret on the desk's machine, by request and reply, with that public key;
4. opens the sealed answer and seals it to the module's machine exactly as secret accept does (AcceptGivenSecret), then forgets it;
5. records the act in the hand-act log (secret accept, cause given-at-the-desk, counted as a person's decision, not a repair).
  The answer is only " on now holds , given at the desk on and sealed to ; run push <node> to send it", or a refusal in words.
The node-launcher seat promises a new verb secret, optional (ADR 0246 step 1): a prompt that shows nothing of what is typed, answered sealed to the asker's key. rofi serves it in mesh-catalog (same branch name).
The controller is granted mesh.seat.node-launcher.tool.secret.* (VerbsTheControllerAsksForASecret), the one grant change; the golden is updated with it alone.

Why sealed to a per-call key: the prompt's answer travels the bus and the desk's tool runner, which record calls. Sealed, the plaintext exists only in the rofi process and in this command, for the length of the call.

What remains (ADR 0234's accepted residual risk):

On an X11 desk any program of the operator's account can read the keys as they are typed.
A program that asks node-launcher.secret itself, with a key of its own, gets what the operator types into a prompt they did not start, just as it could by drawing a window of its own. The prompt says who asks and for what, so the operator types only into a prompt they started.
The prompt waits 25 seconds, the bound of a tool call in the runner. A dismissed, empty or late prompt changes nothing and says so.

Tests (cmd/mesh-controller/desk_secret_test.go)

The value typed is the one sealed, and appears in no answer, prompt argument or recorded act.
An unknown module or undeclared secret is refused with nobody asked.
No desk is refused.
Timeout, dismissal, empty answer, an answer sealed to another key, and an unreachable desk each take nothing and record nothing, and no error carries the value.
give maps to the command; the controller may ask the desk.
Also: the verb-schema flag accounting (--from, --provider and --local withheld from give), the launcher seat's verbs, and the controller's manifest serving give.

sh merge-check.sh passes locally.

Merge order: this first. Then mesh-catalog's rofi PR (same branch name), which serves secret and is refused by a controller that does not promise it. Then a later controller change makes secret required (ADR 0246 step 3).

Note for hq ADR 0259 §10: the record says "the vault gains a verb". It is built in the controller's secret accept path, which is where own secrets are accepted and sealed today (the vault module only serves the operator-sealed export). If that wording should change, hq #211 can say it.

Do not merge without review.

Step 6 of hq ADR 0259 (hq #211): the operator gives a module's own secret, such as the Telegram bot token, without it ever passing through an agent's session, a chat or a call record. **What** - New mesh-controller verb **`give`** `{node, module, secret, at}`. It runs `secret accept <node> <module> <secret> --at-desk <at>`. The value is never an argument and never in the answer. - `secret accept --at-desk <machine>`: 1. refuses a module the mesh does not know, or a name its definition does not declare as an own secret, **before** anybody is asked to type; 2. makes a sealing keypair for this one call; 3. asks `node-launcher.secret` on the desk's machine, by request and reply, with that public key; 4. opens the sealed answer and seals it to the module's machine exactly as `secret accept` does (`AcceptGivenSecret`), then forgets it; 5. records the act in the hand-act log (`secret accept`, cause `given-at-the-desk`, counted as a person's decision, not a repair). The answer is only "<module> on <node> now holds <secret>, given at the desk on <at> and sealed to <node>; run `push <node>` to send it", or a refusal in words. - The `node-launcher` seat promises a new verb **`secret`, optional** (ADR 0246 step 1): a prompt that shows nothing of what is typed, answered sealed to the asker's key. rofi serves it in mesh-catalog (same branch name). - The controller is granted `mesh.seat.node-launcher.tool.secret.*` (`VerbsTheControllerAsksForASecret`), the one grant change; the golden is updated with it alone. **Why sealed to a per-call key:** the prompt's answer travels the bus and the desk's tool runner, which record calls. Sealed, the plaintext exists only in the rofi process and in this command, for the length of the call. **What remains** (ADR 0234's accepted residual risk): - On an X11 desk any program of the operator's account can read the keys as they are typed. - A program that asks `node-launcher.secret` itself, with a key of its own, gets what the operator types into a prompt they did not start, just as it could by drawing a window of its own. The prompt says who asks and for what, so the operator types only into a prompt they started. - The prompt waits 25 seconds, the bound of a tool call in the runner. A dismissed, empty or late prompt changes nothing and says so. **Tests** (`cmd/mesh-controller/desk_secret_test.go`) - The value typed is the one sealed, and appears in no answer, prompt argument or recorded act. - An unknown module or undeclared secret is refused with nobody asked. - No desk is refused. - Timeout, dismissal, empty answer, an answer sealed to another key, and an unreachable desk each take nothing and record nothing, and no error carries the value. - `give` maps to the command; the controller may ask the desk. - Also: the verb-schema flag accounting (`--from`, `--provider` and `--local` withheld from `give`), the launcher seat's verbs, and the controller's manifest serving `give`. `sh merge-check.sh` passes locally. **Merge order:** this first. Then mesh-catalog's rofi PR (same branch name), which serves `secret` and is refused by a controller that does not promise it. Then a later controller change makes `secret` required (ADR 0246 step 3). Note for hq ADR 0259 §10: the record says "the vault gains a verb". It is built in the controller's `secret accept` path, which is where own secrets are accepted and sealed today (the vault module only serves the operator-sealed export). If that wording should change, hq #211 can say it. Do not merge without review.

mesh-admin commented

2026-10-08 15:15:38 +00:00

Delivery novox/mesh-controller@fa19a2d71871 — delivered since 2026-10-09T14:47:44Z

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Machines

mesh-controller on novox: passed — healthy 3 times over 4m17s
mesh-controller on the rest running it: sent
build-agent on ace: passed — healthy 3 times over 3m30s
build-agent on the rest running it: sent
route-proxy on ace: passed — healthy 3 times over 3m46s
route-proxy on the rest running it: sent

Transitions

2026-10-09 14:23 (new) → proposed (announced): novox/mesh-controller#156's head announced
2026-10-09 14:30 proposed → checked (checked): the verdict names this commit
2026-10-09 14:30 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-09 14:30 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-09 14:30 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
2026-10-09 14:47 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@fa19a2d71871` — **delivered** since 2026-10-09T14:47:44Z **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - mesh-controller on novox: passed — healthy 3 times over 4m17s - mesh-controller on the rest running it: sent - build-agent on ace: passed — healthy 3 times over 3m30s - build-agent on the rest running it: sent - route-proxy on ace: passed — healthy 3 times over 3m46s - route-proxy on the rest running it: sent **Transitions** - 2026-10-09 14:23 (new) → proposed (announced): novox/mesh-controller#156's head announced - 2026-10-09 14:30 proposed → checked (checked): the verdict names this commit - 2026-10-09 14:30 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-09 14:30 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-09 14:30 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-09 14:47 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented

2026-10-08 15:27:07 +00:00

Merge check at aa783614

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.82s)

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on shanks as build-1791472528333488855 (builds --log build-1791472528333488855).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 52 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T15:20:36Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-08T15:20:36Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.033s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	183.440s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.046s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.061s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.052s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.222s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.088s
--- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.82s)
    genesis_template_test.go:37: the installer's user list does not let the controller publish [mesh.seat.node-launcher.tool.secret.*] — it would come up and be refused on the first thing it tried
FAIL
FAIL	github.com/novox/mesh-controller/internal/broker	1.706s
ok  	github.com/novox/mesh-controller/internal/builder	1.934s
ok  	github.com/novox/mesh-controller/internal/catalogue	4.753s
ok  	github.com/novox/mesh-controller/internal/conditions	2.227s
ok  	github.com/novox/mesh-controller/internal/envfile	1.056s
ok  	github.com/novox/mesh-controller/internal/facts	1.060s
ok  	github.com/novox/mesh-controller/internal/identity	4.659s
ok  	github.com/novox/mesh-controller/internal/inventory	83.885s
ok  	github.com/novox/mesh-controller/internal/lease	17.696s
ok  	github.com/novox/mesh-controller/internal/licences	4.235s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.058s
ok  	github.com/novox/mesh-controller/internal/link	46.436s
ok  	github.com/novox/mesh-controller/internal/lint	2.109s
ok  	github.com/novox/mesh-controller/internal/outward	1.083s
ok  	github.com/novox/mesh-controller/internal/overlay	1.073s
ok  	github.com/novox/mesh-controller/internal/secrets	1.531s
ok  	github.com/novox/mesh-controller/internal/store	3.425s
ok  	github.com/novox/mesh-controller/internal/testbus	1.232s
ok  	github.com/novox/mesh-controller/internal/token	1.016s
FAIL

**Merge check** at `aa783614` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.82s) **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on shanks as `build-1791472528333488855` (`builds --log build-1791472528333488855`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 52 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-08T15:20:36Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-08T15:20:36Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.033s ok github.com/novox/mesh-controller/cmd/mesh-controller 183.440s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.046s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.061s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.052s ok github.com/novox/mesh-controller/examples/route-proxy 1.222s ok github.com/novox/mesh-controller/internal/artifacts 1.088s --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.82s) genesis_template_test.go:37: the installer's user list does not let the controller publish [mesh.seat.node-launcher.tool.secret.*] — it would come up and be refused on the first thing it tried FAIL FAIL github.com/novox/mesh-controller/internal/broker 1.706s ok github.com/novox/mesh-controller/internal/builder 1.934s ok github.com/novox/mesh-controller/internal/catalogue 4.753s ok github.com/novox/mesh-controller/internal/conditions 2.227s ok github.com/novox/mesh-controller/internal/envfile 1.056s ok github.com/novox/mesh-controller/internal/facts 1.060s ok github.com/novox/mesh-controller/internal/identity 4.659s ok github.com/novox/mesh-controller/internal/inventory 83.885s ok github.com/novox/mesh-controller/internal/lease 17.696s ok github.com/novox/mesh-controller/internal/licences 4.235s ok github.com/novox/mesh-controller/internal/licences/adapters 1.058s ok github.com/novox/mesh-controller/internal/link 46.436s ok github.com/novox/mesh-controller/internal/lint 2.109s ok github.com/novox/mesh-controller/internal/outward 1.083s ok github.com/novox/mesh-controller/internal/overlay 1.073s ok github.com/novox/mesh-controller/internal/secrets 1.531s ok github.com/novox/mesh-controller/internal/store 3.425s ok github.com/novox/mesh-controller/internal/testbus 1.232s ok github.com/novox/mesh-controller/internal/token 1.016s FAIL ```

jschoubben force-pushed feat/a-secret-given-at-the-desk from aa7836140f to cf8ada7699

2026-10-09 09:09:09 +00:00

Compare

mesh-admin commented

2026-10-09 09:15:00 +00:00

Merge check at cf8ada76

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.62s)

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on g14 as build-1791536951218529251 (builds --log build-1791536951218529251).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 53 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T08:07:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T08:07:39Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.028s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	189.892s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.008s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.022s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.010s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.173s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.047s
--- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.62s)
    genesis_template_test.go:37: the installer's user list does not let the controller publish [mesh.seat.node-launcher.tool.secret.*] — it would come up and be refused on the first thing it tried
FAIL
FAIL	github.com/novox/mesh-controller/internal/broker	1.518s
ok  	github.com/novox/mesh-controller/internal/builder	1.808s
ok  	github.com/novox/mesh-controller/internal/catalogue	4.302s
ok  	github.com/novox/mesh-controller/internal/conditions	2.352s
ok  	github.com/novox/mesh-controller/internal/envfile	1.026s
ok  	github.com/novox/mesh-controller/internal/facts	1.034s
ok  	github.com/novox/mesh-controller/internal/identity	4.112s
ok  	github.com/novox/mesh-controller/internal/inventory	81.104s
ok  	github.com/novox/mesh-controller/internal/lease	17.688s
ok  	github.com/novox/mesh-controller/internal/licences	3.664s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.006s
ok  	github.com/novox/mesh-controller/internal/link	52.409s
ok  	github.com/novox/mesh-controller/internal/lint	1.873s
ok  	github.com/novox/mesh-controller/internal/outward	1.026s
ok  	github.com/novox/mesh-controller/internal/overlay	1.020s
ok  	github.com/novox/mesh-controller/internal/secrets	1.405s
ok  	github.com/novox/mesh-controller/internal/store	3.136s
ok  	github.com/novox/mesh-controller/internal/testbus	1.169s
ok  	github.com/novox/mesh-controller/internal/token	1.013s
FAIL

**Merge check** at `cf8ada76` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.62s) **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on g14 as `build-1791536951218529251` (`builds --log build-1791536951218529251`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 53 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T08:07:39Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T08:07:39Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.028s ok github.com/novox/mesh-controller/cmd/mesh-controller 189.892s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.008s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.022s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.010s ok github.com/novox/mesh-controller/examples/route-proxy 1.173s ok github.com/novox/mesh-controller/internal/artifacts 1.047s --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.62s) genesis_template_test.go:37: the installer's user list does not let the controller publish [mesh.seat.node-launcher.tool.secret.*] — it would come up and be refused on the first thing it tried FAIL FAIL github.com/novox/mesh-controller/internal/broker 1.518s ok github.com/novox/mesh-controller/internal/builder 1.808s ok github.com/novox/mesh-controller/internal/catalogue 4.302s ok github.com/novox/mesh-controller/internal/conditions 2.352s ok github.com/novox/mesh-controller/internal/envfile 1.026s ok github.com/novox/mesh-controller/internal/facts 1.034s ok github.com/novox/mesh-controller/internal/identity 4.112s ok github.com/novox/mesh-controller/internal/inventory 81.104s ok github.com/novox/mesh-controller/internal/lease 17.688s ok github.com/novox/mesh-controller/internal/licences 3.664s ok github.com/novox/mesh-controller/internal/licences/adapters 1.006s ok github.com/novox/mesh-controller/internal/link 52.409s ok github.com/novox/mesh-controller/internal/lint 1.873s ok github.com/novox/mesh-controller/internal/outward 1.026s ok github.com/novox/mesh-controller/internal/overlay 1.020s ok github.com/novox/mesh-controller/internal/secrets 1.405s ok github.com/novox/mesh-controller/internal/store 3.136s ok github.com/novox/mesh-controller/internal/testbus 1.169s ok github.com/novox/mesh-controller/internal/token 1.013s FAIL ```

mesh-admin commented

2026-10-09 10:29:59 +00:00

Merge check at a95157a4

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.55s)

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on g14 as build-1791541468456177706 (builds --log build-1791541468456177706).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 53 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T08:07:39Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T08:07:39Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.028s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	202.332s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.024s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.033s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.024s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.242s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.059s
--- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.55s)
    genesis_template_test.go:37: the installer's user list does not let the controller publish [mesh.seat.node-launcher.tool.secret.*] — it would come up and be refused on the first thing it tried
FAIL
FAIL	github.com/novox/mesh-controller/internal/broker	2.528s
ok  	github.com/novox/mesh-controller/internal/builder	4.342s
ok  	github.com/novox/mesh-controller/internal/catalogue	4.571s
ok  	github.com/novox/mesh-controller/internal/conditions	2.460s
ok  	github.com/novox/mesh-controller/internal/envfile	1.024s
ok  	github.com/novox/mesh-controller/internal/facts	1.029s
ok  	github.com/novox/mesh-controller/internal/identity	6.092s
ok  	github.com/novox/mesh-controller/internal/inventory	87.225s
ok  	github.com/novox/mesh-controller/internal/lease	17.744s
ok  	github.com/novox/mesh-controller/internal/licences	5.700s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.010s
ok  	github.com/novox/mesh-controller/internal/link	54.652s
ok  	github.com/novox/mesh-controller/internal/lint	1.839s
ok  	github.com/novox/mesh-controller/internal/outward	1.033s
ok  	github.com/novox/mesh-controller/internal/overlay	1.021s
ok  	github.com/novox/mesh-controller/internal/secrets	1.384s
ok  	github.com/novox/mesh-controller/internal/store	4.097s
ok  	github.com/novox/mesh-controller/internal/testbus	1.171s
ok  	github.com/novox/mesh-controller/internal/token	1.013s
FAIL

**Merge check** at `a95157a4` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.55s) **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on g14 as `build-1791541468456177706` (`builds --log build-1791541468456177706`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 53 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T08:07:39Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T08:07:39Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.028s ok github.com/novox/mesh-controller/cmd/mesh-controller 202.332s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.024s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.033s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.024s ok github.com/novox/mesh-controller/examples/route-proxy 1.242s ok github.com/novox/mesh-controller/internal/artifacts 1.059s --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.55s) genesis_template_test.go:37: the installer's user list does not let the controller publish [mesh.seat.node-launcher.tool.secret.*] — it would come up and be refused on the first thing it tried FAIL FAIL github.com/novox/mesh-controller/internal/broker 2.528s ok github.com/novox/mesh-controller/internal/builder 4.342s ok github.com/novox/mesh-controller/internal/catalogue 4.571s ok github.com/novox/mesh-controller/internal/conditions 2.460s ok github.com/novox/mesh-controller/internal/envfile 1.024s ok github.com/novox/mesh-controller/internal/facts 1.029s ok github.com/novox/mesh-controller/internal/identity 6.092s ok github.com/novox/mesh-controller/internal/inventory 87.225s ok github.com/novox/mesh-controller/internal/lease 17.744s ok github.com/novox/mesh-controller/internal/licences 5.700s ok github.com/novox/mesh-controller/internal/licences/adapters 1.010s ok github.com/novox/mesh-controller/internal/link 54.652s ok github.com/novox/mesh-controller/internal/lint 1.839s ok github.com/novox/mesh-controller/internal/outward 1.033s ok github.com/novox/mesh-controller/internal/overlay 1.021s ok github.com/novox/mesh-controller/internal/secrets 1.384s ok github.com/novox/mesh-controller/internal/store 4.097s ok github.com/novox/mesh-controller/internal/testbus 1.171s ok github.com/novox/mesh-controller/internal/token 1.013s FAIL ```

jschoubben force-pushed feat/a-secret-given-at-the-desk from a95157a4a7 to 500f74de6d

2026-10-09 11:36:14 +00:00

Compare

mesh-admin commented

2026-10-09 11:36:21 +00:00

Restacked on #157 (head 411049a, itself on #154 0c828fb on #164 926dbd7), as the merge order needs: #164, #154, #157 (with mesh-host #59), mesh-host #68, then this. Head 500f74d.

One new commit: #164 makes every secret accept the controller's terminal's alone; give composes secret accept <node> <module> <secret> --at-desk <machine>, which carries no value, so exactly that line (and nothing with a value, a file, a provider or an extra word) passes the rule. Test: TestOnlyTheGiveLinePassesTheTerminalRuleForSecrets.

sh merge-check.sh passes locally (EXIT 0, whole suite with -race, store on a throwaway PostgreSQL) with mesh-host #68 (088ac14, carrying #59's and this PR's grants) beside it. On the forge the installer-list test stays red until mesh-host #59 and #68 are on main. Do not merge without review.

Restacked on #157 (head 411049a, itself on #154 0c828fb on #164 926dbd7), as the merge order needs: #164, #154, #157 (with mesh-host #59), mesh-host #68, then this. Head 500f74d. One new commit: #164 makes every `secret accept` the controller's terminal's alone; `give` composes `secret accept <node> <module> <secret> --at-desk <machine>`, which carries no value, so exactly that line (and nothing with a value, a file, a provider or an extra word) passes the rule. Test: `TestOnlyTheGiveLinePassesTheTerminalRuleForSecrets`. `sh merge-check.sh` passes locally (EXIT 0, whole suite with -race, store on a throwaway PostgreSQL) with mesh-host #68 (088ac14, carrying #59's and this PR's grants) beside it. On the forge the installer-list test stays red until mesh-host #59 and #68 are on main. Do not merge without review.

mesh-admin commented

2026-10-09 11:41:50 +00:00

Merge check at 500f74de

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.74s)

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on shanks as build-1791545791424666742 (builds --log build-1791545791424666742).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 54 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T11:35:23Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T11:35:23Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.042s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	199.249s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.015s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.041s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.053s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.232s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.073s
--- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.74s)
    genesis_template_test.go:37: the installer's user list does not let the controller publish [$KV.mesh-controller_asked.> mesh.seat.mesh-controller.tool.plans mesh.seat.mesh-delivery.tool.release mesh.seat.mesh-delivery.tool.stop mesh.seat.node-launcher.tool.secret.* mesh.seat.node-service-manager.tool.restart.*] — it would come up and be refused on the first thing it tried
    genesis_template_test.go:41: the installer's user list does not let the controller subscribe [mesh.seat.operator-channel.event.decided.mesh-controller]
FAIL
FAIL	github.com/novox/mesh-controller/internal/broker	1.799s
ok  	github.com/novox/mesh-controller/internal/builder	1.965s
ok  	github.com/novox/mesh-controller/internal/catalogue	4.942s
ok  	github.com/novox/mesh-controller/internal/conditions	2.561s
ok  	github.com/novox/mesh-controller/internal/envfile	1.053s
ok  	github.com/novox/mesh-controller/internal/facts	1.056s
ok  	github.com/novox/mesh-controller/internal/identity	4.696s
ok  	github.com/novox/mesh-controller/internal/inventory	84.178s
ok  	github.com/novox/mesh-controller/internal/lease	17.708s
ok  	github.com/novox/mesh-controller/internal/licences	4.259s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.049s
ok  	github.com/novox/mesh-controller/internal/link	53.283s
ok  	github.com/novox/mesh-controller/internal/lint	2.210s
ok  	github.com/novox/mesh-controller/internal/outward	1.088s
ok  	github.com/novox/mesh-controller/internal/overlay	1.076s
ok  	github.com/novox/mesh-controller/internal/secrets	1.531s
ok  	github.com/novox/mesh-controller/internal/store	3.439s
ok  	github.com/novox/mesh-controller/internal/testbus	1.229s
ok  	github.com/novox/mesh-controller/internal/token	1.015s
FAIL

**Merge check** at `500f74de` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.74s) **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on shanks as `build-1791545791424666742` (`builds --log build-1791545791424666742`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 54 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T11:35:23Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T11:35:23Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.042s ok github.com/novox/mesh-controller/cmd/mesh-controller 199.249s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.015s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.041s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.053s ok github.com/novox/mesh-controller/examples/route-proxy 1.232s ok github.com/novox/mesh-controller/internal/artifacts 1.073s --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.74s) genesis_template_test.go:37: the installer's user list does not let the controller publish [$KV.mesh-controller_asked.> mesh.seat.mesh-controller.tool.plans mesh.seat.mesh-delivery.tool.release mesh.seat.mesh-delivery.tool.stop mesh.seat.node-launcher.tool.secret.* mesh.seat.node-service-manager.tool.restart.*] — it would come up and be refused on the first thing it tried genesis_template_test.go:41: the installer's user list does not let the controller subscribe [mesh.seat.operator-channel.event.decided.mesh-controller] FAIL FAIL github.com/novox/mesh-controller/internal/broker 1.799s ok github.com/novox/mesh-controller/internal/builder 1.965s ok github.com/novox/mesh-controller/internal/catalogue 4.942s ok github.com/novox/mesh-controller/internal/conditions 2.561s ok github.com/novox/mesh-controller/internal/envfile 1.053s ok github.com/novox/mesh-controller/internal/facts 1.056s ok github.com/novox/mesh-controller/internal/identity 4.696s ok github.com/novox/mesh-controller/internal/inventory 84.178s ok github.com/novox/mesh-controller/internal/lease 17.708s ok github.com/novox/mesh-controller/internal/licences 4.259s ok github.com/novox/mesh-controller/internal/licences/adapters 1.049s ok github.com/novox/mesh-controller/internal/link 53.283s ok github.com/novox/mesh-controller/internal/lint 2.210s ok github.com/novox/mesh-controller/internal/outward 1.088s ok github.com/novox/mesh-controller/internal/overlay 1.076s ok github.com/novox/mesh-controller/internal/secrets 1.531s ok github.com/novox/mesh-controller/internal/store 3.439s ok github.com/novox/mesh-controller/internal/testbus 1.229s ok github.com/novox/mesh-controller/internal/token 1.015s FAIL ```

jschoubben force-pushed feat/a-secret-given-at-the-desk from 500f74de6d to 045dddaede

2026-10-09 13:00:33 +00:00

Compare

mesh-admin commented

2026-10-09 13:01:02 +00:00

Confirmation-review round (2026-10-09), N1-give fixed, restacked on #157 29d6495.

The secret of a module running as its own account (Telegram's bot token, the router's, the desk channel's) is refused at the desk before anybody is asked, naming the terminal line: mesh-controller secret accept <node> telegram telegram-token. A desk prompt is answered over the desk machine's bus, where an agent holding that runtime's credential could answer first with its own token.
At the terminal, such a secret is announced on every channel (the old bot among them, still on its old token until push) before it is kept, and not kept if the announcement fails; typing is not echoed.
TestOnlyTheDeskMachinesLauncherMayAnswerItsPrompt (new broker.MaySubscribe) holds that only the desk machine's runtime carrying the launcher answers its prompt.
give's allowed line still passes terminalOnly under #176's mesh-cli lines; it now ends in the refusal for a trusted module.
merge-check.sh passed locally with mesh-host #68 beside it, but for one timing flake in internal/link (TestNatsABuildIsTakenAndItsOutcomeReachesEverybody), which passed 3/3 alone and in a full rerun of the package under -race. Merge with mesh-host #68.

**Confirmation-review round (2026-10-09), N1-give fixed**, restacked on #157 29d6495. - The secret of a module running as its own account (Telegram's bot token, the router's, the desk channel's) is refused at the desk before anybody is asked, naming the terminal line: `mesh-controller secret accept <node> telegram telegram-token`. A desk prompt is answered over the desk machine's bus, where an agent holding that runtime's credential could answer first with its own token. - At the terminal, such a secret is announced on every channel (the old bot among them, still on its old token until push) before it is kept, and not kept if the announcement fails; typing is not echoed. - `TestOnlyTheDeskMachinesLauncherMayAnswerItsPrompt` (new `broker.MaySubscribe`) holds that only the desk machine's runtime carrying the launcher answers its prompt. - `give`'s allowed line still passes terminalOnly under #176's mesh-cli lines; it now ends in the refusal for a trusted module. merge-check.sh passed locally with mesh-host #68 beside it, but for one timing flake in internal/link (TestNatsABuildIsTakenAndItsOutcomeReachesEverybody), which passed 3/3 alone and in a full rerun of the package under -race. Merge with mesh-host #68.

mesh-admin commented

2026-10-09 13:06:46 +00:00

Merge check at 045dddae

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.77s)

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on shanks as build-1791550856862086963 (builds --log build-1791550856862086963).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 54 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T12:52:20Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T12:52:20Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.038s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	210.457s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.028s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.043s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.048s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.209s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.083s
--- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.77s)
    genesis_template_test.go:37: the installer's user list does not let the controller publish [$KV.mesh-controller_asked.> mesh.seat.mesh-controller.tool.plans mesh.seat.mesh-delivery.tool.release mesh.seat.mesh-delivery.tool.stop mesh.seat.node-launcher.tool.secret.* mesh.seat.node-service-manager.tool.restart.*] — it would come up and be refused on the first thing it tried
    genesis_template_test.go:41: the installer's user list does not let the controller subscribe [mesh.seat.operator-channel.event.decided.mesh-controller]
FAIL
FAIL	github.com/novox/mesh-controller/internal/broker	1.834s
ok  	github.com/novox/mesh-controller/internal/builder	1.986s
ok  	github.com/novox/mesh-controller/internal/catalogue	5.020s
ok  	github.com/novox/mesh-controller/internal/conditions	2.549s
ok  	github.com/novox/mesh-controller/internal/envfile	1.050s
ok  	github.com/novox/mesh-controller/internal/facts	1.058s
ok  	github.com/novox/mesh-controller/internal/identity	4.745s
ok  	github.com/novox/mesh-controller/internal/inventory	85.173s
ok  	github.com/novox/mesh-controller/internal/lease	17.717s
ok  	github.com/novox/mesh-controller/internal/licences	4.313s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.038s
ok  	github.com/novox/mesh-controller/internal/link	53.545s
ok  	github.com/novox/mesh-controller/internal/lint	2.263s
ok  	github.com/novox/mesh-controller/internal/outward	1.091s
ok  	github.com/novox/mesh-controller/internal/overlay	1.087s
ok  	github.com/novox/mesh-controller/internal/secrets	1.553s
ok  	github.com/novox/mesh-controller/internal/store	3.485s
ok  	github.com/novox/mesh-controller/internal/testbus	1.267s
ok  	github.com/novox/mesh-controller/internal/token	1.020s
FAIL

**Merge check** at `045dddae` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.77s) **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on shanks as `build-1791550856862086963` (`builds --log build-1791550856862086963`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 54 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T12:52:20Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T12:52:20Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.038s ok github.com/novox/mesh-controller/cmd/mesh-controller 210.457s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.028s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.043s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.048s ok github.com/novox/mesh-controller/examples/route-proxy 1.209s ok github.com/novox/mesh-controller/internal/artifacts 1.083s --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.77s) genesis_template_test.go:37: the installer's user list does not let the controller publish [$KV.mesh-controller_asked.> mesh.seat.mesh-controller.tool.plans mesh.seat.mesh-delivery.tool.release mesh.seat.mesh-delivery.tool.stop mesh.seat.node-launcher.tool.secret.* mesh.seat.node-service-manager.tool.restart.*] — it would come up and be refused on the first thing it tried genesis_template_test.go:41: the installer's user list does not let the controller subscribe [mesh.seat.operator-channel.event.decided.mesh-controller] FAIL FAIL github.com/novox/mesh-controller/internal/broker 1.834s ok github.com/novox/mesh-controller/internal/builder 1.986s ok github.com/novox/mesh-controller/internal/catalogue 5.020s ok github.com/novox/mesh-controller/internal/conditions 2.549s ok github.com/novox/mesh-controller/internal/envfile 1.050s ok github.com/novox/mesh-controller/internal/facts 1.058s ok github.com/novox/mesh-controller/internal/identity 4.745s ok github.com/novox/mesh-controller/internal/inventory 85.173s ok github.com/novox/mesh-controller/internal/lease 17.717s ok github.com/novox/mesh-controller/internal/licences 4.313s ok github.com/novox/mesh-controller/internal/licences/adapters 1.038s ok github.com/novox/mesh-controller/internal/link 53.545s ok github.com/novox/mesh-controller/internal/lint 2.263s ok github.com/novox/mesh-controller/internal/outward 1.091s ok github.com/novox/mesh-controller/internal/overlay 1.087s ok github.com/novox/mesh-controller/internal/secrets 1.553s ok github.com/novox/mesh-controller/internal/store 3.485s ok github.com/novox/mesh-controller/internal/testbus 1.267s ok github.com/novox/mesh-controller/internal/token 1.020s FAIL ```

jschoubben added 15 commits 2026-10-09 14:23:03 +00:00

Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259) 8de4dc7951

Ask at most three at a time, wait out a refusal, need a router, and act only on a claimed open ask, as the review asked (hq ADR 0259) 744b0b9162

Bind each asked option to the exact act, and perform only that act on its warrant (hq ADR 0259 §6) 0909d7b125

Every option the controller asks with carries the digest of its verb, machine, arguments and level
(the SDK's Option.Binds). A warrant must name the digest of the ask the controller keeps, and before
acting the controller checks that the act it is about to perform is the one the option bound: a
record changed after the ask is refused, never performed. mesh-sdk moves to d4077b4.

Compose and raise the bus of the lab's proof of the operator's answers, as this controller would (hq ADR 0259) 2190e2c664

mesh-lab's asks proof runs the router, the Telegram channel and an asker on a real bus. Its accounts,
streams, workers, buckets and memberships come from this test at the controller's commit, so the lab
proves the composition and not a copy of it. Skipped unless the lab asks.

Add drill: an ask the operator starts at the controller's terminal, whose approval performs nothing and is recorded (hq ADR 0259) 646c5e53db

The live acceptance needs an approval the operator can ask for at will and that changes nothing. A
drill is asked like any condition's ask, bound to its own act, claimed once on its warrant and recorded
as a warrant hand-act with who answered, through which channel and the proofs. A verb's process may not
start one, so no agent asks the operator a question they did not start.

Say loudly when a condition that needs the operator could not be asked on any channel (hq ADR 0259) ad406e81b8

With no router, or an ask the router refused and nothing changed since, the controller asked nothing
and said it only in its own log. It now keeps a condition of its own, asks-undelivered, naming the
conditions not asked and why, cleared once each can be asked again.

Ask an acknowledgement apart from an approval, change every kept ask by compare-and-set, and rehearse rather than drill (hq ADR 0259, review M1/L2/L3/L7) 799eec0a5a

- M1: a condition offering both kinds of answer is asked twice: its authorising answers about the
  condition, its acknowledging ones (Silence) apart, so an answer from a channel that only acknowledges
  never ends an approval.
- L2: the asked store creates once and changes only over the revision it read, deciding again on what it
  reads; a stale cancel no longer writes over an act.
- L3: every ask is kept before it is published, one whose publishing failed is marked unsent and asked
  again, and a cancel is kept before it is said. The terminal's test question is now `rehearse`, so it is
  not called what the glossary calls a drill; its two answers are both approve-level.
- L7: two deliveries of one warrant to two controllers at once act exactly once, on a real bus.
- Re-vendored onto mesh-sdk 76902998 (canonical digests): an option binds an asks.Act with each argument
  as arg.<name>.
- The lab's bus fixture composes verified-sender only where the lab says its machine is root-free
  (MESH_LAB_ASKS_ROOT_FREE=true).

Start a rehearsal only at the controller's terminal as main now judges it (hq ADR 0259, ADR 0272) d19c9ed5b7

rehearse refused only a verb's process. Since mesh-cli (ADR 0272 §4) the serving controller runs an
ordinary mesh-cli line without a verb, naming its caller: such a line, from an agent's account, read as
the terminal and could start a question the operator did not ask. rehearse now asks
startedAtTheTerminal. And main's mesh-cli test helper asked is cliAsked, beside the asker's asked.

Keep an approval asked through a silence of its condition (hq ADR 0259, the confirmation review's M1) 74d35600a6

Choosing Silence silenced the condition, the condition was no longer wanted, and the next reconcile
cancelled the Restart or Release ask beside it: an acknowledgement, which any desk click may give,
took an approval back. An open approval ask now stays until it is answered or expires while its
condition is open and silenced with the same answers. The test silences as the controller does; it
failed before (0 open) and passes, and the kept Restart is performed on its warrant.

Move to mesh-sdk 16984aa, rebased on its main, which refuses a warrant with no time or for an ask with no expiry

mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…

Details

mesh/repo-check fail: its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.56s)

Details

mesh/delivery stopped: the pull request closed unmerged

Details

0559b80887

Take a module's own secret through a hidden prompt on the operator's desk, so a bot token never passes through an agent's session (hq ADR 0259 §10) 5689553406

give: take only a value a person holds, ask the desk by name, let the controller alone ask it, and announce every value given be59f29f46

The review of 2026-10-09 (M4):
- give refuses broker (the bus account issue mints) and any own secret the mesh may make itself;
- the desk's prompt is asked by module, secret and machine, never with words of the caller's, and the
  bus denies the prompt's subjects to every principal but the controller, however wide its grant, so the
  prompt's 'the controller asks' is the bus's word (Permissions.PublishDeny, broker.ControllerOnly);
- secret accept with a value is refused through a verb: a value comes from the terminal or the desk;
- every value given for an own secret, at the terminal or the desk, raises the urgent condition
  secret-given on every channel, until the operator silences it.

Let the give verb's exact line past the terminal rule for secrets, and nothing else (hq ADR 0259 §10, ADR 0266) ed331eb972

Restacked on #157, which carries #164's rule that no verb runs secret accept. give's line carries no value:
the operator types it into the desk's hidden prompt, sealed to the call and then to the module's machine.
Only that exact line passes: a value, a file, a provider or any extra word stays the terminal's.

give: never take a trusted party's secret at a desk, and announce it before it is kept (hq ADR 0259 §10, the confirmation review's N1-give) 3e5086a2f6

A desk's prompt is answered over the desk machine's bus, on a subject that machine's runtime answers;
on a desk machine agents run as the operator, who holds that credential, so an agent could answer first
with a bot token of its own sealed to the call's key. The secret of a module running as an account of
its own (the Telegram bot's token) is now refused at the desk, before anybody is asked, naming the line
to type at the controller's terminal; there it is announced on every channel, the old one among them,
before it is kept, and not kept when that announcement fails. What is typed at the terminal is not
echoed. Tests: the refusal with nobody asked, and only the desk machine's launcher may answer its
prompt (MaySubscribe).

give: test that a trusted party's secret given at the terminal is announced before it is kept, and refuse an unknown machine before anybody types

mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery delivered

Details

fa19a2d718

The terminal path's order is one function, keepGiven, so the test fails when the announcement before a
trusted party's secret is removed, and when a failed announcement still keeps it. give also refuses a
machine the mesh does not know, as the secret's or as the desk, before the prompt (the final review).

jschoubben force-pushed feat/a-secret-given-at-the-desk from 045dddaede to fa19a2d718

2026-10-09 14:23:03 +00:00

Compare

mesh-admin commented

2026-10-09 14:30:01 +00:00

Merge check at fa19a2d7

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on novox as build-1791555803368315890 (builds --log build-1791555803368315890).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 54 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T14:22:44Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T14:22:44Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.043s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	239.919s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.020s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.025s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.015s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.114s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.054s
ok  	github.com/novox/mesh-controller/internal/broker	2.971s
ok  	github.com/novox/mesh-controller/internal/builder	2.750s
ok  	github.com/novox/mesh-controller/internal/catalogue	5.165s
ok  	github.com/novox/mesh-controller/internal/conditions	2.494s
ok  	github.com/novox/mesh-controller/internal/envfile	1.028s
ok  	github.com/novox/mesh-controller/internal/facts	1.032s
ok  	github.com/novox/mesh-controller/internal/identity	4.982s
ok  	github.com/novox/mesh-controller/internal/inventory	95.482s
ok  	github.com/novox/mesh-controller/internal/lease	17.684s
ok  	github.com/novox/mesh-controller/internal/licences	4.525s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.010s
ok  	github.com/novox/mesh-controller/internal/link	55.251s
ok  	github.com/novox/mesh-controller/internal/lint	2.249s
ok  	github.com/novox/mesh-controller/internal/outward	1.031s
ok  	github.com/novox/mesh-controller/internal/overlay	1.020s
ok  	github.com/novox/mesh-controller/internal/secrets	1.470s
ok  	github.com/novox/mesh-controller/internal/store	3.310s
ok  	github.com/novox/mesh-controller/internal/testbus	1.194s
ok  	github.com/novox/mesh-controller/internal/token	1.015s

**Merge check** at `fa19a2d7` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on novox as `build-1791555803368315890` (`builds --log build-1791555803368315890`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 54 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T14:22:44Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T14:22:44Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.043s ok github.com/novox/mesh-controller/cmd/mesh-controller 239.919s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.020s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.025s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.015s ok github.com/novox/mesh-controller/examples/route-proxy 1.114s ok github.com/novox/mesh-controller/internal/artifacts 1.054s ok github.com/novox/mesh-controller/internal/broker 2.971s ok github.com/novox/mesh-controller/internal/builder 2.750s ok github.com/novox/mesh-controller/internal/catalogue 5.165s ok github.com/novox/mesh-controller/internal/conditions 2.494s ok github.com/novox/mesh-controller/internal/envfile 1.028s ok github.com/novox/mesh-controller/internal/facts 1.032s ok github.com/novox/mesh-controller/internal/identity 4.982s ok github.com/novox/mesh-controller/internal/inventory 95.482s ok github.com/novox/mesh-controller/internal/lease 17.684s ok github.com/novox/mesh-controller/internal/licences 4.525s ok github.com/novox/mesh-controller/internal/licences/adapters 1.010s ok github.com/novox/mesh-controller/internal/link 55.251s ok github.com/novox/mesh-controller/internal/lint 2.249s ok github.com/novox/mesh-controller/internal/outward 1.031s ok github.com/novox/mesh-controller/internal/overlay 1.020s ok github.com/novox/mesh-controller/internal/secrets 1.470s ok github.com/novox/mesh-controller/internal/store 3.310s ok github.com/novox/mesh-controller/internal/testbus 1.194s ok github.com/novox/mesh-controller/internal/token 1.015s ```

mesh-admin merged commit e6b00e2e51 into main

2026-10-09 14:30:47 +00:00

mesh-admin deleted branch feat/a-secret-given-at-the-desk

2026-10-09 14:30:47 +00:00

This repo is archived. You cannot comment on pull requests.

2 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#156