novox/mesh-controller
Archived
9
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Judge the one protection rule the forge applies, and keep a recorded repository id (#174 follow-up) #177

Merged
mesh-admin merged 1 commits from fix/the-forges-first-rule-and-a-kept-identity into main 2026-10-09 11:14:28 +00:00
Conversation 2 Commits 1 Files Changed 3
+81 -23
mesh-admin commented 2026-10-09 11:04:01 +00:00
Contributor
Copy Link
Copy Source

These are the two small follow-ups to #174 from the confirmation review, based on main after #174 and #175 merged.

  • The forge's rule. askTheForge used to pass a branch if any covering rule guarded it. It now judges the single rule the forge applies (judgedRule): the rule named for the branch, otherwise the first glob rule in the forge's order that covers it. Before this, [exact main: push allowed, glob *: guarded] was read as guarded.
  • A kept identity. SetSourceIdentity(module, 0) used to clear the recorded forge id; this happened at the terminal when the forge could not give one. It now keeps the recorded id (coalesce(nullif($2,0), source_repo_id)). A terminal move to another repository whose id the forge cannot give therefore keeps the old id. The next registration through a verb is then refused for the id mismatch, which is loud, until the forge answers at the terminal.

Tests: TestTheRuleJudgedIsTheOneTheForgeApplies and TestAnUnknownIdentityKeepsTheRecordedOne. Both fail against the old behaviour (three assertions) and pass now. merge-check.sh passes on this head, which is current main plus this commit.

These are the two small follow-ups to #174 from the confirmation review, based on main after #174 and #175 merged. - **The forge's rule.** `askTheForge` used to pass a branch if *any* covering rule guarded it. It now judges the single rule the forge applies (`judgedRule`): the rule named for the branch, otherwise the first glob rule in the forge's order that covers it. Before this, `[exact main: push allowed, glob *: guarded]` was read as guarded. - **A kept identity.** `SetSourceIdentity(module, 0)` used to clear the recorded forge id; this happened at the terminal when the forge could not give one. It now keeps the recorded id (`coalesce(nullif($2,0), source_repo_id)`). A terminal move to another repository whose id the forge cannot give therefore keeps the old id. The next registration through a verb is then refused for the id mismatch, which is loud, until the forge answers at the terminal. Tests: `TestTheRuleJudgedIsTheOneTheForgeApplies` and `TestAnUnknownIdentityKeepsTheRecordedOne`. Both fail against the old behaviour (three assertions) and pass now. `merge-check.sh` passes on this head, which is current main plus this commit.
mesh-admin added 1 commit 2026-10-09 11:04:01 +00:00
Judge the one protection rule the forge applies, and keep a recorded repository id
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
eca6390d6f 
The forge applies the rule named for a branch, else the first glob covering
it; the judge passed a branch whose applied rule let pushes when a later rule
happened to guard it. And a registration whose id the forge could not give
cleared the id already recorded (the confirmation review of 2026-10-09).
mesh-admin commented 2026-10-09 11:04:14 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-controller@eca6390d6fe4 — delivered since 2026-10-09T11:35:10Z

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Machines

  • mesh-controller on novox: passed — healthy 3 times over 3m39s
  • mesh-controller on the rest running it: sent
  • build-agent on ace: passed — healthy 3 times over 3m26s
  • build-agent on the rest running it: sent
  • route-proxy on ace: passed — healthy 3 times over 3m16s
  • route-proxy on the rest running it: sent

Transitions

  • 2026-10-09 11:04 (new) → proposed (announced): novox/mesh-controller#177's head announced
  • 2026-10-09 11:09 proposed → checked (checked): the verdict names this commit
  • 2026-10-09 11:09 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-09 11:14 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-09 11:14 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
  • 2026-10-09 11:35 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@eca6390d6fe4` — **delivered** since 2026-10-09T11:35:10Z **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Machines** - mesh-controller on novox: passed — healthy 3 times over 3m39s - mesh-controller on the rest running it: sent - build-agent on ace: passed — healthy 3 times over 3m26s - build-agent on the rest running it: sent - route-proxy on ace: passed — healthy 3 times over 3m16s - route-proxy on the rest running it: sent **Transitions** - 2026-10-09 11:04 (new) → proposed (announced): novox/mesh-controller#177's head announced - 2026-10-09 11:09 proposed → checked (checked): the verdict names this commit - 2026-10-09 11:09 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-09 11:14 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-09 11:14 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-09 11:35 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-admin commented 2026-10-09 11:09:43 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at eca6390d

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Run by the build seat on g14 as build-1791543851622083437 (builds --log build-1791543851622083437).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 52 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T11:00:37Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-09T11:00:37Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.030s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	197.930s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.015s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.024s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.013s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.175s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.046s
ok  	github.com/novox/mesh-controller/internal/broker	2.486s
ok  	github.com/novox/mesh-controller/internal/builder	1.777s
ok  	github.com/novox/mesh-controller/internal/catalogue	4.343s
ok  	github.com/novox/mesh-controller/internal/conditions	2.324s
ok  	github.com/novox/mesh-controller/internal/envfile	1.029s
ok  	github.com/novox/mesh-controller/internal/facts	1.027s
ok  	github.com/novox/mesh-controller/internal/identity	4.065s
ok  	github.com/novox/mesh-controller/internal/inventory	77.002s
ok  	github.com/novox/mesh-controller/internal/lease	17.697s
ok  	github.com/novox/mesh-controller/internal/licences	3.667s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.007s
ok  	github.com/novox/mesh-controller/internal/link	50.898s
ok  	github.com/novox/mesh-controller/internal/lint	1.942s
ok  	github.com/novox/mesh-controller/internal/outward	1.025s
ok  	github.com/novox/mesh-controller/internal/overlay	1.021s
ok  	github.com/novox/mesh-controller/internal/secrets	1.391s
ok  	github.com/novox/mesh-controller/internal/store	3.194s
ok  	github.com/novox/mesh-controller/internal/testbus	1.170s
ok  	github.com/novox/mesh-controller/internal/token	1.012s
**Merge check** at `eca6390d` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves Run by the build seat on g14 as `build-1791543851622083437` (`builds --log build-1791543851622083437`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 52 tool(s); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-09T11:00:37Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-09T11:00:37Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.030s ok github.com/novox/mesh-controller/cmd/mesh-controller 197.930s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.015s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.024s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.013s ok github.com/novox/mesh-controller/examples/route-proxy 1.175s ok github.com/novox/mesh-controller/internal/artifacts 1.046s ok github.com/novox/mesh-controller/internal/broker 2.486s ok github.com/novox/mesh-controller/internal/builder 1.777s ok github.com/novox/mesh-controller/internal/catalogue 4.343s ok github.com/novox/mesh-controller/internal/conditions 2.324s ok github.com/novox/mesh-controller/internal/envfile 1.029s ok github.com/novox/mesh-controller/internal/facts 1.027s ok github.com/novox/mesh-controller/internal/identity 4.065s ok github.com/novox/mesh-controller/internal/inventory 77.002s ok github.com/novox/mesh-controller/internal/lease 17.697s ok github.com/novox/mesh-controller/internal/licences 3.667s ok github.com/novox/mesh-controller/internal/licences/adapters 1.007s ok github.com/novox/mesh-controller/internal/link 50.898s ok github.com/novox/mesh-controller/internal/lint 1.942s ok github.com/novox/mesh-controller/internal/outward 1.025s ok github.com/novox/mesh-controller/internal/overlay 1.021s ok github.com/novox/mesh-controller/internal/secrets 1.391s ok github.com/novox/mesh-controller/internal/store 3.194s ok github.com/novox/mesh-controller/internal/testbus 1.170s ok github.com/novox/mesh-controller/internal/token 1.012s ```
mesh-admin merged commit 33dc85d850 into main 2026-10-09 11:14:28 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#177