A take is a comparison: the preview, its refusals, the strays, and the policy said at build (hq ADR 0163) #201

2026-10-01T19:25:49Z

mesh-admin commented

2026-10-01 19:25:49 +00:00

The controller's half of hq ADR 0163 (group 6), reading what mesh-host #63 reports:

take <node> <module> prints the comparison for every held thing of the module — the found image and its age against the declared one, the found networks and who else is on them, published ports and mounts against what the module declares, a found file's difference from the declared content — and takes nothing; --yes cuts over as previewed. An older image refuses without --downgrade; a differing file refuses without --replace <path> (or --replace '*'). A held thing from a host older than #63 carries no facts, refuses nothing, and is listed as before.
The report's held things carry the facts (jsonb, no schema change) and its strays are kept (migration 0053); node show lists both.
build and the daemon's take-in say when a module's policy will roll the result out at once (issue 126).
The own-secret refusal points at --provider for a secret the module requires (issue 100).

Tests: the preview and its refusals over fixture facts; the existing suite. make check on the branch. Merge before the host's #63 or after, either works.

The controller's half of hq ADR 0163 (group 6), reading what mesh-host #63 reports: - `take <node> <module>` prints the comparison for every held thing of the module — the found image and its age against the declared one, the found networks and who else is on them, published ports and mounts against what the module declares, a found file's difference from the declared content — and takes nothing; `--yes` cuts over as previewed. An older image refuses without `--downgrade`; a differing file refuses without `--replace <path>` (or `--replace '*'`). A held thing from a host older than #63 carries no facts, refuses nothing, and is listed as before. - The report's held things carry the facts (jsonb, no schema change) and its strays are kept (migration 0053); `node show` lists both. - `build` and the daemon's take-in say when a module's policy will roll the result out at once (issue 126). - The own-secret refusal points at `--provider` for a secret the module requires (issue 100). Tests: the preview and its refusals over fixture facts; the existing suite. `make check` on the branch. Merge before the host's #63 or after, either works.

mesh-admin added 1 commit 2026-10-01 19:25:49 +00:00

A take is a comparison: the preview, its refusals, the strays, and the policy said at build (hq ADR 0163) 73a34cc0a7

The host now reports, for every held thing, the facts a take compares; the controller keeps them, and
take puts them beside what the module declares — the found image and its age against the declared one,
the found networks and who else is on them, ports and mounts, a found file's difference from the
declared content — and refuses a downgrade without --downgrade and a differing file without --replace
<path>. Without --yes the comparison is printed and nothing is taken. node show lists the facts and
the strays the machine reports. build and the daemon's take-in say when a module's policy rolls the
result out at once. The own-secret refusal points at the provider form for a required secret.

mesh-admin merged commit 9a99c422a1 into main

2026-10-01 19:28:35 +00:00

mesh-admin deleted branch feat/a-take-is-a-comparison

2026-10-01 19:28:35 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#201