novox/mesh-controller
6
0
Fork 0
Code Issues Pull Requests 6 Releases Wiki Activity

Read a plan by its id as a parameter, never as SQL (issue 561) #268

Merged
mesh-admin merged 2 commits from fix/561-plan-id-parameter into main 2026-10-12 16:37:08 +00:00
Conversation 6 Commits 2 Files Changed 6
+116 -3
mesh-admin commented 2026-10-12 14:33:32 +00:00
Contributor
Copy Link
Copy Source

What. inventory.PlanByID takes the id as $1 instead of pasting it into the query (where id = '+id+'). RecentPlans takes its limit as $1 instead of fmt.Sprintf(... limit %d). That was an integer, so it was not exploitable, but now no plan query is built from a value.

Why. Issue 561. The id reaches PlanByID from callers of the plans verb (id, stop, close, retry, go, and wait after #266) and from the delivery verbs. On main, PlanByID("x' or '1'='1") answers another plan, and an id holding a single quote is a syntax error. A search of cmd/ and internal/ (not vendor, not tests) found no other SQL built from caller text; the list is in issue 561.

Tests. New store-backed test TestAPlanIdHoldingAQuoteIsReadAsAPlainId (internal/inventory/plan_id_test.go, added to testdata/store-tests). It checks:

  • Three ids holding quotes each fail as no plan <id> and answer no other plan.
  • A plan whose id holds quotes is read back by that id.
  • RecentPlans works with its parameter.

On main the test fails with PlanByID("x' or '1'='1") answered plan-561, a plan of another id. sh merge-check.sh against a throwaway PostgreSQL 18 passes locally: gofmt, vet, go test -race ./..., and every listed store test.

Files. internal/inventory/plans.go, the new test, and one line in testdata/store-tests. #266 also adds a line to that file, at another place, and git merge-tree merges the two cleanly. I found no other open pull request touching plans.go. #262 (issue 401) already conflicts with main in testdata/store-tests since #256 merged; this PR does not cause that.

Order. A controller rollout: merge only while mesh-controller.plans says done. It is independent of #266.

Fixes issue 561. Not merged.

**What.** `inventory.PlanByID` takes the id as `$1` instead of pasting it into the query (`where id = '`+id+`'`). `RecentPlans` takes its limit as `$1` instead of `fmt.Sprintf(... limit %d)`. That was an integer, so it was not exploitable, but now no plan query is built from a value. **Why.** Issue 561. The id reaches `PlanByID` from callers of the `plans` verb (`id`, `stop`, `close`, `retry`, `go`, and `wait` after #266) and from the delivery verbs. On main, `PlanByID("x' or '1'='1")` answers another plan, and an id holding a single quote is a syntax error. A search of `cmd/` and `internal/` (not vendor, not tests) found no other SQL built from caller text; the list is in issue 561. **Tests.** New store-backed test `TestAPlanIdHoldingAQuoteIsReadAsAPlainId` (`internal/inventory/plan_id_test.go`, added to `testdata/store-tests`). It checks: - Three ids holding quotes each fail as `no plan <id>` and answer no other plan. - A plan whose id holds quotes is read back by that id. - `RecentPlans` works with its parameter. On main the test fails with `PlanByID("x' or '1'='1") answered plan-561, a plan of another id`. `sh merge-check.sh` against a throwaway PostgreSQL 18 passes locally: gofmt, vet, `go test -race ./...`, and every listed store test. **Files.** `internal/inventory/plans.go`, the new test, and one line in `testdata/store-tests`. #266 also adds a line to that file, at another place, and `git merge-tree` merges the two cleanly. I found no other open pull request touching `plans.go`. #262 (issue 401) already conflicts with main in `testdata/store-tests` since #256 merged; this PR does not cause that. **Order.** A controller rollout: merge only while `mesh-controller.plans` says done. It is independent of #266. Fixes issue 561. Not merged.
mesh-admin added 1 commit 2026-10-12 14:33:32 +00:00
Read a plan by its id as a parameter, never as SQL (issue 561)
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery superseded: a newer head of the same pull request
Details
e9f060e0be 
PlanByID pasted its id into the query, and the id comes from a caller of
the plans verb: an id holding a quote changed the query (x' or '1'='1
answered another plan). The id is now $1, and RecentPlans's limit too, so
no plan query is built from a value.
mesh-admin commented 2026-10-12 14:34:03 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-controller@a1a6f6493d50 — delivered since 2026-10-12T16:46:09Z

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine

Machines

  • mesh-controller on novox: passed — healthy 3 times over 4m8s
  • mesh-controller on the rest running it: sent
  • build-agent on ace: passed — healthy 1 times over 1m45s
  • build-agent on the rest running it: sent

Transitions

  • 2026-10-12 14:46 (new) → proposed (announced): novox/mesh-controller#268's head announced
  • 2026-10-12 14:59 proposed → checked (checked): the verdict names this commit
  • 2026-10-12 14:59 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-12 16:37 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-12 16:37 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-12 16:46 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@a1a6f6493d50` — **delivered** since 2026-10-12T16:46:09Z **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine **Machines** - mesh-controller on novox: passed — healthy 3 times over 4m8s - mesh-controller on the rest running it: sent - build-agent on ace: passed — healthy 1 times over 1m45s - build-agent on the rest running it: sent **Transitions** - 2026-10-12 14:46 (new) → proposed (announced): novox/mesh-controller#268's head announced - 2026-10-12 14:59 proposed → checked (checked): the verdict names this commit - 2026-10-12 14:59 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-12 16:37 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-12 16:37 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-12 16:46 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-admin commented 2026-10-12 14:40:37 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at e9f060e0

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine

Run by the build seat on ace as build-1791815656892902064 (builds --log build-1791815656892902064).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T14:25:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T14:25:57Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.044s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	240.938s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.020s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.025s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.019s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.154s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.136s
?   	github.com/novox/mesh-controller/internal/beside	[no test files]
ok  	github.com/novox/mesh-controller/internal/broker	4.269s
ok  	github.com/novox/mesh-controller/internal/builder	34.526s
ok  	github.com/novox/mesh-controller/internal/catalogue	8.079s
ok  	github.com/novox/mesh-controller/internal/conditions	2.677s
ok  	github.com/novox/mesh-controller/internal/envfile	1.084s
ok  	github.com/novox/mesh-controller/internal/facts	1.109s
ok  	github.com/novox/mesh-controller/internal/identity	4.877s
ok  	github.com/novox/mesh-controller/internal/inventory	89.633s
ok  	github.com/novox/mesh-controller/internal/lease	17.763s
ok  	github.com/novox/mesh-controller/internal/licences	4.424s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.094s
ok  	github.com/novox/mesh-controller/internal/link	59.400s
ok  	github.com/novox/mesh-controller/internal/lint	2.360s
ok  	github.com/novox/mesh-controller/internal/outward	1.123s
ok  	github.com/novox/mesh-controller/internal/overlay	1.127s
ok  	github.com/novox/mesh-controller/internal/secrets	1.497s
ok  	github.com/novox/mesh-controller/internal/store	3.532s
ok  	github.com/novox/mesh-controller/internal/testbus	1.255s
ok  	github.com/novox/mesh-controller/internal/token	1.018s
store tests, each run against the store:
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.45s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.46s)
  ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.43s)
  ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.41s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.43s)
  ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.41s)
  ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.45s)
  ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.33s)
  ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.47s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.45s)
  ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.43s)
  ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.41s)
  ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.45s)
  ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.41s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.44s)
  ./cmd/mesh-controller --- PASS: TestReplay237 (0.42s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.39s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.40s)
  ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.42s)
  ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.43s)
  ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.28s)
  ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.28s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.29s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.28s)
  ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.27s)
  ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.28s)
  ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.29s)
**Merge check** at `e9f060e0` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine Run by the build seat on ace as `build-1791815656892902064` (`builds --log build-1791815656892902064`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T14:25:57Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T14:25:57Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.044s ok github.com/novox/mesh-controller/cmd/mesh-controller 240.938s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.020s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.025s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.019s ok github.com/novox/mesh-controller/examples/route-proxy 1.154s ok github.com/novox/mesh-controller/internal/artifacts 1.136s ? github.com/novox/mesh-controller/internal/beside [no test files] ok github.com/novox/mesh-controller/internal/broker 4.269s ok github.com/novox/mesh-controller/internal/builder 34.526s ok github.com/novox/mesh-controller/internal/catalogue 8.079s ok github.com/novox/mesh-controller/internal/conditions 2.677s ok github.com/novox/mesh-controller/internal/envfile 1.084s ok github.com/novox/mesh-controller/internal/facts 1.109s ok github.com/novox/mesh-controller/internal/identity 4.877s ok github.com/novox/mesh-controller/internal/inventory 89.633s ok github.com/novox/mesh-controller/internal/lease 17.763s ok github.com/novox/mesh-controller/internal/licences 4.424s ok github.com/novox/mesh-controller/internal/licences/adapters 1.094s ok github.com/novox/mesh-controller/internal/link 59.400s ok github.com/novox/mesh-controller/internal/lint 2.360s ok github.com/novox/mesh-controller/internal/outward 1.123s ok github.com/novox/mesh-controller/internal/overlay 1.127s ok github.com/novox/mesh-controller/internal/secrets 1.497s ok github.com/novox/mesh-controller/internal/store 3.532s ok github.com/novox/mesh-controller/internal/testbus 1.255s ok github.com/novox/mesh-controller/internal/token 1.018s store tests, each run against the store: ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.45s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.46s) ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.43s) ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.41s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.43s) ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.41s) ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.45s) ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.33s) ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.47s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.45s) ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.43s) ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.41s) ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.45s) ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.41s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.44s) ./cmd/mesh-controller --- PASS: TestReplay237 (0.42s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.39s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.40s) ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.42s) ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.43s) ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.28s) ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.28s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.29s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.28s) ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.27s) ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.28s) ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.29s) ```
jschoubben added 1 commit 2026-10-12 14:46:32 +00:00
Refuse a plans argument that is not a plan's id (issue 561)
mesh/merge-gate head a1a6f6493d50 merged into trunk f10aedac5880 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
Details
mesh/repo-check head a1a6f6493d50 merged into trunk f10aedac5880 — pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
a1a6f6493d 
Every argument of plans that names a plan (id, wait, stop, close, retry,
go) is checked once where the call becomes a command line, against the
ids the mesh gives plans (plan-<digits>, release-<digits>), so a quote
from a caller never reaches a command or the store (review 75 on #266).
mesh-admin commented 2026-10-12 14:51:18 +00:00
Author
Contributor
Copy Link
Copy Source

Second commit a1a6f649 (review 75 on #266): commandLine refuses every plans argument that names a plan (id, wait, stop, close, retry, go) unless it matches ^(plan|release)-[0-9]+$. Those are the only shapes the controller gives plans (plan-<nanoseconds> in batches.go, delivery.go and release_plan.go; release-<nanoseconds> in release.go). The refusal names the shape and says nothing was done. TestAPlanIdThatIsNoPlansIdIsRefusedBeforeACommandStarts checks seven bad ids against each argument, and that real plan and release ids pass.

wait is declared only by #266. Here it is refused as an undeclared argument, and once #266 is merged the same check covers it. The delivery owner's verbs that take a walk's id (deliver, delivery-stop) are not in this check; the $1 parameter protects their store reads.

A plan kept under any other id shape is no longer reachable through the plans verb. command still reaches it. merge-check.sh against a throwaway Postgres passes locally. Merge this PR before #266.

Second commit a1a6f649 (review 75 on #266): `commandLine` refuses every `plans` argument that names a plan (`id`, `wait`, `stop`, `close`, `retry`, `go`) unless it matches `^(plan|release)-[0-9]+$`. Those are the only shapes the controller gives plans (`plan-<nanoseconds>` in batches.go, delivery.go and release_plan.go; `release-<nanoseconds>` in release.go). The refusal names the shape and says nothing was done. `TestAPlanIdThatIsNoPlansIdIsRefusedBeforeACommandStarts` checks seven bad ids against each argument, and that real plan and release ids pass. `wait` is declared only by #266. Here it is refused as an undeclared argument, and once #266 is merged the same check covers it. The delivery owner's verbs that take a walk's id (`deliver`, `delivery-stop`) are not in this check; the `$1` parameter protects their store reads. A plan kept under any other id shape is no longer reachable through the `plans` verb. `command` still reaches it. `merge-check.sh` against a throwaway Postgres passes locally. Merge this PR before #266.
mesh-admin commented 2026-10-12 14:59:36 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at a1a6f649

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine

Run by the build seat on shanks as build-1791816396839177093 (builds --log build-1791816396839177093).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T14:44:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T14:44:57Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.040s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	259.165s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.038s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.054s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.058s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.239s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.093s
?   	github.com/novox/mesh-controller/internal/beside	[no test files]
ok  	github.com/novox/mesh-controller/internal/broker	4.401s
ok  	github.com/novox/mesh-controller/internal/builder	38.025s
ok  	github.com/novox/mesh-controller/internal/catalogue	7.925s
ok  	github.com/novox/mesh-controller/internal/conditions	2.711s
ok  	github.com/novox/mesh-controller/internal/envfile	1.067s
ok  	github.com/novox/mesh-controller/internal/facts	1.065s
ok  	github.com/novox/mesh-controller/internal/identity	4.904s
ok  	github.com/novox/mesh-controller/internal/inventory	97.692s
ok  	github.com/novox/mesh-controller/internal/lease	17.719s
ok  	github.com/novox/mesh-controller/internal/licences	4.361s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.052s
ok  	github.com/novox/mesh-controller/internal/link	61.302s
ok  	github.com/novox/mesh-controller/internal/lint	2.480s
ok  	github.com/novox/mesh-controller/internal/outward	1.096s
ok  	github.com/novox/mesh-controller/internal/overlay	1.077s
ok  	github.com/novox/mesh-controller/internal/secrets	1.546s
ok  	github.com/novox/mesh-controller/internal/store	3.489s
ok  	github.com/novox/mesh-controller/internal/testbus	1.245s
ok  	github.com/novox/mesh-controller/internal/token	1.017s
store tests, each run against the store:
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.42s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.43s)
  ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.43s)
  ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.41s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.39s)
  ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.37s)
  ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.44s)
  ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.31s)
  ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.45s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.55s)
  ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.41s)
  ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.41s)
  ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.47s)
  ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.42s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.46s)
  ./cmd/mesh-controller --- PASS: TestReplay237 (0.41s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.40s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.41s)
  ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.41s)
  ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.43s)
  ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.26s)
  ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.26s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.27s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.26s)
  ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.25s)
  ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.25s)
  ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.25s)
**Merge check** at `a1a6f649` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine Run by the build seat on shanks as `build-1791816396839177093` (`builds --log build-1791816396839177093`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T14:44:57Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T14:44:57Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.040s ok github.com/novox/mesh-controller/cmd/mesh-controller 259.165s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.038s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.054s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.058s ok github.com/novox/mesh-controller/examples/route-proxy 1.239s ok github.com/novox/mesh-controller/internal/artifacts 1.093s ? github.com/novox/mesh-controller/internal/beside [no test files] ok github.com/novox/mesh-controller/internal/broker 4.401s ok github.com/novox/mesh-controller/internal/builder 38.025s ok github.com/novox/mesh-controller/internal/catalogue 7.925s ok github.com/novox/mesh-controller/internal/conditions 2.711s ok github.com/novox/mesh-controller/internal/envfile 1.067s ok github.com/novox/mesh-controller/internal/facts 1.065s ok github.com/novox/mesh-controller/internal/identity 4.904s ok github.com/novox/mesh-controller/internal/inventory 97.692s ok github.com/novox/mesh-controller/internal/lease 17.719s ok github.com/novox/mesh-controller/internal/licences 4.361s ok github.com/novox/mesh-controller/internal/licences/adapters 1.052s ok github.com/novox/mesh-controller/internal/link 61.302s ok github.com/novox/mesh-controller/internal/lint 2.480s ok github.com/novox/mesh-controller/internal/outward 1.096s ok github.com/novox/mesh-controller/internal/overlay 1.077s ok github.com/novox/mesh-controller/internal/secrets 1.546s ok github.com/novox/mesh-controller/internal/store 3.489s ok github.com/novox/mesh-controller/internal/testbus 1.245s ok github.com/novox/mesh-controller/internal/token 1.017s store tests, each run against the store: ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.42s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.43s) ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.43s) ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.41s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.39s) ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.37s) ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.44s) ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.31s) ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.45s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.55s) ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.41s) ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.41s) ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.47s) ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.42s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.46s) ./cmd/mesh-controller --- PASS: TestReplay237 (0.41s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.40s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.41s) ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.41s) ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.43s) ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.26s) ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.26s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.27s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.26s) ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.25s) ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.25s) ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.25s) ```
mesh-admin left a comment
Author
Contributor
Copy Link
Copy Source

Verdict: approve at a1a6f6493d

Independent review for issue 561 (a plan id was pasted into SQL). Nothing blocking.

  • Parameters: PlanByID now uses where id = $1 and RecentPlans uses limit $1. Every i.plans(...) caller now passes either a fixed tail or $n parameters.
  • Shape check: plainPlanIDs runs first in commandLine for plans. It covers id, wait, stop, close, retry and go, so a bad id is refused before a command starts or the store is read. wait is undeclared on main and is refused there as an unknown argument. Empty or blank values are dropped in readArguments, so plans with no arguments still lists as before.
  • Every id the controller creates matches ^(plan|release)-[0-9]+$. Plan{ID: is only ever built from plan-%d (release_plan.go, delivery.go x2, batches.go x2) or release-%d (release.go). No migration inserts or rewrites release_plan ids. Ids such as plan-308-live appear only in tests, and none of those reaches argvFor: the full suite passes.
  • deliver / delivery-stop / delivery-walks: these take plan with no shape check. Each reaches the store only through PlanByID (letGo, stopWalkWithout, delivery walks --plan), which now binds the id as $1. They are safe. A shape check there would only make the refusal nicer, so it is optional.
  • Other SQL built from strings: I grepped cmd/, internal/ and examples/ and found no caller input in a query string.
    • The concatenations join fixed column lists (nodeColumns, pendingColumns, sendColumns, gateSelect, dataSelect) or fixed fragments (lastSends where-clauses with $1).
    • MarkPending takes its column from a fixed map.
    • sourceRows/Builds append fixed text with $n.
    • The postgres-provisioner example builds DDL with quoteName/quoteString, which DDL needs.
  • The new tests fail without the fix:
    • With main's plans.go, TestAPlanIdHoldingAQuoteIsReadAsAPlainId fails: "PlanByID("x' or '1'='1") answered plan-561, a plan of another id".
    • With the check disabled, TestAPlanIdThatIsNoPlansIdIsRefusedBeforeACommandStarts fails 30 times ("was composed").
  • Ran: merge-check.sh against a throwaway Postgres (MESH_TEST_POSTGRES) exits 0 under -race, and every listed store test passes, including the new one.
  • Statuses on the head: mesh/merge-gate, mesh/repo-check and mesh/delivery all read success, and the PR is mergeable.
  • Merge order with #266: main + #268 + #266 merge cleanly, and wait is refused by shape on the combined tree. I checked this on the merged tree; details are on #266.
Verdict: approve at a1a6f6493d50c4afe40e09819e661305df8eed32 Independent review for issue 561 (a plan id was pasted into SQL). Nothing blocking. - **Parameters:** `PlanByID` now uses `where id = $1` and `RecentPlans` uses `limit $1`. Every `i.plans(...)` caller now passes either a fixed tail or `$n` parameters. - **Shape check:** `plainPlanIDs` runs first in `commandLine` for `plans`. It covers `id`, `wait`, `stop`, `close`, `retry` and `go`, so a bad id is refused before a command starts or the store is read. `wait` is undeclared on main and is refused there as an unknown argument. Empty or blank values are dropped in `readArguments`, so `plans` with no arguments still lists as before. - **Every id the controller creates matches** `^(plan|release)-[0-9]+$`. `Plan{ID:` is only ever built from `plan-%d` (release_plan.go, delivery.go x2, batches.go x2) or `release-%d` (release.go). No migration inserts or rewrites release_plan ids. Ids such as `plan-308-live` appear only in tests, and none of those reaches `argvFor`: the full suite passes. - **deliver / delivery-stop / delivery-walks:** these take `plan` with no shape check. Each reaches the store only through `PlanByID` (`letGo`, `stopWalkWithout`, `delivery walks --plan`), which now binds the id as `$1`. They are safe. A shape check there would only make the refusal nicer, so it is optional. - **Other SQL built from strings:** I grepped cmd/, internal/ and examples/ and found no caller input in a query string. - The concatenations join fixed column lists (`nodeColumns`, `pendingColumns`, `sendColumns`, `gateSelect`, `dataSelect`) or fixed fragments (`lastSends` where-clauses with `$1`). - `MarkPending` takes its column from a fixed map. - `sourceRows`/`Builds` append fixed text with `$n`. - The postgres-provisioner example builds DDL with `quoteName`/`quoteString`, which DDL needs. - **The new tests fail without the fix:** - With main's plans.go, `TestAPlanIdHoldingAQuoteIsReadAsAPlainId` fails: "PlanByID(\"x' or '1'='1\") answered plan-561, a plan of another id". - With the check disabled, `TestAPlanIdThatIsNoPlansIdIsRefusedBeforeACommandStarts` fails 30 times ("was composed"). - **Ran:** `merge-check.sh` against a throwaway Postgres (MESH_TEST_POSTGRES) exits 0 under -race, and every listed store test passes, including the new one. - **Statuses on the head:** mesh/merge-gate, mesh/repo-check and mesh/delivery all read success, and the PR is mergeable. - **Merge order with #266:** main + #268 + #266 merge cleanly, and `wait` is refused by shape on the combined tree. I checked this on the merged tree; details are on #266.
mesh-admin commented 2026-10-12 16:34:27 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at a1a6f649
Judged: head a1a6f6493d50 merged into trunk f10aedac5880; read beside it: mesh-catalog 23ea0f431faf, mesh-controller-main f10aedac5880, mesh-host a1f9856b3957, mesh-tools 954e1a53eef9

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • ace: receives build-agent
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
  • read by no module's build: cmd/mesh-controller/plan_ids_test.go, internal/inventory/plan_id_test.go, testdata/store-tests

Run by the build seat on novox as build-1791822364469577788 (builds --log build-1791822364469577788).

--- the gate: build-agent, mesh-controller
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T16:17:25Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T16:17:25Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.183s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	310.180s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.016s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.025s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.021s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.142s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.062s
?   	github.com/novox/mesh-controller/internal/beside	[no test files]
ok  	github.com/novox/mesh-controller/internal/broker	5.742s
ok  	github.com/novox/mesh-controller/internal/builder	46.018s
ok  	github.com/novox/mesh-controller/internal/catalogue	8.946s
ok  	github.com/novox/mesh-controller/internal/conditions	2.966s
ok  	github.com/novox/mesh-controller/internal/envfile	1.035s
ok  	github.com/novox/mesh-controller/internal/facts	1.026s
ok  	github.com/novox/mesh-controller/internal/identity	6.458s
ok  	github.com/novox/mesh-controller/internal/inventory	115.014s
ok  	github.com/novox/mesh-controller/internal/lease	17.692s
ok  	github.com/novox/mesh-controller/internal/licences	5.960s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.015s
ok  	github.com/novox/mesh-controller/internal/link	65.791s
ok  	github.com/novox/mesh-controller/internal/lint	2.314s
ok  	github.com/novox/mesh-controller/internal/outward	1.044s
ok  	github.com/novox/mesh-controller/internal/overlay	1.031s
ok  	github.com/novox/mesh-controller/internal/secrets	1.508s
ok  	github.com/novox/mesh-controller/internal/store	3.590s
ok  	github.com/novox/mesh-controller/internal/testbus	1.222s
ok  	github.com/novox/mesh-controller/internal/token	1.024s
store tests, each run against the store:
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.47s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.56s)
  ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.48s)
  ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.45s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.43s)
  ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.41s)
  ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.50s)
  ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.35s)
  ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.51s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.53s)
  ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.47s)
  ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.46s)
  ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.52s)
  ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.44s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.59s)
  ./cmd/mesh-controller --- PASS: TestReplay237 (0.50s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.44s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.46s)
  ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.46s)
  ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.95s)
  ./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.54s)
  ./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.54s)
  ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.27s)
  ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.29s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.29s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.29s)
  ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.37s)
  ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.31s)
  ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.27s)
**Merge check** at `a1a6f649` Judged: head `a1a6f6493d50` merged into trunk `f10aedac5880`; read beside it: mesh-catalog `23ea0f431faf`, mesh-controller-main `f10aedac5880`, mesh-host `a1f9856b3957`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - ace: receives build-agent - g14: receives build-agent - novox: receives mesh-controller, build-agent - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine - read by no module's build: cmd/mesh-controller/plan_ids_test.go, internal/inventory/plan_id_test.go, testdata/store-tests Run by the build seat on novox as `build-1791822364469577788` (`builds --log build-1791822364469577788`). ``` --- the gate: build-agent, mesh-controller mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T16:17:25Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T16:17:25Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.183s ok github.com/novox/mesh-controller/cmd/mesh-controller 310.180s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.016s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.025s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.021s ok github.com/novox/mesh-controller/examples/route-proxy 1.142s ok github.com/novox/mesh-controller/internal/artifacts 1.062s ? github.com/novox/mesh-controller/internal/beside [no test files] ok github.com/novox/mesh-controller/internal/broker 5.742s ok github.com/novox/mesh-controller/internal/builder 46.018s ok github.com/novox/mesh-controller/internal/catalogue 8.946s ok github.com/novox/mesh-controller/internal/conditions 2.966s ok github.com/novox/mesh-controller/internal/envfile 1.035s ok github.com/novox/mesh-controller/internal/facts 1.026s ok github.com/novox/mesh-controller/internal/identity 6.458s ok github.com/novox/mesh-controller/internal/inventory 115.014s ok github.com/novox/mesh-controller/internal/lease 17.692s ok github.com/novox/mesh-controller/internal/licences 5.960s ok github.com/novox/mesh-controller/internal/licences/adapters 1.015s ok github.com/novox/mesh-controller/internal/link 65.791s ok github.com/novox/mesh-controller/internal/lint 2.314s ok github.com/novox/mesh-controller/internal/outward 1.044s ok github.com/novox/mesh-controller/internal/overlay 1.031s ok github.com/novox/mesh-controller/internal/secrets 1.508s ok github.com/novox/mesh-controller/internal/store 3.590s ok github.com/novox/mesh-controller/internal/testbus 1.222s ok github.com/novox/mesh-controller/internal/token 1.024s store tests, each run against the store: ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.47s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.56s) ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.48s) ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.45s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.43s) ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.41s) ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.50s) ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.35s) ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.51s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.53s) ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.47s) ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.46s) ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.52s) ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.44s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.59s) ./cmd/mesh-controller --- PASS: TestReplay237 (0.50s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.44s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.46s) ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.46s) ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.95s) ./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.54s) ./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.54s) ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.27s) ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.29s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.29s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.29s) ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.37s) ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.31s) ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.27s) ```
mesh-admin merged commit f8daec01d3 into main 2026-10-12 16:37:08 +00:00
mesh-admin deleted branch fix/561-plan-id-parameter 2026-10-12 16:37:08 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
mesh-admin
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#268