Why (hq issue 567): since #256 delivered at 16:30, the node-engine judges each read-write access by the path's group alone and states nzbget, qbittorrent, radarr, sonarr, lidarr and bookshelf unhealthy on ace, though they write their folders as the owner. Every delivery that moves them fails its first-node gate there and is put back (#256's own walk, mesh-media-catalog #33 and #34, the waiting builds' release). ADR 0325 (proposed, operator's Approve pending) supersedes ADR 0312 with identities per module and ACL entries per use.
What: git revert -m 1 3cfc1216 (#256): internal/catalogue/grants.go and its test removed, Rendering.GrantsGroups gone, the engine pin and testdata/beside back as before #256. The controller sends no grant, as before 16:30; the node-engine (mesh-host 3f7f797) then judges no access by group, as it did then.
Checked: make check green (all packages, store tests).
Delivery effects: mesh-controller on novox, then build-agent and route-proxy; on ace the containers recreated with a media group by #256 (radarr, sonarr, lidarr, bazarr, n8n) are recreated once without it; the access conditions on ace clear.
**Why** (hq issue 567): since #256 delivered at 16:30, the node-engine judges each read-write access by the path's group alone and states nzbget, qbittorrent, radarr, sonarr, lidarr and bookshelf unhealthy on ace, though they write their folders as the owner. Every delivery that moves them fails its first-node gate there and is put back (#256's own walk, mesh-media-catalog #33 and #34, the waiting builds' release). ADR 0325 (proposed, operator's Approve pending) supersedes ADR 0312 with identities per module and ACL entries per use.
**What**: `git revert -m 1 3cfc1216` (#256): `internal/catalogue/grants.go` and its test removed, `Rendering.GrantsGroups` gone, the engine pin and `testdata/beside` back as before #256. The controller sends no grant, as before 16:30; the node-engine (mesh-host 3f7f797) then judges no access by group, as it did then.
**Checked**: `make check` green (all packages, store tests).
**Delivery effects**: mesh-controller on novox, then build-agent and route-proxy; on ace the containers recreated with a media group by #256 (radarr, sonarr, lidarr, bazarr, n8n) are recreated once without it; the access conditions on ace clear.
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
Since #256 delivered, the node-engine judges every read-write access by the path's group alone and
states six media modules unhealthy on ace, though they write their folders as the owner; every
delivery there fails its gate (hq issue 567). ADR 0325 replaces ADR 0312; until it is built, the
controller sends no grant, as before #256.
This reverts commit 3cfc121670.
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine
Machines
mesh-controller on novox: passed — healthy 3 times over 4m7s
mesh-controller on the rest running it: sent
build-agent on ace: passed — healthy 1 times over 1m26s
build-agent on the rest running it: sent
Transitions
2026-10-12 15:26 (new) → proposed (announced): novox/mesh-controller#270's head announced
2026-10-12 15:34 proposed → checked (checked): the verdict names this commit
2026-10-12 15:34 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-12 15:36 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-12 15:36 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-12 15:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-controller@7b050abdcb65` — **delivered** since 2026-10-12T15:45:53Z
**Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- tier 2: route-proxy
- ace: receives build-agent, route-proxy
- g14: receives build-agent
- novox: receives mesh-controller, build-agent, route-proxy
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine
**Machines**
- mesh-controller on novox: passed — healthy 3 times over 4m7s
- mesh-controller on the rest running it: sent
- build-agent on ace: passed — healthy 1 times over 1m26s
- build-agent on the rest running it: sent
**Transitions**
- 2026-10-12 15:26 (new) → proposed (announced): novox/mesh-controller#270's head announced
- 2026-10-12 15:34 proposed → checked (checked): the verdict names this commit
- 2026-10-12 15:34 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-12 15:36 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-12 15:36 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
- 2026-10-12 15:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine
Run by the build seat on novox as build-1791818767269455126 (builds --log build-1791818767269455126).
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T14:54:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T14:54:57Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.044s
ok github.com/novox/mesh-controller/cmd/mesh-controller 333.201s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.024s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.028s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.016s
ok github.com/novox/mesh-controller/examples/route-proxy 1.123s
ok github.com/novox/mesh-controller/internal/artifacts 1.055s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 8.004s
ok github.com/novox/mesh-controller/internal/builder 69.376s
ok github.com/novox/mesh-controller/internal/catalogue 8.183s
ok github.com/novox/mesh-controller/internal/conditions 2.580s
ok github.com/novox/mesh-controller/internal/envfile 1.028s
ok github.com/novox/mesh-controller/internal/facts 1.033s
ok github.com/novox/mesh-controller/internal/identity 18.011s
ok github.com/novox/mesh-controller/internal/inventory 135.108s
ok github.com/novox/mesh-controller/internal/lease 18.576s
ok github.com/novox/mesh-controller/internal/licences 17.102s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.014s
ok github.com/novox/mesh-controller/internal/link 73.918s
ok github.com/novox/mesh-controller/internal/lint 2.328s
ok github.com/novox/mesh-controller/internal/outward 1.044s
ok github.com/novox/mesh-controller/internal/overlay 1.026s
ok github.com/novox/mesh-controller/internal/secrets 1.438s
ok github.com/novox/mesh-controller/internal/store 10.895s
ok github.com/novox/mesh-controller/internal/testbus 1.188s
ok github.com/novox/mesh-controller/internal/token 1.018s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.46s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.46s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.46s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.49s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.43s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.41s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.48s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.36s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.48s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.51s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.46s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.46s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.51s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.46s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.55s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.43s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.42s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.44s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.44s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.46s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.29s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.29s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.29s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.39s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.28s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.29s)
**Merge check** at `7b050abd`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
- tier 0: mesh-controller
- tier 1: build-agent
- tier 2: route-proxy
- ace: receives build-agent, route-proxy
- g14: receives build-agent
- novox: receives mesh-controller, build-agent, route-proxy
- shanks: receives build-agent
- build-agent keeps data (ADR 0233): what it holds is backed up before it moves
- route-proxy provides route: its consumers are sent again after it
- route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
- grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine
Run by the build seat on novox as `build-1791818767269455126` (`builds --log build-1791818767269455126`).
```
--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T14:54:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T14:54:57Z
modules the change moves:
- mesh-controller (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok github.com/novox/mesh-controller/cmd/mesh-builder 1.044s
ok github.com/novox/mesh-controller/cmd/mesh-controller 333.201s
ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.024s
ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.028s
ok github.com/novox/mesh-controller/examples/redis-provisioner 1.016s
ok github.com/novox/mesh-controller/examples/route-proxy 1.123s
ok github.com/novox/mesh-controller/internal/artifacts 1.055s
? github.com/novox/mesh-controller/internal/beside [no test files]
ok github.com/novox/mesh-controller/internal/broker 8.004s
ok github.com/novox/mesh-controller/internal/builder 69.376s
ok github.com/novox/mesh-controller/internal/catalogue 8.183s
ok github.com/novox/mesh-controller/internal/conditions 2.580s
ok github.com/novox/mesh-controller/internal/envfile 1.028s
ok github.com/novox/mesh-controller/internal/facts 1.033s
ok github.com/novox/mesh-controller/internal/identity 18.011s
ok github.com/novox/mesh-controller/internal/inventory 135.108s
ok github.com/novox/mesh-controller/internal/lease 18.576s
ok github.com/novox/mesh-controller/internal/licences 17.102s
ok github.com/novox/mesh-controller/internal/licences/adapters 1.014s
ok github.com/novox/mesh-controller/internal/link 73.918s
ok github.com/novox/mesh-controller/internal/lint 2.328s
ok github.com/novox/mesh-controller/internal/outward 1.044s
ok github.com/novox/mesh-controller/internal/overlay 1.026s
ok github.com/novox/mesh-controller/internal/secrets 1.438s
ok github.com/novox/mesh-controller/internal/store 10.895s
ok github.com/novox/mesh-controller/internal/testbus 1.188s
ok github.com/novox/mesh-controller/internal/token 1.018s
store tests, each run against the store:
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.46s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.46s)
./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.46s)
./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.49s)
./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.43s)
./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.41s)
./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.48s)
./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.36s)
./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.48s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.51s)
./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.46s)
./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.46s)
./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.51s)
./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.46s)
./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.55s)
./cmd/mesh-controller --- PASS: TestReplay237 (0.43s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.42s)
./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.44s)
./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.44s)
./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.46s)
./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.29s)
./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.29s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.29s)
./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.39s)
./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.28s)
./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.29s)
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why (hq issue 567): since #256 delivered at 16:30, the node-engine judges each read-write access by the path's group alone and states nzbget, qbittorrent, radarr, sonarr, lidarr and bookshelf unhealthy on ace, though they write their folders as the owner. Every delivery that moves them fails its first-node gate there and is put back (#256's own walk, mesh-media-catalog #33 and #34, the waiting builds' release). ADR 0325 (proposed, operator's Approve pending) supersedes ADR 0312 with identities per module and ACL entries per use.
What:
git revert -m 1 3cfc1216(#256):internal/catalogue/grants.goand its test removed,Rendering.GrantsGroupsgone, the engine pin andtestdata/besideback as before #256. The controller sends no grant, as before 16:30; the node-engine (mesh-host 3f7f797) then judges no access by group, as it did then.Checked:
make checkgreen (all packages, store tests).Delivery effects: mesh-controller on novox, then build-agent and route-proxy; on ace the containers recreated with a media group by #256 (radarr, sonarr, lidarr, bazarr, n8n) are recreated once without it; the access conditions on ace clear.
Delivery
novox/mesh-controller@7b050abdcb65— delivered since 2026-10-12T15:45:53ZDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
7b050abdmesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step
Run by the build seat on novox as
build-1791818767269455126(builds --log build-1791818767269455126).