Stop composing ADR 0312's group grant, so deliveries to the media machine pass again (hq issue 567) #270

Merged
mesh-admin merged 1 commits from fix/567-revert-the-group-grant into main 2026-10-12 15:36:12 +00:00
Contributor

Why (hq issue 567): since #256 delivered at 16:30, the node-engine judges each read-write access by the path's group alone and states nzbget, qbittorrent, radarr, sonarr, lidarr and bookshelf unhealthy on ace, though they write their folders as the owner. Every delivery that moves them fails its first-node gate there and is put back (#256's own walk, mesh-media-catalog #33 and #34, the waiting builds' release). ADR 0325 (proposed, operator's Approve pending) supersedes ADR 0312 with identities per module and ACL entries per use.

What: git revert -m 1 3cfc1216 (#256): internal/catalogue/grants.go and its test removed, Rendering.GrantsGroups gone, the engine pin and testdata/beside back as before #256. The controller sends no grant, as before 16:30; the node-engine (mesh-host 3f7f797) then judges no access by group, as it did then.

Checked: make check green (all packages, store tests).

Delivery effects: mesh-controller on novox, then build-agent and route-proxy; on ace the containers recreated with a media group by #256 (radarr, sonarr, lidarr, bazarr, n8n) are recreated once without it; the access conditions on ace clear.

**Why** (hq issue 567): since #256 delivered at 16:30, the node-engine judges each read-write access by the path's group alone and states nzbget, qbittorrent, radarr, sonarr, lidarr and bookshelf unhealthy on ace, though they write their folders as the owner. Every delivery that moves them fails its first-node gate there and is put back (#256's own walk, mesh-media-catalog #33 and #34, the waiting builds' release). ADR 0325 (proposed, operator's Approve pending) supersedes ADR 0312 with identities per module and ACL entries per use. **What**: `git revert -m 1 3cfc1216` (#256): `internal/catalogue/grants.go` and its test removed, `Rendering.GrantsGroups` gone, the engine pin and `testdata/beside` back as before #256. The controller sends no grant, as before 16:30; the node-engine (mesh-host 3f7f797) then judges no access by group, as it did then. **Checked**: `make check` green (all packages, store tests). **Delivery effects**: mesh-controller on novox, then build-agent and route-proxy; on ace the containers recreated with a media group by #256 (radarr, sonarr, lidarr, bazarr, n8n) are recreated once without it; the access conditions on ace clear.
mesh-admin added 1 commit 2026-10-12 15:26:01 +00:00
Stop composing ADR 0312's group grant, so deliveries to the media machine pass again
mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…
mesh/repo-check pass: its merge-check.sh passed
mesh/delivery delivered
7b050abdcb
Since #256 delivered, the node-engine judges every read-write access by the path's group alone and
states six media modules unhealthy on ace, though they write their folders as the owner; every
delivery there fails its gate (hq issue 567). ADR 0325 replaces ADR 0312; until it is built, the
controller sends no grant, as before #256.

This reverts commit 3cfc121670.
Author
Contributor

Delivery novox/mesh-controller@7b050abdcb65 — delivered since 2026-10-12T15:45:53Z

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine

Machines

  • mesh-controller on novox: passed — healthy 3 times over 4m7s
  • mesh-controller on the rest running it: sent
  • build-agent on ace: passed — healthy 1 times over 1m26s
  • build-agent on the rest running it: sent

Transitions

  • 2026-10-12 15:26 (new) → proposed (announced): novox/mesh-controller#270's head announced
  • 2026-10-12 15:34 proposed → checked (checked): the verdict names this commit
  • 2026-10-12 15:34 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-12 15:36 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-12 15:36 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-12 15:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@7b050abdcb65` — **delivered** since 2026-10-12T15:45:53Z **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine **Machines** - mesh-controller on novox: passed — healthy 3 times over 4m7s - mesh-controller on the rest running it: sent - build-agent on ace: passed — healthy 1 times over 1m26s - build-agent on the rest running it: sent **Transitions** - 2026-10-12 15:26 (new) → proposed (announced): novox/mesh-controller#270's head announced - 2026-10-12 15:34 proposed → checked (checked): the verdict names this commit - 2026-10-12 15:34 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-12 15:36 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-12 15:36 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-12 15:45 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
Author
Contributor

Merge check at 7b050abd

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • tier 2: route-proxy
  • ace: receives build-agent, route-proxy
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent, route-proxy
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • route-proxy provides route: its consumers are sent again after it
  • route-proxy keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine

Run by the build seat on novox as build-1791818767269455126 (builds --log build-1791818767269455126).

--- the gate: build-agent, mesh-controller, route-proxy
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T14:54:57Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T14:54:57Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.044s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	333.201s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.024s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.028s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.016s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.123s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.055s
?   	github.com/novox/mesh-controller/internal/beside	[no test files]
ok  	github.com/novox/mesh-controller/internal/broker	8.004s
ok  	github.com/novox/mesh-controller/internal/builder	69.376s
ok  	github.com/novox/mesh-controller/internal/catalogue	8.183s
ok  	github.com/novox/mesh-controller/internal/conditions	2.580s
ok  	github.com/novox/mesh-controller/internal/envfile	1.028s
ok  	github.com/novox/mesh-controller/internal/facts	1.033s
ok  	github.com/novox/mesh-controller/internal/identity	18.011s
ok  	github.com/novox/mesh-controller/internal/inventory	135.108s
ok  	github.com/novox/mesh-controller/internal/lease	18.576s
ok  	github.com/novox/mesh-controller/internal/licences	17.102s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.014s
ok  	github.com/novox/mesh-controller/internal/link	73.918s
ok  	github.com/novox/mesh-controller/internal/lint	2.328s
ok  	github.com/novox/mesh-controller/internal/outward	1.044s
ok  	github.com/novox/mesh-controller/internal/overlay	1.026s
ok  	github.com/novox/mesh-controller/internal/secrets	1.438s
ok  	github.com/novox/mesh-controller/internal/store	10.895s
ok  	github.com/novox/mesh-controller/internal/testbus	1.188s
ok  	github.com/novox/mesh-controller/internal/token	1.018s
store tests, each run against the store:
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.46s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.46s)
  ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.46s)
  ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.49s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.43s)
  ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.41s)
  ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.48s)
  ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.36s)
  ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.48s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.51s)
  ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.46s)
  ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.46s)
  ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.51s)
  ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.46s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.55s)
  ./cmd/mesh-controller --- PASS: TestReplay237 (0.43s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.42s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.44s)
  ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.44s)
  ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.46s)
  ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.29s)
  ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.29s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.29s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.39s)
  ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.28s)
  ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.29s)
**Merge check** at `7b050abd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller, route-proxy) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent, route-proxy is judged on its first machine Run by the build seat on novox as `build-1791818767269455126` (`builds --log build-1791818767269455126`). ``` --- the gate: build-agent, mesh-controller, route-proxy mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T14:54:57Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T14:54:57Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 3 module(s) in 3 tier(s): build-agent, mesh-controller, route-proxy --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.044s ok github.com/novox/mesh-controller/cmd/mesh-controller 333.201s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.024s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.028s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.016s ok github.com/novox/mesh-controller/examples/route-proxy 1.123s ok github.com/novox/mesh-controller/internal/artifacts 1.055s ? github.com/novox/mesh-controller/internal/beside [no test files] ok github.com/novox/mesh-controller/internal/broker 8.004s ok github.com/novox/mesh-controller/internal/builder 69.376s ok github.com/novox/mesh-controller/internal/catalogue 8.183s ok github.com/novox/mesh-controller/internal/conditions 2.580s ok github.com/novox/mesh-controller/internal/envfile 1.028s ok github.com/novox/mesh-controller/internal/facts 1.033s ok github.com/novox/mesh-controller/internal/identity 18.011s ok github.com/novox/mesh-controller/internal/inventory 135.108s ok github.com/novox/mesh-controller/internal/lease 18.576s ok github.com/novox/mesh-controller/internal/licences 17.102s ok github.com/novox/mesh-controller/internal/licences/adapters 1.014s ok github.com/novox/mesh-controller/internal/link 73.918s ok github.com/novox/mesh-controller/internal/lint 2.328s ok github.com/novox/mesh-controller/internal/outward 1.044s ok github.com/novox/mesh-controller/internal/overlay 1.026s ok github.com/novox/mesh-controller/internal/secrets 1.438s ok github.com/novox/mesh-controller/internal/store 10.895s ok github.com/novox/mesh-controller/internal/testbus 1.188s ok github.com/novox/mesh-controller/internal/token 1.018s store tests, each run against the store: ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.46s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.46s) ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.46s) ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.49s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.43s) ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.41s) ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.48s) ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.36s) ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.48s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.51s) ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.46s) ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.46s) ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.51s) ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.46s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.55s) ./cmd/mesh-controller --- PASS: TestReplay237 (0.43s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.42s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.44s) ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.44s) ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.46s) ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.29s) ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.29s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.29s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.39s) ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.28s) ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.29s) ```
mesh-admin merged commit c672b3df6d into main 2026-10-12 15:36:12 +00:00
mesh-admin deleted branch fix/567-revert-the-group-grant 2026-10-12 15:36:13 +00:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#270