novox/mesh-controller
6
0
Fork 0
Code Issues Pull Requests 5 Releases Wiki Activity

Refuse a declaring module's mergeable file that names no keys (hq issue 574, ADR 0326 §3) #282

Merged
mesh-admin merged 2 commits from fix/574-a-declaring-module-names-its-files-keys into main 2026-10-12 23:28:22 +00:00
Conversation 7 Commits 2 Files Changed 8
+216 -3
mesh-admin commented 2026-10-12 22:40:33 +00:00
Contributor
Copy Link
Copy Source

What

This restores the refusal that #272 held back. A module that declares a setting under settings and owns a mergeable file without takes-settings is refused by the module check and at registration (TakenSettingsProblems), naming the file.

It is not judged in JudgeSettings. A stored definition is still composed as before and never left out of a machine; its next change brings it into the form.

Why

hq issue 574, ADR 0326 §3 and ADR 0164 §11/§15: only a module that declares no settings keeps today's form, in which every key reaches every mergeable file. The refusal was held back because betterbird was such a module. mesh-catalog #252 (8f80cd47) named betterbird's keys, and #272 is live.

How it was tested

  • TestAModuleThatDeclaresASettingNamesItsFilesKeys covers four cases: a declaring module with two silent files is refused twice; it still composes through JudgeSettings; with both files naming keys it passes; a module that declares nothing passes. It fails without the change.
  • This head's module check passes on every manifest of mesh-catalog main 8f80cd4 (127) and mesh-media-catalog main 94b80fb (15), both exit 0. The only module that declares settings and owns a mergeable file is betterbird, which now names accounts.
  • The catalogue tests with MESH_CHECK_BESIDE at mesh-catalog main pass, except TestTheResolvedPathRulesAreTheNodeEnginesOwn, which needs mesh-host beside. sh merge-check.sh passes; store tests were skipped because there was no MESH_TEST_POSTGRES.

Fixes issue 574.

## What This restores the refusal that #272 held back. A module that declares a setting under `settings` and owns a mergeable file without `takes-settings` is refused by the module check and at registration (`TakenSettingsProblems`), naming the file. It is not judged in `JudgeSettings`. A stored definition is still composed as before and never left out of a machine; its next change brings it into the form. ## Why hq issue 574, ADR 0326 §3 and ADR 0164 §11/§15: only a module that declares no settings keeps today's form, in which every key reaches every mergeable file. The refusal was held back because betterbird was such a module. mesh-catalog #252 (8f80cd47) named betterbird's keys, and #272 is live. ## How it was tested - `TestAModuleThatDeclaresASettingNamesItsFilesKeys` covers four cases: a declaring module with two silent files is refused twice; it still composes through `JudgeSettings`; with both files naming keys it passes; a module that declares nothing passes. It fails without the change. - This head's `module check` passes on every manifest of mesh-catalog main 8f80cd4 (127) and mesh-media-catalog main 94b80fb (15), both exit 0. The only module that declares settings and owns a mergeable file is betterbird, which now names `accounts`. - The catalogue tests with `MESH_CHECK_BESIDE` at mesh-catalog main pass, except `TestTheResolvedPathRulesAreTheNodeEnginesOwn`, which needs mesh-host beside. `sh merge-check.sh` passes; store tests were skipped because there was no `MESH_TEST_POSTGRES`. Fixes issue 574.
mesh-admin added 1 commit 2026-10-12 22:40:33 +00:00
Refuse a declaring module's mergeable file that names no keys (hq issue 574, ADR 0326 §3)
mesh/merge-gate head db0cb1e15e39 merged into trunk 56d6313262e8 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
Details
mesh/repo-check head db0cb1e15e39 merged into trunk 56d6313262e8 — fail: its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheContro…
Details
mesh/delivery superseded: a newer head of the same pull request
Details
db0cb1e15e 
A module that declares a setting and owns a mergeable file naming no keys
still let every key reach that file. The refusal was held back in #272
because betterbird was one; mesh-catalog #252 named its keys, and every
module in mesh-catalog and mesh-media-catalog main now passes, so the
module check and registration refuse it again. A stored definition is
still composed as it is, never left out of a machine.
mesh-admin commented 2026-10-12 22:40:58 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-controller@18221c4079d1 — delivered since 2026-10-12T23:36:40Z

Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • ace: receives build-agent
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine

Machines

  • mesh-controller on novox: passed — healthy 3 times over 4m5s
  • mesh-controller on the rest running it: sent
  • build-agent on ace: passed — healthy 1 times over 28s
  • build-agent on the rest running it: sent

Transitions

  • 2026-10-12 22:54 (new) → proposed (announced): novox/mesh-controller#282's head announced
  • 2026-10-12 23:26 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-12 23:26 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-12 23:28 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-12 23:28 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-12 23:36 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@18221c4079d1` — **delivered** since 2026-10-12T23:36:40Z **Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - ace: receives build-agent - g14: receives build-agent - novox: receives mesh-controller, build-agent - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine **Machines** - mesh-controller on novox: passed — healthy 3 times over 4m5s - mesh-controller on the rest running it: sent - build-agent on ace: passed — healthy 1 times over 28s - build-agent on the rest running it: sent **Transitions** - 2026-10-12 22:54 (new) → proposed (announced): novox/mesh-controller#282's head announced - 2026-10-12 23:26 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-12 23:26 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-12 23:28 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-12 23:28 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-12 23:36 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-admin commented 2026-10-12 22:47:27 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at db0cb1e1
Judged: head db0cb1e15e39 merged into trunk 56d6313262e8; read beside it: mesh-catalog 8f80cd471634, mesh-controller-main 56d6313262e8, mesh-host 7a41e120635b, mesh-tools 954e1a53eef9

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)
  • mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s)

Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • ace: receives build-agent
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
  • read by no module's build: internal/catalogue/setting_takes_test.go

Run by the build seat on novox as build-1791844856689087854 (builds --log build-1791844856689087854).

--- the gate: build-agent, mesh-controller
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T22:33:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T22:33:48Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller

notes:
  - internal/catalogue/setting_takes_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.048s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	203.342s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.024s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.027s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.020s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.142s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.058s
?   	github.com/novox/mesh-controller/internal/beside	[no test files]
--- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s)
    genesis_template_test.go:29: judged against /var/lib/build-agent/workspace/check/mesh-host as cloned beside this check
    genesis_template_test.go:29: open /var/lib/build-agent/workspace/check/mesh-host/examples/foundation-first-node-nats.lock: no such file or directory
FAIL
FAIL	github.com/novox/mesh-controller/internal/broker	3.397s
ok  	github.com/novox/mesh-controller/internal/builder	49.933s
ok  	github.com/novox/mesh-controller/internal/catalogue	10.354s
ok  	github.com/novox/mesh-controller/internal/conditions	2.894s
ok  	github.com/novox/mesh-controller/internal/envfile	1.025s
ok  	github.com/novox/mesh-controller/internal/facts	1.031s
ok  	github.com/novox/mesh-controller/internal/identity	6.170s
ok  	github.com/novox/mesh-controller/internal/inventory	44.864s
ok  	github.com/novox/mesh-controller/internal/lease	17.635s
ok  	github.com/novox/mesh-controller/internal/licences	5.142s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.020s
ok  	github.com/novox/mesh-controller/internal/link	61.162s
ok  	github.com/novox/mesh-controller/internal/lint	2.740s
ok  	github.com/novox/mesh-controller/internal/outward	1.042s
ok  	github.com/novox/mesh-controller/internal/overlay	1.029s
ok  	github.com/novox/mesh-controller/internal/secrets	1.562s
ok  	github.com/novox/mesh-controller/internal/store	3.594s
ok  	github.com/novox/mesh-controller/internal/testbus	1.204s
ok  	github.com/novox/mesh-controller/internal/token	1.016s
FAIL
--- what failed, picked from the whole of its output (the whole is in the build's log)
--- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s)
    genesis_template_test.go:29: judged against /var/lib/build-agent/workspace/check/mesh-host as cloned beside this check
    genesis_template_test.go:29: open /var/lib/build-agent/workspace/check/mesh-host/examples/foundation-first-node-nats.lock: no such file or directory
FAIL	github.com/novox/mesh-controller/internal/broker	3.397s
**Merge check** at `db0cb1e1` Judged: head `db0cb1e15e39` merged into trunk `56d6313262e8`; read beside it: mesh-catalog `8f80cd471634`, mesh-controller-main `56d6313262e8`, mesh-host `7a41e120635b`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s) **Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - ace: receives build-agent - g14: receives build-agent - novox: receives mesh-controller, build-agent - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine - read by no module's build: internal/catalogue/setting_takes_test.go Run by the build seat on novox as `build-1791844856689087854` (`builds --log build-1791844856689087854`). ``` --- the gate: build-agent, mesh-controller mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T22:33:48Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T22:33:48Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller notes: - internal/catalogue/setting_takes_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.048s ok github.com/novox/mesh-controller/cmd/mesh-controller 203.342s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.024s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.027s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.020s ok github.com/novox/mesh-controller/examples/route-proxy 1.142s ok github.com/novox/mesh-controller/internal/artifacts 1.058s ? github.com/novox/mesh-controller/internal/beside [no test files] --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s) genesis_template_test.go:29: judged against /var/lib/build-agent/workspace/check/mesh-host as cloned beside this check genesis_template_test.go:29: open /var/lib/build-agent/workspace/check/mesh-host/examples/foundation-first-node-nats.lock: no such file or directory FAIL FAIL github.com/novox/mesh-controller/internal/broker 3.397s ok github.com/novox/mesh-controller/internal/builder 49.933s ok github.com/novox/mesh-controller/internal/catalogue 10.354s ok github.com/novox/mesh-controller/internal/conditions 2.894s ok github.com/novox/mesh-controller/internal/envfile 1.025s ok github.com/novox/mesh-controller/internal/facts 1.031s ok github.com/novox/mesh-controller/internal/identity 6.170s ok github.com/novox/mesh-controller/internal/inventory 44.864s ok github.com/novox/mesh-controller/internal/lease 17.635s ok github.com/novox/mesh-controller/internal/licences 5.142s ok github.com/novox/mesh-controller/internal/licences/adapters 1.020s ok github.com/novox/mesh-controller/internal/link 61.162s ok github.com/novox/mesh-controller/internal/lint 2.740s ok github.com/novox/mesh-controller/internal/outward 1.042s ok github.com/novox/mesh-controller/internal/overlay 1.029s ok github.com/novox/mesh-controller/internal/secrets 1.562s ok github.com/novox/mesh-controller/internal/store 3.594s ok github.com/novox/mesh-controller/internal/testbus 1.204s ok github.com/novox/mesh-controller/internal/token 1.016s FAIL --- what failed, picked from the whole of its output (the whole is in the build's log) --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s) genesis_template_test.go:29: judged against /var/lib/build-agent/workspace/check/mesh-host as cloned beside this check genesis_template_test.go:29: open /var/lib/build-agent/workspace/check/mesh-host/examples/foundation-first-node-nats.lock: no such file or directory FAIL github.com/novox/mesh-controller/internal/broker 3.397s ```
mesh-admin left a comment
Author
Contributor
Copy Link
Copy Source

Verdict: request changes at db0cb1e15e

What holds

  • The refusal matches ADR 0326 §3: a module that declares a setting under settings and owns a mergeable file without takes-settings is refused, an empty list is accepted, and a module that declares no setting keeps today's form.
  • JudgeSettings still calls only the lowercase takenSettingsProblems (settings.go:541), so composition through JudgeSettings does not refuse. The new test asserts this.
  • The module check at this head passes mesh-catalog main (127 manifests, exit 0) and mesh-media-catalog main (15 manifests, exit 0), with nothing refused. betterbird is the only module that declares settings and owns a mergeable file, and on main it names accounts.
  • The new test fails without the change (problems: [] at setting_takes_test.go:208) and passes with it.
  • go vet ./... is clean. merge-check.sh against a throwaway Postgres 18 exits 0: gofmt, vet, the whole suite under -race (gcc present), and every listed store test PASS.
  • Statuses at this head at 00:45 CEST: mesh/merge-gate is pending (building on novox since 00:40), mesh/delivery is pending, and mesh/repo-check has not been posted yet.

Blocking: a stored definition is refused where it is composed
The new rule is in the exported TakenSettingsProblems, and ParseManifest calls it (manifest.go:1697). ParseManifest does not only read new definitions. It also re-reads stored build manifests on the composition paths:

  • Inventory.ManifestAt (internal/inventory/gate.go:356). It is called by keepRecorded (cmd/mesh-controller/recorded_kept.go:165), which composes a recorded module at the build its machine runs. That includes the grants step's keep-every-build send (issue 490). It is also called by the gate's from/to judging (cmd/mesh-controller/gate.go:802/812/851) and by release.go:901.
  • Inventory.RestoreModule (gate.go:219), which puts an earlier build back.

betterbird has policy: record. It was pushed to g14 and shanks at 2026-10-12 21:54. That was before mesh-catalog 8f80cd4 (22:37), which added takes-settings. Run through this head's module check, betterbird's manifest at mesh-catalog 854c853 gives: "betterbird declares settings, and its mergeable accounts names no takes-settings ...". I infer, without having read the sent-build records, that g14 and shanks run such a build. If they do, then once the registered betterbird build differs from the sent one, keepRecorded gets an error from ManifestAt ("... is not a manifest the mesh can compose"), and every send to g14 and shanks fails. A rollback to a pre-naming build would also be refused. This contradicts the last sentence of §3 ("A definition stored before this record is composed as it was until its next change") and the PR's own comment ("never where a stored one is composed").

Suggested fix: judge §3 only where a definition is written. One way is a separate function that the module check and registration (takeIn, module add, the builder) call, which ParseManifest does not call. Another is to read stored build manifests in ManifestAt and RestoreModule without this rule. Add a test showing that a stored build which declares a setting and owns a silent mergeable file is still read by ManifestAt and composed.

Minor

  • Suppose a module that declares settings has one mergeable file that names keys and one that is silent. The silent file is then reported twice, once under §2 and once under §3. Consider leaving out the §3 line when §2 already names that file.
Verdict: request changes at db0cb1e15e39ecd5de2d868478ded3a55c28929f What holds - The refusal matches ADR 0326 §3: a module that declares a setting under `settings` and owns a mergeable file without `takes-settings` is refused, an empty list is accepted, and a module that declares no setting keeps today's form. - JudgeSettings still calls only the lowercase `takenSettingsProblems` (settings.go:541), so composition through JudgeSettings does not refuse. The new test asserts this. - The module check at this head passes mesh-catalog main (127 manifests, exit 0) and mesh-media-catalog main (15 manifests, exit 0), with nothing refused. betterbird is the only module that declares settings and owns a mergeable file, and on main it names `accounts`. - The new test fails without the change (`problems: []` at setting_takes_test.go:208) and passes with it. - `go vet ./...` is clean. `merge-check.sh` against a throwaway Postgres 18 exits 0: gofmt, vet, the whole suite under `-race` (gcc present), and every listed store test PASS. - Statuses at this head at 00:45 CEST: `mesh/merge-gate` is pending (building on novox since 00:40), `mesh/delivery` is pending, and `mesh/repo-check` has not been posted yet. Blocking: a stored definition is refused where it is composed The new rule is in the exported `TakenSettingsProblems`, and `ParseManifest` calls it (manifest.go:1697). `ParseManifest` does not only read new definitions. It also re-reads stored build manifests on the composition paths: - `Inventory.ManifestAt` (internal/inventory/gate.go:356). It is called by `keepRecorded` (cmd/mesh-controller/recorded_kept.go:165), which composes a recorded module at the build its machine runs. That includes the grants step's keep-every-build send (issue 490). It is also called by the gate's from/to judging (cmd/mesh-controller/gate.go:802/812/851) and by release.go:901. - `Inventory.RestoreModule` (gate.go:219), which puts an earlier build back. betterbird has `policy: record`. It was pushed to g14 and shanks at 2026-10-12 21:54. That was before mesh-catalog 8f80cd4 (22:37), which added `takes-settings`. Run through this head's module check, betterbird's manifest at mesh-catalog 854c853 gives: "betterbird declares settings, and its mergeable accounts names no takes-settings ...". I infer, without having read the sent-build records, that g14 and shanks run such a build. If they do, then once the registered betterbird build differs from the sent one, `keepRecorded` gets an error from `ManifestAt` ("... is not a manifest the mesh can compose"), and every send to g14 and shanks fails. A rollback to a pre-naming build would also be refused. This contradicts the last sentence of §3 ("A definition stored before this record is composed as it was until its next change") and the PR's own comment ("never where a stored one is composed"). Suggested fix: judge §3 only where a definition is written. One way is a separate function that the module check and registration (`takeIn`, `module add`, the builder) call, which `ParseManifest` does not call. Another is to read stored build manifests in `ManifestAt` and `RestoreModule` without this rule. Add a test showing that a stored build which declares a setting and owns a silent mergeable file is still read by `ManifestAt` and composed. Minor - Suppose a module that declares settings has one mergeable file that names keys and one that is silent. The silent file is then reported twice, once under §2 and once under §3. Consider leaving out the §3 line when §2 already names that file.
jschoubben added 1 commit 2026-10-12 22:54:28 +00:00
Judge ADR 0326 §3 only where a definition is written (hq issue 574)
mesh/merge-gate head 18221c4079d1 merged into trunk 7b2a9eae8020 — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
Details
mesh/repo-check head 18221c4079d1 merged into trunk 7b2a9eae8020 — pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
18221c4079 
ParseManifest also reads stored builds again: a build's manifest at a
commit, the gate, a release, a module put back. betterbird's builds from
before its accounts file named its keys would have become uncomposable
there, so a send to g14 or shanks could fail and a rollback be refused.
The refusal now runs in module check, module add, a build taken in, the
builder and the merge gate's registration, and a file is no longer
reported by both §2 and §3.
mesh-admin commented 2026-10-12 22:54:40 +00:00
Author
Contributor
Copy Link
Copy Source

Head 18221c4 answers review 110:

  • The §3 refusal moved out of TakenSettingsProblems, so it is no longer in ParseManifest. It is now catalogue.WrittenSettingsProblems, judged only where a definition is written:
    • module check (check.go);
    • namesNoInstallation, which covers module add, takeIn and the merge gate's registration;
    • the builder.
  • It is never judged in ManifestAt, RestoreModule, the gate's reading of a stored build or release.go.
  • New store test TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed: a stored build that declares a preference and owns a silent mergeable file is read by ManifestAt and composed. With the refusal back in ParseManifest it fails ('is not a manifest the mesh can compose'). It is listed in testdata/store-tests.
  • No double report: §3 says nothing when any mergeable file of the module names its keys, because §2 then names the silent ones. The unit test checks a mixed module is reported once.
  • New TestWhereADefinitionIsWrittenADeclaringModuleNamesItsFilesKeys covers module check and namesNoInstallation.
  • Tested: sh merge-check.sh against a throwaway Postgres 18 exits 0, and every listed store test passes. This head's module check passes on mesh-catalog 8f80cd4 and mesh-media-catalog 94b80fb (exit 0).
Head 18221c4 answers review 110: - The §3 refusal moved out of `TakenSettingsProblems`, so it is no longer in `ParseManifest`. It is now `catalogue.WrittenSettingsProblems`, judged only where a definition is written: - `module check` (check.go); - `namesNoInstallation`, which covers `module add`, `takeIn` and the merge gate's registration; - the builder. - It is never judged in ManifestAt, RestoreModule, the gate's reading of a stored build or release.go. - New store test `TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed`: a stored build that declares a preference and owns a silent mergeable file is read by `ManifestAt` and composed. With the refusal back in `ParseManifest` it fails ('is not a manifest the mesh can compose'). It is listed in testdata/store-tests. - No double report: §3 says nothing when any mergeable file of the module names its keys, because §2 then names the silent ones. The unit test checks a mixed module is reported once. - New `TestWhereADefinitionIsWrittenADeclaringModuleNamesItsFilesKeys` covers `module check` and `namesNoInstallation`. - Tested: `sh merge-check.sh` against a throwaway Postgres 18 exits 0, and every listed store test passes. This head's `module check` passes on mesh-catalog 8f80cd4 and mesh-media-catalog 94b80fb (exit 0).
mesh-admin left a comment
Author
Contributor
Copy Link
Copy Source

Verdict: approve at 18221c4079

This approves the code. Do not merge yet: neither required check has reported green at this head (see Statuses below).

Review 110's blocking finding is resolved:

  • Where the §3 rule runs. WrittenSettingsProblems has four callers outside tests: moduleCheckFor (check.go:81), namesNoInstallation (modules.go:1056), and the builder (builder.go:231). namesNoInstallation is itself reached from module add (modules.go:134), takeIn (build.go:640) and the merge gate's shelfWithChange (merge_gate.go:612), and there only for definitions in scope of the change. ParseManifest calls only TakenSettingsProblems, which is §2/§4 alone again. So ManifestAt, RestoreModule, keepRecorded, the grants step, the gate's from/to judging, release.go and JudgeSettings never meet §3.
  • The new tests prove it. I put the refusal back into ParseManifest (TakenSettingsProblems returning §2/§4 plus WrittenSettingsProblems). All three new or changed tests then fail: TestAModuleThatDeclaresASettingNamesItsFilesKeys, TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (run against the store) and TestWhereADefinitionIsWrittenADeclaringModuleNamesItsFilesKeys. With the head as pushed, all three pass.
  • No double report. With one naming file and one silent file, only §2 names the silent file. §3 speaks only when no mergeable file names its keys, and the test covers this.
  • Module check at this head. mesh-catalog main 8f80cd4 (127 manifests) and mesh-media-catalog main 94b80fb (15 manifests) both exit 0. Nothing is refused.
  • merge-check.sh. Against a throwaway Postgres 18 it exits 0: gofmt, vet, the whole suite under -race, and every listed store test PASS, including the new TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed.

Statuses at 00:58 CEST:

  • mesh/merge-gate is pending (building on ace since 00:54).
  • mesh/delivery is pending.
  • mesh/repo-check has not been posted yet.

The merge waits until both required checks are green and read.

Not blocking: the builder now refuses §3 too. A rebuild of a pre-naming commit, such as betterbird before 8f80cd4, would be refused there. That is consistent with "its next change is held to it", because a rollback goes through RestoreModule, which reads the stored manifest.

Verdict: approve at 18221c4079d15cdab2f9ad5883ae94113e57ad30 This approves the code. Do not merge yet: neither required check has reported green at this head (see Statuses below). Review 110's blocking finding is resolved: - **Where the §3 rule runs.** `WrittenSettingsProblems` has four callers outside tests: `moduleCheckFor` (check.go:81), `namesNoInstallation` (modules.go:1056), and the builder (builder.go:231). `namesNoInstallation` is itself reached from `module add` (modules.go:134), `takeIn` (build.go:640) and the merge gate's `shelfWithChange` (merge_gate.go:612), and there only for definitions in scope of the change. `ParseManifest` calls only `TakenSettingsProblems`, which is §2/§4 alone again. So `ManifestAt`, `RestoreModule`, `keepRecorded`, the grants step, the gate's from/to judging, release.go and `JudgeSettings` never meet §3. - **The new tests prove it.** I put the refusal back into `ParseManifest` (TakenSettingsProblems returning §2/§4 plus WrittenSettingsProblems). All three new or changed tests then fail: `TestAModuleThatDeclaresASettingNamesItsFilesKeys`, `TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed` (run against the store) and `TestWhereADefinitionIsWrittenADeclaringModuleNamesItsFilesKeys`. With the head as pushed, all three pass. - **No double report.** With one naming file and one silent file, only §2 names the silent file. §3 speaks only when no mergeable file names its keys, and the test covers this. - **Module check at this head.** mesh-catalog main 8f80cd4 (127 manifests) and mesh-media-catalog main 94b80fb (15 manifests) both exit 0. Nothing is refused. - **merge-check.sh.** Against a throwaway Postgres 18 it exits 0: gofmt, vet, the whole suite under `-race`, and every listed store test PASS, including the new `TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed`. Statuses at 00:58 CEST: - `mesh/merge-gate` is pending (building on ace since 00:54). - `mesh/delivery` is pending. - `mesh/repo-check` has not been posted yet. The merge waits until both required checks are green and read. Not blocking: the builder now refuses §3 too. A rebuild of a pre-naming commit, such as betterbird before 8f80cd4, would be refused there. That is consistent with "its next change is held to it", because a rollback goes through `RestoreModule`, which reads the stored manifest.
mesh-admin commented 2026-10-12 22:59:47 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at 18221c40
Judged: head 18221c4079d1 merged into trunk 56d6313262e8; read beside it: mesh-catalog 8f80cd471634, mesh-controller-main 56d6313262e8, mesh-host 7a41e120635b, mesh-tools 954e1a53eef9

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)
  • mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s)

Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • ace: receives build-agent
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
  • read by no module's build: cmd/mesh-controller/written_settings_test.go, internal/catalogue/setting_takes_test.go, internal/inventory/stored_silent_file_test.go, testdata/store-tests

Run by the build seat on ace as build-1791845683598155052 (builds --log build-1791845683598155052).

--- the gate: build-agent, mesh-controller
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T22:43:48Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T22:43:48Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller

notes:
  - cmd/mesh-controller/written_settings_test.go, internal/catalogue/setting_takes_test.go, internal/inventory/stored_silent_file_test.go and testdata/store-tests read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.040s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	161.945s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.014s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.021s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.015s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.133s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.064s
?   	github.com/novox/mesh-controller/internal/beside	[no test files]
--- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s)
    genesis_template_test.go:29: judged against /var/lib/build-agent/workspace/check/mesh-host as cloned beside this check
    genesis_template_test.go:29: open /var/lib/build-agent/workspace/check/mesh-host/examples/foundation-first-node-nats.lock: no such file or directory
FAIL
FAIL	github.com/novox/mesh-controller/internal/broker	2.647s
ok  	github.com/novox/mesh-controller/internal/builder	41.576s
ok  	github.com/novox/mesh-controller/internal/catalogue	8.166s
ok  	github.com/novox/mesh-controller/internal/conditions	2.680s
ok  	github.com/novox/mesh-controller/internal/envfile	1.066s
ok  	github.com/novox/mesh-controller/internal/facts	1.060s
ok  	github.com/novox/mesh-controller/internal/identity	4.728s
ok  	github.com/novox/mesh-controller/internal/inventory	38.846s
ok  	github.com/novox/mesh-controller/internal/lease	17.753s
ok  	github.com/novox/mesh-controller/internal/licences	3.979s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.058s
ok  	github.com/novox/mesh-controller/internal/link	61.197s
ok  	github.com/novox/mesh-controller/internal/lint	2.419s
ok  	github.com/novox/mesh-controller/internal/outward	1.098s
ok  	github.com/novox/mesh-controller/internal/overlay	1.077s
ok  	github.com/novox/mesh-controller/internal/secrets	1.462s
ok  	github.com/novox/mesh-controller/internal/store	3.550s
ok  	github.com/novox/mesh-controller/internal/testbus	1.232s
ok  	github.com/novox/mesh-controller/internal/token	1.021s
FAIL
--- what failed, picked from the whole of its output (the whole is in the build's log)
--- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s)
    genesis_template_test.go:29: judged against /var/lib/build-agent/workspace/check/mesh-host as cloned beside this check
    genesis_template_test.go:29: open /var/lib/build-agent/workspace/check/mesh-host/examples/foundation-first-node-nats.lock: no such file or directory
FAIL	github.com/novox/mesh-controller/internal/broker	2.647s

Out of date when it landed: out of date: judged against trunk 56d6313262, the trunk is now cbac703e817d; judged again on a recheck or when it is merged

**Merge check** at `18221c40` Judged: head `18221c4079d1` merged into trunk `56d6313262e8`; read beside it: mesh-catalog `8f80cd471634`, mesh-controller-main `56d6313262e8`, mesh-host `7a41e120635b`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s) **Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - ace: receives build-agent - g14: receives build-agent - novox: receives mesh-controller, build-agent - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine - read by no module's build: cmd/mesh-controller/written_settings_test.go, internal/catalogue/setting_takes_test.go, internal/inventory/stored_silent_file_test.go, testdata/store-tests Run by the build seat on ace as `build-1791845683598155052` (`builds --log build-1791845683598155052`). ``` --- the gate: build-agent, mesh-controller mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T22:43:48Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T22:43:48Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller notes: - cmd/mesh-controller/written_settings_test.go, internal/catalogue/setting_takes_test.go, internal/inventory/stored_silent_file_test.go and testdata/store-tests read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.040s ok github.com/novox/mesh-controller/cmd/mesh-controller 161.945s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.014s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.021s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.015s ok github.com/novox/mesh-controller/examples/route-proxy 1.133s ok github.com/novox/mesh-controller/internal/artifacts 1.064s ? github.com/novox/mesh-controller/internal/beside [no test files] --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s) genesis_template_test.go:29: judged against /var/lib/build-agent/workspace/check/mesh-host as cloned beside this check genesis_template_test.go:29: open /var/lib/build-agent/workspace/check/mesh-host/examples/foundation-first-node-nats.lock: no such file or directory FAIL FAIL github.com/novox/mesh-controller/internal/broker 2.647s ok github.com/novox/mesh-controller/internal/builder 41.576s ok github.com/novox/mesh-controller/internal/catalogue 8.166s ok github.com/novox/mesh-controller/internal/conditions 2.680s ok github.com/novox/mesh-controller/internal/envfile 1.066s ok github.com/novox/mesh-controller/internal/facts 1.060s ok github.com/novox/mesh-controller/internal/identity 4.728s ok github.com/novox/mesh-controller/internal/inventory 38.846s ok github.com/novox/mesh-controller/internal/lease 17.753s ok github.com/novox/mesh-controller/internal/licences 3.979s ok github.com/novox/mesh-controller/internal/licences/adapters 1.058s ok github.com/novox/mesh-controller/internal/link 61.197s ok github.com/novox/mesh-controller/internal/lint 2.419s ok github.com/novox/mesh-controller/internal/outward 1.098s ok github.com/novox/mesh-controller/internal/overlay 1.077s ok github.com/novox/mesh-controller/internal/secrets 1.462s ok github.com/novox/mesh-controller/internal/store 3.550s ok github.com/novox/mesh-controller/internal/testbus 1.232s ok github.com/novox/mesh-controller/internal/token 1.021s FAIL --- what failed, picked from the whole of its output (the whole is in the build's log) --- FAIL: TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose (0.00s) genesis_template_test.go:29: judged against /var/lib/build-agent/workspace/check/mesh-host as cloned beside this check genesis_template_test.go:29: open /var/lib/build-agent/workspace/check/mesh-host/examples/foundation-first-node-nats.lock: no such file or directory FAIL github.com/novox/mesh-controller/internal/broker 2.647s ``` **Out of date when it landed**: out of date: judged against trunk 56d6313262e8, the trunk is now cbac703e817d; judged again on a recheck or when it is merged
mesh-admin commented 2026-10-12 23:26:09 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at 18221c40
Judged: head 18221c4079d1 merged into trunk 7b2a9eae8020; read beside it: mesh-catalog 8f80cd471634, mesh-controller-main 7b2a9eae8020, mesh-host 7a41e120635b, mesh-tools 954e1a53eef9

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-controller
  • tier 1: build-agent
  • ace: receives build-agent
  • g14: receives build-agent
  • novox: receives mesh-controller, build-agent
  • shanks: receives build-agent
  • build-agent keeps data (ADR 0233): what it holds is backed up before it moves
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine
  • read by no module's build: cmd/mesh-controller/written_settings_test.go, internal/catalogue/setting_takes_test.go, internal/inventory/stored_silent_file_test.go, testdata/store-tests

Run by the build seat on ace as build-1791847284840675499 (builds --log build-1791847284840675499).

--- the gate: build-agent, mesh-controller
mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8)
long-running resources without health: 1
files asking for a setting without saying whether it is trusted: 1
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T23:09:52Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T23:09:52Z

modules the change moves:
  - mesh-controller (changed)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller

notes:
  - cmd/mesh-controller/written_settings_test.go, internal/catalogue/setting_takes_test.go, internal/inventory/stored_silent_file_test.go and testdata/store-tests read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-controller/cmd/mesh-builder	1.035s
ok  	github.com/novox/mesh-controller/cmd/mesh-controller	148.469s
ok  	github.com/novox/mesh-controller/examples/objectstore-provisioner	1.044s
ok  	github.com/novox/mesh-controller/examples/postgres-provisioner	1.052s
ok  	github.com/novox/mesh-controller/examples/redis-provisioner	1.033s
ok  	github.com/novox/mesh-controller/examples/route-proxy	1.161s
ok  	github.com/novox/mesh-controller/internal/artifacts	1.089s
?   	github.com/novox/mesh-controller/internal/beside	[no test files]
ok  	github.com/novox/mesh-controller/internal/broker	4.052s
ok  	github.com/novox/mesh-controller/internal/builder	33.832s
ok  	github.com/novox/mesh-controller/internal/catalogue	7.744s
ok  	github.com/novox/mesh-controller/internal/conditions	2.585s
ok  	github.com/novox/mesh-controller/internal/envfile	1.052s
ok  	github.com/novox/mesh-controller/internal/facts	1.054s
ok  	github.com/novox/mesh-controller/internal/identity	4.576s
ok  	github.com/novox/mesh-controller/internal/inventory	30.664s
ok  	github.com/novox/mesh-controller/internal/lease	17.715s
ok  	github.com/novox/mesh-controller/internal/licences	3.750s
ok  	github.com/novox/mesh-controller/internal/licences/adapters	1.055s
ok  	github.com/novox/mesh-controller/internal/link	57.915s
ok  	github.com/novox/mesh-controller/internal/lint	2.302s
ok  	github.com/novox/mesh-controller/internal/outward	1.085s
ok  	github.com/novox/mesh-controller/internal/overlay	1.065s
ok  	github.com/novox/mesh-controller/internal/secrets	1.458s
ok  	github.com/novox/mesh-controller/internal/store	3.429s
ok  	github.com/novox/mesh-controller/internal/testbus	1.236s
ok  	github.com/novox/mesh-controller/internal/token	1.018s
store tests, each run against the store:
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.20s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.22s)
  ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.20s)
  ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.21s)
  ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.19s)
  ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.26s)
  ./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.95s)
  ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.22s)
  ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.13s)
  ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.23s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.22s)
  ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.19s)
  ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.19s)
  ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.24s)
  ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.19s)
  ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.22s)
  ./cmd/mesh-controller --- PASS: TestReplay237 (0.18s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.18s)
  ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.18s)
  ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.18s)
  ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.21s)
  ./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.27s)
  ./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.26s)
  ./cmd/mesh-controller --- PASS: TestReplay201 (0.15s)
  ./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.15s)
  ./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.16s)
  ./cmd/mesh-controller --- PASS: TestReplay401 (0.26s)
  ./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.21s)
  ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.07s)
  ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.07s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.09s)
  ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.07s)
  ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.06s)
  ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.06s)
  ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.06s)
  ./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.06s)
  ./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.06s)
**Merge check** at `18221c40` Judged: head `18221c4079d1` merged into trunk `7b2a9eae8020`; read beside it: mesh-catalog `8f80cd471634`, mesh-controller-main `7b2a9eae8020`, mesh-host `7a41e120635b`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: build-agent, mesh-controller) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - ace: receives build-agent - g14: receives build-agent - novox: receives mesh-controller, build-agent - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before build-agent is judged on its first machine - read by no module's build: cmd/mesh-controller/written_settings_test.go, internal/catalogue/setting_takes_test.go, internal/inventory/stored_silent_file_test.go, testdata/store-tests Run by the build seat on ace as `build-1791847284840675499` (`builds --log build-1791847284840675499`). ``` --- the gate: build-agent, mesh-controller mesh-controller: ok, 58 tool(s); WARNING: merge-window ask(s) for a setting and do(es) not say whether it is trusted, so it counts as trusted: set at the terminal alone; say "trusted" false where nothing trusts it (novox/hq issue 339); WARNING: controller stay(s) up and say(s) not how it is ready — judged by liveness alone, refused from 2026-11-18 (ADR 0240 rule 8) long-running resources without health: 1 files asking for a setting without saying whether it is trusted: 1 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T23:09:52Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T23:09:52Z modules the change moves: - mesh-controller (changed) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 2 module(s) in 2 tier(s): build-agent, mesh-controller notes: - cmd/mesh-controller/written_settings_test.go, internal/catalogue/setting_takes_test.go, internal/inventory/stored_silent_file_test.go and testdata/store-tests read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-controller/cmd/mesh-builder 1.035s ok github.com/novox/mesh-controller/cmd/mesh-controller 148.469s ok github.com/novox/mesh-controller/examples/objectstore-provisioner 1.044s ok github.com/novox/mesh-controller/examples/postgres-provisioner 1.052s ok github.com/novox/mesh-controller/examples/redis-provisioner 1.033s ok github.com/novox/mesh-controller/examples/route-proxy 1.161s ok github.com/novox/mesh-controller/internal/artifacts 1.089s ? github.com/novox/mesh-controller/internal/beside [no test files] ok github.com/novox/mesh-controller/internal/broker 4.052s ok github.com/novox/mesh-controller/internal/builder 33.832s ok github.com/novox/mesh-controller/internal/catalogue 7.744s ok github.com/novox/mesh-controller/internal/conditions 2.585s ok github.com/novox/mesh-controller/internal/envfile 1.052s ok github.com/novox/mesh-controller/internal/facts 1.054s ok github.com/novox/mesh-controller/internal/identity 4.576s ok github.com/novox/mesh-controller/internal/inventory 30.664s ok github.com/novox/mesh-controller/internal/lease 17.715s ok github.com/novox/mesh-controller/internal/licences 3.750s ok github.com/novox/mesh-controller/internal/licences/adapters 1.055s ok github.com/novox/mesh-controller/internal/link 57.915s ok github.com/novox/mesh-controller/internal/lint 2.302s ok github.com/novox/mesh-controller/internal/outward 1.085s ok github.com/novox/mesh-controller/internal/overlay 1.065s ok github.com/novox/mesh-controller/internal/secrets 1.458s ok github.com/novox/mesh-controller/internal/store 3.429s ok github.com/novox/mesh-controller/internal/testbus 1.236s ok github.com/novox/mesh-controller/internal/token 1.018s store tests, each run against the store: ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeWalksTheOthersAgain (0.20s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeEndsTheMergesThatContainIt (0.22s) ./cmd/mesh-controller --- PASS: TestAStopWalksTheOthersAgainInTheOpenBatch (0.20s) ./cmd/mesh-controller --- PASS: TestAStopNamesWhatStaysOnTheMachinesAndWhatStillCarriesIt (0.21s) ./cmd/mesh-controller --- PASS: TestAStopWithoutAMergeLeavesItOutOfABatch (0.19s) ./cmd/mesh-controller --- PASS: TestSavingPlansAndMovingMergesIsOneAct (0.26s) ./cmd/mesh-controller --- PASS: TestAPlanFollowedFromTheStoreAnswersWhenItMoves (1.95s) ./cmd/mesh-controller --- PASS: TestNodeShowAndStatusReadTheLastSendFromTheStore (0.22s) ./cmd/mesh-controller --- PASS: TestTheConditionsVerbReadsTheLooksTheBucketNoLongerHolds (0.13s) ./cmd/mesh-controller --- PASS: TestAWalkLetGoAndStoppedByVerbsIsSaidStartedAndEnded (0.23s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedOrClosedByAPersonIsSaidEndedStopped (0.22s) ./cmd/mesh-controller --- PASS: TestAWalkRetriedByAPersonIsSaidStartedAgain (0.19s) ./cmd/mesh-controller --- PASS: TestABacklogReleasedByAPersonIsSaidStarted (0.19s) ./cmd/mesh-controller --- PASS: TestAWalkEndedByCancelOrClearIsSaidEnded (0.24s) ./cmd/mesh-controller --- PASS: TestAWalkRestartedByARebuildIsSaidStarted (0.19s) ./cmd/mesh-controller --- PASS: TestAWalkStoppedByHandAndRetriedEndsFailedWhenItFailsAgain (0.22s) ./cmd/mesh-controller --- PASS: TestReplay237 (0.18s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer (0.18s) ./cmd/mesh-controller --- PASS: TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt (0.18s) ./cmd/mesh-controller --- PASS: TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal (0.18s) ./cmd/mesh-controller --- PASS: TestADirectoryOwnersKeyIsRefusedThroughAVerb (0.21s) ./cmd/mesh-controller --- PASS: TestTheSendMakesNoValueForAnOutsideSecretNobodyGave (0.27s) ./cmd/mesh-controller --- PASS: TestAQuestionComposesWithoutAnOutsideSecretNobodyGave (0.26s) ./cmd/mesh-controller --- PASS: TestReplay201 (0.15s) ./cmd/mesh-controller --- PASS: TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend (0.15s) ./cmd/mesh-controller --- PASS: TestAGateJudgesTheOtherMovesBesideAKeptCore (0.16s) ./cmd/mesh-controller --- PASS: TestReplay401 (0.26s) ./cmd/mesh-controller --- PASS: TestReplay201ThePlansSend (0.21s) ./internal/inventory --- PASS: TestTheLastSendSaysWhatTheMachineAnswered (0.07s) ./internal/inventory --- PASS: TestAReportIsTheLastSendsAnswerOnlyWhenItIsAboutThatSend (0.07s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain (0.09s) ./internal/inventory --- PASS: TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance (0.07s) ./internal/inventory --- PASS: TestAConditionsLooksAreKeptBesideTheBucket (0.06s) ./internal/inventory --- PASS: TestAPlanIdHoldingAQuoteIsReadAsAPlainId (0.06s) ./internal/inventory --- PASS: TestAWalksStartIsKeptAndARefusedSaveLeavesItUnsaid (0.06s) ./internal/inventory --- PASS: TestAWalksRestIsReadFromEachMachinesOwnSend (0.06s) ./internal/inventory --- PASS: TestAStoredBuildWithASilentMergeableFileIsStillReadAndComposed (0.06s) ```
mesh-admin merged commit 454a3db69a into main 2026-10-12 23:28:22 +00:00
mesh-admin deleted branch fix/574-a-declaring-module-names-its-files-keys 2026-10-12 23:28:22 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
mesh-admin
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#282