novox/mesh-controller
14
0
Fork 0
Code Issues Pull Requests 3 Releases Wiki Activity

Write the facts snapshot in format 2 with each machine's grants and credential bindings (design 47 R4c-2, issue 1394) #409

Merged
mesh-tools merged 2 commits from feat/r4c2-new-keys into main 2026-10-20 19:31:03 +00:00
Conversation 1 Commits 2 Files Changed 4
+86 -34
mesh-tools commented 2026-10-20 19:17:22 +00:00
Member
Copy Link
Copy Source

Design 47 R4c's second delivery (ADR 0456 §2, ADR 0465 §5), one delivery group with mesh-delivery's bridge and indexer on the same branch name.

  • issue 1394: writtenFormat is mesh-sdk's go/facts Format (2); each machine lists the grants it issued (provision, consumer node and module, local; names only, never a sealed value) and the credential bindings its consumers hold, through the scrubber. Every reader (the merge gate, the build seat's check) reads formats 1 and 2 since mesh-controller #408's delivery.
  • issues 1448, 1449: the delivery parts' grant test copies the bridge's and the indexer's manifests whole from the group's mesh-delivery branch, so it asserts the bridge may call gitea_get_file and the indexer writes its manifests bucket.

Tests: facts_format_test.go (1394/AC3, unit), facts_test.go (1394/AC1-AC2, integration). Try build-1792522621685865903 at e7c6abfd passed (unit level 2.44 s of 5 s). Live after the delivery: facts:latest at format 2 within the controller's first pass (1394/AC4).

Reviewed-by: review-r4c2@shanks at e7c6abfd0e

Design 47 R4c's second delivery (ADR 0456 §2, ADR 0465 §5), one delivery group with mesh-delivery's bridge and indexer on the same branch name. - issue 1394: writtenFormat is mesh-sdk's go/facts Format (2); each machine lists the grants it issued (provision, consumer node and module, local; names only, never a sealed value) and the credential bindings its consumers hold, through the scrubber. Every reader (the merge gate, the build seat's check) reads formats 1 and 2 since mesh-controller #408's delivery. - issues 1448, 1449: the delivery parts' grant test copies the bridge's and the indexer's manifests whole from the group's mesh-delivery branch, so it asserts the bridge may call gitea_get_file and the indexer writes its manifests bucket. Tests: facts_format_test.go (1394/AC3, unit), facts_test.go (1394/AC1-AC2, integration). Try build-1792522621685865903 at e7c6abfd passed (unit level 2.44 s of 5 s). Live after the delivery: facts:latest at format 2 within the controller's first pass (1394/AC4). Reviewed-by: review-r4c2@shanks at e7c6abfd0e3c03704791b78592af26a09897223b
mesh-tools added 2 commits 2026-10-20 19:17:23 +00:00
Write the facts snapshot in format 2, with each machine's grants and credential bindings (design 47 R4c-2, issue 1394) b75fb7899e 
Every reader takes format 2 since R4b (ADR 0456 clause 1), and the assigner's composition check reads the grants and bindings (ADR 0456 clause 2): the writer moves now, names only, never a sealed value.
Test the grants of the bridge's file read and the indexer's manifests bucket (issues 1448, 1449, design 47 R4c-2)
mesh/repo-check head e7c6abfd0e3c merged into trunk f2d7bc94800d — pass: its merge-check.sh passed
Details
mesh/merge-gate head e7c6abfd0e3c merged into trunk f2d7bc94800d — pass: group feat/r4c2-new-keys composed: every machine composes with the change as it di…
Details
mesh/delivery delivered
Details
mesh/delivery-group group feat/r4c2-new-keys delivered: every member is delivered
Details
e7c6abfd0e
mesh-tools commented 2026-10-20 19:17:29 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-controller@e7c6abfd0e3c — delivered since 2026-10-20T19:34:41Z

Delivery plan — builds mesh-controller → novox; no bus step

  • tier 0: mesh-controller
  • novox: receives mesh-controller

Group feat/r4c2-new-keys: novox/mesh-controller@e7c6abfd0e, novox/mesh-delivery@c9f742d5f2

  • composed together: pass — every machine composes with the change as it did without (4 of 4 compose)

Machines

  • mesh-controller on every machine running it: sent
  • mesh-delivery-forge-bridge on every machine running it: sent
  • mesh-delivery-indexer on every machine running it: sent

Transitions

  • 2026-10-20 19:17 (new) → proposed (announced): novox/mesh-controller#409's head announced
  • 2026-10-20 19:25 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-20 19:25 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-20 19:32 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-20 19:32 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-20 19:34 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-controller@e7c6abfd0e3c` — **delivered** since 2026-10-20T19:34:41Z **Delivery plan** — builds mesh-controller → novox; no bus step - tier 0: mesh-controller - novox: receives mesh-controller **Group** `feat/r4c2-new-keys`: novox/mesh-controller@e7c6abfd0e3c, novox/mesh-delivery@c9f742d5f20e - composed together: pass — every machine composes with the change as it did without (4 of 4 compose) **Machines** - mesh-controller on every machine running it: sent - mesh-delivery-forge-bridge on every machine running it: sent - mesh-delivery-indexer on every machine running it: sent **Transitions** - 2026-10-20 19:17 (new) → proposed (announced): novox/mesh-controller#409's head announced - 2026-10-20 19:25 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-20 19:25 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-20 19:32 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-20 19:32 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-20 19:34 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools merged commit 073ccc29c6 into main 2026-10-20 19:31:03 +00:00
mesh-tools deleted branch feat/r4c2-new-keys 2026-10-20 19:31:03 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#409