Delete node-dns-resolver; resolver config needs the uplink (hq ADR 0220) #61

2026-10-05T19:59:53Z

mesh-admin commented

2026-10-05 19:59:53 +00:00

Implements hq ADR 0220.

node-dns-resolver deleted from the compiled set (38 → 37) and, via migration 0060-the-per-node-resolver-seat-is-gone.sql, from the store's seat table (seeding never removes rows, ADR 0122) plus any alias. Unheld on every node (read from mesh-controller.seats).
Seat.Needs: the node seats a seat's holder needs on the same node. Compiled, never stored (merged in UseSeats like Receives). DependsOn adds the needs of every node seat a module claims, so assign/unassign/composition refusals follow ADR 0207 unchanged. node-resolver-config needs node-uplink.
Tests: new resolver_needs_uplink_test.go (definition, store round-trip, assign refused/allowed, unassign refused, composition refused, real catalogue: uplink holders dhcpcd/networkmanager/systemd-networkd and resolv-conf the sole resolver-config claimant). resolver_manifests_test.go no longer loads resolved-split-dns; the two-claimants test keeps its intent with a synthetic module. Broker seattools test uses node-hosts-file instead of the deleted seat name.

gofmt -l clean, go vet ./... clean, go test ./... all ok (with the catalogue branch as sibling). Inventory DB tests skip without postgres, so the migration was not executed against a database here.

Merge order: after novox/hq ADR 0220 and after novox/mesh-catalog feat/retire-resolved-split-dns (TestTheCataloguesResolverConfigHasUplinkHoldersToName fails against a catalogue that still has resolved-split-dns). Live impact: none expected — every node already holds both node-resolver-config and node-uplink.

Implements hq ADR 0220. - **`node-dns-resolver` deleted** from the compiled set (38 → 37) and, via migration `0060-the-per-node-resolver-seat-is-gone.sql`, from the store's `seat` table (seeding never removes rows, ADR 0122) plus any alias. Unheld on every node (read from `mesh-controller.seats`). - **`Seat.Needs`**: the node seats a seat's holder needs on the same node. Compiled, never stored (merged in `UseSeats` like `Receives`). `DependsOn` adds the needs of every node seat a module claims, so assign/unassign/composition refusals follow ADR 0207 unchanged. `node-resolver-config` needs `node-uplink`. - Tests: new `resolver_needs_uplink_test.go` (definition, store round-trip, assign refused/allowed, unassign refused, composition refused, real catalogue: uplink holders dhcpcd/networkmanager/systemd-networkd and resolv-conf the sole resolver-config claimant). `resolver_manifests_test.go` no longer loads resolved-split-dns; the two-claimants test keeps its intent with a synthetic module. Broker seattools test uses `node-hosts-file` instead of the deleted seat name. `gofmt -l` clean, `go vet ./...` clean, `go test ./...` all ok (with the catalogue branch as sibling). Inventory DB tests skip without postgres, so the migration was not executed against a database here. **Merge order:** after novox/hq ADR 0220 and **after** novox/mesh-catalog `feat/retire-resolved-split-dns` (`TestTheCataloguesResolverConfigHasUplinkHoldersToName` fails against a catalogue that still has resolved-split-dns). Live impact: none expected — every node already holds both `node-resolver-config` and `node-uplink`.

mesh-admin added 1 commit 2026-10-05 19:59:53 +00:00

Delete node-dns-resolver and make resolver config need the uplink 53d3cd7ce9

Nothing has claimed node-dns-resolver since the mesh moved to one resolver
(hq ADR 0194); seeding never removes a row, so a migration deletes it.

resolv.conf stays the mesh's only while the network manager is told to keep
off it, which the node-uplink holder does (ADR 0117). A seat's Needs makes
that a dependency checked at assignment by the ADR 0207 mechanism (hq ADR
0220). The two-claimants test keeps its intent with a synthetic module now
that resolved-split-dns leaves the catalogue.

mesh-admin merged commit 8a400d165e into main

2026-10-05 20:11:18 +00:00

mesh-admin deleted branch feat/resolver-config-needs-the-uplink

2026-10-05 20:11:19 +00:00

mesh-admin commented

2026-10-06 23:10:04 +00:00

Delivery novox/mesh-controller@8a400d165e88 — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#61 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@8a400d165e88` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#61 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin referenced this pull request

2026-10-08 08:45:35 +00:00

Resolve a group's order rules by precedence, not as a cycle (hq issue 309) #134

mesh-admin referenced this pull request

2026-10-09 09:07:45 +00:00

Name the account agents run as on a node, and say whether it can become root (hq ADR 0266) #164

mesh-admin referenced this pull request

2026-10-09 09:48:44 +00:00

Do not raise agent-can-become-root while the first setuid search is within its bound (hq ADR 0266, note E) #175

jschoubben referenced this issue from a commit

2026-10-09 10:12:36 +00:00

Pin the node-engine at the head whose setuid search runs to its own bound