Bound a consumer's identity by the provision it requires (hq issue 263, ADR 0225) #76

2026-10-06T00:18:34Z

mesh-admin commented

2026-10-06 00:18:34 +00:00

Implements novox/hq ADR 0225 (hq PR #127), which fixes issue 263.

Per-provision bounds. Offer.Identity takes {max, in} or false. Manifest.IdentityBoundOf applies it. If the offer says nothing, the bound is 20 when the provider receives the provision or serves ${consumer:as}, and there is no bound when it does neither. Needed.Identity carries the bound from the answering offer at resolution, and an unknown provider gets 20. CheckIdentityWithin judges against it.
Refuse before merge. IdentityProblems(shelf, longestMachine) judges every module's Wants() against the tightest offering provider. module check --longest-machine-name N runs it; the default, catalogue.DefaultLongestMachine, is 6. TestEveryCatalogueIdentityFitsWhatItRequires runs it over the sibling catalogue.
Never block the provider. grantsFor no longer returns an error for an overflow. It leaves that consumer out of the grants and returns it as a catalogue.Overflow. Rendering.Withheld carries it to sendable.withheld, and reportLeftOut prints it on push and plan. plan <consumer> prints Resolution.Overflowing(). status adds a section, status --json adds overflowing, and the mesh is not called well while one stands.
DNS labels. CheckServes refuses an offer that serves ${consumer:as:dns} with a bound over 63, or with no bound.

Tests: catalogue unit tests for each rule; module check refusing an overflow and passing a long keyless consumer; and a DB test reproducing the networkmanager → wildcard-resolution case on a 6-character node beside an overflowing S3 consumer. In that test the provider composes, networkmanager is granted, and the overflow is withheld and shown in push and status. gofmt -l is clean, go vet ./... passes, and go test -p 1 ./... with MESH_TEST_POSTGRES is green.

Merge order: after hq #127 and before mesh-catalog fix/263-identity-bounds-per-provision. Strict parsing means an older controller refuses the catalogue's new field. With today's catalogue the behaviour is unchanged: every bound is the old 20, or none for providers told nothing of their consumers.

Implements novox/hq ADR 0225 (hq PR #127), which fixes issue 263. - **Per-provision bounds.** `Offer.Identity` takes `{max, in}` or `false`. `Manifest.IdentityBoundOf` applies it. If the offer says nothing, the bound is 20 when the provider receives the provision or serves `${consumer:as}`, and there is no bound when it does neither. `Needed.Identity` carries the bound from the answering offer at resolution, and an unknown provider gets 20. `CheckIdentityWithin` judges against it. - **Refuse before merge.** `IdentityProblems(shelf, longestMachine)` judges every module's `Wants()` against the tightest offering provider. `module check --longest-machine-name N` runs it; the default, `catalogue.DefaultLongestMachine`, is 6. `TestEveryCatalogueIdentityFitsWhatItRequires` runs it over the sibling catalogue. - **Never block the provider.** `grantsFor` no longer returns an error for an overflow. It leaves that consumer out of the grants and returns it as a `catalogue.Overflow`. `Rendering.Withheld` carries it to `sendable.withheld`, and `reportLeftOut` prints it on push and plan. `plan <consumer>` prints `Resolution.Overflowing()`. `status` adds a section, `status --json` adds `overflowing`, and the mesh is not called well while one stands. - **DNS labels.** `CheckServes` refuses an offer that serves `${consumer:as:dns}` with a bound over 63, or with no bound. Tests: catalogue unit tests for each rule; `module check` refusing an overflow and passing a long keyless consumer; and a DB test reproducing the networkmanager → wildcard-resolution case on a 6-character node beside an overflowing S3 consumer. In that test the provider composes, networkmanager is granted, and the overflow is withheld and shown in push and status. `gofmt -l` is clean, `go vet ./...` passes, and `go test -p 1 ./...` with MESH_TEST_POSTGRES is green. **Merge order:** after hq #127 and before mesh-catalog `fix/263-identity-bounds-per-provision`. Strict parsing means an older controller refuses the catalogue's new field. With today's catalogue the behaviour is unchanged: every bound is the old 20, or none for providers told nothing of their consumers.

mesh-admin added 1 commit 2026-10-06 00:18:34 +00:00

Bound a consumer's identity by the provision it requires (hq issue 263) 6d620f77c3

The one global 20-character bound made every consumer pay an object
store's key length, even for provisions that keep no name, and a single
overflow refused the provider's whole declaration. An offer now states
its own bound (identity: {max, in} or false); unsaid, a provider told its
consumers keeps 20 and one told nothing keeps none. module check judges
every identity on the longest machine name before merge, and a provider
leaves an overflowing consumer out of its grants and composes, with the
consumer named by push, plan and status (ADR 0225).

mesh-admin merged commit 146c48fd96 into main

2026-10-06 00:28:48 +00:00

mesh-admin deleted branch fix/263-identity-bound-per-provision

2026-10-06 00:28:48 +00:00

mesh-admin commented

2026-10-06 23:09:31 +00:00

Delivery novox/mesh-controller@146c48fd9647 — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#76 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@146c48fd9647` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#76 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin referenced this pull request

2026-10-09 23:57:03 +00:00

Ask a node's engine for a fresh setuid search at the terminal (hq issue 361) #191

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#76