Grant the self-check its ban-list question, say a refusal at once, judge the engine by its delivered version (hq to-be 45 Phase 1) #80

2026-10-06T08:44:52Z

mesh-admin commented

2026-10-06 08:44:52 +00:00

Two findings of the first live self-check (2026-10-06 08:37 UTC).

D8 refused (bus.controller.refused, 24×): the controller's grant lacked mesh.seat.node-intrusion-prevention.tool.banned.<node>.

broker.VerbsTheSelfCheckAsks names the seat verbs the self-check asks; the controller is granted mesh.seat.<seat>.tool.<verb>.* for each.
Each probe declares Asks; askSeatTool refuses a verb the running probe did not declare; TestEverySeatVerbAProbeAsksIsGranted walks the registry and fails any declared verb the composed permissions do not match (or that VerbsTheSelfCheckAsks omits).
link.AskSeatTool returns a refused publish at once ("the bus refused the controller asking …") by listening for the connection's permission-violation error on that subject, instead of waiting out its timeout. Tested against an authenticating nats:2.11 that denies mesh.seat.>: answered in <1 ms.
D8 asks the machines in parallel (four sequential 10 s waits outlast the probe's 30 s).

D10 false positive: a node-engine reports its version as its delivery directory = the archive digest's first 12 hex (31045596c83a, catalogue versionOf); the live declaration's path is /usr/lib/nox-mesh-host/versions/31045596c83a, so every machine runs exactly what the mesh holds. D10 compared it with the build commit (1545b00a). It now compares with the versions/<v> paths of the registered mesh-host manifest (and, for a hand-placed engine, the commit). Test: TestANodeEngineIsJudgedByTheVersionItIsDeliveredAs.

Tests: full suite green (GOFLAGS=-mod=vendor GOPROXY=off go test -count=1 -p 1 ./..., postgres:17 + nats:2.11), -race on the touched packages, vet/gofmt clean.

Rollout: merge mesh-host#34 (genesis lock, held equal by the genesis test) and this; after the controller's plan, push novox (the broker's machine) so the user list carries the new grant. machine.*.core-behind clears on the next doctor run; bus.controller.refused clears an hour after the last refusal (S9's quiet bound).

Two findings of the first live self-check (2026-10-06 08:37 UTC). **D8 refused (`bus.controller.refused`, 24×):** the controller's grant lacked `mesh.seat.node-intrusion-prevention.tool.banned.<node>`. - `broker.VerbsTheSelfCheckAsks` names the seat verbs the self-check asks; the controller is granted `mesh.seat.<seat>.tool.<verb>.*` for each. - Each probe declares `Asks`; `askSeatTool` refuses a verb the running probe did not declare; `TestEverySeatVerbAProbeAsksIsGranted` walks the registry and fails any declared verb the composed permissions do not match (or that VerbsTheSelfCheckAsks omits). - `link.AskSeatTool` returns a refused publish **at once** ("the bus refused the controller asking …") by listening for the connection's permission-violation error on that subject, instead of waiting out its timeout. Tested against an authenticating nats:2.11 that denies `mesh.seat.>`: answered in <1 ms. - D8 asks the machines in parallel (four sequential 10 s waits outlast the probe's 30 s). **D10 false positive:** a node-engine reports its version as its delivery directory = the archive digest's first 12 hex (`31045596c83a`, catalogue `versionOf`); the live declaration's path is `/usr/lib/nox-mesh-host/versions/31045596c83a`, so every machine runs exactly what the mesh holds. D10 compared it with the build commit (`1545b00a`). It now compares with the `versions/<v>` paths of the registered mesh-host manifest (and, for a hand-placed engine, the commit). Test: `TestANodeEngineIsJudgedByTheVersionItIsDeliveredAs`. Tests: full suite green (`GOFLAGS=-mod=vendor GOPROXY=off go test -count=1 -p 1 ./...`, postgres:17 + nats:2.11), `-race` on the touched packages, vet/gofmt clean. **Rollout:** merge mesh-host#34 (genesis lock, held equal by the genesis test) and this; after the controller's plan, push novox (the broker's machine) so the user list carries the new grant. `machine.*.core-behind` clears on the next doctor run; `bus.controller.refused` clears an hour after the last refusal (S9's quiet bound).

mesh-admin added 1 commit 2026-10-06 08:44:52 +00:00

Grant the self-check its ban-list question, say a refusal at once, judge the engine by its delivered version (hq to-be 45 Phase 1) 8ddc019cd2

Live on 2026-10-06, two of the first self-check's findings were its own:

- D8 asked every machine's node-intrusion-prevention.banned, and the
  controller's grant did not name the subject: the bus refused it 24 times
  and D8 timed out after thirty seconds instead of saying so. The verbs the
  self-check asks are named in broker.VerbsTheSelfCheckAsks and granted
  (mesh.seat.<seat>.tool.<verb>.*); each probe declares the seat verbs it
  calls, askSeatTool refuses an undeclared one, and a test over the
  registry fails a probe whose question the controller is not granted.
  AskSeatTool now returns a refused publish at once ("the bus refused…")
  instead of waiting out its timeout; D8 asks the machines in parallel.
- D10 read every machine as behind right after a push: a node-engine says
  its version as the directory it is delivered into, the archive's digest
  (31045596c83a, catalogue versionOf), and D10 compared that with the
  build's commit (1545b00a). It now compares with the versions the
  registered build is delivered as, and a hand-placed engine's commit.

mesh-admin merged commit 9cf47f4429 into main

2026-10-06 08:45:17 +00:00

mesh-admin deleted branch fix/phase-1-d8-grant-and-d10-version

2026-10-06 08:45:17 +00:00

mesh-admin commented

2026-10-06 23:10:08 +00:00

Delivery novox/mesh-controller@9cf47f4429e7 — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step

tier 0: mesh-controller
tier 1: build-agent
tier 2: route-proxy
ace: receives build-agent, route-proxy
g14: receives build-agent
novox: receives mesh-controller, build-agent, route-proxy
shanks: receives build-agent
build-agent keeps data (ADR 0233): what it holds is backed up before it moves
route-proxy provides route: its consumers are sent again after it
route-proxy keeps data (ADR 0233): what it holds is backed up before it moves

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#80 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@9cf47f4429e7` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step - tier 0: mesh-controller - tier 1: build-agent - tier 2: route-proxy - ace: receives build-agent, route-proxy - g14: receives build-agent - novox: receives mesh-controller, build-agent, route-proxy - shanks: receives build-agent - build-agent keeps data (ADR 0233): what it holds is backed up before it moves - route-proxy provides route: its consumers are sent again after it - route-proxy keeps data (ADR 0233): what it holds is backed up before it moves **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#80 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#80