jschoubben 00bcdccdc7 Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353) ...

#186 judged the grant by whether the bus's machine was last sent the user list composed now: any user's
change held asking back, a list sent was taken for a list the bus enforces, a plan that could not be
worked out read as not behind, and no test held the real judgement. Now the asker asks only when the
composition grants the controller itself to publish its ask, and the bus's own module says that grant
is in force on the running server (nats_user_can's in_force, mesh-catalog); each fact not known is not
held, said with why. brokerBehind takes a list nobody could compose as behind.

2026-10-09 19:41:39 +02:00

..

testdata

Raise a machine's network from what its engine says, once (hq ADR 0241)

2026-10-07 18:52:16 +02:00

acting.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

acts_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

acts.go

mesh-cli lines are calls, followed to their answer; the terminal does not follow assign (review of hq ADR 0272)

2026-10-09 12:48:12 +02:00

addresses_test.go

The registry-trust test reads the runtime's module, which now writes the trust (ADR 0222)

2026-10-05 22:47:43 +02:00

adopting_test.go

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

adoption.go

node show cites ADR 0180 for a removed front end (hq ADR 0186)

2026-10-02 18:42:16 +02:00

agent_account_test.go

Key root-not-free apart from DA, keep ADR 0266's quiet window there, and judge at one clock (hq ADR 0259 §8)

2026-10-09 13:55:06 +02:00

agent_account.go

Key root-not-free apart from DA, keep ADR 0266's quiet window there, and judge at one clock (hq ADR 0259 §8)

2026-10-09 13:55:06 +02:00

api_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

api.go

A module depends on the node seats that apply its resources (hq ADR 0207)

2026-10-04 12:34:11 +02:00

ask.go

One bus: the AMQP transport is gone from the controller

2026-09-28 03:36:16 +02:00

asker_bus_test.go

Ask an acknowledgement apart from an approval, change every kept ask by compare-and-set, and rehearse rather than drill (hq ADR 0259, review M1/L2/L3/L7)

2026-10-09 16:22:34 +02:00

asker_test.go

Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353)

2026-10-09 19:41:39 +02:00

asker_wire.go

Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353)

2026-10-09 19:41:39 +02:00

asker.go

Ask the operator only once the bus holds the controller's grant to ask (hq issue 353)

2026-10-09 18:13:58 +02:00

awaiting_push_test.go

Say a machine waiting for its push as waiting, not uncomposable (hq issue 275)

2026-10-06 18:05:38 +02:00

bindings_test.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

bindings.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

board_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

board.go

Record whether a node is adopted and which modules were taken on it (hq ADR 0100)

2026-09-22 17:14:05 +02:00

build_seat_test.go

The controller asks the build role that has a holder, and hears both roles' outcomes (hq ADR 0190, the handover)

2026-10-03 02:51:03 +02:00

build_source_test.go

Judge the one protection rule the forge applies, and keep a recorded repository id

2026-10-09 12:58:28 +02:00

build_source.go

Merge pull request 'Answer mesh-cli: the control-node's operator is the terminal, everyone else is not (hq ADR 0272)' (#176) from feat/272-answer-mesh-cli into main

2026-10-09 11:38:43 +00:00

build_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

build.go

Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

2026-10-09 12:37:18 +02:00

bus_step.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

bus_waits_test.go

Name the bus upgrade as the mesh call a person makes, and say a same-source rebuild needs no step (review of #173)

2026-10-09 02:54:23 +02:00

bus_waits.go

Say S17 clears once the new bus is sent, as it does

2026-10-09 03:23:47 +02:00

buscertificate_test.go

The mesh makes the bus's certificate itself

2026-09-29 15:42:51 +02:00

buscertificate.go

A token is an account on the bus, and genesis can place the list

2026-09-29 17:36:50 +02:00

busobjects_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

busobjects.go

Serve a trusted holder from a runtime of its own account, refuse it in the machine's runtime, and say while an agent can become root where it runs (hq ADR 0259 §8)

2026-10-09 13:48:56 +02:00

calls_verb_test.go

Let the generic command verb only read, and keep keys and tokens at the terminal

2026-10-09 10:12:05 +02:00

changeplan_test.go

Name the bus upgrade as the mesh call a person makes, and say a same-source rebuild needs no step (review of #173)

2026-10-09 02:54:23 +02:00

changeplan.go

Name the bus upgrade as the mesh call a person makes, and say a same-source rebuild needs no step (review of #173)

2026-10-09 02:54:23 +02:00

check_here.go

Cite the hq issues by the numbers they were given: 285, 286, 287

2026-10-08 01:42:22 +02:00

check_test.go

Let the module graph decide what a pull request's check runs, in two layers (hq ADR 0237)

2026-10-06 22:34:56 +02:00

check.go

Count a file that says nothing as trusted, and drop the refusal date

2026-10-09 01:44:50 +02:00

checks_test.go

Publish only a commit on its module's trunk; post a pull request's change plan (hq ADR 0238)

2026-10-06 22:49:55 +02:00

checks.go

Raise the mesh as it is in the gate, call a baseline that does not compose an error, and let a check run by hand as the seat runs it

2026-10-07 01:33:18 +02:00

collect.go

Leave an eligible index for a confirmed collect instead of letting it go alone

2026-10-08 15:47:42 +02:00

collection.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

conditions_brief_test.go

Page an answer larger than one message of the bus, and keep overviews brief (hq issue 314)

2026-10-08 12:19:16 +02:00

conditions_test.go

Switch the memory store's failure under its lock, so a test cannot race the keeper

2026-10-09 01:25:04 +02:00

conditions.go

Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259)

2026-10-09 16:22:34 +02:00

confirm.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

credential_on_assign_test.go

An assignment issues its bus credential, a push refuses one nobody issued, and what reads a secret restarts on it (hq issue 203)

2026-10-03 04:01:17 +02:00

data_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

data.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

deadletters_test.go

Answer dead-letters on the lent serving connection, and keep one clip helper

2026-10-08 21:09:08 +02:00

deadletters.go

Answer dead-letters on the lent serving connection, and keep one clip helper

2026-10-08 21:09:08 +02:00

delivery_conditions_test.go

Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259)

2026-10-09 16:22:34 +02:00

delivery_conditions.go

Say the terminal explicitly, only from a login session, and name the unannounced pull request (hq ADR 0272)

2026-10-09 13:41:32 +02:00

delivery_order_test.go

Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353)

2026-10-09 19:41:39 +02:00

delivery_test.go

Resolve a group's order rules by precedence, not as a cycle (hq issue 309)

2026-10-08 10:43:42 +02:00

delivery.go

Resolve a group's order rules by precedence, not as a cycle (hq issue 309)

2026-10-08 10:43:42 +02:00

dependents_test.go

A merge of a base rebuilds what stands on it

2026-10-01 16:09:26 +02:00

desk_secret_test.go

give: test that a trusted party's secret given at the terminal is announced before it is kept, and refuse an unknown machine before anybody types

2026-10-09 16:22:47 +02:00

desk_secret.go

give: test that a trusted party's secret given at the terminal is announced before it is kept, and refuse an unknown machine before anybody types

2026-10-09 16:22:47 +02:00

doctor_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

doctor.go

Key root-not-free apart from DA, keep ADR 0266's quiet window there, and judge at one clock (hq ADR 0259 §8)

2026-10-09 13:55:06 +02:00

dry_run_test.go

Take no dry run in: mark it on the request, echo it on the outcome, set it aside

2026-10-05 09:50:20 +02:00

durations.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

epoch_send_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

facts_test.go

Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

2026-10-06 20:31:10 +02:00

facts.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

found_wait_test.go

Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition

2026-10-09 01:23:44 +02:00

gate_followup_test.go

Excuse no wait for a move from a build not known, and count a module put back only once there is one (hq issue 318 review)

2026-10-08 15:49:07 +02:00

gate_test.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

gate.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

given_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

given.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

grant_follows_binding_test.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

handacts_test.go

Let the generic command verb only read, and keep keys and tokens at the terminal

2026-10-09 10:12:05 +02:00

handacts.go

Take a module's own secret through a hidden prompt on the operator's desk, so a bot token never passes through an agent's session (hq ADR 0259 §10)

2026-10-09 16:22:47 +02:00

healers_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

healers.go

Say a walk that waits too long, and a delivery's own stalls (hq ADR 0239)

2026-10-07 00:16:32 +02:00

health_check_test.go

Count a file that says nothing as trusted, and drop the refusal date

2026-10-09 01:44:50 +02:00

health_probes.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

held_back_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

held_back.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

hidden_input.go

give: never take a trusted party's secret at a desk, and announce it before it is kept (hq ADR 0259 §10, the confirmation review's N1-give)

2026-10-09 16:22:47 +02:00

hold_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

hold.go

Hold a node from composing to sending, so a push composed before converge or adopt is never sent after it (hq ADR 0100)

2026-09-22 18:10:04 +02:00

holders_silent_test.go

Make the login shell's execute optional, so a machine may withhold it

2026-10-09 00:07:33 +02:00

holdings_test.go

A holder by derivation is recorded before an assignment can unsettle it (hq 170)

2026-09-30 14:39:59 +02:00

holdings.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

hosts_behind_test.go

A commit has no order, so the mesh says who runs what and claims no newer

2026-09-30 09:28:56 +02:00

identity_bound_test.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

issue348_test.go

Answer the review of hq issues 348 and 349: gaps, parts, the newest merge in any state

2026-10-09 15:00:56 +02:00

issue349_test.go

Test the newest merge's order, a second reopening's gaps and sub-second merge times (hq issues 348, 349)

2026-10-09 15:29:31 +02:00

issue352_test.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

issue_204_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

join_through_the_tunnel_test.go

Hold that a joining machine is a peer of the hub only while its token lives

2026-10-08 02:06:19 +02:00

lease_command_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

lease_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

licence.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

machine_network_test.go

Raise a machine's network from what its engine says, once (hq ADR 0241)

2026-10-07 18:52:16 +02:00

machine_network.go

Answer the review of hq issues 348 and 349: gaps, parts, the newest merge in any state

2026-10-09 15:00:56 +02:00

machine_units_test.go

Raise a failed unit, the module's and the machine's (hq issue 315)

2026-10-08 11:28:52 +02:00

machine_units.go

Open every explanation with what the operator needs to do, and offer the answers

2026-10-08 13:58:53 +02:00

main.go

Ask an acknowledgement apart from an approval, change every kept ask by compare-and-set, and rehearse rather than drill (hq ADR 0259, review M1/L2/L3/L7)

2026-10-09 16:22:34 +02:00

merge_gate_test.go

Cite the hq issues by the numbers they were given: 285, 286, 287

2026-10-08 01:42:22 +02:00

merge_gate.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

mesh_for_test.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

meshcli_stdin_test.go

mesh-cli: give a terminal line the standard input mesh-cli carried, refuse it to any other, keep it nowhere

2026-10-09 17:01:36 +02:00

meshcli_test.go

Start a rehearsal only at the controller's terminal as main now judges it (hq ADR 0259, ADR 0272)

2026-10-09 16:22:34 +02:00

meshcli.go

mesh-cli: give a terminal line the standard input mesh-cli carried, refuse it to any other, keep it nowhere

2026-10-09 17:01:36 +02:00

mirrors_test.go

Leave an eligible index for a confirmed collect instead of letting it go alone

2026-10-08 15:47:42 +02:00

mirrors.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

missed_merges_test.go

Catch up on merges the bus announced and never handed over (hq issue 266)

2026-10-06 01:29:21 +02:00

missed_merges.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

module_health_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

module_health.go

Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259)

2026-10-09 16:22:34 +02:00

modules_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

modules.go

Answer mesh-cli: the control-node's operator is the terminal, everyone else is not (hq ADR 0272)

2026-10-09 12:10:24 +02:00

network_test.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00

network.go

A token can be issued for a machine's tunnel key, and it joins through the tunnel

2026-10-08 02:06:19 +02:00

new_module_on_merge_test.go

Build and register a new module when its merge lands (hq issue 300)

2026-10-07 22:32:20 +02:00

nodes_test.go

Refuse token issue --adopted for a converged node and point to adopt, rather than flip it quietly (hq ADR 0100)

2026-09-22 18:03:45 +02:00

nodes.go

Name the account agents run as on a node, and say whether it can become root

2026-10-09 10:11:21 +02:00

operator.go

Work slower than the window says so, and one address is the bus's

2026-09-28 09:51:50 +02:00

order_test.go

A changed file touches exactly the modules whose build reads it (hq issue 280, ADR 0237)

2026-10-06 22:34:57 +02:00

pending_test.go

Give each pending assignment its own condition, and keep a raised row until it clears

2026-10-08 16:45:43 +02:00

pending.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

person_wait_test.go

Put a broken module back at once, and excuse a wait only for a move that added an account group (hq issue 318 review)

2026-10-08 15:25:58 +02:00

plain_words_test.go

Ask at most three at a time, wait out a refusal, need a router, and act only on a claimed open ask, as the review asked (hq ADR 0259)

2026-10-09 16:22:34 +02:00

plain_words.go

Ask at most three at a time, wait out a refusal, need a router, and act only on a claimed open ask, as the review asked (hq ADR 0259)

2026-10-09 16:22:34 +02:00

plan_clock_test.go

Count a plan's time from its tier, and save it only when a step changed it (hq issue 296)

2026-10-07 20:42:13 +02:00

plan_retry.go

Serve the read verbs on the serving controller's own connection, and name every connection

2026-10-08 21:08:34 +02:00

plan_test.go

review: hold the hosts region through composition, and say so in plan

2026-09-27 00:05:41 +02:00

plan.go

plan --diff says which modules a push would leave out and why, so a module just assigned whose settings cannot compose is not shown as "nothing would change"

2026-10-09 14:27:31 +02:00

planner_records_test.go

Hold the delivery planner to its recorded rules with a table and a property

2026-10-08 22:15:20 +02:00

planner_rules_test.go

Plan a controller merge in the worker-of order in the three-kinds test

2026-10-08 22:22:24 +02:00

plans_one_at_a_time_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

probe_agent_root_test.go

Key root-not-free apart from DA, keep ADR 0266's quiet window there, and judge at one clock (hq ADR 0259 §8)

2026-10-09 13:55:06 +02:00

probe_agent_root.go

Key root-not-free apart from DA, keep ADR 0266's quiet window there, and judge at one clock (hq ADR 0259 §8)

2026-10-09 13:55:06 +02:00

probes.go

Merge pull request 'Kinded benches, verbs named by their caller, proofs and records (hq ADR 0259 §3)' (#154) from feat/asks-answered-on-any-channel into main

2026-10-09 14:17:43 +00:00

provider_hold_test.go

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

2026-10-07 16:17:52 +02:00

provider_hold.go

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

2026-10-07 16:17:52 +02:00

push_recreates_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

push_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

push.go

Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353)

2026-10-09 19:41:39 +02:00

queue_test.go

Count a plan's time from its tier, and save it only when a step changed it (hq issue 296)

2026-10-07 20:42:13 +02:00

queue.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

readable_test.go

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

readable.go

Say why assign finds no module, and keep an assignment pending on its build

2026-10-08 16:38:11 +02:00

reconnects_test.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

reconnects.go

Answer dead-letters on the lent serving connection, and keep one clip helper

2026-10-08 21:09:08 +02:00

recorded_kept_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

recorded_kept.go

Say what each verb replaces, so the agent is pointed at it instead of a shell command (hq ADR 0245)

2026-10-07 20:44:47 +02:00

recorded_push_test.go

Record a push that only moves recorded builds as the person's word, not a repair (hq issue 301)

2026-10-08 00:12:23 +02:00

recorded_push.go

Record a push that only moves recorded builds as the person's word, not a repair (hq issue 301)

2026-10-08 00:12:23 +02:00

references.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

registry_verbs_test.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

registry_verbs.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

rehearse_test.go

Start a rehearsal only at the controller's terminal as main now judges it (hq ADR 0259, ADR 0272)

2026-10-09 16:22:34 +02:00

rehearse.go

Start a rehearsal only at the controller's terminal as main now judges it (hq ADR 0259, ADR 0272)

2026-10-09 16:22:34 +02:00

release_plan_test.go

Plan a controller merge in the worker-of order in the three-kinds test

2026-10-08 22:22:24 +02:00

release_plan.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

release_test.go

No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236)

2026-10-06 19:14:25 +02:00

release.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

replay292_test.go

Replay issues 292 and 298 as tests the commit before each fix fails (hq ADR 0237)

2026-10-08 01:26:39 +02:00

replay309_test.go

Resolve a group's order rules by precedence, not as a cycle (hq issue 309)

2026-10-08 10:43:42 +02:00

replay318_test.go

Put a broken module back at once, and excuse a wait only for a move that added an account group (hq issue 318 review)

2026-10-08 15:25:58 +02:00

replay325_test.go

Say why assign finds no module, and keep an assignment pending on its build

2026-10-08 16:38:11 +02:00

replay327_test.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

replay335_test.go

Test that a carried module takes its lead's pass before its step is read (hq issue 335 review)

2026-10-08 21:08:12 +02:00

replay336_test.go

TestReplay336 reads the bus call in its mesh form

2026-10-09 03:08:21 +02:00

replays_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

retire_verbs.go

Derive data protection from a module's declared data (hq ADR 0233)

2026-10-06 16:47:49 +02:00

retirement_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

retirement.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

rollout_first_test.go

Stop a rollout whose first machine is silent, and choose one that is heard from (hq issue 249, ADR 0218)

2026-10-05 18:17:52 +02:00

rollout_test.go

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

rollout.go

Serve the read verbs on the serving controller's own connection, and name every connection

2026-10-08 21:08:34 +02:00

roster_failure_test.go

The roster is the machines: each node's internal domain covers its routes (hq ADR 0191)

2026-10-03 16:10:16 +02:00

rotate_test.go

rotate: narrow a pair credential to one consuming module (hq issue 268)

2026-10-06 02:13:48 +02:00

rotate.go

rotate: narrow a pair credential to one consuming module (hq issue 268)

2026-10-06 02:13:48 +02:00

same_source_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

sayable_test.go

mesh-cli: give a terminal line the standard input mesh-cli carried, refuse it to any other, keep it nowhere

2026-10-09 17:01:36 +02:00

seat_dependencies_test.go

Refuse an unmet seat dependency the catalogue could meet (hq ADR 0207 §4)

2026-10-04 13:07:45 +02:00

seats_test.go

Serve a trusted holder from a runtime of its own account, refuse it in the machine's runtime, and say while an agent can become root where it runs (hq ADR 0259 §8)

2026-10-09 13:48:56 +02:00

seats.go

Serve a trusted holder from a runtime of its own account, refuse it in the machine's runtime, and say while an agent can become root where it runs (hq ADR 0259 §8)

2026-10-09 13:48:56 +02:00

seatverbs_schema_test.go

Take a module's own secret through a hidden prompt on the operator's desk, so a bot token never passes through an agent's session (hq ADR 0259 §10)

2026-10-09 16:22:47 +02:00

seatverbs_test.go

Refuse a plans line that acts wherever its subcommand stands

2026-10-09 10:12:41 +02:00

seatverbs.go

Let the give verb's exact line past the terminal rule for secrets, and nothing else (hq ADR 0259 §10, ADR 0266)

2026-10-09 16:22:47 +02:00

secret_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

secret.go

give: test that a trusted party's secret given at the terminal is announced before it is kept, and refuse an unknown machine before anybody types

2026-10-09 16:22:47 +02:00

selfexec_test.go

Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

2026-10-07 02:45:09 +02:00

selfexec.go

Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

2026-10-07 02:45:09 +02:00

sendable_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

sendable.go

Leave out a block its holder cannot render, and keep if-capability to known names on offered kinds (hq ADR 0255)

2026-10-08 15:20:59 +02:00

sequence_test.go

Each send is numbered, inside the signed bytes

2026-09-30 14:09:12 +02:00

servingbus.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

settings_effective_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

signals_test.go

Tell the operator at once when sends wait for the bus's planned step, and say it before the merge (hq issue 336)

2026-10-09 02:33:57 +02:00

signals.go

Take a module's own secret through a hidden prompt on the operator's desk, so a bot token never passes through an agent's session (hq ADR 0259 §10)

2026-10-09 16:22:47 +02:00

source_test.go

Rename the mesh's seats to mesh-*, keeping their interfaces

2026-09-26 23:07:09 +02:00

source.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

standing_test.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

standing.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

status_summary_test.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

status_summary.go

Keep what each machine says of what it runs, raise it, and gate on it (hq ADR 0240, to-be 48 Phase A)

2026-10-07 02:28:16 +02:00

status_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

status.go

Make pending assignments safe to race, settle them on a tick, and say only what was checked

2026-10-08 16:38:11 +02:00

stores.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

supersede_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

take_preview_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

terminal_settings_test.go

Refuse any change through a verb to a module with a trusted mergeable file

2026-10-09 02:54:41 +02:00

tier_send_test.go

Excuse no wait for a move from a build not known, and count a module put back only once there is one (hq issue 318 review)

2026-10-08 15:49:07 +02:00

unheld_report_test.go

An act says the unmet seat dependencies of the node it acted on, not the mesh's (hq ADR 0207)

2026-10-04 12:50:25 +02:00

unknown_fields_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

unknown_fields.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

unseen_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

unseen.go

Answer what the records keep, collect on a person's word, and name a machine's images (hq ADR 0251)

2026-10-08 12:04:42 +02:00

untaken_test.go

A held module is in status, and it stops the mesh reading as well

2026-09-30 08:46:20 +02:00

upgrades.go

Answer the review of hq issues 348 and 349: gaps, parts, the newest merge in any state

2026-10-09 15:00:56 +02:00

watchdogs.go

Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259)

2026-10-09 16:22:34 +02:00

well_scope_test.go

The all-well sentence says what it is not a claim about

2026-09-30 08:58:59 +02:00

witness.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

worker_order_test.go

The build seat's holder follows the controller that defines its worker (hq issue 206)

2026-10-03 04:04:41 +02:00