jochen
2eb9a22c24
Two controllers could both act (issue 204), a reconcile's report could overtake the apply after it and the digest decided (issue 267), and a grant could make a second writer of a machine's report. - The lease (internal/lease, ADR 0229): mesh-controller_lease key `holder`, 15 s age, renewed every 5 s by compare-and-set; the epoch is the revision it was taken at. The gate is the clock (stops 3 s before expiry); a refused renewal is a loss and the process exits; a holder that stops gives it back. serve takes it before asserting the bus. Epochs kept in the store (migration 0068 controller_epoch) as a floor: a bucket raised from nothing is compacted past it. Unleased (no epoch, S12 urgent) only when nobody holds it and the bus will not let it be written. A shell command acts under the holder's epoch, or its own lease when none. - Declarations carry `epoch` inside the signed envelope, only to a machine whose latest account carried a report_sequence (mesh-host #35); would-send is composed with the epoch last sent. Allot and the send both pass the gate. - Reports: contract in internal/link/order.go (epoch, sequence, report_sequence, older_than, refused_older). Accounts kept by epoch, then sequence, then report sequence; older refused, counted; unordered reports keep the digest rule. Plans by compare-and-set on a revision, with epoch. Conditions and calls carry the epoch and are not written off the lease. - S12 and S13 (naming the writer by epoch) watched, D5 run; reset of the bucket said. Writers table compiled in and enforced in PermissionsFor; the controller no longer publishes mesh.control.>. A contract per consumed kind, and the empty-on-error lint over the repository. - mesh-host pinned to its main with the epoch in the validator (D1 validates the envelope as sent). Needs mesh-host's genesis lock with the lease grant (mesh-host PR) for TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose.
32 lines
1.3 KiB
AMPL
32 lines
1.3 KiB
AMPL
module github.com/novox/mesh-controller
|
|
|
|
go 1.26.0
|
|
|
|
require (
|
|
github.com/jackc/pgx/v5 v5.10.0
|
|
github.com/nats-io/nats.go v1.54.0
|
|
github.com/novox/mesh-host v0.0.0
|
|
golang.org/x/crypto v0.57.0
|
|
golang.org/x/net v0.58.0
|
|
)
|
|
|
|
require (
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/klauspost/compress v1.20.0 // indirect
|
|
github.com/nats-io/nkeys v0.4.16 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
golang.org/x/sync v0.23.0 // indirect
|
|
golang.org/x/sys v0.48.0 // indirect
|
|
golang.org/x/text v0.42.0 // indirect
|
|
)
|
|
|
|
// The node-engine's own validator (mesh-host/validate, novox/hq to-be 45 D1): one validator, the host's.
|
|
// The host's module path names no forge a build can fetch from, so the module is read from the one
|
|
// that holds it, at the host's commit — **once, by whoever moves the pin, into vendor/**, which is
|
|
// committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
|
|
// fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
|
|
// `go mod vendor` fails loudly, at once, everywhere.
|
|
replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261006095519-3e80b7ae325e
|