mesh-adminandClaude Opus 5.5 69367aa786 Correct a mirror written behind the writer's back, and write none without the lease ...

Review of mesh-controller#315 (hq issue 652): the writer trusted the bucket as
it read it once, so a former lease holder's write stayed for good; it wrote
without the lease, asking only after a refused compare-and-set; and the
declared config carried a manifest's declarations whole, so a field the
manifest gains would reach the bus unreviewed (ADR 0289 §9, §10, §12). Every
pass now reads the bucket and writes back the store's value where it differs,
asks for the lease before the pass and before every write, and a declaration
is mirrored as its listed fields (kind, default, why), with a test that fails
on a declaration field the list does not name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-14 01:01:00 +00:00

..

migrations

Hold a walk's first-machine gate while its busy container finishes its build

2026-10-13 00:53:10 +02:00

addresses.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

adoption_test.go

A repeat assignment says nothing changed (ADR 0115)

2026-09-26 19:02:35 +02:00

adoption.go

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

agent_account_test.go

Refuse a node's accounts through any verb, and a stale or service-account agent verdict

2026-10-09 10:11:21 +02:00

artifacts_test.go

Answer what the records keep, collect on a person's word, and name a machine's images (hq ADR 0251)

2026-10-08 12:04:42 +02:00

asks_lab_test.go

Ask an acknowledgement apart from an approval, change every kept ask by compare-and-set, and rehearse rather than drill (hq ADR 0259, review M1/L2/L3/L7)

2026-10-09 16:22:34 +02:00

batches.go

Owe a merge to the record from its branch's first kept merge (hq ADR 0276 review)

2026-10-10 13:54:40 +02:00

bindings_test.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

bindings.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

buildinput_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

builds_test.go

Say why each module is in a plan: its build source's changed files, or why it is read whole (hq ADR 0267, issue 363)

2026-10-10 12:49:44 +02:00

builds.go

Say why each module is in a plan: its build source's changed files, or why it is read whole (hq ADR 0267, issue 363)

2026-10-10 12:49:44 +02:00

busrecords_test.go

Grant a bar one key of the state it shows, and per-machine state its own machine's key (hq ADR 0260)

2026-10-08 15:51:20 +02:00

busrecords.go

Merge remote-tracking branch 'origin/main' into adr-0297-module-logs

2026-10-12 02:29:00 +02:00

busstep.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

bususers_test.go

Give a fast-renewing test lease a serving controller's time to renew, and prove the minted hash's cost

2026-10-13 00:08:48 +02:00

bususers.go

Give a fast-renewing test lease a serving controller's time to renew, and prove the minted hash's cost

2026-10-13 00:08:48 +02:00

busy_test.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

catalogue_test.go

Refuse the tools-container shape for every module (to-be 38 WP4b's last step)

2026-10-04 02:28:54 +02:00

catalogue.go

A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

2026-10-10 14:42:40 +02:00

collection_test.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

collection.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

data_test.go

Keep one reading when two paths are measured at one moment, rather than failing the machine's record (hq issue 368 review)

2026-10-10 17:48:49 +02:00

data.go

Keep one reading when two paths are measured at one moment, rather than failing the machine's record (hq issue 368 review)

2026-10-10 17:48:49 +02:00

dependencies_test.go

Read a built module's build edges from what is kept of it, so a new SDK rebuilds its toolchain and bundles (hq issue 614)

2026-10-13 11:08:17 +02:00

dependencies.go

Read a built module's build edges from what is kept of it, so a new SDK rebuilds its toolchain and bundles (hq issue 614)

2026-10-13 11:08:17 +02:00

doing_test.go

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

durations_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

durations.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

forget_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

fortest.go

Copy each store test's database from a template migrated once, and hash test bus passwords at bcrypt's least cost

2026-10-12 23:53:06 +02:00

gate.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

givable_test.go

give: take only a value a person holds, ask the desk by name, let the controller alone ask it, and announce every value given

2026-10-09 16:22:47 +02:00

given_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

given.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

heals_test.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

heals.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

health.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

heldhere_test.go

Issue only the recorded holder a seat held once for the mesh (novox/hq issue 218)

2026-10-03 23:30:27 +02:00

hold_plans_test.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

hold_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

hold.go

Let two controllers overlap safely while one hands over to the other (hq issue 213)

2026-10-04 01:11:26 +02:00

holdings_test.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

inventory_test.go

Review of 083: finishing an enrolment whose token was spent takes proof of the key's private half, a live lease and a first delivery — a public key alone cannot replay a spent token; shutdown leaves held messages for the broker; identical builds supersede; what is held leaves room in the prefetch

2026-09-22 14:33:13 +02:00

inventory.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

issued_test.go

Let the controller ask an issued credential's tool in its own name, and seal it again over a remade pair (hq issue 526, ADR 0305)

2026-10-12 01:21:20 +02:00

issued.go

Take a provider's software-issued credential from the provider, sealed (hq issue 526, ADR 0305)

2026-10-12 01:07:16 +02:00

looks_test.go

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)

2026-10-12 12:11:13 +02:00

looks.go

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)

2026-10-12 12:11:13 +02:00

machine_test.go

Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)

2026-10-13 11:20:22 +02:00

machine.go

Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)

2026-10-13 11:20:22 +02:00

mirrored_test.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

mirrors.go

Correct a mirror written behind the writer's back, and write none without the lease

2026-10-14 01:01:00 +00:00

named_peer_test.go

A carried peer is nameable, and the mesh answers for it (hq 112)

2026-09-26 20:09:42 +02:00

nodes.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

older_build_test.go

An older build request never replaces a newer one's artifact

2026-10-04 00:22:11 +02:00

operator_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

operator.go

Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

2026-09-21 21:03:22 +02:00

order_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

order.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

outside_test.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

outside.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

pending_test.go

Make pending assignments safe to race, settle them on a tick, and say only what was checked

2026-10-08 16:38:11 +02:00

pending.go

Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

2026-10-09 12:37:18 +02:00

people_test.go

inventory: a person's one tool is granted naming that person as the caller too (hq issue 365)

2026-10-11 05:47:40 +02:00

pin_completed_test.go

A pin names the module as well as the node; a node that answers twice is refused

2026-10-01 17:23:31 +02:00

plan_id_test.go

Read a plan by its id as a parameter, never as SQL (issue 561)

2026-10-12 16:33:23 +02:00

plans_test.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

plans.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

ports_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

ports.go

Read the foundation's ports from each node's settings, wherever a port is used (hq ADR 0100)

2026-09-22 17:31:07 +02:00

public_domain_test.go

The routing record is 0066, not 0056

2026-09-11 00:09:56 +02:00

reachable_test.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

reachable.go

Review of 082: a store killed mid-conversation is an outage and a wrong password is not; one report holds the queue at most two minutes, then is let go loudly; shutdown does not wait out the pause

2026-09-22 13:34:04 +02:00

record_mirrors_test.go

Correct a mirror written behind the writer's back, and write none without the lease

2026-10-14 01:01:00 +00:00

reported.go

Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

2026-10-06 20:31:10 +02:00

retire_test.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

rootfree_grants_test.go

Answer the controller's own verbs, root-free among them, from the serving controller alone (hq ADR 0259 §8)

2026-10-09 13:51:18 +02:00

schema.go

A gate judges its own send and the build it sent, and never puts the controller back behind its store (hq issue 352)

2026-10-09 17:15:40 +02:00

seats_test.go

Give the store tests' service manager holders the three verbs it now must serve (issue 332)

2026-10-12 12:25:05 +02:00

seats.go

Let failed join the seat optional, and let a seeded row carry both changes

2026-10-07 20:05:01 +02:00

secret_ask_test.go

A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

2026-10-10 15:24:08 +02:00

secret_ask.go

A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

2026-10-10 15:24:08 +02:00

secret_family_test.go

Say a part waiting for the operator as needs-operator and pass its gate; add secret families (issue 386, hq ADR 0283)

2026-10-10 21:19:58 +02:00

secrets_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

secrets.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

sends_test.go

Take an ordered engine's report as a send's answer only by its epoch and sequence (novox/hq issue 485)

2026-10-11 20:44:54 +02:00

sends.go

Take an ordered engine's report as a send's answer only by its epoch and sequence (novox/hq issue 485)

2026-10-11 20:44:54 +02:00

sent_builds_test.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

sent_bus_users_test.go

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

settings_judged_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

source.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

store_as_run_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

stored_silent_file_test.go

Judge ADR 0326 §3 only where a definition is written (hq issue 574)

2026-10-13 00:54:26 +02:00

tunnel_test.go

Adopt the tunnel as a mesh fact, refuse a mismatched takeover, and rekey after enrolment

2026-09-24 00:02:07 +02:00

tunnel.go

The mesh's interface takes over the found tunnel's MTU

2026-09-26 22:40:42 +02:00

unknown_field_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

unseen_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

unseen.go

A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

2026-10-10 14:42:40 +02:00

walkphases_582_test.go

End a walk's apply phase at each machine's own report of its send (hq issue 582)

2026-10-12 23:18:28 +02:00

walkphases_test.go

End a walk's apply phase at each machine's own report of its send (hq issue 582)

2026-10-12 23:18:28 +02:00

walkphases.go

Let a drain lapse, bound the gate's wait on the controller's clock, keep a busy wait out of apply time

2026-10-14 00:07:31 +02:00

walksaid_test.go

Say every walk a verb keeps, and clear a stop from a walk that walks again

2026-10-12 12:54:20 +02:00

walksaid.go

Say what a walk touches, its bound and its outcome when it starts and ends (ADR 0308, issue 532)

2026-10-12 12:54:20 +02:00