jochen c9dd07f919 Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337) ...

A Servarr app's API key, an indexer's key and a downloader's password are values the provider's
software holds; the pair path made a random value for every consumer of them, sealed it to both ends
and reported success, and the provider refused it. An offer may now say `"credential": {"issued-by":
"outside"}`: SecretFor never makes a value for it, the plan reads such a pair as given or not given
and sends the consumer no credential file until a person gives it, without refusing its machine;
remakeShared and SharedSecretFor never make a provider's own secret issued outside either.
`secret accept <provider's node> <provider module> <provision>` seals one value to every consumer that
binds the provision from that provider, the provider and the operator, under one generation; the
per-pair form is refused for such a provision, and rotate names the accept. A consumer may wait for a
provision's credential: the controller excuses the wait only when the store bears it out, and its
needs-operator condition names the one accept line.

Adds the replay of issue 164 (TestReplay164), written with only what the controller had before.

2026-10-13 11:37:31 +02:00

..

testdata

Say a module assigned and left out of its machine's composition as a condition (issue 380)

2026-10-11 04:43:58 +02:00

accept_outside.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

acting.go

Give a fast-renewing test lease a serving controller's time to renew, and prove the minted hash's cost

2026-10-13 00:08:48 +02:00

acts_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

acts.go

Say an act's answer from one resolution after its write (issue 237)

2026-10-12 13:53:19 +02:00

addresses_test.go

The registry-trust test reads the runtime's module, which now writes the trust (ADR 0222)

2026-10-05 22:47:43 +02:00

adopting_test.go

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

adoption.go

Take a provider's software-issued credential from the provider, sealed (hq issue 526, ADR 0305)

2026-10-12 01:07:16 +02:00

advisories_counted_test.go

Count a dead letter by when it was kept, so one kept late still counts (issue 440)

2026-10-11 02:36:58 +02:00

agent_account_test.go

Keep quiet for the setuid search the engine now runs to completion (hq issue 361)

2026-10-10 00:54:52 +02:00

agent_account.go

Keep quiet for the setuid search the engine now runs to completion (hq issue 361)

2026-10-10 00:54:52 +02:00

api_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

api.go

A module depends on the node seats that apply its resources (hq ADR 0207)

2026-10-04 12:34:11 +02:00

apply_failing_test.go

Judge S21 by time since the first failing report while the machine is heard, not by how many reports said it (issue 233 review)

2026-10-12 15:39:08 +02:00

apply_failing.go

Judge S21 by time since the first failing report while the machine is heard, not by how many reports said it (issue 233 review)

2026-10-12 15:39:08 +02:00

ask.go

One bus: the AMQP transport is gone from the controller

2026-09-28 03:36:16 +02:00

asker_bus_test.go

Ask an acknowledgement apart from an approval, change every kept ask by compare-and-set, and rehearse rather than drill (hq ADR 0259, review M1/L2/L3/L7)

2026-10-09 16:22:34 +02:00

asker_test.go

Take an older bus module's allowed as held, and name only remedies that work (review 31 of PR 188, hq issue 353)

2026-10-12 13:21:32 +02:00

asker_wire.go

Take an older bus module's allowed as held, and name only remedies that work (review 31 of PR 188, hq issue 353)

2026-10-12 13:21:32 +02:00

asker.go

Keep asking on an older bus module and name the real remedy for each grant not held (review of hq issue 353)

2026-10-12 13:21:32 +02:00

awaiting_push_test.go

Say a machine waiting for its push as waiting, not uncomposable (hq issue 275)

2026-10-06 18:05:38 +02:00

batches_test.go

Merge pull request 'A merge that shares nothing with the assembling batch, and whose group waits for no one, is cut at once (hq issue 525, ADR 0304 §1, ADR 0306 §2-3)' (#250) from feat/525-a-lone-merge-skips-the-window into main

2026-10-12 11:46:59 +00:00

batches_watch.go

Let a merge that shares nothing skip the merge window (hq issue 525)

2026-10-12 12:14:46 +02:00

batches.go

Say which modules a walk left unchanged, so a merge that moved nothing is not read as stranded (hq issue 611)

2026-10-13 08:18:19 +02:00

bindings_test.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

bindings.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

board_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

board.go

Record whether a node is adopted and which modules were taken on it (hq ADR 0100)

2026-09-22 17:14:05 +02:00

bucket_log_fill_test.go

Keep a fill warning for an unreadable bucket or log only when its condition was read open

2026-10-11 19:34:42 +02:00

bucket_log_fill.go

Keep a fill warning for an unreadable bucket or log only when its condition was read open

2026-10-11 19:34:42 +02:00

build_seat_test.go

The controller asks the build role that has a holder, and hears both roles' outcomes (hq ADR 0190, the handover)

2026-10-03 02:51:03 +02:00

build_source_test.go

Ask the rollback test's failed build after the registered one, whenever it runs

2026-10-10 12:49:44 +02:00

build_source.go

Cap the forge wait as a whole, and wait out only a forge not served (novox/hq issue 486)

2026-10-12 11:32:14 +02:00

build_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

build.go

Say each machine's last send in status and node show, and as fields in status --json (novox/hq issue 485)

2026-10-11 20:40:48 +02:00

bus_step.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

bus_waits_test.go

Name the bus upgrade as the mesh call a person makes, and say a same-source rebuild needs no step (review of #173)

2026-10-09 02:54:23 +02:00

bus_waits.go

Say S17 clears once the new bus is sent, as it does

2026-10-09 03:23:47 +02:00

buscertificate_test.go

The mesh makes the bus's certificate itself

2026-09-29 15:42:51 +02:00

buscertificate.go

A token is an account on the bus, and genesis can place the list

2026-09-29 17:36:50 +02:00

busobjects_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

busobjects.go

Serve a trusted holder from a runtime of its own account, refuse it in the machine's runtime, and say while an agent can become root where it runs (hq ADR 0259 §8)

2026-10-09 13:48:56 +02:00

calls_verb_test.go

Let the generic command verb only read, and keep keys and tokens at the terminal

2026-10-09 10:12:05 +02:00

changeplan_test.go

Name the bus upgrade as the mesh call a person makes, and say a same-source rebuild needs no step (review of #173)

2026-10-09 02:54:23 +02:00

changeplan.go

Class a new module by its own name, so adding a core module is not called leaf (issue 403, review 69)

2026-10-12 16:16:02 +02:00

check_here.go

Move a module on a merge only when its build source holds a changed file (hq ADR 0267, issue 363)

2026-10-10 03:20:36 +02:00

check_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

check.go

Judge ADR 0326 §3 only where a definition is written (hq issue 574)

2026-10-13 00:54:26 +02:00

checks_test.go

Format PullUpdated, and keep the announced base head on a rechecked member

2026-10-12 17:52:12 +02:00

checks.go

Mark a rerun check with a short (run N) after its verdict, and word a re-hand-out neutrally

2026-10-13 00:31:57 +02:00

collect.go

Leave an eligible index for a confirmed collect instead of letting it go alone

2026-10-08 15:47:42 +02:00

collection.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

condition_looks_test.go

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)

2026-10-12 12:11:13 +02:00

condition_looks.go

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)

2026-10-12 12:11:13 +02:00

conditions_brief_test.go

Page an answer larger than one message of the bus, and keep overviews brief (hq issue 314)

2026-10-08 12:19:16 +02:00

conditions_test.go

Switch the memory store's failure under its lock, so a test cannot race the keeper

2026-10-09 01:25:04 +02:00

conditions.go

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)

2026-10-12 12:11:13 +02:00

confirm.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

core_downgrade.go

Leave a kept core move out of what a gate judges (issue 201, review 91)

2026-10-12 19:16:26 +02:00

credential_on_assign_test.go

An assignment issues its bus credential, a push refuses one nobody issued, and what reads a secret restarts on it (hq issue 203)

2026-10-03 04:01:17 +02:00

data_test.go

Read a shrink against the item's own path, so a moved directory starts its size history again (hq issue 368)

2026-10-10 17:42:46 +02:00

data.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

deadletters_test.go

Answer dead-letters on the lent serving connection, and keep one clip helper

2026-10-08 21:09:08 +02:00

deadletters.go

Remove an ask's original only when its sequence still holds it, and only with a worker (issue 334)

2026-10-11 03:24:52 +02:00

delivery_conditions_test.go

Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259)

2026-10-09 16:22:34 +02:00

delivery_conditions.go

Advise a recheck for an unanswered check on a ready or rejected delivery (issue 451)

2026-10-12 13:47:11 +02:00

delivery_order_test.go

Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353)

2026-10-12 13:21:32 +02:00

delivery_test.go

Assemble merges in a rolling window and walk each batch once (hq ADR 0276, issue 362)

2026-10-10 13:20:04 +02:00

delivery.go

End a walk's apply phase at each machine's own report of its send (hq issue 582)

2026-10-12 23:18:28 +02:00

dependents_test.go

A merge of a base rebuilds what stands on it

2026-10-01 16:09:26 +02:00

desk_secret_test.go

A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

2026-10-10 15:24:08 +02:00

desk_secret.go

A module's own secret is asked for by a verb and typed at the desk, bounded, the prompt naming who asked (hq ADR 0277)

2026-10-10 15:24:08 +02:00

doctor_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

doctor.go

Keep a condition's looks in the store, so a look that changes nothing writes no bucket (issue 420)

2026-10-12 12:11:13 +02:00

dry_run_test.go

Take no dry run in: mark it on the request, echo it on the outcome, set it aside

2026-10-05 09:50:20 +02:00

durations.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

epoch_send_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

facts_test.go

Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

2026-10-06 20:31:10 +02:00

facts.go

Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

2026-10-11 11:55:27 +02:00

failed_wait_provider_test.go

Check a provider's waits before saying who waits on it (issue 450)

2026-10-11 03:29:10 +02:00

fixclass_test.go

Class a new module by its own name, so adding a core module is not called leaf (issue 403, review 69)

2026-10-12 16:16:02 +02:00

forge_wait_test.go

Cap the forge wait as a whole, and wait out only a forge not served (novox/hq issue 486)

2026-10-12 11:32:14 +02:00

found_wait_test.go

node hand-over: the terminal hands a directory used as found to the mesh, asked of the node's engine (hq issue 356)

2026-10-09 18:38:09 +02:00

gate_followup_test.go

Judge a leaf module on one healthy reading, a core module on three (hq issue 524)

2026-10-12 01:08:14 +02:00

gate_test.go

Judge a send on no machine as the core, and test a send carrying the core with the real classes

2026-10-12 01:38:09 +02:00

gate.go

Refuse a send that puts the controller or node-engine behind its machine's build (issue 201)

2026-10-12 18:21:17 +02:00

generation_test.go

Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

2026-10-11 11:55:27 +02:00

generation.go

Say each machine's last send in status and node show, and as fields in status --json (novox/hq issue 485)

2026-10-11 20:40:48 +02:00

given_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

given.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

grant_follows_binding_test.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

grants_step_store_test.go

Give the grants step's restic fixture a check beside its tool, as the module rules require (repo-check of #230)

2026-10-11 19:43:50 +02:00

grants_step_test.go

Give the grants step's restic fixture a check beside its tool, as the module rules require (repo-check of #230)

2026-10-11 19:43:50 +02:00

group_wait.go

Keep a group member of the other kind's batch from being overtaken (hq issue 525)

2026-10-12 12:54:11 +02:00

handacts_test.go

Let the generic command verb only read, and keep keys and tokens at the terminal

2026-10-09 10:12:05 +02:00

handacts.go

Take a provider's software-issued credential from the provider, sealed (hq issue 526, ADR 0305)

2026-10-12 01:07:16 +02:00

handover_test.go

Ask a node's engine which of its directories the walk would refuse, read-only (issue 358)

2026-10-12 14:17:01 +02:00

healers_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

healers.go

Assemble merges in a rolling window and walk each batch once (hq ADR 0276, issue 362)

2026-10-10 13:20:04 +02:00

health_check_test.go

Count a file that says nothing as trusted, and drop the refusal date

2026-10-09 01:44:50 +02:00

health_probes.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

held_back_test.go

Say in every declaration the assignment generation it came from, and record every send (hq issue 234)

2026-10-11 11:30:16 +02:00

held_back.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

hidden_input.go

give: never take a trusted party's secret at a desk, and announce it before it is kept (hq ADR 0259 §10, the confirmation review's N1-give)

2026-10-09 16:22:47 +02:00

hold_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

hold.go

Hold a node from composing to sending, so a push composed before converge or adopt is never sent after it (hq ADR 0100)

2026-09-22 18:10:04 +02:00

holders_silent_test.go

Make the login shell's execute optional, so a machine may withhold it

2026-10-09 00:07:33 +02:00

holdings_test.go

A holder by derivation is recorded before an assignment can unsettle it (hq 170)

2026-09-30 14:39:59 +02:00

holdings.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

hosts_behind_test.go

A commit has no order, so the mesh says who runs what and claims no newer

2026-09-30 09:28:56 +02:00

identity_bound_test.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

issue201_test.go

Leave a kept core move out of what a gate judges (issue 201, review 91)

2026-10-12 19:16:26 +02:00

issue348_test.go

Answer the review of hq issues 348 and 349: gaps, parts, the newest merge in any state

2026-10-09 15:00:56 +02:00

issue352_test.go

Judge a leaf module on one healthy reading, a core module on three (hq issue 524)

2026-10-12 01:08:14 +02:00

issue459_test.go

Ask mesh-delivery whether a merge's group still assembles (hq issue 525)

2026-10-12 12:14:46 +02:00

issue529_test.go

Offer no hand start for a walk that is only waiting its turn (issue 529)

2026-10-12 11:34:54 +02:00

issue611_test.go

Say which modules a walk left unchanged, so a merge that moved nothing is not read as stranded (hq issue 611)

2026-10-13 08:18:19 +02:00

issue_204_test.go

Say in every declaration the assignment generation it came from, and record every send (hq issue 234)

2026-10-11 11:30:16 +02:00

issued_test.go

Cite ADR 0305's clauses by their accepted-for-review numbers (issue 526)

2026-10-12 01:09:26 +02:00

issued.go

Let the controller ask an issued credential's tool in its own name, and seal it again over a remade pair (hq issue 526, ADR 0305)

2026-10-12 01:21:20 +02:00

join_through_the_tunnel_test.go

Hold that a joining machine is a peer of the hub only while its token lives

2026-10-08 02:06:19 +02:00

last_send_test.go

Say each machine's last send in status and node show, and as fields in status --json (novox/hq issue 485)

2026-10-11 20:40:48 +02:00

lease_command_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

lease_test.go

Give a fast-renewing test lease a serving controller's time to renew, and prove the minted hash's cost

2026-10-13 00:08:48 +02:00

left_out_test.go

Restore the tracked controller binary a local build overwrote, and hold that D1 never clears a wait (review of #223)

2026-10-11 11:14:03 +02:00

left_out.go

Use the glossary's words, say which modules raise a condition, and judge left-out modules in D1 (review of #223)

2026-10-11 11:10:22 +02:00

licence.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

lone_merge_test.go

Keep a group member of the other kind's batch from being overtaken (hq issue 525)

2026-10-12 12:54:11 +02:00

machine_lines_test.go

Say an account without its time as age unknown, not as two thousand years (issue 160)

2026-10-12 17:43:38 +02:00

machine_lines.go

Say an account without its time as age unknown, not as two thousand years (issue 160)

2026-10-12 17:43:38 +02:00

machine_network_test.go

Raise a machine's network from what its engine says, once (hq ADR 0241)

2026-10-07 18:52:16 +02:00

machine_network.go

Answer the review of hq issues 348 and 349: gaps, parts, the newest merge in any state

2026-10-09 15:00:56 +02:00

machine_units_test.go

Raise a failed unit, the module's and the machine's (hq issue 315)

2026-10-08 11:28:52 +02:00

machine_units.go

Open every explanation with what the operator needs to do, and offer the answers

2026-10-08 13:58:53 +02:00

main.go

Say every walk a verb keeps, and clear a stop from a walk that walks again

2026-10-12 12:54:20 +02:00

merge_gate_test.go

Judge the SDK conformance fixtures against the SDK the controller pins, never a desktop's checkout (issue 449)

2026-10-11 04:19:01 +02:00

merge_gate.go

Move a module on a merge only when its build source holds a changed file (hq ADR 0267, issue 363)

2026-10-10 03:20:36 +02:00

mesh_for_test.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

meshcli_stdin_test.go

mesh-cli: give a terminal line the standard input mesh-cli carried, refuse it to any other, keep it nowhere

2026-10-09 17:01:36 +02:00

meshcli_test.go

Start a rehearsal only at the controller's terminal as main now judges it (hq ADR 0259, ADR 0272)

2026-10-09 16:22:34 +02:00

meshcli.go

mesh-cli: give a terminal line the standard input mesh-cli carried, refuse it to any other, keep it nowhere

2026-10-09 17:01:36 +02:00

mirrors_test.go

Leave an eligible index for a confirmed collect instead of letting it go alone

2026-10-08 15:47:42 +02:00

mirrors.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

missed_merges_test.go

Catch up on merges the bus announced and never handed over (hq issue 266)

2026-10-06 01:29:21 +02:00

missed_merges.go

Keep a merge a cut made history, and build a batch's walk at the branch (hq ADR 0276 review)

2026-10-10 13:48:31 +02:00

module_health_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

module_health.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

modules_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

modules.go

Let a requirement be optional, binding only a provider that already runs (hq issue 166, ADR 0330)

2026-10-13 01:53:18 +02:00

network_test.go

Judge tests that read another repository against what the check clones, never the desktop's checkout (issue 432)

2026-10-11 02:55:04 +02:00

network.go

node hand-over: the terminal hands a directory used as found to the mesh, asked of the node's engine (hq issue 356)

2026-10-09 18:38:09 +02:00

new_module_on_merge_test.go

Build and register a new module when its merge lands (hq issue 300)

2026-10-07 22:32:20 +02:00

nodes_test.go

Refuse token issue --adopted for a converged node and point to adopt, rather than flip it quietly (hq ADR 0100)

2026-09-22 18:03:45 +02:00

nodes.go

Let a requirement be optional, binding only a provider that already runs (hq issue 166, ADR 0330)

2026-10-13 01:53:18 +02:00

one_resolution_test.go

Say an act's answer from one resolution after its write (issue 237)

2026-10-12 13:53:19 +02:00

operator_wait_test.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

operator_wait.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

operator.go

Work slower than the window says so, and one address is the bus's

2026-09-28 09:51:50 +02:00

order_test.go

Move a module on a merge only when its build source holds a changed file (hq ADR 0267, issue 363)

2026-10-10 03:20:36 +02:00

outside_accept_test.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

outside_not_given_test.go

Make no value for an own secret issued outside the mesh that nobody gave (issue 401)

2026-10-12 17:15:12 +02:00

outside_wait_test.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

over_budget_test.go

Hold a leaf delivery to three minutes (hq ADR 0304 decision 4, issue 525)

2026-10-12 01:44:18 +02:00

over_budget.go

Hold a leaf delivery to three minutes (hq ADR 0304 decision 4, issue 525)

2026-10-12 01:44:18 +02:00

pending_test.go

Give each pending assignment its own condition, and keep a raised row until it clears

2026-10-08 16:45:43 +02:00

pending.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

person_wait_test.go

Put a broken module back at once, and excuse a wait only for a move that added an account group (hq issue 318 review)

2026-10-08 15:25:58 +02:00

plain_words_test.go

Advise a recheck for an unanswered check on a ready or rejected delivery (issue 451)

2026-10-12 13:47:11 +02:00

plain_words.go

Keep the core over an older record instead of refusing the send (issue 201, review 90)

2026-10-12 18:51:17 +02:00

plan_clock_test.go

Count a plan's time from its tier, and save it only when a step changed it (hq issue 296)

2026-10-07 20:42:13 +02:00

plan_ids_test.go

Refuse a plans argument that is not a plan's id (issue 561)

2026-10-12 16:46:29 +02:00

plan_ids.go

Refuse a plans argument that is not a plan's id (issue 561)

2026-10-12 16:46:29 +02:00

plan_retry_tier_test.go

Ask every failed build of the tier on a retry, not only the first (issue 457)

2026-10-11 10:51:41 +02:00

plan_retry.go

Say every walk a verb keeps, and clear a stop from a walk that walks again

2026-10-12 12:54:20 +02:00

plan_test.go

review: hold the hosts region through composition, and say so in plan

2026-09-27 00:05:41 +02:00

plan.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

planner_records_test.go

Move a module on a merge only when its build source holds a changed file (hq ADR 0267, issue 363)

2026-10-10 03:20:36 +02:00

planner_rules_test.go

Say a deleted module's reason, read a context's reason at the merged branch, and keep the snapshot's bytes (hq ADR 0267, review)

2026-10-10 12:56:22 +02:00

plans_follow_test.go

Give a fast-renewing test lease a serving controller's time to renew, and prove the minted hash's cost

2026-10-13 00:08:48 +02:00

plans_follow.go

Stop the controller's tests waiting out fixed intervals

2026-10-12 23:53:06 +02:00

plans_one_at_a_time_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

probe_agent_root_test.go

Say the setuid search's quiet in the tests' words, and pin the node-engine at its reviewed head (hq issue 361)

2026-10-10 01:11:24 +02:00

probe_agent_root.go

Keep quiet for the setuid search the engine now runs to completion (hq issue 361)

2026-10-10 00:54:52 +02:00

probes.go

Use the glossary's words, say which modules raise a condition, and judge left-out modules in D1 (review of #223)

2026-10-11 11:10:22 +02:00

proposals_test.go

A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

2026-10-10 14:42:40 +02:00

proposals.go

Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353)

2026-10-12 13:21:32 +02:00

provider_hold_test.go

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

2026-10-07 16:17:52 +02:00

provider_hold.go

Check a provider's waits before saying who waits on it (issue 450)

2026-10-11 03:29:10 +02:00

push_recreates_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

push_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

push.go

Keep the core over an older record instead of refusing the send (issue 201, review 90)

2026-10-12 18:51:17 +02:00

queue_answer_test.go

Make a queue move lossless and run its passes on the acting controller alone (hq issue 558)

2026-10-12 21:38:11 +02:00

queue_test.go

Answer the build queue as data too, so a check can say how far back it waits

2026-10-12 14:22:22 +02:00

queue.go

Mark a rerun check with a short (run N) after its verdict, and word a re-hand-out neutrally

2026-10-13 00:31:57 +02:00

readable_test.go

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

readable.go

Say each machine's last send in status and node show, and as fields in status --json (novox/hq issue 485)

2026-10-11 20:40:48 +02:00

reconnects_test.go

Wait for the verb's own connection by name, not the first closed one (issue 543)

2026-10-12 13:05:15 +02:00

reconnects.go

Answer dead-letters on the lent serving connection, and keep one clip helper

2026-10-08 21:09:08 +02:00

recorded_kept_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

recorded_kept.go

Keep the core over an older record instead of refusing the send (issue 201, review 90)

2026-10-12 18:51:17 +02:00

recorded_push_test.go

Record a push that only moves recorded builds as the person's word, not a repair (hq issue 301)

2026-10-08 00:12:23 +02:00

recorded_push.go

Record a push that only moves recorded builds as the person's word, not a repair (hq issue 301)

2026-10-08 00:12:23 +02:00

references.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

registry_verbs_test.go

Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

2026-10-08 15:47:42 +02:00

registry_verbs.go

Let platform manifests go only on a confirmed collect, and copy again what a sweep took

2026-10-08 15:47:42 +02:00

rehearse_test.go

Start a rehearsal only at the controller's terminal as main now judges it (hq ADR 0259, ADR 0272)

2026-10-09 16:22:34 +02:00

rehearse.go

Start a rehearsal only at the controller's terminal as main now judges it (hq ADR 0259, ADR 0272)

2026-10-09 16:22:34 +02:00

related_test.go

Relate a batch whose moves are not known to every change

2026-10-12 02:06:54 +02:00

related.go

Relate a batch whose moves are not known to every change

2026-10-12 02:06:54 +02:00

release_plan_test.go

Move a module on a merge only when its build source holds a changed file (hq ADR 0267, issue 363)

2026-10-10 03:20:36 +02:00

release_plan.go

Let plans wait for a plan to move and answer it as data (issue 229)

2026-10-12 16:18:54 +02:00

release_test.go

Judge a leaf module on one healthy reading, a core module on three (hq issue 524)

2026-10-12 01:08:14 +02:00

release.go

Leave a kept core move out of what a gate judges (issue 201, review 91)

2026-10-12 19:16:26 +02:00

replay164_test.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

replay201_test.go

Replay issue 201 with only what the controller had before its fix

2026-10-12 21:17:31 +02:00

replay237_test.go

Say an act's answer from one resolution after its write (issue 237)

2026-10-12 13:53:19 +02:00

replay239_test.go

Add the replay of issue 239: a module's name is not taken over by a build from another repository

2026-10-13 07:02:05 +02:00

replay292_test.go

Replay issues 292 and 298 as tests the commit before each fix fails (hq ADR 0237)

2026-10-08 01:26:39 +02:00

replay309_test.go

Resolve a group's order rules by precedence, not as a cycle (hq issue 309)

2026-10-08 10:43:42 +02:00

replay318_test.go

Put a broken module back at once, and excuse a wait only for a move that added an account group (hq issue 318 review)

2026-10-08 15:25:58 +02:00

replay325_test.go

Say why assign finds no module, and keep an assignment pending on its build

2026-10-08 16:38:11 +02:00

replay327_test.go

Wait for the verb's own connection by name, not the first closed one (issue 543)

2026-10-12 13:05:15 +02:00

replay335_test.go

Judge a leaf module on one healthy reading, a core module on three (hq issue 524)

2026-10-12 01:08:14 +02:00

replay336_test.go

TestReplay336 reads the bus call in its mesh form

2026-10-09 03:08:21 +02:00

replay340_test.go

Add the replay of issue 340: a verb set what every agent session obeys (hq issue 340)

2026-10-13 02:52:28 +02:00

replay348_test.go

Add the replay of issue 348, and refuse bind-dynamic now the catalogue binds once (hq issue 348)

2026-10-13 06:09:09 +02:00

replay349_test.go

Drive the replay of issue 349 to where main decides (review of #290)

2026-10-13 05:42:52 +02:00

replay401_test.go

Add issue 401's replay, written with what the controller had before its fix, so the lab can prove it

2026-10-12 18:36:22 +02:00

replay614_test.go

Read a built module's build edges from what is kept of it, so a new SDK rebuilds its toolchain and bundles (hq issue 614)

2026-10-13 11:08:17 +02:00

replays_test.go

Register a module only from the repository the catalogue builds it from

2026-10-09 12:37:18 +02:00

restarted_test.go

Mark a rerun check with a short (run N) after its verdict, and word a re-hand-out neutrally

2026-10-13 00:31:57 +02:00

restarts_words_test.go

Say a restart count runs from when the node-engine began watching it

2026-10-12 10:46:38 +02:00

retire_verbs.go

Derive data protection from a module's declared data (hq ADR 0233)

2026-10-06 16:47:49 +02:00

retirement_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

retirement.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

rollout_first_test.go

Stop a rollout whose first machine is silent, and choose one that is heard from (hq issue 249, ADR 0218)

2026-10-05 18:17:52 +02:00

rollout_test.go

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

rollout.go

Serve the read verbs on the serving controller's own connection, and name every connection

2026-10-08 21:08:34 +02:00

roster_failure_test.go

The roster is the machines: each node's internal domain covers its routes (hq ADR 0191)

2026-10-03 16:10:16 +02:00

rotate_test.go

rotate: narrow a pair credential to one consuming module (hq issue 268)

2026-10-06 02:13:48 +02:00

rotate.go

Cite ADR 0305's clauses by their accepted-for-review numbers (issue 526)

2026-10-12 01:09:26 +02:00

same_source_test.go

Judge a leaf module on one healthy reading, a core module on three (hq issue 524)

2026-10-12 01:08:14 +02:00

sayable_test.go

Stop the controller's tests waiting out fixed intervals

2026-10-12 23:53:06 +02:00

seat_dependencies_test.go

Give the store tests' service manager holders the three verbs it now must serve (issue 332)

2026-10-12 12:25:05 +02:00

seats_test.go

Name the paths a seat's holder owns, and refuse a claim or a declaration without the seat (issue 412)

2026-10-12 16:19:49 +02:00

seats.go

Name the paths a seat's holder owns, and refuse a claim or a declaration without the seat (issue 412)

2026-10-12 16:19:49 +02:00

seatverbs_schema_test.go

Answer the build queue as data too, so a check can say how far back it waits

2026-10-12 14:22:22 +02:00

seatverbs_test.go

Quote none of the line in the unclosed-quote refusal: a refusal is kept on the bus as the call's answer (hq issue 294)

2026-10-10 18:39:20 +02:00

seatverbs.go

Merge pull request 'Let plans wait for a plan to move and answer it as data (issue 229)' (#266) from fix/229-plans-wait into main

2026-10-12 17:06:50 +00:00

secret_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

secret.go

Never make a credential only a person can give, and give it once per provider (hq issue 164, ADR 0337)

2026-10-13 11:37:31 +02:00

selfexec_test.go

Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

2026-10-07 02:45:09 +02:00

selfexec.go

Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

2026-10-07 02:45:09 +02:00

sendable_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

sendable.go

Raise S20 for every generation refusal, ask for a push when the counter was behind, and write a send's generation with its digest (hq issue 234 review)

2026-10-11 11:55:27 +02:00

sequence_test.go

Each send is numbered, inside the signed bytes

2026-09-30 14:09:12 +02:00

servingbus.go

Answer a panicking verb with an error, say flag errors in the answer, and leave refused logins out of D15

2026-10-08 21:08:34 +02:00

settings_effective_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

signals_test.go

Judge S21 by time since the first failing report while the machine is heard, not by how many reports said it (issue 233 review)

2026-10-12 15:39:08 +02:00

signals.go

Judge S21 by time since the first failing report while the machine is heard, not by how many reports said it (issue 233 review)

2026-10-12 15:39:08 +02:00

source_test.go

Rename the mesh's seats to mesh-*, keeping their interfaces

2026-09-26 23:07:09 +02:00

source.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

standing_test.go

Say a module assigned and left out of its machine's composition as a condition (issue 380)

2026-10-11 04:43:58 +02:00

standing.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

status_summary_test.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

status_summary.go

Ask a node's engine which of its directories the walk would refuse, read-only (issue 358)

2026-10-12 14:17:01 +02:00

status_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

status.go

Say each machine's last send in status and node show, and as fields in status --json (novox/hq issue 485)

2026-10-11 20:40:48 +02:00

stores.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

take_preview_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

terminal_settings_test.go

Let a trusted file that names its keys hold only those keys at the terminal (hq issue 586, ADR 0329 §5)

2026-10-13 05:22:35 +02:00

tier_send_test.go

Judge a send on no machine as the core, and test a send carrying the core with the real classes

2026-10-12 01:38:09 +02:00

unbound_test.go

Let a requirement be optional, binding only a provider that already runs (hq issue 166, ADR 0330)

2026-10-13 01:53:18 +02:00

unbound.go

Let a requirement be optional, binding only a provider that already runs (hq issue 166, ADR 0330)

2026-10-13 01:53:18 +02:00

unheld_report_test.go

Give the unheld log test its own writer and memory, so it passes on a repeat (novox/hq issue 486)

2026-10-12 11:41:41 +02:00

unknown_fields_test.go

Leave out a module whose stored manifest has an unknown field, and raise it (hq ADR 0262 review)

2026-10-08 17:34:53 +02:00

unknown_fields.go

Place a left-out module's backup lines best effort, and refuse more identity keys (hq ADR 0262 review)

2026-10-08 18:27:50 +02:00

unseen_test.go

No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

2026-10-08 01:44:43 +02:00

unseen.go

Answer what the records keep, collect on a person's word, and name a machine's images (hq ADR 0251)

2026-10-08 12:04:42 +02:00

untaken_test.go

A held module is in status, and it stops the mesh reading as well

2026-09-30 08:46:20 +02:00

upgrades.go

Say which modules a walk left unchanged, so a merge that moved nothing is not read as stranded (hq issue 611)

2026-10-13 08:18:19 +02:00

waiting_provider_test.go

Check a provider's waits before saying who waits on it (issue 450)

2026-10-11 03:29:10 +02:00

walk_said_test.go

Say every walk a verb keeps, and clear a stop from a walk that walks again

2026-10-12 12:54:20 +02:00

walk_said.go

Say what a walk touches, its bound and its outcome when it starts and ends (ADR 0308, issue 532)

2026-10-12 12:54:20 +02:00

warranted_test.go

warranted says what the operator chose, never that the module acted (hq ADR 0274 review)

2026-10-10 03:55:44 +02:00

warranted.go

warranted says what the operator chose, never that the module acted (hq ADR 0274 review)

2026-10-10 03:55:44 +02:00

watchdogs.go

Hand a delivery build out before pull-request checks (hq issue 558)

2026-10-12 21:25:46 +02:00

well_scope_test.go

The all-well sentence says what it is not a claim about

2026-09-30 08:58:59 +02:00

witness.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

worker_order_test.go

Move a module on a merge only when its build source holds a changed file (hq ADR 0267, issue 363)

2026-10-10 03:20:36 +02:00

written_settings_test.go

Judge ADR 0326 §3 only where a definition is written (hq issue 574)

2026-10-13 00:54:26 +02:00