jschoubben 7f8e5a821c Grant the controller's bucket-deleted, narrow a node's backup word to restic's, and grant the operator release 6's hand path ahead of the switch (issue 1945; the review of A1) ...

The new controller says its first start's deletions as an event, a node-engine hears only its backup holder, and the
way back right after the switch, a want and a composition written at the terminal, runs on the user list today's
controller composes (ADR 0539 clauses 2, 10 and 13). The operator is the administrator person, the one second
writer ADR 0539 names.

2026-10-24 18:21:58 +02:00

..

testdata

Grant the controller's bucket-deleted, narrow a node's backup word to restic's, and grant the operator release 6's hand path ahead of the switch (issue 1945; the review of A1)

2026-10-24 18:21:58 +02:00

agreement_catalogue_test.go

Set aside a retired seat's consume the trunk catalogue still holds, and say it, so a group that retires a seat passes its check

2026-10-23 18:05:06 +02:00

agreement_streams_test.go

Count a module's own stream events beside its emits in the catalogue agreement (issue 1249)

2026-10-19 15:31:13 +02:00

agreement.go

Event names are checked now, per manifest and across the catalogue

2026-09-27 14:43:16 +02:00

announced_test_helpers_test.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

announced_test.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

announced.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

broker_test.go

One bus: the AMQP transport is gone from the controller

2026-09-28 03:36:16 +02:00

broker.go

Work slower than the window says so, and one address is the bus's

2026-09-28 09:51:50 +02:00

buildbacklog_test.go

Grant the builder the build seats' streams' information and messages by name, so its take-over at start can tell an ask its key names is on its stream (issue 1910)

2026-10-23 16:59:03 +02:00

buildbacklog.go

Grant the builder the build seats' streams' information and messages by name, so its take-over at start can tell an ask its key names is on its stream (issue 1910)

2026-10-23 16:59:03 +02:00

bus_module_emits_test.go

Raise every bus user's slow consumer and closed connection as S9, from the bus module's events (hq issue 270, ADR 0357)

2026-10-14 08:41:47 +02:00

callers_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

callers_test.go

broker: grant each credential the tool calls that name it as the caller, and no other (hq issue 365)

2026-10-11 05:25:29 +02:00

callers.go

broker: grant each credential the tool calls that name it as the caller, and no other (hq issue 365)

2026-10-11 05:25:29 +02:00

cancelled_test.go

Take the controller's publish grants on node-build-agent and mesh-build-machine away, with the cancelled sets and the redelivery of its own asks: it asks no build seat (ADR 0525 §10, C3a)

2026-10-23 16:13:43 +02:00

cancelled.go

Take the controller's publish grants on node-build-agent and mesh-build-machine away, with the cancelled sets and the redelivery of its own asks: it asks no build seat (ADR 0525 §10, C3a)

2026-10-23 16:13:43 +02:00

composed_test.go

Grant the controller's bucket-deleted, narrow a node's backup word to restic's, and grant the operator release 6's hand path ahead of the switch (issue 1945; the review of A1)

2026-10-24 18:21:58 +02:00

composed.go

Grant the controller's bucket-deleted, narrow a node's backup word to restic's, and grant the operator release 6's hand path ahead of the switch (issue 1945; the review of A1)

2026-10-24 18:21:58 +02:00

condition_grant_test.go

Prove a module may say a condition to the operator only under its own name (issue 1216)

2026-10-19 12:01:59 +02:00

config_owner_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

consumer_from_now_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

consumer_upgrade_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

controller_asks_test.go

Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259)

2026-10-09 16:22:34 +02:00

controller_buckets_integration_test.go

Keep a build request as the build in state asked (issue 1091)

2026-10-18 02:53:39 +02:00

controller_buckets_test.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

controller_buckets.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

declaration_files_live_test.go

Take mesh-sdk at 86f9a1a5 and name each node's bucket with its FileBucketFor, refusing a node name that could carry a wildcard (issues 1696, 1697; ADR 0488)

2026-10-21 16:05:24 +02:00

declaration_files_test.go

Take mesh-sdk at 86f9a1a5 and name each node's bucket with its FileBucketFor, refusing a node name that could carry a wildcard (issues 1696, 1697; ADR 0488)

2026-10-21 16:05:24 +02:00

declaration_files.go

Take mesh-sdk at 86f9a1a5 and name each node's bucket with its FileBucketFor, refusing a node name that could carry a wildcard (issues 1696, 1697; ADR 0488)

2026-10-21 16:05:24 +02:00

declared_packages_mirror_test.go

Merge main (upgrade safety's declared packages, issue 1840) and pin the R4e mesh-sdk member's final head 875c680d, re-vendored here and in modules/route-proxy; the controller announces declared-packages readable (issue 1790, D1; E)

2026-10-22 20:44:59 +02:00

delivery_gate_grant_test.go

Carry a module on the tool runner only when the runner has something of it to serve, so a part on its own credential has one writer (issue 1329)

2026-10-19 23:10:48 +00:00

delivery_parts_grant_test.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

derived_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

derived.go

Derive a worker per kind for the build seats and grant their users to put asks, so a build node pulls delivery, check and recheck in order and a session cannot ask (issue 1887 A6, ADR 0525 §2)

2026-10-23 15:54:45 +02:00

genesis_template_test.go

Take the controller's publish grants on node-build-agent and mesh-build-machine away, with the cancelled sets and the redelivery of its own asks: it asks no build seat (ADR 0525 §10, C3a)

2026-10-23 16:13:43 +02:00

grants_test.go

Declare the controller's grants bucket, written by the controller alone and readable through mesh-controller.grants, so the assigner can read its sixth rule's key (issue 1394, subtask C9a; ADR 0528 clause 2); the SDK pin moves to the layouts' commit, captured beside

2026-10-23 15:39:40 +02:00

have_bucket_live_test.go

The broker asserts the have bucket and grants each node its own keys of it, the controller none (issue 1136)

2026-10-18 19:04:55 +02:00

have_bucket_test.go

The have bucket takes a node's whole facts, as large as a chain value, never cut (issue 1162)

2026-10-18 23:51:56 +02:00

invokes_test.go

broker: grant each credential the tool calls that name it as the caller, and no other (hq issue 365)

2026-10-11 05:25:29 +02:00

issued_test.go

Let the controller ask an issued credential's tool in its own name, and seal it again over a remade pair (hq issue 526, ADR 0305)

2026-10-12 01:21:20 +02:00

jetstream_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

jetstream.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

log_integration_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

log_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

log.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

membership_test.go

The machine runs one tool runtime, loading every delivered bundle (hq ADR 0175, to-be 38 WP2.3)

2026-10-02 18:26:54 +02:00

membership.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

modstream_work_queue_test.go

Review round 1: a carried module's queue consumer survives PruneHeard, a work-queue stream's restricted metadata is proven on the server config (issue 1178)

2026-10-19 03:18:18 +02:00

modstreams_live_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

modstreams_test.go

Carry a module on the tool runner only when the runner has something of it to serve, so a part on its own credential has one writer (issue 1329)

2026-10-19 23:10:48 +00:00

modstreams_workqueue_integration_test.go

Let module issue mint and deliver a bus process's account (issue 1181)

2026-10-19 02:55:29 +02:00

modstreams.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

move_secrets_test.go

Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

2026-10-16 08:28:38 +00:00

msgttl_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

nats_golden_test.go

The bus's system account exports MESH's connect and disconnect events and connections request, heard only by the watchman (issue 1147)

2026-10-18 19:07:06 +02:00

nats_test.go

Grant the controller's bucket-deleted, narrow a node's backup word to restic's, and grant the operator release 6's hand path ahead of the switch (issue 1945; the review of A1)

2026-10-24 18:21:58 +02:00

nats.go

Grant the controller's bucket-deleted, narrow a node's backup word to restic's, and grant the operator release 6's hand path ahead of the switch (issue 1945; the review of A1)

2026-10-24 18:21:58 +02:00

no_build_queue_test.go

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10)

2026-10-23 15:55:15 +02:00

node_key_test.go

Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

2026-10-16 08:28:38 +00:00

onnats.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

process_grants_test.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

process_grants.go

Let module issue mint and deliver a bus process's account (issue 1181)

2026-10-19 02:55:29 +02:00

process_state_watch_test.go

issue 1840/S3b: prove a process may watch its own state's bucket and no other (AC9)

2026-10-22 14:23:58 +02:00

prov_applied_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

provisioner_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

provisioner_server_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

provisioner_test.go

Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

2026-10-16 08:28:38 +00:00

provisioner.go

Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

2026-10-16 08:28:38 +00:00

raise_live_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

raise.go

The bus's objects are raised on every start, and one switch says which bus

2026-09-27 02:59:05 +02:00

readiness_test.go

The move ends with the old broker going, not staying

2026-09-27 23:04:59 +02:00

readiness.go

The move ends with the old broker going, not staying

2026-09-27 23:04:59 +02:00

sdk_membership.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

seattools_test.go

Rename node-hosts-file to node-hostname, and refuse one seat claimed under two names (hq ADR 0223)

2026-10-05 23:43:15 +02:00

seattraffic_test.go

Bound the build seats' workers' deliveries, so an ask no run ends is offered at most five times even when the holder that says it is poison dies too (issue 1907)

2026-10-23 16:42:13 +02:00

seattraffic.go

Bound the build seats' workers' deliveries, so an ask no run ends is offered at most five times even when the holder that says it is poison dies too (issue 1907)

2026-10-23 16:42:13 +02:00

snapshot_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

snapshot_test.go

Grant the bus's own module the snapshot API and nothing else (hq ADR 0235)

2026-10-06 18:20:57 +02:00

state_integration_test.go

A state entry may say key-ttl and its bucket allows a time to live per key (issue 1154)

2026-10-18 20:53:42 +02:00

state_keyttl_test.go

A state entry may say key-ttl and its bucket allows a time to live per key (issue 1154)

2026-10-18 20:53:42 +02:00

state_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

state.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

stream_names_agreement_test.go

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10)

2026-10-23 15:55:15 +02:00

streams_test.go

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10)

2026-10-23 15:55:15 +02:00

streams.go

Grant the controller's bucket-deleted, narrow a node's backup word to restic's, and grant the operator release 6's hand path ahead of the switch (issue 1945; the review of A1)

2026-10-24 18:21:58 +02:00

system_exports_live_test.go

The system-exports reload test waits for the event naming the user it connected, past the watchman's own (issue 1169)

2026-10-19 01:06:56 +02:00

system_exports_test.go

The bus's system account exports MESH's connect and disconnect events and connections request, heard only by the watchman (issue 1147)

2026-10-18 19:07:06 +02:00

users_test.go

Compose a bus user only for a module that can read an account

2026-10-04 17:32:50 +02:00

users.go

Grant the controller's bucket-deleted, narrow a node's backup word to restic's, and grant the operator release 6's hand path ahead of the switch (issue 1945; the review of A1)

2026-10-24 18:21:58 +02:00

vault_calls_live_integration_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

vault_calls_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

waits_test.go

Let the tool runner's account hear the event families its manifest names (issue 745, ADR 0367)

2026-10-14 23:05:14 +00:00

waits.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

witness_grants_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

worker_type_change_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

writers_test.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

writers.go

Grant the controller's bucket-deleted, narrow a node's backup word to restic's, and grant the operator release 6's hand path ahead of the switch (issue 1945; the review of A1)

2026-10-24 18:21:58 +02:00