mesh-controller

Files

T

jochen 4291fee68e

mesh/merge-gate pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus step; every machine composes with the change as it…

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery delivered

Details

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

With twelve consumers of the database provision, one provider down would be
twelve conditions for one fault and twelve gates failed for something none of
them did. A consumer's check names the provision it exercises; while the
provider composed for it — its recorded binding, or the machine its credential
comes from — is unhealthy on the record, what that check finds raises nothing
of its own: the provider's condition lists it as waiting and is urgent, and
the consumer's gate waits, past its bound too, rather than putting a build
back. Liveness findings and checks naming no provision stay the consumer's own,
and once the provider is healthy a consumer still failing is raised at once.

2026-10-07 16:17:52 +02:00

acting.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

acts_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

acts.go

Derive data protection from a module's declared data (hq ADR 0233)

2026-10-06 16:47:49 +02:00

addresses_test.go

The registry-trust test reads the runtime's module, which now writes the trust (ADR 0222)

2026-10-05 22:47:43 +02:00

adopting_test.go

Keep a named push from sending builds a policy or a plan holds back

2026-10-05 22:22:03 +02:00

adoption.go

node show cites ADR 0180 for a removed front end (hq ADR 0186)

2026-10-02 18:42:16 +02:00

api_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

api.go

A module depends on the node seats that apply its resources (hq ADR 0207)

2026-10-04 12:34:11 +02:00

ask.go

One bus: the AMQP transport is gone from the controller

2026-09-28 03:36:16 +02:00

awaiting_push_test.go

Say a machine waiting for its push as waiting, not uncomposable (hq issue 275)

2026-10-06 18:05:38 +02:00

bindings_test.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

bindings.go

Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

2026-10-06 15:19:23 +02:00

board_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

board.go

Record whether a node is adopted and which modules were taken on it (hq ADR 0100)

2026-09-22 17:14:05 +02:00

build_seat_test.go

The controller asks the build role that has a holder, and hears both roles' outcomes (hq ADR 0190, the handover)

2026-10-03 02:51:03 +02:00

build_test.go

An older build request never replaces a newer one's artifact

2026-10-04 00:22:11 +02:00

build.go

Publish only a commit on its module's trunk; post a pull request's change plan (hq ADR 0238)

2026-10-06 22:49:55 +02:00

bus_step.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

buscertificate_test.go

The mesh makes the bus's certificate itself

2026-09-29 15:42:51 +02:00

buscertificate.go

A token is an account on the bus, and genesis can place the list

2026-09-29 17:36:50 +02:00

busobjects_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

busobjects.go

Assert the bus's objects on every send, not only at start (hq issue 208)

2026-10-06 11:45:51 +02:00

calls_verb_test.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

changeplan_test.go

Publish only a commit on its module's trunk; post a pull request's change plan (hq ADR 0238)

2026-10-06 22:49:55 +02:00

changeplan.go

Publish only a commit on its module's trunk; post a pull request's change plan (hq ADR 0238)

2026-10-06 22:49:55 +02:00

check_here.go

Remove everything a check run by hand leaves, the toolchain's files under its HOME too

2026-10-07 01:48:37 +02:00

check_test.go

Let the module graph decide what a pull request's check runs, in two layers (hq ADR 0237)

2026-10-06 22:34:56 +02:00

check.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

checks_test.go

Publish only a commit on its module's trunk; post a pull request's change plan (hq ADR 0238)

2026-10-06 22:49:55 +02:00

checks.go

Raise the mesh as it is in the gate, call a baseline that does not compose an error, and let a check run by hand as the seat runs it

2026-10-07 01:33:18 +02:00

collect.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

collection.go

Hold every kept archive by a manifest so the store's collector keeps it (hq issue 253)

2026-10-05 18:13:23 +02:00

conditions_test.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

conditions.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

confirm.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

credential_on_assign_test.go

An assignment issues its bus credential, a push refuses one nobody issued, and what reads a secret restarts on it (hq issue 203)

2026-10-03 04:01:17 +02:00

data_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

data.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

delivery_conditions_test.go

Say a walk that waits too long, and a delivery's own stalls (hq ADR 0239)

2026-10-07 00:16:32 +02:00

delivery_conditions.go

Say a walk that waits too long, and a delivery's own stalls (hq ADR 0239)

2026-10-07 00:16:32 +02:00

delivery_order_test.go

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

delivery_test.go

Let a walk wait for its delivery's word, and serve the delivery's owner (hq ADR 0239)

2026-10-07 00:01:42 +02:00

delivery.go

Let a walk wait for its delivery's word, and serve the delivery's owner (hq ADR 0239)

2026-10-07 00:01:42 +02:00

dependents_test.go

A merge of a base rebuilds what stands on it

2026-10-01 16:09:26 +02:00

doctor_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

doctor.go

Say a walk that waits too long, and a delivery's own stalls (hq ADR 0239)

2026-10-07 00:16:32 +02:00

dry_run_test.go

Take no dry run in: mark it on the request, echo it on the outcome, set it aside

2026-10-05 09:50:20 +02:00

durations.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

epoch_send_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

facts_test.go

Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

2026-10-06 20:31:10 +02:00

facts.go

Name a repository in the facts as owner/repository, without the forge's address

2026-10-07 02:04:35 +02:00

gate_test.go

Keep what each machine says of what it runs, raise it, and gate on it (hq ADR 0240, to-be 48 Phase A)

2026-10-07 02:28:16 +02:00

gate.go

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

2026-10-07 16:17:52 +02:00

given_test.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

given.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

grant_follows_binding_test.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

handacts_test.go

Record a drill through its own verb, so S15 never counts a deliberate test as a repair

2026-10-07 13:55:31 +02:00

handacts.go

Record a drill through its own verb, so S15 never counts a deliberate test as a repair

2026-10-07 13:55:31 +02:00

healers_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

healers.go

Say a walk that waits too long, and a delivery's own stalls (hq ADR 0239)

2026-10-07 00:16:32 +02:00

health_check_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

health_probes.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

held_back_test.go

No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236)

2026-10-06 19:14:25 +02:00

held_back.go

No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236)

2026-10-06 19:14:25 +02:00

hold_test.go

Send the bus's machine before the grants, and only when its user list moved (hq issue 249)

2026-10-05 18:17:52 +02:00

hold.go

Hold a node from composing to sending, so a push composed before converge or adopt is never sent after it (hq ADR 0100)

2026-09-22 18:10:04 +02:00

holdings_test.go

A holder by derivation is recorded before an assignment can unsettle it (hq 170)

2026-09-30 14:39:59 +02:00

holdings.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

hosts_behind_test.go

A commit has no order, so the mesh says who runs what and claims no newer

2026-09-30 09:28:56 +02:00

identity_bound_test.go

Grant a provider only the consumers bound to it (hq issue 274)

2026-10-06 16:07:12 +02:00

issue_204_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

lease_command_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

lease_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

licence.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

main.go

Raise the mesh as it is in the gate, call a baseline that does not compose an error, and let a check run by hand as the seat runs it

2026-10-07 01:33:18 +02:00

merge_gate_test.go

Raise the mesh as it is in the gate, call a baseline that does not compose an error, and let a check run by hand as the seat runs it

2026-10-07 01:33:18 +02:00

merge_gate.go

Raise the mesh as it is in the gate, call a baseline that does not compose an error, and let a check run by hand as the seat runs it

2026-10-07 01:33:18 +02:00

mesh_for_test.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

missed_merges_test.go

Catch up on merges the bus announced and never handed over (hq issue 266)

2026-10-06 01:29:21 +02:00

missed_merges.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

module_health_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

module_health.go

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

2026-10-07 16:17:52 +02:00

modules_test.go

A module's own secret rotates when its definition says the module reads it at start (hq 180)

2026-10-01 11:41:49 +02:00

modules.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

network_test.go

The mesh's one resolver: its seat, a provider's address, zones, and a node's hosts file (hq ADR 0194, 0196, 0199)

2026-10-04 17:32:08 +02:00

network.go

The private network writes nothing into the runtime's file (hq issue 190)

2026-10-05 22:19:43 +02:00

nodes_test.go

Refuse token issue --adopted for a converged node and point to adopt, rather than flip it quietly (hq ADR 0100)

2026-09-22 18:03:45 +02:00

nodes.go

Keep what each machine says of what it runs, raise it, and gate on it (hq ADR 0240, to-be 48 Phase A)

2026-10-07 02:28:16 +02:00

operator.go

Work slower than the window says so, and one address is the bus's

2026-09-28 09:51:50 +02:00

order_test.go

A changed file touches exactly the modules whose build reads it (hq issue 280, ADR 0237)

2026-10-06 22:34:57 +02:00

plan_retry.go

Send a plan's tier to each machine once, and blame no module for its machine (hq issue 281)

2026-10-06 22:20:43 +02:00

plan_test.go

review: hold the hosts region through composition, and say so in plan

2026-09-27 00:05:41 +02:00

plan.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

plans_one_at_a_time_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

probes.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

provider_hold_test.go

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

2026-10-07 16:17:52 +02:00

provider_hold.go

Hold a consumer's findings under its unhealthy provider, and say them once there (hq ADR 0240, to-be 48 Phase C)

2026-10-07 16:17:52 +02:00

push_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

push.go

Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

2026-10-07 02:45:09 +02:00

queue_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

queue.go

Keep a replay from moving the mesh backwards, and tighten the queue's edges (review of hq ADR 0219)

2026-10-05 19:45:45 +02:00

readable_test.go

The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

2026-10-02 12:00:12 +02:00

readable.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

references.go

An address is read from the node's settings where it is used, never recorded with a port

2026-09-23 23:49:31 +02:00

release_plan_test.go

A module's directory is never shared code, held or not (hq issue 278)

2026-10-06 19:55:25 +02:00

release_plan.go

Let a walk wait for its delivery's word, and serve the delivery's owner (hq ADR 0239)

2026-10-07 00:01:42 +02:00

release_test.go

No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236)

2026-10-06 19:14:25 +02:00

release.go

Send a plan's tier to each machine once, and blame no module for its machine (hq issue 281)

2026-10-06 22:20:43 +02:00

replays_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

retire_verbs.go

Derive data protection from a module's declared data (hq ADR 0233)

2026-10-06 16:47:49 +02:00

retirement_test.go

Give every test a bus of its own, at the release the mesh runs (hq ADR 0237)

2026-10-06 21:17:02 +02:00

retirement.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

rollout_first_test.go

Stop a rollout whose first machine is silent, and choose one that is heard from (hq issue 249, ADR 0218)

2026-10-05 18:17:52 +02:00

rollout_test.go

Merge main: the trunk renamed the seats and made them data

2026-09-27 18:50:18 +02:00

rollout.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

roster_failure_test.go

The roster is the machines: each node's internal domain covers its routes (hq ADR 0191)

2026-10-03 16:10:16 +02:00

rotate_test.go

rotate: narrow a pair credential to one consuming module (hq issue 268)

2026-10-06 02:13:48 +02:00

rotate.go

rotate: narrow a pair credential to one consuming module (hq issue 268)

2026-10-06 02:13:48 +02:00

same_source_test.go

Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

2026-10-06 22:09:11 +02:00

sayable_test.go

Look twice before saying a probe failed, and say conditions in machine names (hq issue 277)

2026-10-06 18:40:33 +02:00

seat_dependencies_test.go

Refuse an unmet seat dependency the catalogue could meet (hq ADR 0207 §4)

2026-10-04 13:07:45 +02:00

seats_test.go

Name system seats by scope; let a module define its own (ADR 0121)

2026-09-27 14:30:56 +02:00

seats.go

Let the mesh's resolver seat have several holders on record

2026-10-05 22:42:53 +02:00

seatverbs_schema_test.go

Derive data protection from a module's declared data (hq ADR 0233)

2026-10-06 16:47:49 +02:00

seatverbs_test.go

Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

2026-10-06 18:56:54 +02:00

seatverbs.go

Record a drill through its own verb, so S15 never counts a deliberate test as a repair

2026-10-07 13:55:31 +02:00

secret_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

secret.go

Replace a value given by hand like one the mesh made (hq ADR 0228)

2026-10-06 12:13:48 +02:00

selfexec_test.go

Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

2026-10-07 02:45:09 +02:00

selfexec.go

Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

2026-10-07 02:45:09 +02:00

sendable_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

sendable.go

Say a machine waiting for its push as waiting, not uncomposable (hq issue 275)

2026-10-06 18:05:38 +02:00

sequence_test.go

Each send is numbered, inside the signed bytes

2026-09-30 14:09:12 +02:00

signals_test.go

Record a drill through its own verb, so S15 never counts a deliberate test as a repair

2026-10-07 13:55:31 +02:00

signals.go

Say a walk that waits too long, and a delivery's own stalls (hq ADR 0239)

2026-10-07 00:16:32 +02:00

source_test.go

Rename the mesh's seats to mesh-*, keeping their interfaces

2026-09-26 23:07:09 +02:00

source.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

standing_test.go

Say when the mesh is wrong: conditions, watchdogs, the bus's advisories, doctor (hq to-be 45 Phase 1)

2026-10-06 10:21:11 +02:00

standing.go

Hear what providers retire, and let a person approve, reject and delete (hq ADR 0230)

2026-10-06 14:41:15 +02:00

status_summary_test.go

Keep calls and hand acts on the bus, answer status at once, record durations (hq to-be 45 Phase 0)

2026-10-06 02:59:36 +02:00

status_summary.go

Keep what each machine says of what it runs, raise it, and gate on it (hq ADR 0240, to-be 48 Phase A)

2026-10-07 02:28:16 +02:00

status_test.go

Rename mesh-control -> mesh-controller, substrate -> foundation

2026-09-16 18:40:40 +02:00

status.go

Heal what is known, under a brake, and say every repair (hq to-be 45 Phase 3)

2026-10-06 14:26:26 +02:00

stores.go

Retire the networking bundle and what the control plane stops shipping (hq ADR 0226)

2026-10-06 14:59:28 +02:00

supersede_test.go

Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

2026-10-06 12:29:18 +02:00

take_preview_test.go

A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

2026-10-02 11:01:09 +02:00

tier_send_test.go

Send a plan's tier to each machine once, and blame no module for its machine (hq issue 281)

2026-10-06 22:20:43 +02:00

unheld_report_test.go

An act says the unmet seat dependencies of the node it acted on, not the mesh's (hq ADR 0207)

2026-10-04 12:50:25 +02:00

untaken_test.go

A held module is in status, and it stops the mesh reading as well

2026-09-30 08:46:20 +02:00

upgrades.go

Let a walk wait for its delivery's word, and serve the delivery's owner (hq ADR 0239)

2026-10-07 00:01:42 +02:00

watchdogs.go

Say a walk that waits too long, and a delivery's own stalls (hq ADR 0239)

2026-10-07 00:16:32 +02:00

well_scope_test.go

The all-well sentence says what it is not a claim about

2026-09-30 08:58:59 +02:00

witness.go

Name the decision this builds: hq ADR 0236 (0235 is the bus's snapshot)

2026-10-06 18:56:54 +02:00

worker_order_test.go

The build seat's holder follows the controller that defines its worker (hq issue 206)

2026-10-03 04:04:41 +02:00