mesh-controller

Take done keys in from a durable pull consumer, a batch at a time (issue 1945, ADR 0544)

2026-10-25 17:59:20 +01:00

agreement_catalogue_test.go

Re-capture the catalogue at mesh-catalog feat/r6 3a1017f5 and excuse a derived subject whose module lives in another repository (issue 1945)

2026-10-24 20:37:04 +02:00

agreement_streams_test.go

Count a module's own stream events beside its emits in the catalogue agreement (issue 1249)

2026-10-19 15:31:13 +02:00

agreement.go

Event names are checked now, per manifest and across the catalogue

2026-09-27 14:43:16 +02:00

announced_test_helpers_test.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

announced_test.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

announced.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

broker_test.go

One bus: the AMQP transport is gone from the controller

2026-09-28 03:36:16 +02:00

broker.go

Work slower than the window says so, and one address is the bus's

2026-09-28 09:51:50 +02:00

buildbacklog_test.go

Grant the builder the build seats' streams' information and messages by name, so its take-over at start can tell an ask its key names is on its stream (issue 1910)

2026-10-23 16:59:03 +02:00

buildbacklog.go

Grant the builder the build seats' streams' information and messages by name, so its take-over at start can tell an ask its key names is on its stream (issue 1910)

2026-10-23 16:59:03 +02:00

bus_module_emits_test.go

Raise every bus user's slow consumer and closed connection as S9, from the bus module's events (hq issue 270, ADR 0357)

2026-10-14 08:41:47 +02:00

callers_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

callers_test.go

broker: grant each credential the tool calls that name it as the caller, and no other (hq issue 365)

2026-10-11 05:25:29 +02:00

callers.go

broker: grant each credential the tool calls that name it as the caller, and no other (hq issue 365)

2026-10-11 05:25:29 +02:00

cancelled_test.go

Take the controller's publish grants on node-build-agent and mesh-build-machine away, with the cancelled sets and the redelivery of its own asks: it asks no build seat (ADR 0525 §10, C3a)

2026-10-23 16:13:43 +02:00

cancelled.go

Take the controller's publish grants on node-build-agent and mesh-build-machine away, with the cancelled sets and the redelivery of its own asks: it asks no build seat (ADR 0525 §10, C3a)

2026-10-23 16:13:43 +02:00

composed_live_test.go

Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

2026-10-24 18:30:24 +02:00

composed_test.go

Merge main (#456 , the pre-switch grants) into feat/r6 (issue 1945)

2026-10-24 22:02:32 +02:00

composed.go

Follow config from a durable consumer, compose again only what changed since, and hold the node only for a write (issue 1945, ADR 0545, review)

2026-10-25 18:27:43 +01:00

condition_grant_test.go

Prove a module may say a condition to the operator only under its own name (issue 1216)

2026-10-19 12:01:59 +02:00

config_owner_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

consumer_from_now_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

consumer_upgrade_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

controller_asks_test.go

Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259)

2026-10-09 16:22:34 +02:00

controller_buckets_integration_test.go

Take a registered module's new done key in, compose it and grant it; at start delete the plans' buckets and compose every node and the replaced controller (issue 1945, B3, B5, B13)

2026-10-24 17:11:01 +02:00

controller_buckets_test.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

controller_buckets.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

creates_streams_test.go

Broker: the bus node may follow the grants part's sealed user list and the grants part may write it, the operator's second one-grant exception (issue 1945, ADR 0547 clauses 7-8)

2026-10-26 13:03:15 +01:00

declaration_files_live_test.go

Take mesh-sdk at 86f9a1a5 and name each node's bucket with its FileBucketFor, refusing a node name that could carry a wildcard (issues 1696, 1697; ADR 0488)

2026-10-21 16:05:24 +02:00

declaration_files_test.go

Take mesh-sdk at 86f9a1a5 and name each node's bucket with its FileBucketFor, refusing a node name that could carry a wildcard (issues 1696, 1697; ADR 0488)

2026-10-21 16:05:24 +02:00

declaration_files.go

Take mesh-sdk at 86f9a1a5 and name each node's bucket with its FileBucketFor, refusing a node name that could carry a wildcard (issues 1696, 1697; ADR 0488)

2026-10-21 16:05:24 +02:00

declared_packages_mirror_test.go

Merge main (upgrade safety's declared packages, issue 1840) and pin the R4e mesh-sdk member's final head 875c680d, re-vendored here and in modules/route-proxy; the controller announces declared-packages readable (issue 1790, D1; E)

2026-10-22 20:44:59 +02:00

delivery_gate_grant_test.go

Carry a module on the tool runner only when the runner has something of it to serve, so a part on its own credential has one writer (issue 1329)

2026-10-19 23:10:48 +00:00

delivery_parts_grant_test.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

derived_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

derived.go

Derive a worker per kind for the build seats and grant their users to put asks, so a build node pulls delivery, check and recheck in order and a session cannot ask (issue 1887 A6, ADR 0525 §2)

2026-10-23 15:54:45 +02:00

genesis_template_test.go

Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

2026-10-24 18:30:24 +02:00

grants_test.go

Declare the controller's grants bucket, written by the controller alone and readable through mesh-controller.grants, so the assigner can read its sixth rule's key (issue 1394, subtask C9a; ADR 0528 clause 2); the SDK pin moves to the layouts' commit, captured beside

2026-10-23 15:39:40 +02:00

have_bucket_live_test.go

The broker asserts the have bucket and grants each node its own keys of it, the controller none (issue 1136)

2026-10-18 19:04:55 +02:00

have_bucket_test.go

The have bucket takes a node's whole facts, as large as a chain value, never cut (issue 1162)

2026-10-18 23:51:56 +02:00

invokes_test.go

broker: grant each credential the tool calls that name it as the caller, and no other (hq issue 365)

2026-10-11 05:25:29 +02:00

issued_test.go

Let the controller ask an issued credential's tool in its own name, and seal it again over a remade pair (hq issue 526, ADR 0305)

2026-10-12 01:21:20 +02:00

jetstream_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

jetstream.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

log_integration_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

log_test.go

Broker: the bus node may follow the grants part's sealed user list and the grants part may write it, the operator's second one-grant exception (issue 1945, ADR 0547 clauses 7-8)

2026-10-26 13:03:15 +01:00

log.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

membership_test.go

Grant the grants part reading every membership; seal the seeded account in the addresses test (ADR 0547 §5, review; issue 1945)

2026-10-25 22:51:25 +01:00

membership.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

modstream_work_queue_test.go

Review round 1: a carried module's queue consumer survives PruneHeard, a work-queue stream's restricted metadata is proven on the server config (issue 1178)

2026-10-19 03:18:18 +02:00

modstreams_live_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

modstreams_test.go

Carry a module on the tool runner only when the runner has something of it to serve, so a part on its own credential has one writer (issue 1329)

2026-10-19 23:10:48 +00:00

modstreams_workqueue_integration_test.go

Let module issue mint and deliver a bus process's account (issue 1181)

2026-10-19 02:55:29 +02:00

modstreams.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

move_secrets_test.go

Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

2026-10-16 08:28:38 +00:00

msgttl_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

nats_golden_test.go

The bus's system account exports MESH's connect and disconnect events and connections request, heard only by the watchman (issue 1147)

2026-10-18 19:07:06 +02:00

nats_test.go

Grant each node-engine its own access-act ask, which it has subscribed to since ADR 0325 and was refused at every connect (issue 1945)

2026-10-25 01:42:28 +02:00

nats.go

Broker: the bus node may follow the grants part's sealed user list and the grants part may write it, the operator's second one-grant exception (issue 1945, ADR 0547 clauses 7-8)

2026-10-26 13:03:15 +01:00

no_build_queue_test.go

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10)

2026-10-23 15:55:15 +02:00

node_key_test.go

Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

2026-10-16 08:28:38 +00:00

onnats.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

process_grants_test.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

process_grants.go

Let module issue mint and deliver a bus process's account (issue 1181)

2026-10-19 02:55:29 +02:00

process_state_watch_test.go

issue 1840/S3b: prove a process may watch its own state's bucket and no other (AC9)

2026-10-22 14:23:58 +02:00

prov_applied_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

provisioner_have_test.go

Grant each provisioner client a read of its node's own have, so it refills when the node's own composition moves (issue 1945)

2026-10-25 01:58:27 +02:00

provisioner_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

provisioner_server_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

provisioner_test.go

Grant each provisioner client a read of its node's own have, so it refills when the node's own composition moves (issue 1945)

2026-10-25 01:58:27 +02:00

provisioner.go

Grant each provisioner client a read of its node's own have, so it refills when the node's own composition moves (issue 1945)

2026-10-25 01:58:27 +02:00

raise_live_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

raise.go

The bus's objects are raised on every start, and one switch says which bus

2026-09-27 02:59:05 +02:00

readiness_test.go

The move ends with the old broker going, not staying

2026-09-27 23:04:59 +02:00

readiness.go

The move ends with the old broker going, not staying

2026-09-27 23:04:59 +02:00

reads-outside

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:51 +02:00

sdk_membership.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

seattools_test.go

Rename node-hosts-file to node-hostname, and refuse one seat claimed under two names (hq ADR 0223)

2026-10-05 23:43:15 +02:00

seattraffic_test.go

broker: DeadLetterReads grants only what a pulled ordered consumer needs, as mesh-sdk buscompose (issue 734, review round 1)

2026-10-26 14:17:00 +01:00

seattraffic.go

broker: DeadLetterReads grants only what a pulled ordered consumer needs, as mesh-sdk buscompose (issue 734, review round 1)

2026-10-26 14:17:00 +01:00

snapshot_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

snapshot_test.go

Grant the bus's own module the snapshot API and nothing else (hq ADR 0235)

2026-10-06 18:20:57 +02:00

state_integration_test.go

A state entry may say key-ttl and its bucket allows a time to live per key (issue 1154)

2026-10-18 20:53:42 +02:00

state_keyttl_test.go

A state entry may say key-ttl and its bucket allows a time to live per key (issue 1154)

2026-10-18 20:53:42 +02:00

state_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

state.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

stream_names_agreement_test.go

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10)

2026-10-23 15:55:15 +02:00

streams_test.go

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10)

2026-10-23 15:55:15 +02:00

streams.go

Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

2026-10-24 18:30:24 +02:00

system_exports_live_test.go

The system-exports reload test waits for the event naming the user it connected, past the watchman's own (issue 1169)

2026-10-19 01:06:56 +02:00

system_exports_test.go

The bus's system account exports MESH's connect and disconnect events and connections request, heard only by the watchman (issue 1147)

2026-10-18 19:07:06 +02:00

userlist_switch.go

Broker: the bus node may follow the grants part's sealed user list and the grants part may write it, the operator's second one-grant exception (issue 1945, ADR 0547 clauses 7-8)

2026-10-26 13:03:15 +01:00

users_test.go

Compose a bus user only for a module that can read an account

2026-10-04 17:32:50 +02:00

users.go

Broker: the bus node may follow the grants part's sealed user list and the grants part may write it, the operator's second one-grant exception (issue 1945, ADR 0547 clauses 7-8)

2026-10-26 13:03:15 +01:00

vault_calls_live_integration_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

vault_calls_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

waits_test.go

Let the tool runner's account hear the event families its manifest names (issue 745, ADR 0367)

2026-10-14 23:05:14 +00:00

waits.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

witness_grants_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

worker_type_change_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

writers_test.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

writers.go

Broker: the bus node may follow the grants part's sealed user list and the grants part may write it, the operator's second one-grant exception (issue 1945, ADR 0547 clauses 7-8)

2026-10-26 13:03:15 +01:00