The bridge carries each module's manifest and lock hashes, and the indexer writes manifests by digest and each module's new-form inputs (design 47 R4c-2, issues 1448, 1449, 1450, 1444, 1451, 1458)
#10
Merged
mesh-toolsmerged 9 commits from feat/r4c2-new-keys into main2026-10-20 19:31:05 +00:00
Design 47 R4c's second delivery (ADR 0465 clauses 1-3, 5), one delivery group with mesh-controller's facts in format 2 (issue 1394) on the same branch name.
issue 1448: the forge bridge reads each module directory's module.json and lock files (go.sum, package-lock.json) through gitea_get_file at the merge commit or the head, and carries Manifests and Locks (hex sha256) in its merged and pull messages; a lock file the forge does not have is left out, any other failure retries. The manifest invokes gitea.gitea_get_file.
issue 1458 (its time half): the files are read at most eight at once, so a merge into the catalogue (131 modules, ~393 files) stays inside the bridge's 30 s bound; the result and the first error do not depend on the order calls finish.
issue 1449: the indexer writes manifests. create-once and keeps the digest in modules.; its manifest declares the state manifests (history 1).
issue 1450: the indexer reads a module's tree, bases (build.on), lock hashes and artifacts' languages from its manifest with mesh-sdk's catalogue parser and keeps them as modules..Inputs2.
issue 1444 (R4c-2 half): every module gets None2 with the reason naming what is missing; no new-form fingerprint is written in this release.
issue 1451: a candidate's touched modules carry their manifest digest and None2 'no merge preview is computed', and the candidate its FPSet.
Both modules pin mesh-sdk 4024909a (mesh-sdk #50, delivered). Test fixtures are real manifests copied server-side from mesh-catalog a67f0196 and mesh-controller f2d7bc94. Tries: build-1792522618026311210 (f69a561a) and build-1792523185056657850 (c9f742d5) passed. Opened in review: 1458 (the message's size half stays open), 1459 (TypeScript modules commit no lock file; a decision before the build modules).
Design 47 R4c's second delivery (ADR 0465 clauses 1-3, 5), one delivery group with mesh-controller's facts in format 2 (issue 1394) on the same branch name.
- issue 1448: the forge bridge reads each module directory's module.json and lock files (go.sum, package-lock.json) through gitea_get_file at the merge commit or the head, and carries Manifests and Locks (hex sha256) in its merged and pull messages; a lock file the forge does not have is left out, any other failure retries. The manifest invokes gitea.gitea_get_file.
- issue 1458 (its time half): the files are read at most eight at once, so a merge into the catalogue (131 modules, ~393 files) stays inside the bridge's 30 s bound; the result and the first error do not depend on the order calls finish.
- issue 1449: the indexer writes manifests.<digest> create-once and keeps the digest in modules.<m>; its manifest declares the state manifests (history 1).
- issue 1450: the indexer reads a module's tree, bases (build.on), lock hashes and artifacts' languages from its manifest with mesh-sdk's catalogue parser and keeps them as modules.<m>.Inputs2.
- issue 1444 (R4c-2 half): every module gets None2 with the reason naming what is missing; no new-form fingerprint is written in this release.
- issue 1451: a candidate's touched modules carry their manifest digest and None2 'no merge preview is computed', and the candidate its FPSet.
Both modules pin mesh-sdk 4024909a (mesh-sdk #50, delivered). Test fixtures are real manifests copied server-side from mesh-catalog a67f0196 and mesh-controller f2d7bc94. Tries: build-1792522618026311210 (f69a561a) and build-1792523185056657850 (c9f742d5) passed. Opened in review: 1458 (the message's size half stays open), 1459 (TypeScript modules commit no lock file; a decision before the build modules).
Reviewed-by: review-r4c2@shanks at c9f742d5f20ea8d2e7489d1a5917802434c8e02e
Fixtures are copied from the writer, never written by hand: four catalogue manifests at mesh-catalog a67f0196 and build-agent's at mesh-controller f2d7bc94.
mesh/merge-gate head c9f742d5f20e merged into trunk 2520cc4a88f7 — pass: group feat/r4c2-new-keys composed: every machine composes with the change as it di…
composed together: pass — every machine composes with the change as it did without (4 of 4 compose)
Machines
mesh-controller on every machine running it: sent
mesh-delivery-forge-bridge on every machine running it: sent
mesh-delivery-indexer on every machine running it: sent
Transitions
2026-10-20 19:17 (new) → proposed (announced): novox/mesh-delivery#10's head announced
2026-10-20 19:20 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-20 19:20 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-20 19:32 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-20 19:32 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-20 19:34 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-delivery@c9f742d5f20e` — **delivered** since 2026-10-20T19:34:41Z
**Delivery plan** — builds mesh-delivery-forge-bridge, mesh-delivery-indexer → novox; no bus step
- tier 0: mesh-delivery-forge-bridge, mesh-delivery-indexer
- novox: receives mesh-delivery-forge-bridge, mesh-delivery-indexer
**Group** `feat/r4c2-new-keys`: novox/mesh-controller@e7c6abfd0e3c, novox/mesh-delivery@c9f742d5f20e
- composed together: pass — every machine composes with the change as it did without (4 of 4 compose)
**Machines**
- mesh-controller on every machine running it: sent
- mesh-delivery-forge-bridge on every machine running it: sent
- mesh-delivery-indexer on every machine running it: sent
**Transitions**
- 2026-10-20 19:17 (new) → proposed (announced): novox/mesh-delivery#10's head announced
- 2026-10-20 19:20 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
- 2026-10-20 19:20 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
- 2026-10-20 19:32 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
- 2026-10-20 19:32 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
- 2026-10-20 19:34 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says
The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
Merge check at c9f742d5
Judged: head c9f742d5f20e merged into trunk 2520cc4a88f7; read beside it: mesh-catalog 809dd76973fd, mesh-controller f2d7bc94800d, mesh-controller-main f2d7bc94800d, mesh-host ce1b97ad973d, mesh-tools 18260ce9beca
mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery-forge-bridge, mesh-delivery-indexer)
mesh/repo-check: PASS — its merge-check.sh passed
Delivery plan — builds mesh-delivery-forge-bridge, mesh-delivery-indexer → novox; no bus step
Run by the build seat on ace as build-1792523843032273756 (builds --log build-1792523843032273756).
--- the gate: mesh-delivery-forge-bridge, mesh-delivery-indexer
mesh-delivery-forge-bridge: ok, invokes gitea.gitea_merge_pull_request, gitea.gitea_commit_status, gitea.gitea_delivery_view, gitea.gitea_note_append, gitea.gitea_add_comment, gitea.gitea_open_pulls, gitea.gitea_commit_trees, gitea.gitea_get_file, keeps state heads, performed, reads mesh-delivery-gate.merges, mesh-delivery-gate.owed, ready: bridge by unit every 30s
mesh-delivery-indexer: ok, keeps state candidates, manifests, modules, reads mesh-controller.builds, mesh-delivery-gate.source, ready: indexer by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-20T18:46:14Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-20T18:46:14Z
modules the change moves:
- mesh-delivery-forge-bridge (changed)
- mesh-delivery-indexer (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 2 module(s) in 1 tier(s): mesh-delivery-forge-bridge, mesh-delivery-indexer
notes:
- modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/integration_test.go, modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/main_test.go, modules/mesh-delivery-forge-bridge/internal/bridge/bridge_test.go, modules/mesh-delivery-forge-bridge/internal/bridge/files_test.go, modules/mesh-delivery-forge-bridge/manifest_test.go, modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go, modules/mesh-delivery-indexer/internal/index/candidate_manifests_test.go, modules/mesh-delivery-indexer/internal/index/inputs_test.go, modules/mesh-delivery-indexer/internal/index/manifests_test.go, modules/mesh-delivery-indexer/internal/index/newform_test.go, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-audit-logger.module.json, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-avahi.module.json, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-ca-trust.module.json, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-netcheck.module.json, modules/mesh-delivery-indexer/internal/index/testdata/controller-f2d7bc94-build-agent.module.json and modules/mesh-delivery-indexer/manifest_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
== ./modules/mesh-delivery-forge-bridge: go vet and the unit tests
ok mesh-delivery-forge-bridge 0.003s
ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge (cached)
ok mesh-delivery-forge-bridge/internal/bridge 0.198s
== ./modules/mesh-delivery-forge-bridge: the integration tests (-tags integration)
ok mesh-delivery-forge-bridge 0.002s
ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge 3.512s
ok mesh-delivery-forge-bridge/internal/bridge 0.198s
== ./modules/mesh-delivery-indexer: go vet and the unit tests
ok mesh-delivery-indexer 0.003s
ok mesh-delivery-indexer/cmd/mesh-delivery-indexer (cached)
ok mesh-delivery-indexer/internal/index 0.010s
== ./modules/mesh-delivery-indexer: the integration tests (-tags integration)
ok mesh-delivery-indexer 0.003s
ok mesh-delivery-indexer/cmd/mesh-delivery-indexer 0.435s
ok mesh-delivery-indexer/internal/index 0.009s
== ./modules/mesh-delivery-teller: go vet and the unit tests
ok mesh-delivery-teller 0.002s
ok mesh-delivery-teller/cmd/mesh-delivery-teller (cached)
== ./modules/mesh-delivery-teller: the integration tests (-tags integration)
ok mesh-delivery-teller 0.003s
ok mesh-delivery-teller/cmd/mesh-delivery-teller (cached)
== ./modules/mesh-delivery-view: go vet and the unit tests
ok mesh-delivery-view 0.003s
ok mesh-delivery-view/cmd/mesh-delivery-cli (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view (cached)
ok mesh-delivery-view/internal/view (cached)
== ./modules/mesh-delivery-view: the integration tests (-tags integration)
ok mesh-delivery-view 0.002s
ok mesh-delivery-view/cmd/mesh-delivery-cli (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view (cached)
ok mesh-delivery-view/internal/view (cached)
== ./modules/mesh-delivery-watchman: go vet and the unit tests
ok mesh-delivery-watchman 0.002s
ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached)
ok mesh-delivery-watchman/internal/watch (cached)
== ./modules/mesh-delivery-watchman: the integration tests (-tags integration)
ok mesh-delivery-watchman 0.003s
ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached)
ok mesh-delivery-watchman/internal/watch (cached)
**Merge check** at `c9f742d5`
Judged: head `c9f742d5f20e` merged into trunk `2520cc4a88f7`; read beside it: mesh-catalog `809dd76973fd`, mesh-controller `f2d7bc94800d`, mesh-controller-main `f2d7bc94800d`, mesh-host `ce1b97ad973d`, mesh-tools `18260ce9beca`
- `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery-forge-bridge, mesh-delivery-indexer)
- `mesh/repo-check`: **PASS** — its merge-check.sh passed
**Delivery plan** — builds mesh-delivery-forge-bridge, mesh-delivery-indexer → novox; no bus step
- tier 0: mesh-delivery-forge-bridge, mesh-delivery-indexer
- novox: receives mesh-delivery-forge-bridge, mesh-delivery-indexer
- read by no module's build: modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/integration_test.go, modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/main_test.go, modules/mesh-delivery-forge-bridge/internal/bridge/bridge_test.go, modules/mesh-delivery-forge-bridge/internal/bridge/files_test.go, modules/mesh-delivery-forge-bridge/manifest_test.go, modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go, modules/mesh-delivery-indexer/internal/index/candidate_manifests_test.go, modules/mesh-delivery-indexer/internal/index/inputs_test.go, modules/mesh-delivery-indexer/internal/index/manifests_test.go, modules/mesh-delivery-indexer/internal/index/newform_test.go, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-audit-logger.module.json, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-avahi.module.json, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-ca-trust.module.json, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-netcheck.module.json, modules/mesh-delivery-indexer/internal/index/testdata/controller-f2d7bc94-build-agent.module.json, modules/mesh-delivery-indexer/manifest_test.go
Run by the build seat on ace as `build-1792523843032273756` (`builds --log build-1792523843032273756`).
```
--- the gate: mesh-delivery-forge-bridge, mesh-delivery-indexer
mesh-delivery-forge-bridge: ok, invokes gitea.gitea_merge_pull_request, gitea.gitea_commit_status, gitea.gitea_delivery_view, gitea.gitea_note_append, gitea.gitea_add_comment, gitea.gitea_open_pulls, gitea.gitea_commit_trees, gitea.gitea_get_file, keeps state heads, performed, reads mesh-delivery-gate.merges, mesh-delivery-gate.owed, ready: bridge by unit every 30s
mesh-delivery-indexer: ok, keeps state candidates, manifests, modules, reads mesh-controller.builds, mesh-delivery-gate.source, ready: indexer by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 2 module(s) changed against 4 machine(s), as the snapshot of 2026-10-20T18:46:14Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 6 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-20T18:46:14Z
modules the change moves:
- mesh-delivery-forge-bridge (changed)
- mesh-delivery-indexer (changed)
machines:
- a machine (f35): composes
- holds mesh-dns-resolver (idt): composes
- holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
- a machine (yvbpsm): composes
a merge would rebuild 2 module(s) in 1 tier(s): mesh-delivery-forge-bridge, mesh-delivery-indexer
notes:
- modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/integration_test.go, modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/main_test.go, modules/mesh-delivery-forge-bridge/internal/bridge/bridge_test.go, modules/mesh-delivery-forge-bridge/internal/bridge/files_test.go, modules/mesh-delivery-forge-bridge/manifest_test.go, modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go, modules/mesh-delivery-indexer/internal/index/candidate_manifests_test.go, modules/mesh-delivery-indexer/internal/index/inputs_test.go, modules/mesh-delivery-indexer/internal/index/manifests_test.go, modules/mesh-delivery-indexer/internal/index/newform_test.go, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-audit-logger.module.json, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-avahi.module.json, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-ca-trust.module.json, modules/mesh-delivery-indexer/internal/index/testdata/catalogue-a67f0196-netcheck.module.json, modules/mesh-delivery-indexer/internal/index/testdata/controller-f2d7bc94-build-agent.module.json and modules/mesh-delivery-indexer/manifest_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
== ./modules/mesh-delivery-forge-bridge: go vet and the unit tests
ok mesh-delivery-forge-bridge 0.003s
ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge (cached)
ok mesh-delivery-forge-bridge/internal/bridge 0.198s
== ./modules/mesh-delivery-forge-bridge: the integration tests (-tags integration)
ok mesh-delivery-forge-bridge 0.002s
ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge 3.512s
ok mesh-delivery-forge-bridge/internal/bridge 0.198s
== ./modules/mesh-delivery-indexer: go vet and the unit tests
ok mesh-delivery-indexer 0.003s
ok mesh-delivery-indexer/cmd/mesh-delivery-indexer (cached)
ok mesh-delivery-indexer/internal/index 0.010s
== ./modules/mesh-delivery-indexer: the integration tests (-tags integration)
ok mesh-delivery-indexer 0.003s
ok mesh-delivery-indexer/cmd/mesh-delivery-indexer 0.435s
ok mesh-delivery-indexer/internal/index 0.009s
== ./modules/mesh-delivery-teller: go vet and the unit tests
ok mesh-delivery-teller 0.002s
ok mesh-delivery-teller/cmd/mesh-delivery-teller (cached)
== ./modules/mesh-delivery-teller: the integration tests (-tags integration)
ok mesh-delivery-teller 0.003s
ok mesh-delivery-teller/cmd/mesh-delivery-teller (cached)
== ./modules/mesh-delivery-view: go vet and the unit tests
ok mesh-delivery-view 0.003s
ok mesh-delivery-view/cmd/mesh-delivery-cli (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view (cached)
ok mesh-delivery-view/internal/view (cached)
== ./modules/mesh-delivery-view: the integration tests (-tags integration)
ok mesh-delivery-view 0.002s
ok mesh-delivery-view/cmd/mesh-delivery-cli (cached)
ok mesh-delivery-view/cmd/mesh-delivery-view (cached)
ok mesh-delivery-view/internal/view (cached)
== ./modules/mesh-delivery-watchman: go vet and the unit tests
ok mesh-delivery-watchman 0.002s
ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached)
ok mesh-delivery-watchman/internal/watch (cached)
== ./modules/mesh-delivery-watchman: the integration tests (-tags integration)
ok mesh-delivery-watchman 0.003s
ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached)
ok mesh-delivery-watchman/internal/watch (cached)
```
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Design 47 R4c's second delivery (ADR 0465 clauses 1-3, 5), one delivery group with mesh-controller's facts in format 2 (issue 1394) on the same branch name.
Both modules pin mesh-sdk 4024909a (mesh-sdk #50, delivered). Test fixtures are real manifests copied server-side from mesh-catalog a67f0196 and mesh-controller f2d7bc94. Tries: build-1792522618026311210 (
f69a561a) and build-1792523185056657850 (c9f742d5) passed. Opened in review: 1458 (the message's size half stays open), 1459 (TypeScript modules commit no lock file; a decision before the build modules).Reviewed-by: review-r4c2@shanks at
c9f742d5f2Delivery
novox/mesh-delivery@c9f742d5f20e— delivered since 2026-10-20T19:34:41ZDelivery plan — builds mesh-delivery-forge-bridge, mesh-delivery-indexer → novox; no bus step
Group
feat/r4c2-new-keys: novox/mesh-controller@e7c6abfd0e, novox/mesh-delivery@c9f742d5f2Machines
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.Merge check at
c9f742d5Judged: head
c9f742d5f20emerged into trunk2520cc4a88f7; read beside it: mesh-catalog809dd76973fd, mesh-controllerf2d7bc94800d, mesh-controller-mainf2d7bc94800d, mesh-hostce1b97ad973d, mesh-tools18260ce9becamesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery-forge-bridge, mesh-delivery-indexer)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds mesh-delivery-forge-bridge, mesh-delivery-indexer → novox; no bus step
Run by the build seat on ace as
build-1792523843032273756(builds --log build-1792523843032273756).