Add the builder that builds each fingerprint's bundles and archives on two build nodes beside build-agent, and have the indexer write a module's path and toolchains (R4c-4: issues 1606, 1607, 1615) #12

2026-10-21T11:23:25Z

mesh-tools commented

2026-10-21 11:23:25 +00:00

Design 47 R4c-4, ADR 0478 (accepted v11), running dark beside build-agent.

mesh-delivery-indexer writes each module's Path ('.' for a repository root) and the toolchains each fingerprint was computed with (issues 1606, 1615).
mesh-delivery-builder (issue 1607): claims a fingerprint's build key by create, then compare-and-set; builds bundles and archives through the build module of their language (an archive needs no toolchain, §1); refuses image, upstream and package kinds with 'refused kind:' (§2); chooses nodes by the agreed toolchain, presence and a healthy build module (node-engine_have), then fewest lanes under each node's build capacity, reserving at choice and waiting on a watch with no timer (§3); builds on two nodes, 'digests differ:' fails and is never retaken, a 'one node' done key is built again when a second node qualifies (§4); one instance (§5); takes over every key found 'building' at start (§6); archives stay on the build node, the key names the digest only (§7).
Integration tests start the builder whole against a real bus.

Try: build-1792581339137779518 passed at bfc64ac65e.

Issue 1607 AC7 ('a second instance not building twice'): two instances started together may both build, the second compare-and-set is refused, so one done key is written; ADR 0478 §5/§6 rest on one instance.
Later issues: 1660, 1661, 1664, 1655.

Fixes issues 1606, 1607 (and the builder side of 1615).

Reviewed-by: reviewer-r4c4@shanks at bfc64ac65e

Design 47 R4c-4, ADR 0478 (accepted v11), running dark beside build-agent. - mesh-delivery-indexer writes each module's Path ('.' for a repository root) and the toolchains each fingerprint was computed with (issues 1606, 1615). - mesh-delivery-builder (issue 1607): claims a fingerprint's build key by create, then compare-and-set; builds bundles and archives through the build module of their language (an archive needs no toolchain, §1); refuses image, upstream and package kinds with 'refused kind:' (§2); chooses nodes by the agreed toolchain, presence and a healthy build module (node-engine_have), then fewest lanes under each node's build capacity, reserving at choice and waiting on a watch with no timer (§3); builds on two nodes, 'digests differ:' fails and is never retaken, a 'one node' done key is built again when a second node qualifies (§4); one instance (§5); takes over every key found 'building' at start (§6); archives stay on the build node, the key names the digest only (§7). - Integration tests start the builder whole against a real bus. Try: build-1792581339137779518 passed at bfc64ac65ea1af14f3feddf4e3b7dad85219d909. Issue 1607 AC7 ('a second instance not building twice'): two instances started together may both build, the second compare-and-set is refused, so one done key is written; ADR 0478 §5/§6 rest on one instance. Later issues: 1660, 1661, 1664, 1655. Fixes issues 1606, 1607 (and the builder side of 1615). Reviewed-by: reviewer-r4c4@shanks at bfc64ac65ea1af14f3feddf4e3b7dad85219d909

mesh-tools added 14 commits 2026-10-21 11:23:26 +00:00

The indexer writes each module's directory into modules.<m> and keeps it (issue 1606, ADR 0478 clause 8) 07a28b03c4

Add the builder part: its manifest, its credential and its bus connection (issue 1607, AC1) c3804b012f

Plan a manifest's artifacts for the build modules and refuse image, upstream and package by kind (issue 1607, AC2) 87e550681f

Claim a build key by create and compare-and-set, never twice, retry a failed key except a refused kind (issue 1607, AC3) 1e6d00b4c7

Choose build nodes by the agreed toolchain and fewest running steps, and agree the two nodes' digests (issue 1607, AC4) 74d11f95a2

Run a build module's long step: call it on its node, read the result at its steps key, bound the wait (issue 1607, AC5) 3298ad58d3

Watch the build modules' toolchains and steps and keep the toolchains by node, with no timer (issue 1607, AC6) 71bb5a5fb3

Build each new-form fingerprint through the build modules on two nodes and write its key done or failed (issue 1607, AC7, AC8) 46c9f33d64

Test the builder whole over the real bus with fake build modules, and look again at a value that arrives while its key is built (issue 1607, AC6, AC7) 0b0cfb6e37

The indexer writes '.' for a root module's path and the toolchains each fingerprint was computed with (issue 1615) 3bd2a065f9

Build a key only with the toolchain its fingerprint names, accept '.' as a root module's path, and choose only online nodes (issues 1615, 1607 review) f555a05cfb

Run at most a node's build capacity of build steps on it at once, and hold a step back for a place with no timer (issue 1607, round 3) 27e4c3891f

Move the indexer and builder to mesh-sdk main with the toolchains and root path (issue 1615) ebac167cd6

Build an archive with no toolchain, mark digests that differ and a one-node key so each is handled, reserve a place when a node is chosen, choose only nodes whose build module is healthy, and take over any key found building (issue 1607, review round 4)

mesh/merge-gate head bfc64ac65ea1 merged into trunk 26de6bc62558 — pass: builds mesh-delivery-indexer, new: modules/mesh-delivery-builder → novox; no bus s…

Details

mesh/repo-check head bfc64ac65ea1 merged into trunk 26de6bc62558 — pass: its merge-check.sh passed

Details

mesh/delivery delivered

Details

bfc64ac65e

mesh-tools commented

2026-10-21 11:23:31 +00:00

Delivery novox/mesh-delivery@bfc64ac65ea1 — delivered since 2026-10-21T11:35:55Z

Delivery plan — builds mesh-delivery-indexer, new: modules/mesh-delivery-builder → novox; no bus step

tier 0: mesh-delivery-indexer
novox: receives mesh-delivery-indexer

Machines

mesh-delivery-indexer on every machine running it: sent

Transitions

2026-10-21 11:23 (new) → proposed (announced): novox/mesh-delivery#12's head announced
2026-10-21 11:30 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
2026-10-21 11:30 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-21 11:31 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-21 11:31 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
2026-10-21 11:35 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-delivery@bfc64ac65ea1` — **delivered** since 2026-10-21T11:35:55Z **Delivery plan** — builds mesh-delivery-indexer, new: modules/mesh-delivery-builder → novox; no bus step - tier 0: mesh-delivery-indexer - novox: receives mesh-delivery-indexer **Machines** - mesh-delivery-indexer on every machine running it: sent **Transitions** - 2026-10-21 11:23 (new) → proposed (announced): novox/mesh-delivery#12's head announced - 2026-10-21 11:30 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 11:30 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 11:31 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-21 11:31 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 11:35 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-21 11:30:17 +00:00

Merge check at bfc64ac6
Judged: head bfc64ac65ea1 merged into trunk 26de6bc62558; read beside it: mesh-catalog d74c1cb995a4, mesh-controller cada7e3c8374, mesh-controller-main cada7e3c8374, mesh-host c5c4caa2a4ab, mesh-tools e0fadc43d9dd

mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery-indexer, new:modules/mesh-delivery-builder)
mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds mesh-delivery-indexer, new: modules/mesh-delivery-builder → novox; no bus step

tier 0: mesh-delivery-indexer
novox: receives mesh-delivery-indexer
read by no module's build: modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go, modules/mesh-delivery-indexer/internal/index/modules_test.go, modules/mesh-delivery-indexer/internal/index/source_test.go, modules/mesh-delivery-indexer/internal/index/toolchains_test.go

Run by the build seat on ace as build-1792581817642267498 (builds --log build-1792581817642267498).

--- the gate: mesh-delivery-indexer, new:modules/mesh-delivery-builder
mesh-delivery-builder: ok, invokes mesh-build-go.build_go_build, mesh-build-go.build_go_fetch, mesh-build-node.build_node_build, mesh-build-node.build_node_fetch, keeps state builds, reads mesh-build-go.steps, mesh-build-go.toolchains, mesh-build-node.steps, mesh-build-node.toolchains, mesh-delivery-indexer.manifests, mesh-delivery-indexer.modules, mesh-delivery-watchman.presence, node-engine.have, ready: builder by unit every 30s
mesh-delivery-indexer: ok, keeps state candidates, manifests, modules, reads mesh-build-go.toolchains, mesh-build-node.toolchains, mesh-controller.builds, mesh-delivery-gate.source, ready: indexer by unit every 30s
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T11:11:29Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T11:11:29Z

modules the change moves:
  - mesh-delivery-builder (added)

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-delivery-indexer

notes:
  - mesh-delivery-builder could not be tried on a machine: mesh-delivery-builder on f35 has no bus credential: nothing was issued for f35.mesh-delivery-builder, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue mesh-delivery-builder --node f35`, then push again
  - modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go, modules/mesh-delivery-indexer/internal/index/modules_test.go, modules/mesh-delivery-indexer/internal/index/source_test.go and modules/mesh-delivery-indexer/internal/index/toolchains_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
== ./modules/mesh-delivery-builder: go vet and the unit tests
ok  	mesh-delivery-builder	0.003s
?   	mesh-delivery-builder/cmd/mesh-delivery-builder	[no test files]
ok  	mesh-delivery-builder/internal/build	(cached)
== ./modules/mesh-delivery-builder: the integration tests (-tags integration)
ok  	mesh-delivery-builder	0.003s
ok  	mesh-delivery-builder/cmd/mesh-delivery-builder	1.848s
ok  	mesh-delivery-builder/internal/build	(cached)
== ./modules/mesh-delivery-forge-bridge: go vet and the unit tests
ok  	mesh-delivery-forge-bridge	0.003s
ok  	mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge	(cached)
ok  	mesh-delivery-forge-bridge/internal/bridge	0.197s
== ./modules/mesh-delivery-forge-bridge: the integration tests (-tags integration)
ok  	mesh-delivery-forge-bridge	0.002s
ok  	mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge	3.622s
ok  	mesh-delivery-forge-bridge/internal/bridge	0.197s
== ./modules/mesh-delivery-indexer: go vet and the unit tests
ok  	mesh-delivery-indexer	0.003s
ok  	mesh-delivery-indexer/cmd/mesh-delivery-indexer	(cached)
ok  	mesh-delivery-indexer/internal/index	0.063s
== ./modules/mesh-delivery-indexer: the integration tests (-tags integration)
ok  	mesh-delivery-indexer	0.003s
ok  	mesh-delivery-indexer/cmd/mesh-delivery-indexer	5.988s
ok  	mesh-delivery-indexer/internal/index	0.030s
== ./modules/mesh-delivery-teller: go vet and the unit tests
ok  	mesh-delivery-teller	0.002s
ok  	mesh-delivery-teller/cmd/mesh-delivery-teller	(cached)
== ./modules/mesh-delivery-teller: the integration tests (-tags integration)
ok  	mesh-delivery-teller	0.002s
ok  	mesh-delivery-teller/cmd/mesh-delivery-teller	(cached)
== ./modules/mesh-delivery-view: go vet and the unit tests
ok  	mesh-delivery-view	0.002s
ok  	mesh-delivery-view/cmd/mesh-delivery-cli	(cached)
ok  	mesh-delivery-view/cmd/mesh-delivery-view	(cached)
ok  	mesh-delivery-view/internal/view	(cached)
== ./modules/mesh-delivery-view: the integration tests (-tags integration)
ok  	mesh-delivery-view	0.003s
ok  	mesh-delivery-view/cmd/mesh-delivery-cli	(cached)
ok  	mesh-delivery-view/cmd/mesh-delivery-view	(cached)
ok  	mesh-delivery-view/internal/view	(cached)
== ./modules/mesh-delivery-watchman: go vet and the unit tests
ok  	mesh-delivery-watchman	0.002s
ok  	mesh-delivery-watchman/cmd/mesh-delivery-watchman	(cached)
ok  	mesh-delivery-watchman/internal/watch	(cached)
== ./modules/mesh-delivery-watchman: the integration tests (-tags integration)
ok  	mesh-delivery-watchman	0.002s
ok  	mesh-delivery-watchman/cmd/mesh-delivery-watchman	(cached)
ok  	mesh-delivery-watchman/internal/watch	(cached)

**Merge check** at `bfc64ac6` Judged: head `bfc64ac65ea1` merged into trunk `26de6bc62558`; read beside it: mesh-catalog `d74c1cb995a4`, mesh-controller `cada7e3c8374`, mesh-controller-main `cada7e3c8374`, mesh-host `c5c4caa2a4ab`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-delivery-indexer, new:modules/mesh-delivery-builder) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds mesh-delivery-indexer, new: modules/mesh-delivery-builder → novox; no bus step - tier 0: mesh-delivery-indexer - novox: receives mesh-delivery-indexer - read by no module's build: modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go, modules/mesh-delivery-indexer/internal/index/modules_test.go, modules/mesh-delivery-indexer/internal/index/source_test.go, modules/mesh-delivery-indexer/internal/index/toolchains_test.go Run by the build seat on ace as `build-1792581817642267498` (`builds --log build-1792581817642267498`). ``` --- the gate: mesh-delivery-indexer, new:modules/mesh-delivery-builder mesh-delivery-builder: ok, invokes mesh-build-go.build_go_build, mesh-build-go.build_go_fetch, mesh-build-node.build_node_build, mesh-build-node.build_node_fetch, keeps state builds, reads mesh-build-go.steps, mesh-build-go.toolchains, mesh-build-node.steps, mesh-build-node.toolchains, mesh-delivery-indexer.manifests, mesh-delivery-indexer.modules, mesh-delivery-watchman.presence, node-engine.have, ready: builder by unit every 30s mesh-delivery-indexer: ok, keeps state candidates, manifests, modules, reads mesh-build-go.toolchains, mesh-build-node.toolchains, mesh-controller.builds, mesh-delivery-gate.source, ready: indexer by unit every 30s long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 2 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 1 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T11:11:29Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-21T11:11:29Z modules the change moves: - mesh-delivery-builder (added) machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-delivery-indexer notes: - mesh-delivery-builder could not be tried on a machine: mesh-delivery-builder on f35 has no bus credential: nothing was issued for f35.mesh-delivery-builder, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue mesh-delivery-builder --node f35`, then push again - modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go, modules/mesh-delivery-indexer/internal/index/modules_test.go, modules/mesh-delivery-indexer/internal/index/source_test.go and modules/mesh-delivery-indexer/internal/index/toolchains_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) == ./modules/mesh-delivery-builder: go vet and the unit tests ok mesh-delivery-builder 0.003s ? mesh-delivery-builder/cmd/mesh-delivery-builder [no test files] ok mesh-delivery-builder/internal/build (cached) == ./modules/mesh-delivery-builder: the integration tests (-tags integration) ok mesh-delivery-builder 0.003s ok mesh-delivery-builder/cmd/mesh-delivery-builder 1.848s ok mesh-delivery-builder/internal/build (cached) == ./modules/mesh-delivery-forge-bridge: go vet and the unit tests ok mesh-delivery-forge-bridge 0.003s ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge (cached) ok mesh-delivery-forge-bridge/internal/bridge 0.197s == ./modules/mesh-delivery-forge-bridge: the integration tests (-tags integration) ok mesh-delivery-forge-bridge 0.002s ok mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge 3.622s ok mesh-delivery-forge-bridge/internal/bridge 0.197s == ./modules/mesh-delivery-indexer: go vet and the unit tests ok mesh-delivery-indexer 0.003s ok mesh-delivery-indexer/cmd/mesh-delivery-indexer (cached) ok mesh-delivery-indexer/internal/index 0.063s == ./modules/mesh-delivery-indexer: the integration tests (-tags integration) ok mesh-delivery-indexer 0.003s ok mesh-delivery-indexer/cmd/mesh-delivery-indexer 5.988s ok mesh-delivery-indexer/internal/index 0.030s == ./modules/mesh-delivery-teller: go vet and the unit tests ok mesh-delivery-teller 0.002s ok mesh-delivery-teller/cmd/mesh-delivery-teller (cached) == ./modules/mesh-delivery-teller: the integration tests (-tags integration) ok mesh-delivery-teller 0.002s ok mesh-delivery-teller/cmd/mesh-delivery-teller (cached) == ./modules/mesh-delivery-view: go vet and the unit tests ok mesh-delivery-view 0.002s ok mesh-delivery-view/cmd/mesh-delivery-cli (cached) ok mesh-delivery-view/cmd/mesh-delivery-view (cached) ok mesh-delivery-view/internal/view (cached) == ./modules/mesh-delivery-view: the integration tests (-tags integration) ok mesh-delivery-view 0.003s ok mesh-delivery-view/cmd/mesh-delivery-cli (cached) ok mesh-delivery-view/cmd/mesh-delivery-view (cached) ok mesh-delivery-view/internal/view (cached) == ./modules/mesh-delivery-watchman: go vet and the unit tests ok mesh-delivery-watchman 0.002s ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached) ok mesh-delivery-watchman/internal/watch (cached) == ./modules/mesh-delivery-watchman: the integration tests (-tags integration) ok mesh-delivery-watchman 0.002s ok mesh-delivery-watchman/cmd/mesh-delivery-watchman (cached) ok mesh-delivery-watchman/internal/watch (cached) ```

mesh-tools merged commit d68d7ef3d9 into main

2026-10-21 11:31:05 +00:00

mesh-tools deleted branch feat/r4c4-builder

2026-10-21 11:31:06 +00:00

mesh-tools referenced this pull request

2026-10-21 11:59:36 +00:00

Make the builder's build capacity a setting per node, hold a failed second-node build until the nodes change, and close keys left building for a vanished fingerprint (issues 1661, 1664, 1660) #14

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-delivery#12