genesis: seal the build agent the forge it raised, in place of the builder's npm-password (hq issue 121, ADR 0336) #102

Merged

mesh-admin merged 1 commits from fix/121-genesis-package-registry into main 2026-10-13 03:37:15 +00:00

Conversation 4 Commits 1 Files Changed 4

+120 -60

mesh-admin commented 2026-10-13 00:56:38 +00:00

Contributor

Copy Link

Copy Source

What

• The packages step (14) seals the genesis-package-registry own-secret to the build agent (BuilderModule, build-agent since #101): secret accept <node> build-agent genesis-package-registry, then push. The document is JSON with scheme http, at 127.0.0.1, the port given for the package registry (--packages-port), npm path /api/packages/novox/npm/, account mesh-builder and its password (ADR 0336 §3). mesh-controller's cmd/mesh-builder reads the same field names.
• deliverBuilderNpm and its npm-password own-secret are gone, and setFoundationSettings no longer gives the builder a serves.port setting (ServesSetting removed). The build agent declares neither.

Tests

• internal/bootstrap/genesis_registry_test.go: the document carried has the given port 3100, account and password, and is accepted for build-agent before the push; installing the build agent on a non-default packages port gives it no settings file, and nothing says npm-password or serves. Fails on main (no such step; the builder got {"serves":{"port":3100}}).
• Removed TestTheBuildersPackageRegistryPortIsASettingAndNotTheManifest, which pinned the serves setting.
• go vet, go test -race ./internal/bootstrap, sh merge-check.sh: pass.

Rebased on main after #101 (issue 596) merged; the one conflict (that removed test, which #101 had edited) is resolved by dropping it.

Fixes issue 121 (with mesh-catalog #263 and mesh-controller #289).

## What - The packages step (14) seals the `genesis-package-registry` own-secret to the build agent (`BuilderModule`, `build-agent` since #101): `secret accept <node> build-agent genesis-package-registry`, then push. The document is JSON with scheme http, at 127.0.0.1, the port given for the package registry (`--packages-port`), npm path `/api/packages/novox/npm/`, account `mesh-builder` and its password (ADR 0336 §3). mesh-controller's cmd/mesh-builder reads the same field names. - `deliverBuilderNpm` and its `npm-password` own-secret are gone, and `setFoundationSettings` no longer gives the builder a `serves.port` setting (`ServesSetting` removed). The build agent declares neither. ## Tests - `internal/bootstrap/genesis_registry_test.go`: the document carried has the given port 3100, account and password, and is accepted for build-agent before the push; installing the build agent on a non-default packages port gives it no settings file, and nothing says `npm-password` or `serves`. Fails on main (no such step; the builder got `{"serves":{"port":3100}}`). - Removed `TestTheBuildersPackageRegistryPortIsASettingAndNotTheManifest`, which pinned the serves setting. - `go vet`, `go test -race ./internal/bootstrap`, `sh merge-check.sh`: pass. Rebased on main after #101 (issue 596) merged; the one conflict (that removed test, which #101 had edited) is resolved by dropping it. Fixes issue 121 (with mesh-catalog #263 and mesh-controller #289).

mesh-admin commented 2026-10-13 00:56:56 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at 6f13813a
Judged: head 6f13813a59dc merged into trunk 0d11b4fc930d

• mesh/merge-gate: FAIL — head 6f13813a59 does not merge cleanly into trunk 0d11b4fc93: in conflict internal/bootstrap/builder_test.go
• mesh/repo-check: FAIL — head 6f13813a59 does not merge cleanly into trunk 0d11b4fc93: in conflict internal/bootstrap/builder_test.go

Run by the build seat on g14 as build-1791853013578746780 (builds --log build-1791853013578746780).

head 6f13813a59dc does not merge cleanly into trunk 0d11b4fc930d: in conflict internal/bootstrap/builder_test.go

**Merge check** at `6f13813a` Judged: head `6f13813a59dc` merged into trunk `0d11b4fc930d` - `mesh/merge-gate`: **FAIL** — head 6f13813a59dc does not merge cleanly into trunk 0d11b4fc930d: in conflict internal/bootstrap/builder_test.go - `mesh/repo-check`: **FAIL** — head 6f13813a59dc does not merge cleanly into trunk 0d11b4fc930d: in conflict internal/bootstrap/builder_test.go Run by the build seat on g14 as `build-1791853013578746780` (`builds --log build-1791853013578746780`). ``` head 6f13813a59dc does not merge cleanly into trunk 0d11b4fc930d: in conflict internal/bootstrap/builder_test.go ```

mesh-admin commented 2026-10-13 00:56:59 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-host@5f147fe6b9c7 — delivered since 2026-10-13T03:37:35Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Group fix/121-genesis-package-registry, in order: novox/hq@39830983cc → novox/mesh-host@5f147fe6b9

• novox/mesh-catalog@e0bc919d49 before novox/mesh-controller@a641ed7d15: built by
• novox/mesh-controller@a641ed7d15 before novox/mesh-catalog@e0bc919d49: built by
• refused: novox/mesh-catalog@e0bc919d49 and novox/mesh-controller@a641ed7d15: built by puts novox/mesh-catalog@e0bc919d49 first, built by puts novox/mesh-controller@a641ed7d15 first, version skew puts novox/mesh-controller@a641ed7d15 first; neither outranks the other: declare the order with a line after: novox/mesh-catalog in novox/mesh-controller#289's description, or after: novox/mesh-controller in novox/mesh-catalog#263's

Transitions

• 2026-10-13 01:02 (new) → proposed (announced): novox/mesh-host#102's head announced
• 2026-10-13 01:03 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-13 01:03 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-13 03:37 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-13 03:37 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-host@5f147fe6b9c7` — **delivered** since 2026-10-13T03:37:35Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Group** `fix/121-genesis-package-registry`, in order: novox/hq@39830983ccf1 → novox/mesh-host@5f147fe6b9c7 - novox/mesh-catalog@e0bc919d4945 before novox/mesh-controller@a641ed7d15c7: built by - novox/mesh-controller@a641ed7d15c7 before novox/mesh-catalog@e0bc919d4945: built by - **refused**: novox/mesh-catalog@e0bc919d4945 and novox/mesh-controller@a641ed7d15c7: built by puts novox/mesh-catalog@e0bc919d4945 first, built by puts novox/mesh-controller@a641ed7d15c7 first, version skew puts novox/mesh-controller@a641ed7d15c7 first; neither outranks the other: declare the order with a line `after: novox/mesh-catalog` in novox/mesh-controller#289's description, or `after: novox/mesh-controller` in novox/mesh-catalog#263's **Transitions** - 2026-10-13 01:02 (new) → proposed (announced): novox/mesh-host#102's head announced - 2026-10-13 01:03 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-13 01:03 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-13 03:37 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-13 03:37 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben added 1 commit 2026-10-13 01:02:11 +00:00

Seal the build agent the forge genesis raised, in place of the builder's npm-password (hq issue 121, ADR 0336) ... 5f147fe6b9

The build agent declares neither the retired builder's npm-password own-secret
nor a serves setting, so the packages step handed its credential to nothing
and genesis's sdk step had no way to publish. The packages step now seals the
genesis-package-registry own-secret to build-agent: the forge on this node's
loopback, the port given for the package registry, its npm path, and the
mesh-builder account with its password. setFoundationSettings no longer gives
the builder a serves.port.

jschoubben force-pushed fix/121-genesis-package-registry from 6f13813a59 to 5f147fe6b9 2026-10-13 01:02:11 +00:00 Compare

mesh-admin reviewed 2026-10-13 03:32:37 +00:00

mesh-admin left a comment

Author

Contributor

Copy Link

Copy Source

Verdict: approve at 5f147fe6b9

Independent review against ADR 0336 §3 and §7.

No blocking finding. The one precondition is outside the code: merge in the group fix/121-genesis-package-registry once mesh/delivery-group reads green. At genesis, secret accept <node> build-agent genesis-package-registry needs a catalogue that declares that own-secret, which mesh-catalog #263 adds.

What I checked:

1. The packages step does what §3 says. After raising the forge and creating mesh-builder, it seals one JSON document to build-agent as the own-secret genesis-package-registry: scheme http, at 127.0.0.1, the port this node gave the package registry, /api/packages/novox/npm/, the account, and its password. It is carried in, accepted, and pushed before the sdk step. The field names match mesh-controller #289's GenesisRegistry exactly. The loopback address works because the builder runs package publishes and installs with --network host.
2. npm-password and the builder's serves.port are gone. deliverBuilderNpm, ServesSetting and the serves branch of setFoundationSettings are removed, and no reference to them is left in the code.
3. Tests fail without the change. With main's phase_packages.go and ports.go, the new tests do not compile (genesisRegistry, deliverGenesisRegistry, GenesisRegistrySecret, GenesisRegistry are new). With only main's ports.go restored, TestNoStepGivesTheBuildAgentAServesSettingOrAnNpmPassword fails with "build-agent was given a setting on a node with a non-default packages port: {"serves":{"port":3100}}". At the head, go vet and go test ./internal/bootstrap pass, and sh merge-check.sh passes.

Non-blocking:

• TestNoStepGivesTheBuildAgentAServesSettingOrAnNpmPassword loops over a one-element list. A plain body would read more simply.
• The removed test TestTheBuildersPackageRegistryPortIsASettingAndNotTheManifest also held that the installer does not rewrite the manifest it registers. That property is still held for the default port by TestTheBuilderOnTheDefaultPackagesPortIsToldNothing only if that test checks the manifest. I did not confirm that it does, and it is worth a line.
• Not yet proved live: no genesis bed has passed steps 13 to 16. ADR 0336's How it is checked names this as the mesh-lab check, and to-be 17 in hq #337 says so honestly.

Statuses at this head:

• mesh/merge-gate: success, "head 5f147fe6b9 merged into trunk 0d11b4fc93 — pass: the change touches no module of the mesh's graph"
• mesh/repo-check: success, "head 5f147fe6b9 merged into trunk 0d11b4fc93 — pass: its merge-check.sh passed"
• mesh/delivery: success, "ready: it delivers once merged"
• mesh/delivery-group: no status on this head. The group as a whole reads rejected (see mesh-controller #289).

Verdict: approve at 5f147fe6b9c7d429e15e8d45592c8a1ef851aeea Independent review against ADR 0336 §3 and §7. No blocking finding. The one precondition is outside the code: merge in the group fix/121-genesis-package-registry once mesh/delivery-group reads green. At genesis, `secret accept <node> build-agent genesis-package-registry` needs a catalogue that declares that own-secret, which mesh-catalog #263 adds. What I checked: 1. The packages step does what §3 says. After raising the forge and creating `mesh-builder`, it seals one JSON document to `build-agent` as the own-secret `genesis-package-registry`: scheme http, at 127.0.0.1, the port this node gave the package registry, `/api/packages/novox/npm/`, the account, and its password. It is carried in, accepted, and pushed before the sdk step. The field names match mesh-controller #289's GenesisRegistry exactly. The loopback address works because the builder runs package publishes and installs with `--network host`. 2. `npm-password` and the builder's `serves.port` are gone. `deliverBuilderNpm`, `ServesSetting` and the `serves` branch of `setFoundationSettings` are removed, and no reference to them is left in the code. 3. Tests fail without the change. With main's phase_packages.go and ports.go, the new tests do not compile (genesisRegistry, deliverGenesisRegistry, GenesisRegistrySecret, GenesisRegistry are new). With only main's ports.go restored, TestNoStepGivesTheBuildAgentAServesSettingOrAnNpmPassword fails with "build-agent was given a setting on a node with a non-default packages port: {\"serves\":{\"port\":3100}}". At the head, `go vet` and `go test ./internal/bootstrap` pass, and `sh merge-check.sh` passes. Non-blocking: - TestNoStepGivesTheBuildAgentAServesSettingOrAnNpmPassword loops over a one-element list. A plain body would read more simply. - The removed test TestTheBuildersPackageRegistryPortIsASettingAndNotTheManifest also held that the installer does not rewrite the manifest it registers. That property is still held for the default port by TestTheBuilderOnTheDefaultPackagesPortIsToldNothing only if that test checks the manifest. I did not confirm that it does, and it is worth a line. - Not yet proved live: no genesis bed has passed steps 13 to 16. ADR 0336's How it is checked names this as the mesh-lab check, and to-be 17 in hq #337 says so honestly. Statuses at this head: - mesh/merge-gate: success, "head 5f147fe6b9c7 merged into trunk 0d11b4fc930d — pass: the change touches no module of the mesh's graph" - mesh/repo-check: success, "head 5f147fe6b9c7 merged into trunk 0d11b4fc930d — pass: its merge-check.sh passed" - mesh/delivery: success, "ready: it delivers once merged" - mesh/delivery-group: no status on this head. The group as a whole reads rejected (see mesh-controller #289).

mesh-admin commented 2026-10-13 03:32:48 +00:00

Author

Contributor

Copy Link

Copy Source

A follow-up to my review at 5f147fe6b9, settling the point I left open there. I checked it: TestTheBuilderOnTheDefaultPackagesPortIsToldNothing asserts only that no setting is told, and no other test in internal/bootstrap reads the manifest the installer registers. Removing TestTheBuildersPackageRegistryPortIsASettingAndNotTheManifest therefore drops the only assertion that the installer registers the build agent's manifest unchanged. This is still not blocking. One line in the remaining test, comparing c.settings[BuilderModule+"-module.json"] with the manifest given, would keep it. The verdict is unchanged: approve.

A follow-up to my review at 5f147fe6b9c7d429e15e8d45592c8a1ef851aeea, settling the point I left open there. I checked it: TestTheBuilderOnTheDefaultPackagesPortIsToldNothing asserts only that no setting is told, and no other test in internal/bootstrap reads the manifest the installer registers. Removing TestTheBuildersPackageRegistryPortIsASettingAndNotTheManifest therefore drops the only assertion that the installer registers the build agent's manifest unchanged. This is still not blocking. One line in the remaining test, comparing c.settings[BuilderModule+"-module.json"] with the manifest given, would keep it. The verdict is unchanged: approve.

mesh-admin merged commit 64f0ab4051 into main 2026-10-13 03:37:15 +00:00

mesh-admin deleted branch fix/121-genesis-package-registry 2026-10-13 03:37:16 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

mesh-admin

Labels

No items

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

jschoubben miel.truyen

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#102