novox/mesh-host
13
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

A directory says how it reacts to files it does not know; the node-engine moves out what a move-out directory does not know (issue 1024) #117

Merged
mesh-tools merged 2 commits from feat/owned-paths into main 2026-10-17 16:20:06 +00:00
Conversation 4 Commits 2 Files Changed 12
+1089
mesh-tools commented 2026-10-17 16:09:50 +00:00
Member
Copy Link
Copy Source

Issue 1024, ADR 0422 (accepted 2026-10-17, on ADR 0416). Release 1 of 2 of feature owned-paths: the catalogue's manifests use the words only after this is delivered.

  • directory and archive resources take unknown (move-out, module, program) and knows; bad forms are refused at decode.
  • For move-out under a home, after each apply and every reconcile, each path the declaration does not know (not declared, not unpacked, not in knows, not a parent of those) is moved whole into ~/.local/state/mesh-moved/<module>/<UTC time>/, with <UTC time>.json listing each move before it is made. No link followed (Renameat2 through the home-safe helpers); a path changed under a minute ago waits; a socket, pipe or device is left and reported; nothing is made when nothing moved; another file system fails the resource; move-out outside a home fails the resource, nothing moved. The report carries moved-out and left.
  • Acceptance: TestAMoveOutDirectoryKeepsOnlyWhatItKnows drives the node-engine through its command, as root and as a normal user.

Reviewed in two rounds (approved at the reviewed tree 22e6c427, equal to this head's tree). Not in scope, opened: issue 1036 (edges of move-out).

Issue 1024, ADR 0422 (accepted 2026-10-17, on ADR 0416). Release 1 of 2 of feature owned-paths: the catalogue's manifests use the words only after this is delivered. - `directory` and `archive` resources take `unknown` (`move-out`, `module`, `program`) and `knows`; bad forms are refused at decode. - For `move-out` under a home, after each apply and every reconcile, each path the declaration does not know (not declared, not unpacked, not in `knows`, not a parent of those) is moved whole into `~/.local/state/mesh-moved/<module>/<UTC time>/`, with `<UTC time>.json` listing each move before it is made. No link followed (Renameat2 through the home-safe helpers); a path changed under a minute ago waits; a socket, pipe or device is left and reported; nothing is made when nothing moved; another file system fails the resource; `move-out` outside a home fails the resource, nothing moved. The report carries `moved-out` and `left`. - Acceptance: `TestAMoveOutDirectoryKeepsOnlyWhatItKnows` drives the node-engine through its command, as root and as a normal user. Reviewed in two rounds (approved at the reviewed tree 22e6c427, equal to this head's tree). Not in scope, opened: issue 1036 (edges of move-out).
mesh-tools added 1 commit 2026-10-17 16:09:50 +00:00
Let a directory say how it reacts to files it does not know, and move out what a move-out directory does not know (issue 1024, ADR 0422)
mesh/merge-gate head d237dee4c9e3 merged into trunk cd13f7726ef0 — pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes wi…
Details
mesh/repo-check head d237dee4c9e3 merged into trunk cd13f7726ef0 — fail: its merge-check.sh failed: --- FAIL: TestAMoveOutDirectoryKeepsOnlyWhatItKnows (0.…
Details
mesh/delivery superseded: a newer head of the same pull request
Details
d237dee4c9 
A directory or archive resource carries `unknown` (move-out, module, program) and `knows`. For move-out under a home, every look moves each path the declaration does not know into ~/.local/state/mesh-moved/<module>/<time>/, the list written before each move, without following a link, a young path waiting, a socket or pipe left and reported, nothing made when nothing moved, and another file system refused. Reviewed in two rounds.
mesh-tools commented 2026-10-17 16:09:53 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-host@dae79c76434c — delivered since 2026-10-17T16:22:11Z

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine

Machines

  • mesh-host on every machine running it: sent

Transitions

  • 2026-10-17 16:16 (new) → proposed (announced): novox/mesh-host#117's head announced
  • 2026-10-17 16:19 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-17 16:19 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-17 16:20 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-17 16:20 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-17 16:22 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-host@dae79c76434c` — **delivered** since 2026-10-17T16:22:11Z **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine **Machines** - mesh-host on every machine running it: sent **Transitions** - 2026-10-17 16:16 (new) → proposed (announced): novox/mesh-host#117's head announced - 2026-10-17 16:19 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-17 16:19 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-17 16:20 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-17 16:20 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-17 16:22 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools commented 2026-10-17 16:13:20 +00:00
Author
Member
Copy Link
Copy Source

Merge check at d237dee4
Judged: head d237dee4c9e3 merged into trunk cd13f7726ef0; read beside it: mesh-catalog 54b3ce503e79, mesh-controller c43772fd94eb, mesh-controller-main c43772fd94eb, mesh-tools 7412c5b6c9c5

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)
  • mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestAMoveOutDirectoryKeepsOnlyWhatItKnows (0.00s)

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine
  • read by no module's build: README.md, cmd/mesh-host/move_out_test.go, internal/apply/move_out_test.go, internal/declaration/declaration_test.go

Run by the build seat on shanks as build-1792253391805147272 (builds --log build-1792253391805147272).

--- the gate: mesh-host
mesh-host: ok
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-17T16:03:34Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-17T16:03:34Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host

notes:
  - README.md, cmd/mesh-host/move_out_test.go, internal/apply/move_out_test.go and internal/declaration/declaration_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.016s

this machine's tunnel key, made here; the private half stays in /tmp/TestKeyMakesTheTunnelKeyOnceAndKeepsIt3884628447/001/overlay.key.
Issue the token for it — `token issue --new <name> --overlay-key <the line above>` — and enrol with that token.

this machine's tunnel key, made here; the private half stays in /tmp/TestATokenThroughTheTunnelTakesItsOwnKey3560100234/001/overlay.key.
Issue the token for it — `token issue --new <name> --overlay-key <the line above>` — and enrol with that token.
flag provided but not defined: -jsom
nox-mesh-host — the node-engine

A daemon: its launcher runs it, and it applies what the mesh declares for this machine. The
operator's command is nox (mesh-cli), on any node, from their own account (novox/hq ADR 0272);
the subcommands here are for installing a machine, joining it, and rescuing one no mesh can
reach, run as root at the machine.

  profile     what this machine can be asked to do
  inventory   what this machine is, and what it holds
  apply FILE  make this machine match a declaration from a file
  reconcile   make this machine match what the mesh last told it — or, before any
              mesh has, the bundle this host carries
  bundle      show what this host carries
  key         make this machine's tunnel key, or read the one it made, and print the public
              half: what its join token is issued for (novox/hq ADR 0169)
  enrol --token T  join the mesh — through the tunnel when the token was issued for a key
  overlay take  take over the tunnel found here (novox/hq ADR 0105): its key becomes this
              node's overlay key and the mesh is told, signed; --tunnel <iface> when several are up
  owned       what this host has applied and still owns
  hand-over <dir>  hand a directory used as found to the mesh: the next apply gives it its declared
              owner and mode. The operator's line is nox node hand-over <node> <dir> on the
              control-node; this is the same act for a machine with no mesh to reach
  judge-directories  which directories this node is declared the walk that follows no link another
              account could make would refuse, read-only (novox/hq issue 358); run as root
  version

  --json      machine-readable output
  --timeout   how long any single probe may take (default 10s)
  --state     where this node keeps what it knows (default /var/lib/mesh-host/state.json)
  --dry-run   say what applying would change, and change nothing

Both apply and reconcile say what they would change before changing anything, and refuse a
declaration for the other mode than this node is in, or one older than what the mesh last said.

It connects to nothing and listens on nothing. What it applies comes from a file.
--- FAIL: TestAMoveOutDirectoryKeepsOnlyWhatItKnows (0.00s)
    move_out_test.go:74: refused or failed: "this is the arch host and pacman does not answer here. Either this machine is not Arch, or its package database is broken: pacman: exec: \"pacman\": executable file not found in $PATH" map[]
FAIL
FAIL	github.com/novox/mesh-host/cmd/mesh-host	5.156s
ok  	github.com/novox/mesh-host/examples	1.030s
ok  	github.com/novox/mesh-host/internal/accounts	1.457s
ok  	github.com/novox/mesh-host/internal/apply	14.785s
ok  	github.com/novox/mesh-host/internal/bootstrap	4.676s
ok  	github.com/novox/mesh-host/internal/bundle	1.022s
ok  	github.com/novox/mesh-host/internal/declaration	1.078s
ok  	github.com/novox/mesh-host/internal/filling	1.747s
ok  	github.com/novox/mesh-host/internal/firewall	1.901s
ok  	github.com/novox/mesh-host/internal/identity	1.120s
ok  	github.com/novox/mesh-host/internal/image	1.038s
ok  	github.com/novox/mesh-host/internal/inventory	1.069s
ok  	github.com/novox/mesh-host/internal/link	10.553s
ok  	github.com/novox/mesh-host/internal/liveness	2.138s
ok  	github.com/novox/mesh-host/internal/meshcli	1.577s
ok  	github.com/novox/mesh-host/internal/network	1.064s
ok  	github.com/novox/mesh-host/internal/outward	1.047s
ok  	github.com/novox/mesh-host/internal/profile	1.654s
ok  	github.com/novox/mesh-host/internal/reachable	1.047s
ok  	github.com/novox/mesh-host/internal/store	1.233s
ok  	github.com/novox/mesh-host/internal/system	1.041s
ok  	github.com/novox/mesh-host/internal/tunnel	1.039s
ok  	github.com/novox/mesh-host/internal/units	1.031s
ok  	github.com/novox/mesh-host/internal/upgrade	1.175s
ok  	github.com/novox/mesh-host/internal/witness	15.059s
ok  	github.com/novox/mesh-host/packaging	1.036s
?   	github.com/novox/mesh-host/rootsearch	[no test files]
ok  	github.com/novox/mesh-host/validate	1.014s
FAIL
--- what failed, picked from the whole of its output (the whole is in the build's log)
--- FAIL: TestAMoveOutDirectoryKeepsOnlyWhatItKnows (0.00s)
    move_out_test.go:74: refused or failed: "this is the arch host and pacman does not answer here. Either this machine is not Arch, or its package database is broken: pacman: exec: \"pacman\": executable file not found in $PATH" map[]
FAIL	github.com/novox/mesh-host/cmd/mesh-host	5.156s
**Merge check** at `d237dee4` Judged: head `d237dee4c9e3` merged into trunk `cd13f7726ef0`; read beside it: mesh-catalog `54b3ce503e79`, mesh-controller `c43772fd94eb`, mesh-controller-main `c43772fd94eb`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestAMoveOutDirectoryKeepsOnlyWhatItKnows (0.00s) **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine - read by no module's build: README.md, cmd/mesh-host/move_out_test.go, internal/apply/move_out_test.go, internal/declaration/declaration_test.go Run by the build seat on shanks as `build-1792253391805147272` (`builds --log build-1792253391805147272`). ``` --- the gate: mesh-host mesh-host: ok long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-17T16:03:34Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-17T16:03:34Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-host notes: - README.md, cmd/mesh-host/move_out_test.go, internal/apply/move_out_test.go and internal/declaration/declaration_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.016s this machine's tunnel key, made here; the private half stays in /tmp/TestKeyMakesTheTunnelKeyOnceAndKeepsIt3884628447/001/overlay.key. Issue the token for it — `token issue --new <name> --overlay-key <the line above>` — and enrol with that token. this machine's tunnel key, made here; the private half stays in /tmp/TestATokenThroughTheTunnelTakesItsOwnKey3560100234/001/overlay.key. Issue the token for it — `token issue --new <name> --overlay-key <the line above>` — and enrol with that token. flag provided but not defined: -jsom nox-mesh-host — the node-engine A daemon: its launcher runs it, and it applies what the mesh declares for this machine. The operator's command is nox (mesh-cli), on any node, from their own account (novox/hq ADR 0272); the subcommands here are for installing a machine, joining it, and rescuing one no mesh can reach, run as root at the machine. profile what this machine can be asked to do inventory what this machine is, and what it holds apply FILE make this machine match a declaration from a file reconcile make this machine match what the mesh last told it — or, before any mesh has, the bundle this host carries bundle show what this host carries key make this machine's tunnel key, or read the one it made, and print the public half: what its join token is issued for (novox/hq ADR 0169) enrol --token T join the mesh — through the tunnel when the token was issued for a key overlay take take over the tunnel found here (novox/hq ADR 0105): its key becomes this node's overlay key and the mesh is told, signed; --tunnel <iface> when several are up owned what this host has applied and still owns hand-over <dir> hand a directory used as found to the mesh: the next apply gives it its declared owner and mode. The operator's line is nox node hand-over <node> <dir> on the control-node; this is the same act for a machine with no mesh to reach judge-directories which directories this node is declared the walk that follows no link another account could make would refuse, read-only (novox/hq issue 358); run as root version --json machine-readable output --timeout how long any single probe may take (default 10s) --state where this node keeps what it knows (default /var/lib/mesh-host/state.json) --dry-run say what applying would change, and change nothing Both apply and reconcile say what they would change before changing anything, and refuse a declaration for the other mode than this node is in, or one older than what the mesh last said. It connects to nothing and listens on nothing. What it applies comes from a file. --- FAIL: TestAMoveOutDirectoryKeepsOnlyWhatItKnows (0.00s) move_out_test.go:74: refused or failed: "this is the arch host and pacman does not answer here. Either this machine is not Arch, or its package database is broken: pacman: exec: \"pacman\": executable file not found in $PATH" map[] FAIL FAIL github.com/novox/mesh-host/cmd/mesh-host 5.156s ok github.com/novox/mesh-host/examples 1.030s ok github.com/novox/mesh-host/internal/accounts 1.457s ok github.com/novox/mesh-host/internal/apply 14.785s ok github.com/novox/mesh-host/internal/bootstrap 4.676s ok github.com/novox/mesh-host/internal/bundle 1.022s ok github.com/novox/mesh-host/internal/declaration 1.078s ok github.com/novox/mesh-host/internal/filling 1.747s ok github.com/novox/mesh-host/internal/firewall 1.901s ok github.com/novox/mesh-host/internal/identity 1.120s ok github.com/novox/mesh-host/internal/image 1.038s ok github.com/novox/mesh-host/internal/inventory 1.069s ok github.com/novox/mesh-host/internal/link 10.553s ok github.com/novox/mesh-host/internal/liveness 2.138s ok github.com/novox/mesh-host/internal/meshcli 1.577s ok github.com/novox/mesh-host/internal/network 1.064s ok github.com/novox/mesh-host/internal/outward 1.047s ok github.com/novox/mesh-host/internal/profile 1.654s ok github.com/novox/mesh-host/internal/reachable 1.047s ok github.com/novox/mesh-host/internal/store 1.233s ok github.com/novox/mesh-host/internal/system 1.041s ok github.com/novox/mesh-host/internal/tunnel 1.039s ok github.com/novox/mesh-host/internal/units 1.031s ok github.com/novox/mesh-host/internal/upgrade 1.175s ok github.com/novox/mesh-host/internal/witness 15.059s ok github.com/novox/mesh-host/packaging 1.036s ? github.com/novox/mesh-host/rootsearch [no test files] ok github.com/novox/mesh-host/validate 1.014s FAIL --- what failed, picked from the whole of its output (the whole is in the build's log) --- FAIL: TestAMoveOutDirectoryKeepsOnlyWhatItKnows (0.00s) move_out_test.go:74: refused or failed: "this is the arch host and pacman does not answer here. Either this machine is not Arch, or its package database is broken: pacman: exec: \"pacman\": executable file not found in $PATH" map[] FAIL github.com/novox/mesh-host/cmd/mesh-host 5.156s ```
mesh-tools added 1 commit 2026-10-17 16:16:05 +00:00
Prove move-out on a machine that is not Arch (issue 1024)
mesh/merge-gate head dae79c76434c merged into trunk cd13f7726ef0 — pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes wi…
Details
mesh/repo-check head dae79c76434c merged into trunk cd13f7726ef0 — pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
dae79c7643 
The merge check's build container has no pacman, so the acceptance test now stubs it and names the host it was built for, as other command tests do; nothing in the node-engine itself changes.
mesh-tools commented 2026-10-17 16:19:01 +00:00
Author
Member
Copy Link
Copy Source

Merge check at dae79c76
Judged: head dae79c76434c merged into trunk cd13f7726ef0; read beside it: mesh-catalog 54b3ce503e79, mesh-controller c43772fd94eb, mesh-controller-main c43772fd94eb, mesh-tools 7412c5b6c9c5

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine
  • read by no module's build: README.md, cmd/mesh-host/move_out_test.go, internal/apply/move_out_test.go, internal/declaration/declaration_test.go

Run by the build seat on ace as build-1792253767589957786 (builds --log build-1792253767589957786).

--- the gate: mesh-host
mesh-host: ok
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-17T16:03:34Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-17T16:03:34Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host

notes:
  - README.md, cmd/mesh-host/move_out_test.go, internal/apply/move_out_test.go and internal/declaration/declaration_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.012s
ok  	github.com/novox/mesh-host/cmd/mesh-host	6.114s
ok  	github.com/novox/mesh-host/examples	1.025s
ok  	github.com/novox/mesh-host/internal/accounts	1.439s
ok  	github.com/novox/mesh-host/internal/apply	15.726s
ok  	github.com/novox/mesh-host/internal/bootstrap	4.064s
ok  	github.com/novox/mesh-host/internal/bundle	1.012s
ok  	github.com/novox/mesh-host/internal/declaration	1.052s
ok  	github.com/novox/mesh-host/internal/filling	1.767s
ok  	github.com/novox/mesh-host/internal/firewall	1.680s
ok  	github.com/novox/mesh-host/internal/identity	1.123s
ok  	github.com/novox/mesh-host/internal/image	1.051s
ok  	github.com/novox/mesh-host/internal/inventory	1.047s
ok  	github.com/novox/mesh-host/internal/link	10.525s
ok  	github.com/novox/mesh-host/internal/liveness	2.128s
ok  	github.com/novox/mesh-host/internal/meshcli	1.607s
ok  	github.com/novox/mesh-host/internal/network	1.091s
ok  	github.com/novox/mesh-host/internal/outward	1.084s
ok  	github.com/novox/mesh-host/internal/profile	1.680s
ok  	github.com/novox/mesh-host/internal/reachable	1.055s
ok  	github.com/novox/mesh-host/internal/store	1.256s
ok  	github.com/novox/mesh-host/internal/system	1.053s
ok  	github.com/novox/mesh-host/internal/tunnel	1.081s
ok  	github.com/novox/mesh-host/internal/units	1.051s
ok  	github.com/novox/mesh-host/internal/upgrade	1.215s
ok  	github.com/novox/mesh-host/internal/witness	17.277s
ok  	github.com/novox/mesh-host/packaging	1.076s
?   	github.com/novox/mesh-host/rootsearch	[no test files]
ok  	github.com/novox/mesh-host/validate	1.012s
**Merge check** at `dae79c76` Judged: head `dae79c76434c` merged into trunk `cd13f7726ef0`; read beside it: mesh-catalog `54b3ce503e79`, mesh-controller `c43772fd94eb`, mesh-controller-main `c43772fd94eb`, mesh-tools `7412c5b6c9c5` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine - read by no module's build: README.md, cmd/mesh-host/move_out_test.go, internal/apply/move_out_test.go, internal/declaration/declaration_test.go Run by the build seat on ace as `build-1792253767589957786` (`builds --log build-1792253767589957786`). ``` --- the gate: mesh-host mesh-host: ok long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-17T16:03:34Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-17T16:03:34Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-host notes: - README.md, cmd/mesh-host/move_out_test.go, internal/apply/move_out_test.go and internal/declaration/declaration_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.012s ok github.com/novox/mesh-host/cmd/mesh-host 6.114s ok github.com/novox/mesh-host/examples 1.025s ok github.com/novox/mesh-host/internal/accounts 1.439s ok github.com/novox/mesh-host/internal/apply 15.726s ok github.com/novox/mesh-host/internal/bootstrap 4.064s ok github.com/novox/mesh-host/internal/bundle 1.012s ok github.com/novox/mesh-host/internal/declaration 1.052s ok github.com/novox/mesh-host/internal/filling 1.767s ok github.com/novox/mesh-host/internal/firewall 1.680s ok github.com/novox/mesh-host/internal/identity 1.123s ok github.com/novox/mesh-host/internal/image 1.051s ok github.com/novox/mesh-host/internal/inventory 1.047s ok github.com/novox/mesh-host/internal/link 10.525s ok github.com/novox/mesh-host/internal/liveness 2.128s ok github.com/novox/mesh-host/internal/meshcli 1.607s ok github.com/novox/mesh-host/internal/network 1.091s ok github.com/novox/mesh-host/internal/outward 1.084s ok github.com/novox/mesh-host/internal/profile 1.680s ok github.com/novox/mesh-host/internal/reachable 1.055s ok github.com/novox/mesh-host/internal/store 1.256s ok github.com/novox/mesh-host/internal/system 1.053s ok github.com/novox/mesh-host/internal/tunnel 1.081s ok github.com/novox/mesh-host/internal/units 1.051s ok github.com/novox/mesh-host/internal/upgrade 1.215s ok github.com/novox/mesh-host/internal/witness 17.277s ok github.com/novox/mesh-host/packaging 1.076s ? github.com/novox/mesh-host/rootsearch [no test files] ok github.com/novox/mesh-host/validate 1.012s ```
mesh-tools added the mesh/ready label 2026-10-17 16:19:17 +00:00
mesh-tools commented 2026-10-17 16:19:17 +00:00
Author
Member
Copy Link
Copy Source

ready at dae79c7643

Reviewed by owned-paths-review@novox: Approved in two review rounds plus the check-failure cycle against issue 1024 and ADR 0422; the forge tree equals the reviewed tree; gate and merge-check.sh green with the acceptance test run. Marked through mesh-delivery.mark-ready (novox/hq issue 913).

ready at dae79c76434c11cee5c1a6280cc7adcb997ac6f0 Reviewed by owned-paths-review@novox: Approved in two review rounds plus the check-failure cycle against issue 1024 and ADR 0422; the forge tree equals the reviewed tree; gate and merge-check.sh green with the acceptance test run. Marked through mesh-delivery.mark-ready (novox/hq issue 913).
mesh-tools merged commit 6469e82384 into main 2026-10-17 16:20:06 +00:00
mesh-tools deleted branch feat/owned-paths 2026-10-17 16:20:06 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels mesh/ready
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-host#117