Bus node: follow the grants part's sealed user list after the operator's take-over, never both sources; hand the vault the loaded hashes (issue 1945) #145

2026-10-26T12:18:32Z

mesh-tools commented

2026-10-26 12:18:32 +00:00

Group feat/1945-user-list-switch, one Approve. On the node holding mesh-broker the node-engine follows mesh-grants' key user-list.sealed once it says follow=grants: opens the sealed object with its own key, checks the digest, keeps the controller-user and half-dropped guards, writes the file 0600 only on a change, reports follows: grants; writes nothing until the key has been heard (the last key is kept on the machine), retries a refused watch, never writes the controller's list on an apply in grants mode, and refuses an apply when the list on the machine cannot be read (the file stays). It also hands the vault, sealed to the vault's key, the hashes of the loaded list (ADR 0550 clause 4), re-asking the vault's key until it has one. Try try-1793015653572825118 passed.

Reviewed-by: review-switch@shanks at e88ddab241

Group feat/1945-user-list-switch, one Approve. On the node holding mesh-broker the node-engine follows mesh-grants' key user-list.sealed once it says follow=grants: opens the sealed object with its own key, checks the digest, keeps the controller-user and half-dropped guards, writes the file 0600 only on a change, reports follows: grants; writes nothing until the key has been heard (the last key is kept on the machine), retries a refused watch, never writes the controller's list on an apply in grants mode, and refuses an apply when the list on the machine cannot be read (the file stays). It also hands the vault, sealed to the vault's key, the hashes of the loaded list (ADR 0550 clause 4), re-asking the vault's key until it has one. Try try-1793015653572825118 passed. Reviewed-by: review-switch@shanks at e88ddab2417069b97fe3fcc14a260dad6fd68d31

mesh-tools added 7 commits 2026-10-26 12:18:33 +00:00

The bus node hands the loaded list's hashes to the vault, sealed to its key, in the bus module's have (ADR 0547 clause 9, issue 1945) fd381567f4

The vault holds no value for the controller's own account, the node accounts and the enrolled devices, so it cannot
hash them, and take-over waits on their hashes. The bus node's engine is the one part that has them, in the list the
bus loaded. Its follower of the user list now puts every loaded user's bcrypt hash in the bus module's have, sealed to
the vault's own key (mesh-sdk delivery.AccountsHanded), so of every reader of the have bucket the vault alone opens
it; the clear part says only the list's digest, the key's fingerprint and how many users. The vault's key is heard from
its answer to node-key, which the engine already asks at start; a first or changed key looks at the list again. It is
sealed again only when the list on the machine or the vault's key changes; a refused list hands the list kept on the
machine. The vault takes from it only the users it holds no value for.

Also: the user list follower's test sent its later puts before the watch had handed the keys there before it, so two
of its cases failed on main whenever the goroutine started late; the feed now says when the watch began.

The engine states its key again until it hears the vault's key, and at a slow interval after, so a vault delivered after it or a changed vault key is heard (review of the adoption handing, ADR 0547 clause 9) 1a190090ab

The bus node follows the grants part's sealed user list from take-over, the controller's otherwise, never both (ADR 0547 clauses 7, 8; issue 1945) 882e75c954

On the node whose compositions carry the bus's list, the engine also watches mesh-grants' key user-list.sealed. While it
says follow grants, the object it names is read by name, opened with this machine's sealing key, checked against the
key's digest and the guard, and written to the same file at 0600 only when its digest differs; the bus reloads it
itself. The have says which list is followed and this machine's sealing key, which the grants part seals to.
The follower's test waits for its watch to catch up before a later put, which raced under load. Pins mesh-sdk 175a5567.

Pin mesh-sdk at the group's head 83ee7769 (issue 1945) 5e2fadce15

gofmt the follower's test (issue 1945) 61cec66ba8

Bring in the adoption handing; the bus node writes nothing before it heard the switch, retries the key's watch and keeps the follow last heard, and an apply never writes the controller's list while the grants part's is followed (review of the switch, issue 1945) 06f70e11ee

Merges fix/1945-adopt-hashes 1a190090. A new follower (one per link) waits for the grants part's key to catch up before
its first write, so a restart after take-over never writes the controller's list first. A refused or ended watch is
tried again on link.Backoff, the have says why it is not watched, and the key last heard, kept beside the node's state,
holds meanwhile. While the grants part's list is followed, the bus module's composition is applied with the list on the
machine in place of the controller's. The grants list is never handed to the vault. Pins mesh-sdk c2a410bb.

An apply of the bus module waits when the list on the machine cannot be read while the grants part's is followed, so the file is never removed as an orphan (review of the switch, issue 1945)

mesh/delivery merged: source.main moved to novox/mesh-host@7f04d1204765

Details

mesh/delivery-group group feat/1945-user-list-switch merged: every member is merged

Details

mesh/check being carried to e88ddab24170 on 7f04d1204765 | novox/mesh-host#145 in group feat/1945-user-list-switch

e88ddab241

mesh-tools commented

2026-10-26 12:18:37 +00:00

Delivery novox/mesh-host@e88ddab24170 — merged since 2026-10-26T12:21:58Z

Source — source.main moved to novox/mesh-host@7f04d12047. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group feat/1945-user-list-switch: novox/mesh-catalog@c9414b1c98, novox/mesh-controller@09d2cc5056, novox/mesh-delivery@5c76c9d3ac, novox/mesh-host@e88ddab241, novox/mesh-sdk@c2a410bb63

Transitions

2026-10-26 12:18 (new) → proposed (announced): novox/mesh-host#145's head announced
2026-10-26 12:18 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-26 12:21 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-host@e88ddab24170` — **merged** since 2026-10-26T12:21:58Z **Source** — source.main moved to novox/mesh-host@7f04d1204765. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `feat/1945-user-list-switch`: novox/mesh-catalog@c9414b1c9856, novox/mesh-controller@09d2cc5056ef, novox/mesh-delivery@5c76c9d3ac84, novox/mesh-host@e88ddab24170, novox/mesh-sdk@c2a410bb6376 **Transitions** - 2026-10-26 12:18 (new) → proposed (announced): novox/mesh-host#145's head announced - 2026-10-26 12:18 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-26 12:21 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-26 12:18:43 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools commented

2026-10-26 12:18:46 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools commented

2026-10-26 12:18:52 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools merged commit 7f04d12047 into main

2026-10-26 12:21:55 +00:00

mesh-tools deleted branch feat/1945-user-list-switch

2026-10-26 12:21:55 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#145