Node agent: compose its own modules from their builds and providers' served keys under its own grant (issue 1126, group fix/1126-node-creds) #153

2026-10-27T20:31:40Z

mesh-tools commented

2026-10-27 20:31:40 +00:00

Delivery group fix/1126-node-creds with mesh-sdk and mesh-delivery; pins mesh-sdk 7a8e9f97 exactly.

Watch the have bucket only where the node's grant allows (the reviewed watch fix).
Compose each module from its build and read what providers elsewhere serve, so a self-composing node hands its moved modules and settles mailu's domain.
A failed have that names no fingerprint and no composition (the agent's NotComposed) no longer counts as a module run inside the node's own composition; without this a module whose build cannot be read was applied from its raw manifest.

Tests: H8 (TestNatsANodeThePlacementNamesComposesAndAppliesItsOwn) reads a provider's served key on a second node and a placed module's build under the real per-node user and fails without ServedReads; a subtest under the plain node grant gets the bus's Permissions Violation and composes nothing (ADR 0560). Its refused subtest takes about 12.4 s, because a refused publish reaches only nats.go's async error handler and the read ends at the link's 10 s history bound; within the check's 60 s per package. A unit table (TestAHaveSaysWhetherItsModuleRunsInsideTheNodesOwn) holds the failed-have rule.

Rule bent (test budget): mesh-host runs about 1260 unit tests against a budget of 500; this adds one table test instead of shrinking. Folding it into an existing table would have cost another review round for one test; the budget is covered by issue 1921's shrink work.

Nothing live changes until the placement seed returns.

Reviewed-by: review-1126d@shanks at 6a4718b712

Delivery group fix/1126-node-creds with mesh-sdk and mesh-delivery; pins mesh-sdk 7a8e9f97 exactly. - Watch the have bucket only where the node's grant allows (the reviewed watch fix). - Compose each module from its build and read what providers elsewhere serve, so a self-composing node hands its moved modules and settles mailu's domain. - A failed have that names no fingerprint and no composition (the agent's NotComposed) no longer counts as a module run inside the node's own composition; without this a module whose build cannot be read was applied from its raw manifest. Tests: H8 (TestNatsANodeThePlacementNamesComposesAndAppliesItsOwn) reads a provider's served key on a second node and a placed module's build under the real per-node user and fails without ServedReads; a subtest under the plain node grant gets the bus's Permissions Violation and composes nothing (ADR 0560). Its refused subtest takes about 12.4 s, because a refused publish reaches only nats.go's async error handler and the read ends at the link's 10 s history bound; within the check's 60 s per package. A unit table (TestAHaveSaysWhetherItsModuleRunsInsideTheNodesOwn) holds the failed-have rule. Rule bent (test budget): mesh-host runs about 1260 unit tests against a budget of 500; this adds one table test instead of shrinking. Folding it into an existing table would have cost another review round for one test; the budget is covered by issue 1921's shrink work. Nothing live changes until the placement seed returns. Reviewed-by: review-1126d@shanks at 6a4718b712b276ad403bf1e40aca01c1e2896159

mesh-tools added 6 commits 2026-10-27 20:31:40 +00:00

Watch the have bucket only where the node's grant allows, so a node composing itself is not refused by the bus (issue 1126) 0184e2a5b8

The fold's watch of every have key ('>') was refused (permissions violation on
CONSUMER.CREATE KV_node-engine_have), and every self-composing agent stopped
after the seed. The composer now watches '*.node' (records) and '<node>.>' (its
own haves), as buscompose grants a node; the shadow watches '<node>.>' too. The
selfcompose tests check every watch and get against PermissionsFor(KindNode),
and the agent's integration tests run the agent as the node under that grant.

Compose each module from its build and read what providers elsewhere serve, pinning mesh-sdk cebc651, so a self-composing node hands its moved modules and settles mailu's domain (issue 1126) 45439fd742

The node read a behind module's source manifest digest and composed every module
from the indexer's raw manifest; frombus now takes the build itself (Scope.KeptAt,
a fingerprint). The reader gives frombus the builder's key, a templates archive
fetched as every archive is (apply.Fetch) once per digest and checked against it,
and another node's served keys one by one, as the node's grant allows them.

Pin mesh-sdk 538ffba, the group's head (issue 1126) 0862f97972

Prove in H8 that a node reads a placed module's build and a provider's served key through its own session, refused without the grant, and take a failed have naming nothing as no module run inside the node's own; pin mesh-sdk 7a8e9f9 (issue 1126, review round 1) 7365890298

H8 found it: a module the node could not compose yet got a failed have naming
no fingerprint, which counted as run inside the node's own composition, so the
next composition took it from its manifest past its build.

Drop two debugging lines from the build read and H8, and say why the refused read's wait stays above the history bound (issue 1126, review round 1) d5adf9b72b

Hold in a unit table which haves count a module as run inside the node's own composition, so a failed have naming nothing is caught without H8's timing (issue 1126, review round 2)

mesh/delivery merged: source.main moved to novox/mesh-host@bb15aab50eda

Details

mesh/delivery-group group fix/1126-node-creds merged: every member is merged

Details

mesh/check checking 6a4718b712b2 on bb15aab50eda | novox/mesh-host#153 in group fix/1126-node-creds

6a4718b712

mesh-tools commented

2026-10-27 20:31:44 +00:00

Delivery novox/mesh-host@6a4718b712b2 — merged since 2026-10-27T20:32:42Z

Source — source.main moved to novox/mesh-host@bb15aab50e. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group fix/1126-node-creds: novox/mesh-delivery@bb7f2ff365, novox/mesh-host@6a4718b712, novox/mesh-sdk@7a8e9f9706

Transitions

2026-10-27 20:31 (new) → proposed (announced): novox/mesh-host#153's head announced
2026-10-27 20:31 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-27 20:32 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-host@6a4718b712b2` — **merged** since 2026-10-27T20:32:42Z **Source** — source.main moved to novox/mesh-host@bb15aab50eda. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `fix/1126-node-creds`: novox/mesh-delivery@bb7f2ff365c7, novox/mesh-host@6a4718b712b2, novox/mesh-sdk@7a8e9f970648 **Transitions** - 2026-10-27 20:31 (new) → proposed (announced): novox/mesh-host#153's head announced - 2026-10-27 20:31 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-27 20:32 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-27 20:31:51 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools merged commit bb15aab50e into main

2026-10-27 20:32:37 +00:00

mesh-tools deleted branch fix/1126-node-creds

2026-10-27 20:32:38 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#153