novox/mesh-host
9
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Lay out the publishing test as every gofmt agrees (hq issue 286) #46

Merged
mesh-admin merged 3 commits from fix/gofmt-as-the-toolchain into main 2026-10-07 00:27:49 +00:00
Conversation 4 Commits 3 Files Changed 1
+7 -6
mesh-admin commented 2026-10-06 23:39:04 +00:00
Contributor
Copy Link
Copy Source

The build seat runs merge-check.sh in the mesh's Go toolchain (Go 1.26). There, gofmt -l lists internal/bootstrap/publish_test.go. A newer local Go lays out the same return of several multi-line composite literals the other way, and neither release accepts the other's layout. Every mesh-host pull request failed mesh/repo-check with the file's name as the summary (#44, #45).

The options and deps are now named before the return, a layout both releases agree on. Checked with gofmt -l . in the toolchain image and locally (both clean), and with mesh-controller check-here (mesh-controller#104): before the fix it reproduces the seat's failure, after it mesh/repo-check is PASS. Live seat: build-1791329950373773619, repository PASS.

novox/hq issue 286 (renumbered from 283).

The build seat runs `merge-check.sh` in the mesh's Go toolchain (Go 1.26). There, `gofmt -l` lists `internal/bootstrap/publish_test.go`. A newer local Go lays out the same `return` of several multi-line composite literals the other way, and neither release accepts the other's layout. Every mesh-host pull request failed `mesh/repo-check` with the file's name as the summary (#44, #45). The options and deps are now named before the return, a layout both releases agree on. Checked with `gofmt -l .` in the toolchain image and locally (both clean), and with `mesh-controller check-here` (mesh-controller#104): before the fix it reproduces the seat's failure, after it `mesh/repo-check` is PASS. Live seat: build-1791329950373773619, repository PASS. novox/hq issue 286 (renumbered from 283).
mesh-admin added 1 commit 2026-10-06 23:39:04 +00:00
Lay out the publishing test's return as every gofmt agrees, so the build seat's check passes
mesh/merge-gate pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without (0 of 4 compose)
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery superseded: a newer head of the same pull request
Details
ed43d65bf3 
The toolchain the build seat runs merge-check.sh in (Go 1.26) and a newer local Go format a return of
several multi-line composite literals differently; the seat's is the one that judges, and it failed every
pull request on this file (novox/hq issue 283).
mesh-admin commented 2026-10-06 23:39:29 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-host@bd30534ab196 — delivered since 2026-10-07T00:34:58Z

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host

Machines

  • mesh-host on ace: passed — healthy 3 times over 2m34s
  • mesh-host on the rest running it: sent

Transitions

  • 2026-10-07 00:07 (new) → proposed (announced): novox/mesh-host#46's head announced
  • 2026-10-07 00:13 proposed → checked (checked): the verdict names this commit
  • 2026-10-07 00:13 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-07 00:28 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-07 00:28 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path
  • 2026-10-07 00:34 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-host@bd30534ab196` — **delivered** since 2026-10-07T00:34:58Z **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host **Machines** - mesh-host on ace: passed — healthy 3 times over 2m34s - mesh-host on the rest running it: sent **Transitions** - 2026-10-07 00:07 (new) → proposed (announced): novox/mesh-host#46's head announced - 2026-10-07 00:13 proposed → checked (checked): the verdict names this commit - 2026-10-07 00:13 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-07 00:28 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-07 00:28 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path - 2026-10-07 00:34 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-admin commented 2026-10-06 23:43:35 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at ed43d65b

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (0 of 4 compose) (modules: mesh-host)
  • mesh/repo-check: PASS — its merge-check.sh passed

Change plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host

Run by the build seat on novox as build-1791329950373773619 (builds --log build-1791329950373773619).

--- the gate: mesh-host
mesh-host: ok
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-06T23:08:02Z says they run
composing every machine as the mesh is
composing every machine with the change
merge gate: PASS — every machine composes with the change as it did without (0 of 4 compose)
judged by controller development build against the facts of 2026-10-06T23:08:02Z

machines:
  - a machine (f35): does not compose
  - holds mesh-dns-resolver (idt): does not compose
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose
  - a machine (yvbpsm): does not compose

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host

notes:
  - the mesh's settings of nzbget are not kept: refused: nzbget on the mesh cannot compose with the layer "the mesh" — nzbget has a file that says ${setting:username}, and nothing sets "username" for it — an operator's value is the assignment's, never the definition's (novox/hq ADR 0112): `settings set nzbget <file>` with {"username": …}; set today: pgid, puid
  - the mesh's settings of qbittorrent are not kept: refused: qbittorrent on the mesh cannot compose with the layer "the mesh" — qbittorrent has a file that says ${setting:username}, and nothing sets "username" for it — an operator's value is the assignment's, never the definition's (novox/hq ADR 0112): `settings set qbittorrent <file>` with {"username": …}; set today: pgid, puid
  - a machine (f35)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (f35)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s settings of plex are not kept: refused: plex on idt cannot compose with the layer "idt" — plex places the access "formula-1" at withheld, which is not an absolute path
  - holds mesh-dns-resolver (idt)'s given broker for baserow is not kept: baserow does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for bazarr is not kept: bazarr does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for bookshelf is not kept: bookshelf does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for grafana is not kept: grafana does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for home-assistant is not kept: home-assistant does not declare "broker" as an own secret; it declares: token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for icecast is not kept: icecast does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for influxdb is not kept: influxdb does not declare "broker" as an own secret; it declares: admin, admin-token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for jackett is not kept: jackett does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for kometa is not kept: kometa does not declare "broker" as an own secret; it declares: tmdb — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for letta is not kept: letta does not declare "broker" as an own secret; it declares: openai-api-key, server-password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for lidarr is not kept: lidarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for mosquitto is not kept: mosquitto does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for mssql is not kept: mssql does not declare "broker" as an own secret; it declares: reader, sa — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for nodered is not kept: nodered does not declare "broker" as an own secret; it declares: admin, api-token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for nzbget is not kept: nzbget does not declare "broker" as an own secret; it declares: password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for ombi is not kept: ombi does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for plex is not kept: plex does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for postgres is not kept: postgres does not declare "broker" as an own secret; it declares: reader, superuser — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for qbittorrent is not kept: qbittorrent does not declare "broker" as an own secret; it declares: password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for radarr is not kept: radarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for redis is not kept: redis does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for searxng is not kept: searxng does not declare "broker" as an own secret; it declares: secret — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for sonarr is not kept: sonarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for tautulli is not kept: tautulli does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for unifi is not kept: unifi does not declare "broker" as an own secret; it declares: controller — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for gitea is not kept: gitea does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for keycloak is not kept: keycloak does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mailu is not kept: mailu does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mesh-catalog is not kept: mesh-catalog does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mesh-vault is not kept: mesh-vault does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for minio is not kept: minio does not declare "broker" as an own secret; it declares: root — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mongodb is not kept: mongodb does not declare "broker" as an own secret; it declares: root — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mssql is not kept: mssql does not declare "broker" as an own secret; it declares: reader, sa — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for nextcloud is not kept: nextcloud does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for postgres is not kept: postgres does not declare "broker" as an own secret; it declares: reader, superuser — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for records is not kept: records does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for umami is not kept: umami does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (yvbpsm)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (yvbpsm)'s given broker for lab is not kept: lab does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (yvbpsm)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (f35) composes on the mesh and not as the snapshot raised it: build-agent on f35 has no bus credential: nothing was issued for f35.build-agent, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue build-agent --node f35`, then push again — judged by what the change adds
  - holds mesh-dns-resolver (idt) composes on the mesh and not as the snapshot raised it: route-proxy on idt has no bus credential: nothing was issued for idt.route-proxy, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue route-proxy --node idt`, then push again — judged by what the change adds
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr) composes on the mesh and not as the snapshot raised it: distribution on ygcyr has no bus credential: nothing was issued for ygcyr.distribution, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue distribution --node ygcyr`, then push again — judged by what the change adds
  - a machine (yvbpsm) composes on the mesh and not as the snapshot raised it: build-agent on yvbpsm has no bus credential: nothing was issued for yvbpsm.build-agent, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue build-agent --node yvbpsm`, then push again — judged by what the change adds
--- its merge-check.sh (go toolchain)
go: downloading github.com/nats-io/nats.go v1.54.0
go: downloading golang.org/x/crypto v0.57.0
go: downloading github.com/klauspost/compress v1.20.0
go: downloading github.com/nats-io/nuid v1.0.1
go: downloading github.com/nats-io/nkeys v0.4.16
go: downloading golang.org/x/sys v0.48.0
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.013s
ok  	github.com/novox/mesh-host/cmd/mesh-host	1.935s
ok  	github.com/novox/mesh-host/examples	1.019s
ok  	github.com/novox/mesh-host/internal/apply	41.089s
ok  	github.com/novox/mesh-host/internal/bootstrap	3.095s
ok  	github.com/novox/mesh-host/internal/bundle	1.027s
ok  	github.com/novox/mesh-host/internal/declaration	1.061s
ok  	github.com/novox/mesh-host/internal/firewall	1.850s
ok  	github.com/novox/mesh-host/internal/identity	1.461s
ok  	github.com/novox/mesh-host/internal/image	1.032s
ok  	github.com/novox/mesh-host/internal/inventory	1.030s
ok  	github.com/novox/mesh-host/internal/link	10.376s
ok  	github.com/novox/mesh-host/internal/outward	1.037s
ok  	github.com/novox/mesh-host/internal/profile	1.494s
ok  	github.com/novox/mesh-host/internal/reachable	1.027s
ok  	github.com/novox/mesh-host/internal/store	2.406s
ok  	github.com/novox/mesh-host/internal/system	1.016s
ok  	github.com/novox/mesh-host/internal/tunnel	1.018s
ok  	github.com/novox/mesh-host/internal/upgrade	1.939s
ok  	github.com/novox/mesh-host/internal/witness	46.916s
ok  	github.com/novox/mesh-host/packaging	1.008s
ok  	github.com/novox/mesh-host/validate	1.008s
**Merge check** at `ed43d65b` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (0 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Change plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host Run by the build seat on novox as `build-1791329950373773619` (`builds --log build-1791329950373773619`). ``` --- the gate: mesh-host mesh-host: ok 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-06T23:08:02Z says they run composing every machine as the mesh is composing every machine with the change merge gate: PASS — every machine composes with the change as it did without (0 of 4 compose) judged by controller development build against the facts of 2026-10-06T23:08:02Z machines: - a machine (f35): does not compose - holds mesh-dns-resolver (idt): does not compose - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose - a machine (yvbpsm): does not compose a merge would rebuild 1 module(s) in 1 tier(s): mesh-host notes: - the mesh's settings of nzbget are not kept: refused: nzbget on the mesh cannot compose with the layer "the mesh" — nzbget has a file that says ${setting:username}, and nothing sets "username" for it — an operator's value is the assignment's, never the definition's (novox/hq ADR 0112): `settings set nzbget <file>` with {"username": …}; set today: pgid, puid - the mesh's settings of qbittorrent are not kept: refused: qbittorrent on the mesh cannot compose with the layer "the mesh" — qbittorrent has a file that says ${setting:username}, and nothing sets "username" for it — an operator's value is the assignment's, never the definition's (novox/hq ADR 0112): `settings set qbittorrent <file>` with {"username": …}; set today: pgid, puid - a machine (f35)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (f35)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s settings of plex are not kept: refused: plex on idt cannot compose with the layer "idt" — plex places the access "formula-1" at withheld, which is not an absolute path - holds mesh-dns-resolver (idt)'s given broker for baserow is not kept: baserow does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for bazarr is not kept: bazarr does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for bookshelf is not kept: bookshelf does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for grafana is not kept: grafana does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for home-assistant is not kept: home-assistant does not declare "broker" as an own secret; it declares: token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for icecast is not kept: icecast does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for influxdb is not kept: influxdb does not declare "broker" as an own secret; it declares: admin, admin-token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for jackett is not kept: jackett does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for kometa is not kept: kometa does not declare "broker" as an own secret; it declares: tmdb — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for letta is not kept: letta does not declare "broker" as an own secret; it declares: openai-api-key, server-password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for lidarr is not kept: lidarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for mosquitto is not kept: mosquitto does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for mssql is not kept: mssql does not declare "broker" as an own secret; it declares: reader, sa — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for nodered is not kept: nodered does not declare "broker" as an own secret; it declares: admin, api-token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for nzbget is not kept: nzbget does not declare "broker" as an own secret; it declares: password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for ombi is not kept: ombi does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for plex is not kept: plex does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for postgres is not kept: postgres does not declare "broker" as an own secret; it declares: reader, superuser — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for qbittorrent is not kept: qbittorrent does not declare "broker" as an own secret; it declares: password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for radarr is not kept: radarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for redis is not kept: redis does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for searxng is not kept: searxng does not declare "broker" as an own secret; it declares: secret — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for sonarr is not kept: sonarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for tautulli is not kept: tautulli does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for unifi is not kept: unifi does not declare "broker" as an own secret; it declares: controller — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for gitea is not kept: gitea does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for keycloak is not kept: keycloak does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mailu is not kept: mailu does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mesh-catalog is not kept: mesh-catalog does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mesh-vault is not kept: mesh-vault does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for minio is not kept: minio does not declare "broker" as an own secret; it declares: root — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mongodb is not kept: mongodb does not declare "broker" as an own secret; it declares: root — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mssql is not kept: mssql does not declare "broker" as an own secret; it declares: reader, sa — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for nextcloud is not kept: nextcloud does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for postgres is not kept: postgres does not declare "broker" as an own secret; it declares: reader, superuser — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for records is not kept: records does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for umami is not kept: umami does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (yvbpsm)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (yvbpsm)'s given broker for lab is not kept: lab does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (yvbpsm)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (f35) composes on the mesh and not as the snapshot raised it: build-agent on f35 has no bus credential: nothing was issued for f35.build-agent, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue build-agent --node f35`, then push again — judged by what the change adds - holds mesh-dns-resolver (idt) composes on the mesh and not as the snapshot raised it: route-proxy on idt has no bus credential: nothing was issued for idt.route-proxy, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue route-proxy --node idt`, then push again — judged by what the change adds - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr) composes on the mesh and not as the snapshot raised it: distribution on ygcyr has no bus credential: nothing was issued for ygcyr.distribution, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue distribution --node ygcyr`, then push again — judged by what the change adds - a machine (yvbpsm) composes on the mesh and not as the snapshot raised it: build-agent on yvbpsm has no bus credential: nothing was issued for yvbpsm.build-agent, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue build-agent --node yvbpsm`, then push again — judged by what the change adds --- its merge-check.sh (go toolchain) go: downloading github.com/nats-io/nats.go v1.54.0 go: downloading golang.org/x/crypto v0.57.0 go: downloading github.com/klauspost/compress v1.20.0 go: downloading github.com/nats-io/nuid v1.0.1 go: downloading github.com/nats-io/nkeys v0.4.16 go: downloading golang.org/x/sys v0.48.0 ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.013s ok github.com/novox/mesh-host/cmd/mesh-host 1.935s ok github.com/novox/mesh-host/examples 1.019s ok github.com/novox/mesh-host/internal/apply 41.089s ok github.com/novox/mesh-host/internal/bootstrap 3.095s ok github.com/novox/mesh-host/internal/bundle 1.027s ok github.com/novox/mesh-host/internal/declaration 1.061s ok github.com/novox/mesh-host/internal/firewall 1.850s ok github.com/novox/mesh-host/internal/identity 1.461s ok github.com/novox/mesh-host/internal/image 1.032s ok github.com/novox/mesh-host/internal/inventory 1.030s ok github.com/novox/mesh-host/internal/link 10.376s ok github.com/novox/mesh-host/internal/outward 1.037s ok github.com/novox/mesh-host/internal/profile 1.494s ok github.com/novox/mesh-host/internal/reachable 1.027s ok github.com/novox/mesh-host/internal/store 2.406s ok github.com/novox/mesh-host/internal/system 1.016s ok github.com/novox/mesh-host/internal/tunnel 1.018s ok github.com/novox/mesh-host/internal/upgrade 1.939s ok github.com/novox/mesh-host/internal/witness 46.916s ok github.com/novox/mesh-host/packaging 1.008s ok github.com/novox/mesh-host/validate 1.008s ```
jschoubben added 1 commit 2026-10-07 00:00:15 +00:00
Cite the hq issues by the numbers they were given: 285, 286, 287
mesh/merge-gate pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without (0 of 4 compose)
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery superseded: a newer head of the same pull request
Details
2a4b521e1b
mesh-admin commented 2026-10-07 00:02:33 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at 2a4b521e

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (0 of 4 compose) (modules: mesh-host)
  • mesh/repo-check: PASS — its merge-check.sh passed

Change plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host

Run by the build seat on ace as build-1791331237244478582 (builds --log build-1791331237244478582).

--- the gate: mesh-host
mesh-host: ok
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-06T23:48:02Z says they run
composing every machine as the mesh is
composing every machine with the change
merge gate: PASS — every machine composes with the change as it did without (0 of 4 compose)
judged by controller development build against the facts of 2026-10-06T23:48:02Z

machines:
  - a machine (f35): does not compose
  - holds mesh-dns-resolver (idt): does not compose
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose
  - a machine (yvbpsm): does not compose

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host

notes:
  - the mesh's settings of nzbget are not kept: refused: nzbget on the mesh cannot compose with the layer "the mesh" — nzbget has a file that says ${setting:username}, and nothing sets "username" for it — an operator's value is the assignment's, never the definition's (novox/hq ADR 0112): `settings set nzbget <file>` with {"username": …}; set today: pgid, puid
  - the mesh's settings of qbittorrent are not kept: refused: qbittorrent on the mesh cannot compose with the layer "the mesh" — qbittorrent has a file that says ${setting:username}, and nothing sets "username" for it — an operator's value is the assignment's, never the definition's (novox/hq ADR 0112): `settings set qbittorrent <file>` with {"username": …}; set today: pgid, puid
  - a machine (f35)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (f35)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s settings of plex are not kept: refused: plex on idt cannot compose with the layer "idt" — plex places the access "formula-1" at withheld, which is not an absolute path
  - holds mesh-dns-resolver (idt)'s given broker for baserow is not kept: baserow does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for bazarr is not kept: bazarr does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for bookshelf is not kept: bookshelf does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for grafana is not kept: grafana does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for home-assistant is not kept: home-assistant does not declare "broker" as an own secret; it declares: token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for icecast is not kept: icecast does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for influxdb is not kept: influxdb does not declare "broker" as an own secret; it declares: admin, admin-token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for jackett is not kept: jackett does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for kometa is not kept: kometa does not declare "broker" as an own secret; it declares: tmdb — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for letta is not kept: letta does not declare "broker" as an own secret; it declares: openai-api-key, server-password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for lidarr is not kept: lidarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for mosquitto is not kept: mosquitto does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for mssql is not kept: mssql does not declare "broker" as an own secret; it declares: reader, sa — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for nodered is not kept: nodered does not declare "broker" as an own secret; it declares: admin, api-token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for nzbget is not kept: nzbget does not declare "broker" as an own secret; it declares: password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for ombi is not kept: ombi does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for plex is not kept: plex does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for postgres is not kept: postgres does not declare "broker" as an own secret; it declares: reader, superuser — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for qbittorrent is not kept: qbittorrent does not declare "broker" as an own secret; it declares: password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for radarr is not kept: radarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for redis is not kept: redis does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for searxng is not kept: searxng does not declare "broker" as an own secret; it declares: secret — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for sonarr is not kept: sonarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for tautulli is not kept: tautulli does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds mesh-dns-resolver (idt)'s given broker for unifi is not kept: unifi does not declare "broker" as an own secret; it declares: controller — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for gitea is not kept: gitea does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for keycloak is not kept: keycloak does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mailu is not kept: mailu does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mesh-catalog is not kept: mesh-catalog does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mesh-vault is not kept: mesh-vault does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for minio is not kept: minio does not declare "broker" as an own secret; it declares: root — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mongodb is not kept: mongodb does not declare "broker" as an own secret; it declares: root — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mssql is not kept: mssql does not declare "broker" as an own secret; it declares: reader, sa — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for nextcloud is not kept: nextcloud does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for postgres is not kept: postgres does not declare "broker" as an own secret; it declares: reader, superuser — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for records is not kept: records does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for umami is not kept: umami does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (yvbpsm)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (yvbpsm)'s given broker for lab is not kept: lab does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (yvbpsm)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163)
  - a machine (f35) composes on the mesh and not as the snapshot raised it: build-agent on f35 has no bus credential: nothing was issued for f35.build-agent, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue build-agent --node f35`, then push again — judged by what the change adds
  - holds mesh-dns-resolver (idt) composes on the mesh and not as the snapshot raised it: route-proxy on idt has no bus credential: nothing was issued for idt.route-proxy, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue route-proxy --node idt`, then push again — judged by what the change adds
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr) composes on the mesh and not as the snapshot raised it: distribution on ygcyr has no bus credential: nothing was issued for ygcyr.distribution, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue distribution --node ygcyr`, then push again — judged by what the change adds
  - a machine (yvbpsm) composes on the mesh and not as the snapshot raised it: build-agent on yvbpsm has no bus credential: nothing was issued for yvbpsm.build-agent, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue build-agent --node yvbpsm`, then push again — judged by what the change adds
--- its merge-check.sh (go toolchain)
go: downloading golang.org/x/crypto v0.57.0
go: downloading github.com/nats-io/nats.go v1.54.0
go: downloading github.com/nats-io/nuid v1.0.1
go: downloading github.com/klauspost/compress v1.20.0
go: downloading github.com/nats-io/nkeys v0.4.16
go: downloading golang.org/x/sys v0.48.0
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.014s
ok  	github.com/novox/mesh-host/cmd/mesh-host	1.306s
ok  	github.com/novox/mesh-host/examples	1.015s
ok  	github.com/novox/mesh-host/internal/apply	3.879s
ok  	github.com/novox/mesh-host/internal/bootstrap	1.472s
ok  	github.com/novox/mesh-host/internal/bundle	1.012s
ok  	github.com/novox/mesh-host/internal/declaration	1.039s
ok  	github.com/novox/mesh-host/internal/firewall	1.633s
ok  	github.com/novox/mesh-host/internal/identity	1.081s
ok  	github.com/novox/mesh-host/internal/image	1.070s
ok  	github.com/novox/mesh-host/internal/inventory	1.077s
ok  	github.com/novox/mesh-host/internal/link	10.390s
ok  	github.com/novox/mesh-host/internal/outward	1.076s
ok  	github.com/novox/mesh-host/internal/profile	1.531s
ok  	github.com/novox/mesh-host/internal/reachable	1.073s
ok  	github.com/novox/mesh-host/internal/store	1.245s
ok  	github.com/novox/mesh-host/internal/system	1.075s
ok  	github.com/novox/mesh-host/internal/tunnel	1.078s
ok  	github.com/novox/mesh-host/internal/upgrade	1.170s
ok  	github.com/novox/mesh-host/internal/witness	4.412s
ok  	github.com/novox/mesh-host/packaging	1.069s
ok  	github.com/novox/mesh-host/validate	1.072s
**Merge check** at `2a4b521e` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (0 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Change plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host Run by the build seat on ace as `build-1791331237244478582` (`builds --log build-1791331237244478582`). ``` --- the gate: mesh-host mesh-host: ok 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-06T23:48:02Z says they run composing every machine as the mesh is composing every machine with the change merge gate: PASS — every machine composes with the change as it did without (0 of 4 compose) judged by controller development build against the facts of 2026-10-06T23:48:02Z machines: - a machine (f35): does not compose - holds mesh-dns-resolver (idt): does not compose - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): does not compose - a machine (yvbpsm): does not compose a merge would rebuild 1 module(s) in 1 tier(s): mesh-host notes: - the mesh's settings of nzbget are not kept: refused: nzbget on the mesh cannot compose with the layer "the mesh" — nzbget has a file that says ${setting:username}, and nothing sets "username" for it — an operator's value is the assignment's, never the definition's (novox/hq ADR 0112): `settings set nzbget <file>` with {"username": …}; set today: pgid, puid - the mesh's settings of qbittorrent are not kept: refused: qbittorrent on the mesh cannot compose with the layer "the mesh" — qbittorrent has a file that says ${setting:username}, and nothing sets "username" for it — an operator's value is the assignment's, never the definition's (novox/hq ADR 0112): `settings set qbittorrent <file>` with {"username": …}; set today: pgid, puid - a machine (f35)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (f35)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s settings of plex are not kept: refused: plex on idt cannot compose with the layer "idt" — plex places the access "formula-1" at withheld, which is not an absolute path - holds mesh-dns-resolver (idt)'s given broker for baserow is not kept: baserow does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for bazarr is not kept: bazarr does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for bookshelf is not kept: bookshelf does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for grafana is not kept: grafana does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for home-assistant is not kept: home-assistant does not declare "broker" as an own secret; it declares: token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for icecast is not kept: icecast does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for influxdb is not kept: influxdb does not declare "broker" as an own secret; it declares: admin, admin-token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for jackett is not kept: jackett does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for kometa is not kept: kometa does not declare "broker" as an own secret; it declares: tmdb — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for letta is not kept: letta does not declare "broker" as an own secret; it declares: openai-api-key, server-password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for lidarr is not kept: lidarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for mosquitto is not kept: mosquitto does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for mssql is not kept: mssql does not declare "broker" as an own secret; it declares: reader, sa — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for nodered is not kept: nodered does not declare "broker" as an own secret; it declares: admin, api-token — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for nzbget is not kept: nzbget does not declare "broker" as an own secret; it declares: password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for ombi is not kept: ombi does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for plex is not kept: plex does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for postgres is not kept: postgres does not declare "broker" as an own secret; it declares: reader, superuser — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for qbittorrent is not kept: qbittorrent does not declare "broker" as an own secret; it declares: password — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for radarr is not kept: radarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for redis is not kept: redis does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for searxng is not kept: searxng does not declare "broker" as an own secret; it declares: secret — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for sonarr is not kept: sonarr does not declare "broker" as an own secret; it declares: api-key — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for tautulli is not kept: tautulli does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds mesh-dns-resolver (idt)'s given broker for unifi is not kept: unifi does not declare "broker" as an own secret; it declares: controller — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for gitea is not kept: gitea does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for keycloak is not kept: keycloak does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mailu is not kept: mailu does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mesh-catalog is not kept: mesh-catalog does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mesh-vault is not kept: mesh-vault does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for minio is not kept: minio does not declare "broker" as an own secret; it declares: root — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mongodb is not kept: mongodb does not declare "broker" as an own secret; it declares: root — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for mssql is not kept: mssql does not declare "broker" as an own secret; it declares: reader, sa — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for nextcloud is not kept: nextcloud does not declare "broker" as an own secret; it declares: admin — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for postgres is not kept: postgres does not declare "broker" as an own secret; it declares: reader, superuser — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for records is not kept: records does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr)'s given broker for umami is not kept: umami does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (yvbpsm)'s given broker for fail2ban is not kept: fail2ban does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (yvbpsm)'s given broker for lab is not kept: lab does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (yvbpsm)'s given broker for nftables is not kept: nftables does not declare "broker" as an own secret; it declares no own secrets — a secret it requires from a provider is accepted with `--provider <node> [--local <name>]`, the value the running service already uses (novox/hq ADR 0163) - a machine (f35) composes on the mesh and not as the snapshot raised it: build-agent on f35 has no bus credential: nothing was issued for f35.build-agent, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue build-agent --node f35`, then push again — judged by what the change adds - holds mesh-dns-resolver (idt) composes on the mesh and not as the snapshot raised it: route-proxy on idt has no bus credential: nothing was issued for idt.route-proxy, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue route-proxy --node idt`, then push again — judged by what the change adds - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr) composes on the mesh and not as the snapshot raised it: distribution on ygcyr has no bus credential: nothing was issued for ygcyr.distribution, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue distribution --node ygcyr`, then push again — judged by what the change adds - a machine (yvbpsm) composes on the mesh and not as the snapshot raised it: build-agent on yvbpsm has no bus credential: nothing was issued for yvbpsm.build-agent, and a push would seal a placeholder its process cannot read (novox/hq issue 203). `module issue build-agent --node yvbpsm`, then push again — judged by what the change adds --- its merge-check.sh (go toolchain) go: downloading golang.org/x/crypto v0.57.0 go: downloading github.com/nats-io/nats.go v1.54.0 go: downloading github.com/nats-io/nuid v1.0.1 go: downloading github.com/klauspost/compress v1.20.0 go: downloading github.com/nats-io/nkeys v0.4.16 go: downloading golang.org/x/sys v0.48.0 ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.014s ok github.com/novox/mesh-host/cmd/mesh-host 1.306s ok github.com/novox/mesh-host/examples 1.015s ok github.com/novox/mesh-host/internal/apply 3.879s ok github.com/novox/mesh-host/internal/bootstrap 1.472s ok github.com/novox/mesh-host/internal/bundle 1.012s ok github.com/novox/mesh-host/internal/declaration 1.039s ok github.com/novox/mesh-host/internal/firewall 1.633s ok github.com/novox/mesh-host/internal/identity 1.081s ok github.com/novox/mesh-host/internal/image 1.070s ok github.com/novox/mesh-host/internal/inventory 1.077s ok github.com/novox/mesh-host/internal/link 10.390s ok github.com/novox/mesh-host/internal/outward 1.076s ok github.com/novox/mesh-host/internal/profile 1.531s ok github.com/novox/mesh-host/internal/reachable 1.073s ok github.com/novox/mesh-host/internal/store 1.245s ok github.com/novox/mesh-host/internal/system 1.075s ok github.com/novox/mesh-host/internal/tunnel 1.078s ok github.com/novox/mesh-host/internal/upgrade 1.170s ok github.com/novox/mesh-host/internal/witness 4.412s ok github.com/novox/mesh-host/packaging 1.069s ok github.com/novox/mesh-host/validate 1.072s ```
mesh-admin changed title from Lay out the publishing test as every gofmt agrees (hq issue 283) to Lay out the publishing test as every gofmt agrees (hq issue 286) 2026-10-07 00:05:14 +00:00
jschoubben added 1 commit 2026-10-07 00:06:53 +00:00
Check again, judged by the controller with the gate's fix (novox/hq issue 285)
mesh/merge-gate pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without (4 of 4 compose)
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
bd30534ab1
mesh-admin commented 2026-10-07 00:13:39 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at bd30534a

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)
  • mesh/repo-check: PASS — its merge-check.sh passed

Change plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host

Run by the build seat on novox as build-1791331633548093635 (builds --log build-1791331633548093635).

--- the gate: mesh-host
mesh-host: ok
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T00:02:01Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-07T00:02:01Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.014s
ok  	github.com/novox/mesh-host/cmd/mesh-host	5.636s
ok  	github.com/novox/mesh-host/examples	1.017s
ok  	github.com/novox/mesh-host/internal/apply	33.368s
ok  	github.com/novox/mesh-host/internal/bootstrap	5.892s
ok  	github.com/novox/mesh-host/internal/bundle	1.016s
ok  	github.com/novox/mesh-host/internal/declaration	1.048s
ok  	github.com/novox/mesh-host/internal/firewall	1.983s
ok  	github.com/novox/mesh-host/internal/identity	3.588s
ok  	github.com/novox/mesh-host/internal/image	1.016s
ok  	github.com/novox/mesh-host/internal/inventory	1.017s
ok  	github.com/novox/mesh-host/internal/link	10.484s
ok  	github.com/novox/mesh-host/internal/outward	1.027s
ok  	github.com/novox/mesh-host/internal/profile	1.474s
ok  	github.com/novox/mesh-host/internal/reachable	1.011s
ok  	github.com/novox/mesh-host/internal/store	4.228s
ok  	github.com/novox/mesh-host/internal/system	1.012s
ok  	github.com/novox/mesh-host/internal/tunnel	1.018s
ok  	github.com/novox/mesh-host/internal/upgrade	3.208s
ok  	github.com/novox/mesh-host/internal/witness	38.519s
ok  	github.com/novox/mesh-host/packaging	1.009s
ok  	github.com/novox/mesh-host/validate	1.009s
**Merge check** at `bd30534a` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Change plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host Run by the build seat on novox as `build-1791331633548093635` (`builds --log build-1791331633548093635`). ``` --- the gate: mesh-host mesh-host: ok 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-07T00:02:01Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-07T00:02:01Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-host --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.014s ok github.com/novox/mesh-host/cmd/mesh-host 5.636s ok github.com/novox/mesh-host/examples 1.017s ok github.com/novox/mesh-host/internal/apply 33.368s ok github.com/novox/mesh-host/internal/bootstrap 5.892s ok github.com/novox/mesh-host/internal/bundle 1.016s ok github.com/novox/mesh-host/internal/declaration 1.048s ok github.com/novox/mesh-host/internal/firewall 1.983s ok github.com/novox/mesh-host/internal/identity 3.588s ok github.com/novox/mesh-host/internal/image 1.016s ok github.com/novox/mesh-host/internal/inventory 1.017s ok github.com/novox/mesh-host/internal/link 10.484s ok github.com/novox/mesh-host/internal/outward 1.027s ok github.com/novox/mesh-host/internal/profile 1.474s ok github.com/novox/mesh-host/internal/reachable 1.011s ok github.com/novox/mesh-host/internal/store 4.228s ok github.com/novox/mesh-host/internal/system 1.012s ok github.com/novox/mesh-host/internal/tunnel 1.018s ok github.com/novox/mesh-host/internal/upgrade 3.208s ok github.com/novox/mesh-host/internal/witness 38.519s ok github.com/novox/mesh-host/packaging 1.009s ok github.com/novox/mesh-host/validate 1.009s ```
mesh-admin merged commit a338c2e581 into main 2026-10-07 00:27:49 +00:00
mesh-admin deleted branch fix/gofmt-as-the-toolchain 2026-10-07 00:27:49 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-host#46