novox/mesh-host
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Give the controller the contract it can fill: tool runners by name, the take act's access id, wait reasons and ACL support (hq ADR 0325) #94

Merged
mesh-admin merged 2 commits from feat/325-the-contract-the-controller-needs into main 2026-10-12 17:57:42 +00:00
Conversation 2 Commits 2 Files Changed 13
+392 -21
mesh-admin commented 2026-10-12 17:51:56 +00:00
Contributor
Copy Link
Copy Source

Why: the controller half of hq ADR 0325 (built, under review) found four places where #93's contract could not be filled. Issue 567.

What

  • Tool-runner users may omit uid; the engine reads it by the account's name (getent passwd through the accounts package), accepting the answer only when getent's name equals the name asked (an all-digit name is never read as a uid), and refuses a missing, uid-0 or root-group account. Every access with users reports entries with the resolved uid.
  • The take act's access is the declared access resource id exactly as declared (/ allowed), matched against the declared resources; anything undeclared, CR/LF/NUL or over 200 bytes is refused.
  • Access waits carry reason: keep or disk.
  • Keep waits carry acl: needs-enabling (a ZFS dataset the take act will set acltype on) or unsupported; omitted when ACLs work. The probe is a read-only fgetxattr through the folder's own descriptor.
  • Contract stays 5. Nothing changes for an old-shape declaration (no users).

Checked: merge-check.sh green (whole suite under -race). Independent review: APPROVE at 7122f74e after one finding (the all-digit name) was fixed with a failing-first test. This head is the same two commits rebased onto #93's merge (ef26dba2), git range-diff identical.

Delivery effects: node-engine restarts on ace, g14, novox, shanks; nothing changes on any folder until the controller half is delivered.

**Why**: the controller half of hq ADR 0325 (built, under review) found four places where #93's contract could not be filled. Issue 567. **What** - Tool-runner users may omit `uid`; the engine reads it by the account's name (`getent passwd` through the accounts package), accepting the answer only when getent's name equals the name asked (an all-digit name is never read as a uid), and refuses a missing, uid-0 or root-group account. Every access with users reports `entries` with the resolved uid. - The take act's `access` is the declared access resource id exactly as declared (`/` allowed), matched against the declared resources; anything undeclared, CR/LF/NUL or over 200 bytes is refused. - Access waits carry `reason`: `keep` or `disk`. - Keep waits carry `acl`: `needs-enabling` (a ZFS dataset the take act will set `acltype` on) or `unsupported`; omitted when ACLs work. The probe is a read-only `fgetxattr` through the folder's own descriptor. - Contract stays 5. Nothing changes for an old-shape declaration (no users). **Checked**: `merge-check.sh` green (whole suite under `-race`). Independent review: APPROVE at 7122f74e after one finding (the all-digit name) was fixed with a failing-first test. This head is the same two commits rebased onto #93's merge (ef26dba2), `git range-diff` identical. **Delivery effects**: node-engine restarts on ace, g14, novox, shanks; nothing changes on any folder until the controller half is delivered.
mesh-admin added 2 commits 2026-10-12 17:51:56 +00:00
Give the controller the contract it can fill (hq ADR 0325, issue 567) aad33dfe5c 
The controller cannot know the operator's account's uid, names an access by its
declared id (which holds a slash), and should not parse words. A tool runner's
account may now come by name alone and is read here (refused when absent or root's,
its uid said in the access's listing); the take act matches the declared id exactly;
an access wait says its reason (keep or disk) and, for a filesystem that refuses
ACLs, whether the take act can enable them.
Read an account by its name, never as a number getent takes for a uid (hq ADR 0325)
mesh/merge-gate head 5c8e768ef520 merged into trunk ef26dba2753a — pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes wi…
Details
mesh/repo-check head 5c8e768ef520 merged into trunk ef26dba2753a — pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
5c8e768ef5 
getent passwd reads an all-digit key as a uid, so a tool runner's account named
"1000" resolved to whoever has uid 1000 and the entry went to them. Only an answer
naming the account asked for is taken.
mesh-admin commented 2026-10-12 17:52:16 +00:00
Author
Contributor
Copy Link
Copy Source

Delivery novox/mesh-host@5c8e768ef520 — delivered since 2026-10-12T18:02:06Z

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine

Machines

  • mesh-host on ace: passed — healthy 3 times over 2m48s
  • mesh-host on the rest running it: sent

Transitions

  • 2026-10-12 17:52 (new) → proposed (announced): novox/mesh-host#94's head announced
  • 2026-10-12 17:54 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-12 17:54 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-12 17:58 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-12 17:58 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-12 18:02 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-host@5c8e768ef520` — **delivered** since 2026-10-12T18:02:06Z **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine **Machines** - mesh-host on ace: passed — healthy 3 times over 2m48s - mesh-host on the rest running it: sent **Transitions** - 2026-10-12 17:52 (new) → proposed (announced): novox/mesh-host#94's head announced - 2026-10-12 17:54 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-12 17:54 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-12 17:58 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-12 17:58 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-12 18:02 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-admin commented 2026-10-12 17:54:35 +00:00
Author
Contributor
Copy Link
Copy Source

Merge check at 5c8e768e
Judged: head 5c8e768ef520 merged into trunk ef26dba2753a; read beside it: mesh-catalog 23ea0f431faf, mesh-controller d8f36a8fb706, mesh-controller-main d8f36a8fb706, mesh-tools 954e1a53eef9

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine
  • read by no module's build: cmd/mesh-host/kept_test.go, internal/accounts/ids_test.go, internal/apply/contract_test.go, internal/link/access_act_test.go

Run by the build seat on shanks as build-1791827530926081877 (builds --log build-1791827530926081877).

--- the gate: mesh-host
mesh-host: ok
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T17:47:33Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T17:47:33Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host

notes:
  - cmd/mesh-host/kept_test.go, internal/accounts/ids_test.go, internal/apply/contract_test.go and internal/link/access_act_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.011s
ok  	github.com/novox/mesh-host/cmd/mesh-host	6.075s
ok  	github.com/novox/mesh-host/examples	1.021s
ok  	github.com/novox/mesh-host/internal/accounts	1.598s
ok  	github.com/novox/mesh-host/internal/apply	9.143s
ok  	github.com/novox/mesh-host/internal/bootstrap	1.888s
ok  	github.com/novox/mesh-host/internal/bundle	1.030s
ok  	github.com/novox/mesh-host/internal/declaration	1.108s
ok  	github.com/novox/mesh-host/internal/firewall	1.932s
ok  	github.com/novox/mesh-host/internal/identity	1.168s
ok  	github.com/novox/mesh-host/internal/image	1.050s
ok  	github.com/novox/mesh-host/internal/inventory	1.055s
ok  	github.com/novox/mesh-host/internal/link	10.570s
ok  	github.com/novox/mesh-host/internal/liveness	2.220s
ok  	github.com/novox/mesh-host/internal/meshcli	1.592s
ok  	github.com/novox/mesh-host/internal/network	1.068s
ok  	github.com/novox/mesh-host/internal/outward	1.051s
ok  	github.com/novox/mesh-host/internal/profile	1.540s
ok  	github.com/novox/mesh-host/internal/reachable	1.051s
ok  	github.com/novox/mesh-host/internal/store	1.364s
ok  	github.com/novox/mesh-host/internal/system	1.057s
ok  	github.com/novox/mesh-host/internal/tunnel	1.047s
ok  	github.com/novox/mesh-host/internal/units	1.054s
ok  	github.com/novox/mesh-host/internal/upgrade	1.263s
ok  	github.com/novox/mesh-host/internal/witness	8.195s
ok  	github.com/novox/mesh-host/packaging	1.053s
?   	github.com/novox/mesh-host/rootsearch	[no test files]
ok  	github.com/novox/mesh-host/validate	1.049s
**Merge check** at `5c8e768e` Judged: head `5c8e768ef520` merged into trunk `ef26dba2753a`; read beside it: mesh-catalog `23ea0f431faf`, mesh-controller `d8f36a8fb706`, mesh-controller-main `d8f36a8fb706`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine - read by no module's build: cmd/mesh-host/kept_test.go, internal/accounts/ids_test.go, internal/apply/contract_test.go, internal/link/access_act_test.go Run by the build seat on shanks as `build-1791827530926081877` (`builds --log build-1791827530926081877`). ``` --- the gate: mesh-host mesh-host: ok long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T17:47:33Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T17:47:33Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-host notes: - cmd/mesh-host/kept_test.go, internal/accounts/ids_test.go, internal/apply/contract_test.go and internal/link/access_act_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.011s ok github.com/novox/mesh-host/cmd/mesh-host 6.075s ok github.com/novox/mesh-host/examples 1.021s ok github.com/novox/mesh-host/internal/accounts 1.598s ok github.com/novox/mesh-host/internal/apply 9.143s ok github.com/novox/mesh-host/internal/bootstrap 1.888s ok github.com/novox/mesh-host/internal/bundle 1.030s ok github.com/novox/mesh-host/internal/declaration 1.108s ok github.com/novox/mesh-host/internal/firewall 1.932s ok github.com/novox/mesh-host/internal/identity 1.168s ok github.com/novox/mesh-host/internal/image 1.050s ok github.com/novox/mesh-host/internal/inventory 1.055s ok github.com/novox/mesh-host/internal/link 10.570s ok github.com/novox/mesh-host/internal/liveness 2.220s ok github.com/novox/mesh-host/internal/meshcli 1.592s ok github.com/novox/mesh-host/internal/network 1.068s ok github.com/novox/mesh-host/internal/outward 1.051s ok github.com/novox/mesh-host/internal/profile 1.540s ok github.com/novox/mesh-host/internal/reachable 1.051s ok github.com/novox/mesh-host/internal/store 1.364s ok github.com/novox/mesh-host/internal/system 1.057s ok github.com/novox/mesh-host/internal/tunnel 1.047s ok github.com/novox/mesh-host/internal/units 1.054s ok github.com/novox/mesh-host/internal/upgrade 1.263s ok github.com/novox/mesh-host/internal/witness 8.195s ok github.com/novox/mesh-host/packaging 1.053s ? github.com/novox/mesh-host/rootsearch [no test files] ok github.com/novox/mesh-host/validate 1.049s ```
mesh-admin merged commit 303d4037e8 into main 2026-10-12 17:57:42 +00:00
mesh-admin deleted branch feat/325-the-contract-the-controller-needs 2026-10-12 17:57:42 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-host#94