novox/mesh-host
18
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fetch a file the declaration names by digest from the bus's object bucket and verify it before writing, and run the integration tests in the merge check (issue 1695, ADR 0486 step 2) #126

Merged
mesh-tools merged 5 commits from fix/1695-fetch-by-digest into main 2026-10-21 13:33:55 +00:00
Conversation 2 Commits 5 Files Changed 13
+634 -5
mesh-tools commented 2026-10-21 13:04:04 +00:00
Member
Copy Link
Copy Source

ADR 0486 (accepted), the lasting fix of issue 1689: files over 64 KiB travel by sha256 digest; mesh-sdk #59 is delivered, this is the node-engine, the controller follows (1696-1698) and sends references only to nodes reporting file-references.

  • apply.ResolveFileReferences, after the older-than and generation checks and before system.Check: each referenced file is fetched from bucket declaration-files by name (capped at its declared size), checked with File.Verify, and put back; a missing, altered or oversize object or no bus refuses the whole declaration and nothing is written. A file already on disk that verifies is used without a fetch (offline reconcile).
  • The hand-run apply and reconcile resolve references too, and applyFile refuses an unresolved reference, so no path writes one empty.
  • link.FileObject reads by name only, through calls that can be granted without listing the bucket: DIRECT.GET of the metadata subject and an ordered consumer bound to the stream on the chunk subject; the exact grant set is in its comment and on issue 1697.
  • The node reports capability file-references (declaration.FileReferencesCapability).
  • merge-check.sh now runs go test -tags integration (it never did): takes effect for the pull requests after this one.
  • The object-bucket test runs against the real bus (proved by a deliberate-failure try).

Try: build-1792587699078472888 passed at fdb59bcf4e (mesh-sdk pinned to #59's merge 863a981e).

For issue 1695.

Reviewed-by: reviewer-1695@shanks at fdb59bcf4e

ADR 0486 (accepted), the lasting fix of issue 1689: files over 64 KiB travel by sha256 digest; mesh-sdk #59 is delivered, this is the node-engine, the controller follows (1696-1698) and sends references only to nodes reporting file-references. - apply.ResolveFileReferences, after the older-than and generation checks and before system.Check: each referenced file is fetched from bucket declaration-files by name (capped at its declared size), checked with File.Verify, and put back; a missing, altered or oversize object or no bus refuses the whole declaration and nothing is written. A file already on disk that verifies is used without a fetch (offline reconcile). - The hand-run `apply` and `reconcile` resolve references too, and applyFile refuses an unresolved reference, so no path writes one empty. - link.FileObject reads by name only, through calls that can be granted without listing the bucket: DIRECT.GET of the metadata subject and an ordered consumer bound to the stream on the chunk subject; the exact grant set is in its comment and on issue 1697. - The node reports capability file-references (declaration.FileReferencesCapability). - merge-check.sh now runs `go test -tags integration` (it never did): takes effect for the pull requests after this one. - The object-bucket test runs against the real bus (proved by a deliberate-failure try). Try: build-1792587699078472888 passed at fdb59bcf4eb79ff92a017009ed2ebb8b0dbe7426 (mesh-sdk pinned to #59's merge 863a981e). For issue 1695. Reviewed-by: reviewer-1695@shanks at fdb59bcf4eb79ff92a017009ed2ebb8b0dbe7426
mesh-tools added 5 commits 2026-10-21 13:04:04 +00:00
Fetch a declaration's files given by digest from the bus's object bucket, verify them and report file-references (issue 1695, ADR 0486) a457b38968 
mesh-sdk is pinned to fix/1694-file-references 6c857e1c025f until it merges.
Run the integration tests in the merge check, resolve file references in the hand apply, refuse an unresolved one, and read an object by name without listing the bucket (issue 1695) 45f437eea6
Run the object-bucket test in the trunk's tagless suite too: the trunk's merge check judges this change (issue 1695) 4cfa0469fd
Pin mesh-sdk to the merge of #59 (file references) d0298a99da
Correct the grant list above FileObject to the subjects it calls, flow control and consumer delete included (issue 1695)
mesh/merge-gate head fdb59bcf4eb7 merged into trunk c5c4caa2a4ab — pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes wi…
Details
mesh/repo-check head fdb59bcf4eb7 merged into trunk c5c4caa2a4ab — pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the ch…
Details
mesh/delivery delivered
Details
fdb59bcf4e
mesh-tools commented 2026-10-21 13:04:17 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-host@fdb59bcf4eb7 — delivered since 2026-10-21T14:21:13Z

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine

Machines

  • mesh-host on every machine running it: sent
  • mesh-controller on every machine running it: sent
  • build-agent on every machine running it: sent

Transitions

  • 2026-10-21 13:04 (new) → proposed (announced): novox/mesh-host#126's head announced
  • 2026-10-21 13:19 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-21 13:19 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-21 14:06 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-21 14:06 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-21 14:21 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-host@fdb59bcf4eb7` — **delivered** since 2026-10-21T14:21:13Z **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine **Machines** - mesh-host on every machine running it: sent - mesh-controller on every machine running it: sent - build-agent on every machine running it: sent **Transitions** - 2026-10-21 13:04 (new) → proposed (announced): novox/mesh-host#126's head announced - 2026-10-21 13:19 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-21 13:19 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-21 14:06 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-21 14:06 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-21 14:21 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools commented 2026-10-21 13:19:06 +00:00
Author
Member
Copy Link
Copy Source

Merge check at fdb59bcf
Judged: head fdb59bcf4eb7 merged into trunk c5c4caa2a4ab; read beside it: mesh-catalog 90ecba4e50a3, mesh-controller f10fbda1f619, mesh-controller-main f10fbda1f619, mesh-tools e0fadc43d9dd

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)
  • mesh/repo-check: PASS — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine
  • read by no module's build: cmd/mesh-host/file_references_test.go, internal/apply/references_test.go, internal/link/files_nats_test.go, internal/profile/file_references_test.go, merge-check.sh

Run by the build seat on shanks as build-1792587903610385288 (builds --log build-1792587903610385288).

--- the gate: mesh-host
mesh-host: ok
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T13:13:20Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-21T13:13:20Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host

notes:
  - cmd/mesh-host/file_references_test.go, internal/apply/references_test.go, internal/link/files_nats_test.go, internal/profile/file_references_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280)
--- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges
--- its merge-check.sh (go toolchain)
go: downloading git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021124357-863a981e014e
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.019s
ok  	github.com/novox/mesh-host/cmd/mesh-host	6.242s
ok  	github.com/novox/mesh-host/examples	1.032s
ok  	github.com/novox/mesh-host/internal/accounts	1.459s
ok  	github.com/novox/mesh-host/internal/apply	5.514s
ok  	github.com/novox/mesh-host/internal/bootstrap	4.483s
ok  	github.com/novox/mesh-host/internal/bundle	1.018s
ok  	github.com/novox/mesh-host/internal/filling	1.746s
ok  	github.com/novox/mesh-host/internal/firewall	1.870s
ok  	github.com/novox/mesh-host/internal/identity	1.129s
ok  	github.com/novox/mesh-host/internal/image	1.043s
ok  	github.com/novox/mesh-host/internal/inventory	1.074s
ok  	github.com/novox/mesh-host/internal/link	11.067s
ok  	github.com/novox/mesh-host/internal/liveness	2.162s
ok  	github.com/novox/mesh-host/internal/meshcli	1.577s
ok  	github.com/novox/mesh-host/internal/network	1.069s
ok  	github.com/novox/mesh-host/internal/outward	1.053s
ok  	github.com/novox/mesh-host/internal/profile	1.794s
ok  	github.com/novox/mesh-host/internal/reachable	1.048s
ok  	github.com/novox/mesh-host/internal/store	1.243s
ok  	github.com/novox/mesh-host/internal/system	1.040s
ok  	github.com/novox/mesh-host/internal/tunnel	1.042s
ok  	github.com/novox/mesh-host/internal/units	1.036s
ok  	github.com/novox/mesh-host/internal/upgrade	1.180s
ok  	github.com/novox/mesh-host/internal/witness	4.962s
ok  	github.com/novox/mesh-host/packaging	1.038s
?   	github.com/novox/mesh-host/rootsearch	[no test files]
**Merge check** at `fdb59bcf` Judged: head `fdb59bcf4eb7` merged into trunk `c5c4caa2a4ab`; read beside it: mesh-catalog `90ecba4e50a3`, mesh-controller `f10fbda1f619`, mesh-controller-main `f10fbda1f619`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **PASS** — THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; its merge-check.sh passed **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine - read by no module's build: cmd/mesh-host/file_references_test.go, internal/apply/references_test.go, internal/link/files_nats_test.go, internal/profile/file_references_test.go, merge-check.sh Run by the build seat on shanks as `build-1792587903610385288` (`builds --log build-1792587903610385288`). ``` --- the gate: mesh-host mesh-host: ok long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-21T13:13:20Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 7 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, ygcyr.mesh-mail.send, node.yvbpsm, yvbpsm.brother.device. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-21T13:13:20Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-host notes: - cmd/mesh-host/file_references_test.go, internal/apply/references_test.go, internal/link/files_nats_test.go, internal/profile/file_references_test.go and merge-check.sh read by no module's build, and rebuild nothing (issue 280) --- THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges --- its merge-check.sh (go toolchain) go: downloading git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021124357-863a981e014e ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.019s ok github.com/novox/mesh-host/cmd/mesh-host 6.242s ok github.com/novox/mesh-host/examples 1.032s ok github.com/novox/mesh-host/internal/accounts 1.459s ok github.com/novox/mesh-host/internal/apply 5.514s ok github.com/novox/mesh-host/internal/bootstrap 4.483s ok github.com/novox/mesh-host/internal/bundle 1.018s ok github.com/novox/mesh-host/internal/filling 1.746s ok github.com/novox/mesh-host/internal/firewall 1.870s ok github.com/novox/mesh-host/internal/identity 1.129s ok github.com/novox/mesh-host/internal/image 1.043s ok github.com/novox/mesh-host/internal/inventory 1.074s ok github.com/novox/mesh-host/internal/link 11.067s ok github.com/novox/mesh-host/internal/liveness 2.162s ok github.com/novox/mesh-host/internal/meshcli 1.577s ok github.com/novox/mesh-host/internal/network 1.069s ok github.com/novox/mesh-host/internal/outward 1.053s ok github.com/novox/mesh-host/internal/profile 1.794s ok github.com/novox/mesh-host/internal/reachable 1.048s ok github.com/novox/mesh-host/internal/store 1.243s ok github.com/novox/mesh-host/internal/system 1.040s ok github.com/novox/mesh-host/internal/tunnel 1.042s ok github.com/novox/mesh-host/internal/units 1.036s ok github.com/novox/mesh-host/internal/upgrade 1.180s ok github.com/novox/mesh-host/internal/witness 4.962s ok github.com/novox/mesh-host/packaging 1.038s ? github.com/novox/mesh-host/rootsearch [no test files] ```
mesh-tools merged commit fd3259a3f5 into main 2026-10-21 13:33:55 +00:00
mesh-tools deleted branch fix/1695-fetch-by-digest 2026-10-21 13:33:55 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-host#126