novox/mesh-host
18
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Take a root-made directory in the mesh's own tree, and hold a container until the file it mounts exists (issue 1873) #131

Merged
mesh-tools merged 3 commits from fix/1873-mesh-tree-dirs into main 2026-10-22 20:41:09 +00:00
Conversation 2 Commits 3 Files Changed 6
+339
mesh-tools commented 2026-10-22 20:33:00 +00:00
Member
Copy Link
Copy Source

Issue 1873 (note 8). The operator asked for a quick fix (22:20). Delivering postgres's move on ace (22:12) showed two node-engine faults; novox's postgres move is held until this is delivered.

  1. cdbff17 + 03b9c47: /var/lib/mesh/postgres was already there, root:root 0700, when its declaration first ran, so the engine used it as found and never gave it its declared owner (condition module.postgres.ace.directory-used-as-found); on novox the postgres provider runs as the operator's account and reads its files there. Now a directory below /var/lib/mesh owned by the engine's own account, judged both by its clean path and by its resolved path against the resolved tree root, is the mesh's and gets its declared owner and mode. Outside the tree, through a link out of it, or owned by any other account, issue 339's rule stands. Tests: TestADirectoryInTheMeshsOwnTreeMadeByTheEngineIsTheMeshs, TestALinkInTheMeshsTreeLeadingOutOfItIsNotTheTree (both failed first).
  2. 0d12fb1: postgres's container on ace was replaced before its superuser.secret was filled, and the container runtime made the missing bind source a directory, so the file can never be written ('read .../superuser.secret: is a directory'). (a) A container whose mount source is a declared file not yet on disk is neither created nor replaced until the fill writes it; the fill re-applies it (WriteFilled, readsChange). (b) A declared file whose path is an EMPTY directory in the mesh's tree (by path and resolved path) owned by the engine's account is removed and the file written, said in the outcome. Never a non-empty directory, never outside the tree. Tests: TestAContainerWaitsForAFileItMountsAndIsMadeWhenTheFillLands, TestAnEmptyDirectoryTheRuntimeLeftAtAFilesPathIsReplacedByTheFile (both failed first).

Try build-1792700985531116446 PASS.

What the operator sees: the node-engine is delivered to ace, g14, novox and shanks; on ace /var/lib/mesh/postgres becomes ace's and the store's secret a file again, without a hand step; then novox's held postgres move can be released.

Reviewed-by: review-1873-engine@shanks at 0d12fb11a4

Issue 1873 (note 8). The operator asked for a quick fix (22:20). Delivering postgres's move on ace (22:12) showed two node-engine faults; novox's postgres move is held until this is delivered. 1. cdbff17 + 03b9c47: /var/lib/mesh/postgres was already there, root:root 0700, when its declaration first ran, so the engine used it as found and never gave it its declared owner (condition module.postgres.ace.directory-used-as-found); on novox the postgres provider runs as the operator's account and reads its files there. Now a directory below /var/lib/mesh owned by the engine's own account, judged both by its clean path and by its resolved path against the resolved tree root, is the mesh's and gets its declared owner and mode. Outside the tree, through a link out of it, or owned by any other account, issue 339's rule stands. Tests: TestADirectoryInTheMeshsOwnTreeMadeByTheEngineIsTheMeshs, TestALinkInTheMeshsTreeLeadingOutOfItIsNotTheTree (both failed first). 2. 0d12fb1: postgres's container on ace was replaced before its superuser.secret was filled, and the container runtime made the missing bind source a directory, so the file can never be written ('read .../superuser.secret: is a directory'). (a) A container whose mount source is a declared file not yet on disk is neither created nor replaced until the fill writes it; the fill re-applies it (WriteFilled, readsChange). (b) A declared file whose path is an EMPTY directory in the mesh's tree (by path and resolved path) owned by the engine's account is removed and the file written, said in the outcome. Never a non-empty directory, never outside the tree. Tests: TestAContainerWaitsForAFileItMountsAndIsMadeWhenTheFillLands, TestAnEmptyDirectoryTheRuntimeLeftAtAFilesPathIsReplacedByTheFile (both failed first). Try build-1792700985531116446 PASS. What the operator sees: the node-engine is delivered to ace, g14, novox and shanks; on ace /var/lib/mesh/postgres becomes ace's and the store's secret a file again, without a hand step; then novox's held postgres move can be released. Reviewed-by: review-1873-engine@shanks at 0d12fb11a48be930b5b7b7660425db109f66b9a9
mesh-tools added 3 commits 2026-10-22 20:33:00 +00:00
Take a directory in the mesh's own tree that the engine's account owns as the mesh's, not as found (issue 1873) cdbff1777e 
postgres's data directory moved to /var/lib/mesh/postgres. On ace and novox that
directory was there, root:root 0700, before the directory resource was applied, so
the engine used it as found (issue 339's rule) and left it to root: the postgres
provider, running as the operator's account, cannot reach its own secrets,
consumers and grants there.

/var/lib/mesh is the engine's tree (root, 0755): only the engine's account makes a
directory in it. A directory below it owned by that account is now the mesh's and
is given its declared owner and mode. Anywhere else, or owned by another account,
issue 339's rule stands.
Judge the mesh's tree by where a path leads, not only by its text (issue 1873, review) 03b9c47af4 
A root-only link inside /var/lib/mesh pointing out of it would have made a
directory outside the tree, owned by the engine's account, the mesh's to give
away: the fault of issue 1873 again. The path and the tree's root are now both
resolved, links followed, and the directory is the tree's only when the resolved
path lies below the resolved root as well.
Make no container before a file it mounts is there, and clear the empty directory a runtime left at a file's path (issue 1873)
mesh/merge-gate head 0d12fb11a48b merged into trunk 59e6a6fa2a4a — pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes wi…
Details
mesh/repo-check head 0d12fb11a48b merged into trunk 59e6a6fa2a4a — pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details
mesh/check failed: mesh-build-go: no go build node qualifies: builders disagree: go1.27.1-X:nodwarf5 recipe 74744709d277ded9 on ace, g14, shanks; go1.…
0d12fb11a4 
On ace the postgres container was replaced at 22:11:51 mounting superuser.secret, a
file the provisioner's client fills only after the apply. The runtime made the
missing source a directory, and every fill after it failed with "is a directory".

A container whose mount source is a file the declaration declares, not yet on the
machine, now waits and is neither created nor replaced. The write of that file
(WriteFilled) applies what reads it, as before, so the container is made once the
file is there.

What the runtime already left is cured by the mesh: a declared file whose path is
an empty directory in the mesh's own tree (by its path and by where it leads),
owned by the engine's account, has that directory removed before the file is
written, and the outcome says so. A directory with anything in it, or outside the
tree, is never removed.
mesh-tools commented 2026-10-22 20:33:13 +00:00
Author
Member
Copy Link
Copy Source

Delivery novox/mesh-host@0d12fb11a48b — delivered since 2026-10-22T20:44:29Z

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine

Machines

  • mesh-host on every machine running it: sent

Transitions

  • 2026-10-22 20:33 (new) → proposed (announced): novox/mesh-host#131's head announced
  • 2026-10-22 20:36 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
  • 2026-10-22 20:36 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
  • 2026-10-22 20:41 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
  • 2026-10-22 20:41 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
  • 2026-10-22 20:44 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-host@0d12fb11a48b` — **delivered** since 2026-10-22T20:44:29Z **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine **Machines** - mesh-host on every machine running it: sent **Transitions** - 2026-10-22 20:33 (new) → proposed (announced): novox/mesh-host#131's head announced - 2026-10-22 20:36 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-22 20:36 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-22 20:41 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-22 20:41 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-22 20:44 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.
mesh-tools commented 2026-10-22 20:36:51 +00:00
Author
Member
Copy Link
Copy Source

Merge check at 0d12fb11
Judged: head 0d12fb11a48b merged into trunk 59e6a6fa2a4a; read beside it: mesh-catalog 66c404fd39a5, mesh-controller f2a4363a1a77, mesh-controller-main f2a4363a1a77, mesh-tools e0fadc43d9dd

  • mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)
  • mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

  • tier 0: mesh-host
  • ace: receives mesh-host
  • g14: receives mesh-host
  • novox: receives mesh-host
  • shanks: receives mesh-host
  • grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine
  • read by no module's build: internal/apply/mesh_tree_found_test.go, internal/apply/mount_waits_test.go

Run by the build seat on ace as build-1792701185306923648 (builds --log build-1792701185306923648).

--- the gate: mesh-host
mesh-host: ok
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T20:16:54Z says they run
composing every machine as the mesh is
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
composing every machine with the change
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued
HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-22T20:16:54Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host

notes:
  - internal/apply/mesh_tree_found_test.go and internal/apply/mount_waits_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.015s
ok  	github.com/novox/mesh-host/cmd/mesh-host	6.168s
ok  	github.com/novox/mesh-host/examples	1.048s
ok  	github.com/novox/mesh-host/internal/accounts	1.587s
ok  	github.com/novox/mesh-host/internal/apply	5.473s
ok  	github.com/novox/mesh-host/internal/bootstrap	4.436s
ok  	github.com/novox/mesh-host/internal/bundle	1.031s
ok  	github.com/novox/mesh-host/internal/filling	1.755s
ok  	github.com/novox/mesh-host/internal/firewall	1.657s
ok  	github.com/novox/mesh-host/internal/identity	1.115s
ok  	github.com/novox/mesh-host/internal/image	1.033s
ok  	github.com/novox/mesh-host/internal/inventory	1.070s
ok  	github.com/novox/mesh-host/internal/link	12.149s
ok  	github.com/novox/mesh-host/internal/liveness	2.114s
ok  	github.com/novox/mesh-host/internal/meshcli	1.567s
ok  	github.com/novox/mesh-host/internal/network	1.051s
ok  	github.com/novox/mesh-host/internal/outward	1.042s
ok  	github.com/novox/mesh-host/internal/profile	1.782s
ok  	github.com/novox/mesh-host/internal/reachable	1.019s
ok  	github.com/novox/mesh-host/internal/store	1.209s
ok  	github.com/novox/mesh-host/internal/system	1.021s
ok  	github.com/novox/mesh-host/internal/tunnel	1.024s
ok  	github.com/novox/mesh-host/internal/units	1.018s
ok  	github.com/novox/mesh-host/internal/upgrade	1.140s
ok  	github.com/novox/mesh-host/internal/witness	4.616s
ok  	github.com/novox/mesh-host/packaging	1.011s
?   	github.com/novox/mesh-host/rootsearch	[no test files]
**Merge check** at `0d12fb11` Judged: head `0d12fb11a48b` merged into trunk `59e6a6fa2a4a`; read beside it: mesh-catalog `66c404fd39a5`, mesh-controller `f2a4363a1a77`, mesh-controller-main `f2a4363a1a77`, mesh-tools `e0fadc43d9dd` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine - read by no module's build: internal/apply/mesh_tree_found_test.go, internal/apply/mount_waits_test.go Run by the build seat on ace as `build-1792701185306923648` (`builds --log build-1792701185306923648`). ``` --- the gate: mesh-host mesh-host: ok long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-22T20:16:54Z says they run composing every machine as the mesh is HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus composing every machine with the change HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on f35; sealed by the controller until the vault holds it: mesh-provisioner-client — own/f35/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on idt; sealed by the controller until the vault holds it: mesh-provisioner-client — own/idt/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus HELD: the vault did not answer for the core's credentials on ygcyr; sealed by the controller until the vault holds it: mesh-provisioner, mesh-provisioner-client, nats — own/ygcyr/mesh-provisioner/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus; own/ygcyr/nats/broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus the bus's user list leaves out 12 user(s) the mesh has minted no credential for: controller, node.f35, f35.pacman.keeper, node.idt, idt.pacman.keeper, node.ygcyr, ygcyr.mesh-mail.send, ygcyr.only-office.converter, ygcyr.pacman.keeper, node.yvbpsm, yvbpsm.brother.device, yvbpsm.pacman.keeper. Each is a user that cannot connect until one is issued HELD: the vault did not answer for the core's credentials on yvbpsm; sealed by the controller until the vault holds it: mesh-provisioner-client — own/yvbpsm/mesh-provisioner-client/provisioner-broker: this control plane has no MESH_BUS_NATS, so it cannot reach the mesh's bus merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-22T20:16:54Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-config, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-provisioner, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-host notes: - internal/apply/mesh_tree_found_test.go and internal/apply/mount_waits_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.015s ok github.com/novox/mesh-host/cmd/mesh-host 6.168s ok github.com/novox/mesh-host/examples 1.048s ok github.com/novox/mesh-host/internal/accounts 1.587s ok github.com/novox/mesh-host/internal/apply 5.473s ok github.com/novox/mesh-host/internal/bootstrap 4.436s ok github.com/novox/mesh-host/internal/bundle 1.031s ok github.com/novox/mesh-host/internal/filling 1.755s ok github.com/novox/mesh-host/internal/firewall 1.657s ok github.com/novox/mesh-host/internal/identity 1.115s ok github.com/novox/mesh-host/internal/image 1.033s ok github.com/novox/mesh-host/internal/inventory 1.070s ok github.com/novox/mesh-host/internal/link 12.149s ok github.com/novox/mesh-host/internal/liveness 2.114s ok github.com/novox/mesh-host/internal/meshcli 1.567s ok github.com/novox/mesh-host/internal/network 1.051s ok github.com/novox/mesh-host/internal/outward 1.042s ok github.com/novox/mesh-host/internal/profile 1.782s ok github.com/novox/mesh-host/internal/reachable 1.019s ok github.com/novox/mesh-host/internal/store 1.209s ok github.com/novox/mesh-host/internal/system 1.021s ok github.com/novox/mesh-host/internal/tunnel 1.024s ok github.com/novox/mesh-host/internal/units 1.018s ok github.com/novox/mesh-host/internal/upgrade 1.140s ok github.com/novox/mesh-host/internal/witness 4.616s ok github.com/novox/mesh-host/packaging 1.011s ? github.com/novox/mesh-host/rootsearch [no test files] ```
mesh-tools merged commit 48c3e3834c into main 2026-10-22 20:41:09 +00:00
mesh-tools deleted branch fix/1873-mesh-tree-dirs 2026-10-22 20:41:09 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
mesh/ready
Reviewed and ready: mesh-delivery merges at the marked head once its checks pass (hq ADR 0364)
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
agent-ace agent-g14 agent-novox agent-shanks jschoubben mesh-tools miel.truyen nox-agent
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-host#131