Renew the engine placed by hand to the proved build, and take a hand-over from the controller's terminal (hq issue 356) #74
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: novox/mesh-host#74
Reference in New Issue
Block a user
hq issue 356 (hq pull request named in the thread once open). On 2026-10-09 at 18:01 the operator typed the node-engine's
hand-overon the control-node, as a condition told them to, and the engine on PATH answered "unexpected argument":/usr/bin/nox-mesh-hostis the engine a person copied at installation, every delivered engine runs from the versions directory, and nothing ever renewed the file on PATH. And the hand-over itself was a terminal act at the machine with no channel.Reviewers' checklist
AnswerHandOver(internal/link/handover.go) bounds the ask (8 KiB), refuses one that is not a hand-over, refuses nobody asking, a name over one line or 200 bytes or holding NUL, and no directory — before the handler sees anything.handOverFound(cmd/mesh-host/found.go) then judges the path: absolute;filepath.Clean(path) == path(so no.., no doubled or trailing separator); one the node's state records as used as found; on disk a directory and not a link;EvalSymlinks(path) == path(reached through no link). Nothing is recorded unless all pass.mesh.node.<node>.ask.hand-over, which only the controller may publish (mesh.node.>is the controller's grant; the node's grant for the subject and the right to answer are in mesh-controller's PR). The controller runsnode hand-overonly as its terminal (anodesubcommand that is not a read is refused through every verb and through mesh-cli outside the terminal). The engine runs nothing it is sent; its one act is the record the next apply reads, ashand-overtyped at the machine already did.TestTheFallbackBecomesACopyOfTheProvedEngine(bytes, mode 0755, running file untouched; already a copy → same inode, no temp file),TestAnEngineRunningFromTheFallbackRenewsNothing(SameFile),TestAMissingFallbackIsPlaced,TestALinkAtTheFallbackIsRefusedAndLeft(link refused, target untouched, link kept),TestAnUnreadableRunningEngineIsSaid,TestTheFallbackPathIsTheLaunchers(internal/upgrade);TestTheHandOverAskAndAnswerKeepTheirFieldNames,TestAHandOverAskIsJudgedBeforeAnythingIsRecorded(seven refusals, each counted as never reaching the handler) (internal/link);TestHandOverRecordsOnlyAFoundDirectory(the subcommand and the controller's ask are one judgement; who asked is recorded),TestAHandOverIsRefusedForEveryPathThatIsNotTheFoundDirectory(nine refusals, nothing recorded, the exact path taken),TestAFoundDirectoryIsStatedUnhealthy(the statement namesnox node hand-over <node> <directory>on the control-node, never the binary, never the path) (cmd/mesh-host).What changes
upgrade.RenewFallback(internal/upgrade/fallback.go): when a build is proved (the mesh took a report under it — the same evidenceknown-goodis written on,proving.heardincmd/mesh-host/witnessing.go), the engine copies itself over the launcher's fallback (MESH_HOST_BIN, default/usr/bin/nox-mesh-host, the same variable the launcher reads) when the bytes differ: a copy, renamed into place, mode 0755 — never a link (ADR 0012), never a write through one, nothing while the engine runs from the fallback itself. Chosen over an exec-shim: the launcher runs that file as the engine while nothing is delivered (a shim there would run itself), and which version runs is the launcher's policy. The launcher is unchanged.link.HandOvers/HearHandOvers(internal/link/hearing_nats.go): a request subscription onmesh.node.<node>.ask.hand-over, answered once on the reply it carried withHandOverAnswer{said|refused};Queue.HandOveris the engine's judgement (handOverFrom), wired inrun.gobeside the report ask. Field names held on both sides. The engine's ownhand-over <dir>stays, for a machine no mesh can reach, through the samehandOverFound.nox node hand-over <node> <directory>on the control-node; the path stays the resource's target (evidence), never in the reason the operator's channel says. The usage says the binary is a daemon, the operator's command isnox, and the subcommands are install-time and rescue, run as root at the machine; the README says the same and uses the binary's real name.Checks.
make check(fmt, vet,go test ./..., the launcher's, rollback's and roused tests, build) passed locally on this tree before the issue was renumbered 353→356 (comments and the README only since);go testofinternal/upgrade,internal/link,cmd/mesh-hostandgo build ./...pass ate74ee82. Not merged; nothing pushed to a node.Order. mesh-controller's PR first (it composes the node's grant for the subject and the right to answer; an engine delivered before it has its subscription refused and says so, and
nox node hand-overthen says nothing on the node answers), then this. mesh-catalog's and hq's PRs in any order. After both are live:nox node hand-over <control-node> <the messenger's data directory>on the control-node, then its next apply.Delivery
novox/mesh-host@8fc1d72cd546— failed since 2026-10-09T18:07:48ZDelivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step
Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition:git log --notes=mesh-plan.The record: hq #256 (issue 356 — renumbered from 353, which another branch took first; the code says 356). The controller's side is mesh-controller #187 (merge first: the node's grant), the catalogue's check mesh-catalog #165.
Merge check at
e74ee82amesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step
Run by the build seat on g14 as
build-1791563763968800353(builds --log build-1791563763968800353).Review addressed — head
fc6c5a9(main has not moved sinceb0d03be, so the branch is the merge result).Forgeable ask (blocking).
AnswerHandOver(check, handle, body)now verifiesSignedHandOverwithm.Signer(the keyhandleBodyverifies declarations with, carried intonatsLink.signer) overHandOverContext+ the ask's bytes before reading anything out of the ask; then refuses an ask for another node, expired, with no expiry, good for longer than 1m + 1m skew, without a nonce of ≥16 bytes, or whose nonce was taken (process-wideHandOverNonces, each kept until its ask expires — a reconnect is no replay; a restart can replay only within the minute, and recording the same hand-over again is idempotent). An engine with no key believes nothing.HandOverReplyis the subscription's whole body: no reply subject → nothing judged, recorded or said.Apply follows a link (blocking). A handed-over directory now goes through
applyHandedOver:EvalSymlinks(path) == pathat apply time, thengiveHandedOver— one descriptor fromopenUnderAs("/", path, kindDir)(every componentopenatO_NOFOLLOW|O_DIRECTORY from /, judged by fstat),Fchmod/Fchownon it. Nothing is changed by path.TestAHandedOverDirectoryIsChangedThroughNoLinkswaps the parent, the grandparent and the directory itself for links to a victim tree after the hand-over: refused, the victim keeps mode 0700, and the error names which check refused.TestGiveHandedOverFollowsNoLinkholds the descriptor walk alone.Test gaps.
TestAHandOverIsAnsweredOnlyWhenItCarriesAReply(reply guard),TestALinkThatHearsHandOversIsGivenTheQueues(run.go hook, throughserve),TestNatsAHandOverIsAskedOfTheNode(real server: answered on its own subject, another node's unheard, a publish with no reply handled by nobody — run locally against a throwaway nats-server, skipped without MESH_TEST_NATS as the other Nats tests),TestOnlyAnAccountUnderThisBuildProvesItnow assertsrenewFallbackran (fallback = this test binary's bytes, said) and that nothing before the proof renewed it — and pointsMESH_HOST_BINat a temp file, so a test run as root never writes/usr/bin.TestAFallbackThatIsNotARegularFileIsRefused(a directory at the fallback; a directory as the running engine). The redundant same-file case inRenewFallbackis gone (same bytes covers it).Mutations: 27 checks each removed in turn, 27 killed (signature, no key, context, node, expired, too long, nonce shape, replay, nonce prune, by empty/line, no path, size, reply guard, run.go hook, the NATS respond, apply re-check, apply descriptor, handed-over branch, fallback not-regular/self not-regular/link/same-bytes, renewFallback called, path clean/link/through-link).
Checks:
make checkandmerge-check.shexit 0 atfc6c5a9.Merge check at
fc6c5a92mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step
Run by the build seat on ace as
build-1791567965774413759(builds --log build-1791567965774413759).Confirmation review addressed. Head
9a807de.The hand-over is now checked before the
oursshortcut inapplyDirectory:if existed && HandedOver()[handOverKey(r.ID, r.Path)] { return applyHandedOver(...) }. A handed-over directory therefore goes through the re-check and the no-link descriptor on every apply, not only the first. Before this, after the first apply the record was no longer as found, so the directory read as the mesh's own and later applies usedchmodDirPathandownby path.TestAHandedOverDirectoryIsChangedThroughNoLinkgains two cases: the parent, and the grandparent, swapped for a link after an apply already gave the directory its mode (the record is checked to be no longer as found first). With the old branch order both new cases fail ("a handed-over directory reached through a link was applied"); with the fix both pass.make checkandmerge-check.shexit 0 at9a807de. Main has not moved sinceb0d03be, so the branch is the merge result.The same by-path gap for ordinary mesh directories outside a home is older than this issue and is not fixed here. It is recorded as hq issue 358 (hq #258).
Merge check at
9a807de6mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestTheSetuidSearchRunsInTheBackgroundAndIsKeptForItsInterval (0.00s)Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step
Run by the build seat on shanks as
build-1791568726990600635(builds --log build-1791568726990600635).9a807dewas rejected by mesh/repo-check, and not because of this change. The failing test isinternal/accountsTestTheSetuidSearchRunsInTheBackgroundAndIsKeptForItsInterval, which this branch never touched. The same test fails on main (b0d03be) too.Cause:
SetuidCache.Lookcompares the caller'snowwithc.at, butc.atwas read from the wall clock (time.Now()) when the search finished. The test's clock is a fixed date (2026-10-08 19:00 UTC). Its look at +24h is due only while the wall clock is earlier than 18:00 UTC on 2026-10-09. From then on the test fails on every branch; it passed at 17:48 and failed at 18:00.Effect on a machine: it is the same defect. A caller whose clock runs behind the wall clock never searches again.
Fix: a separate commit, head
8fc1d72. A search's time (at,failedAt) is now thenowit was started at, so there is one clock, the caller's. A result reads at most one search older than it is, which errs towards searching again. The test fails without the fix and passes with it (5 runs).merge-check.shandmake checkexit 0 at8fc1d72. Main has not moved.Merge check at
8fc1d72cmesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)mesh/repo-check: PASS — its merge-check.sh passedDelivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step
Run by the build seat on g14 as
build-1791569060643270655(builds --log build-1791569060643270655).