Give every module an identity and keep shared folders through ACL entries (hq ADR 0325, issue 567) #93

Merged

mesh-admin merged 10 commits from feat/325-identities-and-kept-folders into main 2026-10-12 17:50:59 +00:00

Conversation 3 Commits 10 Files Changed 39

+6854 -1615

mesh-admin commented 2026-10-12 17:24:55 +00:00

Contributor

Copy Link

Copy Source

Why: hq ADR 0325 (accepted with the operator's Approve, 2026-10-12) replaces ADR 0312's group grant: a module asks for data by name and use, the mesh gives each module its own identity, and keeps each shared folder usable by its users through POSIX ACL entries. Issue 567 (deliveries to the media machine failed on ADR 0312's group judgement; the controller half was reverted in mesh-controller #270).

What (node-engine half; the controller half is built separately and states nothing new until it is delivered):

• identities: system accounts mesh-<module> with controller-allocated numbers; never 0 or a root group; only what the engine made is removed. Containers told their identity by env (PUID/PGID) or --user.
• Kept folders: access + default ACL entries per user and use, mask set to what they need, owning group's entry kept at its former bits; owner, group, owner's and others' bits never changed; entries removed exactly per user. Linux xattr ACL encoder/decoder checked against the kernel.
• Take act on a signed warrant (mesh.node.<node>.ask.access-act, "novox-mesh access-act v2"), tied to a named filesystem; ZFS acltype set only inside the act.
• Missing folders made as their parent only on the placed filesystem; a disk not there (mount point present but unmounted, by mountinfo, fstab, systemd .mount units, zfs list, mounts seen) waits and holds its containers; root's folders never kept.
• Filesystems named by UUID (by-uuid st_rdev), else nonzero f_fsid, else mountinfo source; unnameable → never kept; a name not readable this look is unknown, never a move.
• inotify watch repairs a narrowed mask (capping other entries so no right widens), bounded sweep as backstop; leftovers reported as kept-entries until removed, forgotten after 30 days off their filesystem.
• ADR 0312 group-grant code removed (groups it recorded are taken back; ADR 0252 untouched).
• Compatibility: an access from a controller that does not send contract 5 (users/identities) is applied exactly as on main (legacyAccess, parity tests).

Checked: merge-check.sh green, whole suite under -race (bus tests need nats-server). Independent adversarial review over seven rounds; every finding fixed with a test that fails without it (mutation-checked); final verdict APPROVE ("comfortable with it running as root against the 12k-file ZFS library").

Delivery effects: node-engine restarts on ace, g14, novox, shanks; with today's controller nothing changes on any folder (legacy path). The health statement says contract 5.

**Why**: hq ADR 0325 (accepted with the operator's Approve, 2026-10-12) replaces ADR 0312's group grant: a module asks for data by name and use, the mesh gives each module its own identity, and keeps each shared folder usable by its users through POSIX ACL entries. Issue 567 (deliveries to the media machine failed on ADR 0312's group judgement; the controller half was reverted in mesh-controller #270). **What** (node-engine half; the controller half is built separately and states nothing new until it is delivered): - `identities`: system accounts `mesh-<module>` with controller-allocated numbers; never 0 or a root group; only what the engine made is removed. Containers told their identity by env (`PUID`/`PGID`) or `--user`. - Kept folders: access + default ACL entries per user and use, mask set to what they need, owning group's entry kept at its former bits; owner, group, owner's and others' bits never changed; entries removed exactly per user. Linux xattr ACL encoder/decoder checked against the kernel. - Take act on a signed warrant (`mesh.node.<node>.ask.access-act`, "novox-mesh access-act v2"), tied to a named filesystem; ZFS `acltype` set only inside the act. - Missing folders made as their parent only on the placed filesystem; a disk not there (mount point present but unmounted, by mountinfo, fstab, systemd .mount units, zfs list, mounts seen) waits and holds its containers; root's folders never kept. - Filesystems named by UUID (by-uuid st_rdev), else nonzero f_fsid, else mountinfo source; unnameable → never kept; a name not readable this look is `unknown`, never a move. - inotify watch repairs a narrowed mask (capping other entries so no right widens), bounded sweep as backstop; leftovers reported as `kept-entries` until removed, forgotten after 30 days off their filesystem. - ADR 0312 group-grant code removed (groups it recorded are taken back; ADR 0252 untouched). - **Compatibility**: an access from a controller that does not send contract 5 (`users`/`identities`) is applied exactly as on main (`legacyAccess`, parity tests). **Checked**: `merge-check.sh` green, whole suite under `-race` (bus tests need nats-server). Independent adversarial review over seven rounds; every finding fixed with a test that fails without it (mutation-checked); final verdict APPROVE ("comfortable with it running as root against the 12k-file ZFS library"). **Delivery effects**: node-engine restarts on ace, g14, novox, shanks; with today's controller nothing changes on any folder (legacy path). The health statement says contract 5.

mesh-admin added 9 commits 2026-10-12 17:24:55 +00:00

Give every module an identity and keep shared folders through ACL entries (hq ADR 0325, issue 567) ... 51e97a8c14

A module's containers ran as whatever their image chose and shared folders were
made writable by putting accounts in the folder's group (ADR 0312), which ADR 0325
supersedes. The engine now makes each declared module identity as a system account
with the controller's numbers, runs a container declaring `identity` as it, and keeps
each placed shared folder usable through one POSIX ACL entry per user, set through
the kernel's xattrs on descriptors it opened itself. A folder holding data is kept
only after the operator's warrant (the take act); a missing folder is made where its
data lives and waits where its disk is not; root's data is never kept. A watch and a
bounded sweep put back what an app narrows. The group grant is removed, and what it
put an account in is taken back.

Reuses the descriptor walks, the create act, the missing-path wait and the warrant-
backed act message from the paused issue 567 branch.

Judge a kept folder before every walk, and keep nothing a disk mounted over (hq ADR 0325 review) ... 2026ef36f3

A walk run while a dataset was unmounted wrote onto root's empty mount point, or
"dropped" entries from it and forgot the ones on the data; a folder kept while empty
below an unnamed mount was then swept whole once the disk mounted, with no warrant.
Every walk is now judged as an apply is, a changed mount judges the folder afresh, and
systemd .mount units and mounts seen are read for the first-sight rule. Widening a
mask caps the entries it limited, so the owning group gains nothing. The watch lets
go of removed folders, re-arms on lost notice, reads users under its lock and ends
with its context. A drop that cannot read an ACL is counted, a broken folder's words
carry no path, a grant's group that could not be left is tried again, and a folder's
stat is bounded.

Hold what mounts a missing disk, and say entries the mesh could not take out (hq ADR 0325 re-review) ... d2d9fbbd7d

A container was still created over an unmounted mount point, so its writes landed on
the filesystem below; a folder moved to another disk was kept on the old warrant; and
entries left by a drop or a move that could not run lived only in a log line. Every
container mounting an access whose disk is away now waits, the warrant holds only for
the filesystem it was carried out on (the wait names the new one, path-free), entries
left on a filesystem are recorded per mount and taken out when it is back, and every
leftover is said as unhealthy until it is. A hung stat is shared per path, and a
widened mask takes from other entries only the bits it adds.

Leave no leftover for a folder kept only while empty, and name filesystems by more than their mount point (hq ADR 0325 third review) ... f0adb177f0

A folder kept because it was empty, then covered by its disk, was said as unhealthy
leftover entries for ever: its entries sit on a hidden empty folder and grant nothing,
so they are now forgotten, and only entries walked onto data under a warrant are kept
to be taken out. A warrant and a kept folder now name their filesystem by mount point,
source and type, so another pool at the same point is a move; records naming a mount
point are read as its name. A record with no access ids is said under a path-free name.

Format the third review's tests (hq ADR 0325) 21cd036232

Name a filesystem by its kernel id, never its device name (hq ADR 0325 fourth review) ... f00f9c2a2f

An ext4 or xfs library mounted by UUID can come back from a reboot as another device
(/dev/sdb1 as /dev/sdc1); naming the filesystem by mountinfo's source read that as a
move, stripped the warranted library's entries and asked for a new Approve. A
filesystem is now named by statfs's f_fsid (from the UUID, or the ZFS dataset), its
type and its mount point. Entries left on the filesystem a folder is on now are
merged back or held, never walked away, and a TakenOn naming a mount point is not
taken.

Name a filesystem by its UUID, its kernel id or its source, and keep nothing that has no name (hq ADR 0325 fifth review) ... 46c16e18fe

NFS and FUSE report a zero f_fsid, so another export or another FUSE mount at the
same point was named alike and kept without a warrant; xfs's f_fsid follows the
device number. A filesystem is now named by its UUID (its device matched in
/dev/disk/by-uuid), else a nonzero f_fsid, else mountinfo's source; one that cannot
be named is never kept or taken. Entries left on a filesystem not back within 30 days
are forgotten, said once, and the naming read is shared per mount.

Read a filesystem that could not be named as unknown, never as a move (hq ADR 0325 sixth review) ... 2ff40109ac

A name read that timed out gave an empty name, which differed from the recorded one
and so reset the record: a folder kept while empty asked again, a warranted one was
walked again. An unnamed filesystem now leaves the folder exactly as it is, the
access is said not known for that look, and it resumes once it is named.

Apply an older controller's accesses exactly as before (hq ADR 0325) ... c85c2804a0

The engine delivers before the controller half, and today's controller sends no
identities, users or taken. Keeping now starts only for an access whose folder has
users, or a declaration with identities; every other access is mounted when present
and refused when absent as on main, with nothing made, kept, held or judged. A
leftover whose walk could not run says why, not always that its disk is away.

mesh-admin commented 2026-10-12 17:25:16 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-host@d12bba01090d — delivered since 2026-10-12T17:55:03Z

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

• tier 0: mesh-host
• ace: receives mesh-host
• g14: receives mesh-host
• novox: receives mesh-host
• shanks: receives mesh-host
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine

Machines

• mesh-host on ace: passed — healthy 3 times over 2m25s
• mesh-host on the rest running it: sent

Transitions

• 2026-10-12 17:35 (new) → proposed (announced): novox/mesh-host#93's head announced
• 2026-10-12 17:37 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-12 17:37 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-12 17:51 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-12 17:51 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit
• 2026-10-12 17:55 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-host@d12bba01090d` — **delivered** since 2026-10-12T17:55:03Z **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine **Machines** - mesh-host on ace: passed — healthy 3 times over 2m25s - mesh-host on the rest running it: sent **Transitions** - 2026-10-12 17:35 (new) → proposed (announced): novox/mesh-host#93's head announced - 2026-10-12 17:37 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-12 17:37 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-12 17:51 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-12 17:51 published → delivering (go): its walk started: let go by this owner in its group's order, by a person, or on the controller's own path — not a failed walk that carried a later commit for it, after which it waits for a walk of its own commit - 2026-10-12 17:55 delivering → delivered (done): its walk is done, carrying its own commit: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin commented 2026-10-12 17:27:23 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at c85c2804
Judged: head c85c2804a010 merged into trunk dd9ab7927d96; read beside it: mesh-catalog 23ea0f431faf, mesh-controller ba685b17f5e1, mesh-controller-main ba685b17f5e1, mesh-tools 954e1a53eef9

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)
• mesh/repo-check: FAIL — its merge-check.sh failed: --- FAIL: TestAnAccessTheMeshMayNotKeepYetIsSaidAsAWaitOfItsOwnKind (0.00s); and TestAKeptFolderCarriesAnEntryPerUserAndNothingElseOfItChanges, TestTheToolRunnersEntryIsTheWidestUseAnyModuleGivesIt, TestWhatIsMadeInAKeptFolderIsGivenItsUsersRights, TestAFolderThatHoldsDataIsTakenOnlyOnAWarrantAndLetGoEntryByEntry, TestAMissingFolderIsMadeWhereItsDataLivesAndWaitsWhereItsDiskIsNot and 21 more

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

• tier 0: mesh-host
• ace: receives mesh-host
• g14: receives mesh-host
• novox: receives mesh-host
• shanks: receives mesh-host
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine
• read by no module's build: cmd/mesh-host/grants_test.go, cmd/mesh-host/kept_test.go, cmd/mesh-host/units_test.go, internal/apply/access_test.go, internal/apply/grants_test.go, internal/apply/identities_test.go, internal/apply/kept_test.go, internal/apply/mesh_names_test.go, internal/apply/oldshape_test.go, internal/apply/reads_test.go, internal/apply/vocabulary_test.go, internal/declaration/identity_test.go, internal/link/access_act_test.go

Run by the build seat on ace as build-1791825908540629227 (builds --log build-1791825908540629227).

files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T17:18:24Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T17:18:24Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host

notes:
  - cmd/mesh-host/grants_test.go, cmd/mesh-host/kept_test.go, cmd/mesh-host/units_test.go, internal/apply/access_test.go, internal/apply/grants_test.go, internal/apply/identities_test.go, internal/apply/kept_test.go, internal/apply/mesh_names_test.go, internal/apply/oldshape_test.go, internal/apply/reads_test.go, internal/apply/vocabulary_test.go, internal/declaration/identity_test.go and internal/link/access_act_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.013s

this machine's tunnel key, made here; the private half stays in /tmp/TestKeyMakesTheTunnelKeyOnceAndKeepsIt4258774180/001/overlay.key.
Issue the token for it — `token issue --new <name> --overlay-key <the line above>` — and enrol with that token.

this machine's tunnel key, made here; the private half stays in /tmp/TestATokenThroughTheTunnelTakesItsOwnKey4141738697/001/overlay.key.
Issue the token for it — `token issue --new <name> --overlay-key <the line above>` — and enrol with that token.
--- FAIL: TestAnAccessTheMeshMayNotKeepYetIsSaidAsAWaitOfItsOwnKind (0.00s)
    kept_test.go:39: not waiting with one wait: {state:unhealthy reason:it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12) waits:[] act:<nil> entries:[]}
flag provided but not defined: -jsom
nox-mesh-host — the node-engine

A daemon: its launcher runs it, and it applies what the mesh declares for this machine. The
operator's command is nox (mesh-cli), on any node, from their own account (novox/hq ADR 0272);
the subcommands here are for installing a machine, joining it, and rescuing one no mesh can
reach, run as root at the machine.

  profile     what this machine can be asked to do
  inventory   what this machine is, and what it holds
  apply FILE  make this machine match a declaration from a file
  reconcile   make this machine match what the mesh last told it — or, before any
              mesh has, the bundle this host carries
  bundle      show what this host carries
  key         make this machine's tunnel key, or read the one it made, and print the public
              half: what its join token is issued for (novox/hq ADR 0169)
  enrol --token T  join the mesh — through the tunnel when the token was issued for a key
  overlay take  take over the tunnel found here (novox/hq ADR 0105): its key becomes this
              node's overlay key and the mesh is told, signed; --tunnel <iface> when several are up
  owned       what this host has applied and still owns
  hand-over <dir>  hand a directory used as found to the mesh: the next apply gives it its declared
              owner and mode. The operator's line is nox node hand-over <node> <dir> on the
              control-node; this is the same act for a machine with no mesh to reach
  judge-directories  which directories this node is declared the walk that follows no link another
              account could make would refuse, read-only (novox/hq issue 358); run as root
  version

  --json      machine-readable output
  --timeout   how long any single probe may take (default 10s)
  --state     where this node keeps what it knows (default /var/lib/mesh-host/state.json)
  --dry-run   say what applying would change, and change nothing

Both apply and reconcile say what they would change before changing anything, and refuse a
declaration for the other mode than this node is in, or one older than what the mesh last said.

It connects to nothing and listens on nothing. What it applies comes from a file.
FAIL
FAIL	github.com/novox/mesh-host/cmd/mesh-host	4.721s
ok  	github.com/novox/mesh-host/examples	1.018s
ok  	github.com/novox/mesh-host/internal/accounts	1.496s
--- FAIL: TestAKeptFolderCarriesAnEntryPerUserAndNothingElseOfItChanges (0.00s)
    kept_test.go:144: an empty folder was not kept: applying "radarr.movies": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed, and one other resource also failed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestTheToolRunnersEntryIsTheWidestUseAnyModuleGivesIt (0.00s)
    kept_test.go:199: applying "reader.books": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed, and one other resource also failed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestWhatIsMadeInAKeptFolderIsGivenItsUsersRights (0.00s)
    kept_test.go:219: applying "radarr.downloads": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestAFolderThatHoldsDataIsTakenOnlyOnAWarrantAndLetGoEntryByEntry (0.00s)
    kept_test.go:319: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestAMissingFolderIsMadeWhereItsDataLivesAndWaitsWhereItsDiskIsNot (0.00s)
    kept_test.go:428: a missing folder under a mounted dataset was not made: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestTheSweepPutsBackWhatAnAppNarrowedAndCoversTheFolderOverLooks (0.00s)
    kept_test.go:479: applying "sonarr.shows": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestNoWalkRunsWhereTheDiskIsNotThere (0.00s)
    kept_test.go:617: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestADiskMountedOverAFolderKeptEmptyIsNotKeptWithoutAWarrant (0.00s)
    kept_test.go:659: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestWideningTheMaskGivesTheOwningGroupNothingMore (0.00s)
    kept_test.go:707: applying "sonarr.shows": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestTheWatchOfAFolderRemovedIsLetGo (0.00s)
    kept_test.go:761: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestNoticeLostReArmsTheWatch (0.00s)
    kept_test.go:775: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestUsersGivenWhileNoticesAreHeardAreReadUnderTheLock (0.00s)
    kept_test.go:791: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestTheWatchEndsWithItsContext (0.00s)
    kept_test.go:817: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestAContainerWaitsWhileItsAccessesDiskIsNotThere (0.00s)
    kept_test.go:887: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestEntriesThatCouldNotBeDroppedAreSaidUntilTheyAre (0.00s)
    kept_test.go:916: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestEntriesLeftOnAFilesystemNoLongerAtTheFolderAreDroppedWhenItIsBack (0.00s)
    kept_test.go:953: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestAFolderKeptEmptyLeavesNoLeftoverWhenADiskMountsOverIt (0.00s)
    kept_test.go:998: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestAnotherFilesystemAtTheSameMountPointIsNotTaken (0.00s)
    kept_test.go:1076: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestADeviceRenamedIsTheSameFilesystem (0.00s)
    kept_test.go:1094: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestAMovedFolderIsNotTakenOnTheOldWarrant (0.00s)
    kept_test.go:1124: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestEntriesLeftOnTheFilesystemTheFolderIsOnAreNeverWalkedAway (0.00s)
    kept_test.go:1193: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestATakenOnOfTheOldFormIsNotTaken (0.00s)
    kept_test.go:1230: an old-form record is read as taken: root
--- FAIL: TestAnNFSExportIsNamedByItsSource (0.00s)
    kept_test.go:1278: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestAFilesystemsUUIDNamesItBeforeItsFsid (0.00s)
    kept_test.go:1320: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestAFilesystemNotNamedThisTimeIsNeverAMove (0.00s)
    kept_test.go:1402: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
--- FAIL: TestALeftoverSaysWhyItsWalkCouldNotRun (0.00s)
    oldshape_test.go:123: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
        
        0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done.
FAIL
FAIL	github.com/novox/mesh-host/internal/apply	4.114s
ok  	github.com/novox/mesh-host/internal/bootstrap	1.661s
ok  	github.com/novox/mesh-host/internal/bundle	1.014s
ok  	github.com/novox/mesh-host/internal/declaration	1.070s
ok  	github.com/novox/mesh-host/internal/firewall	1.705s
ok  	github.com/novox/mesh-host/internal/identity	1.174s
ok  	github.com/novox/mesh-host/internal/image	1.074s
ok  	github.com/novox/mesh-host/internal/inventory	1.016s
ok  	github.com/novox/mesh-host/internal/link	10.532s
ok  	github.com/novox/mesh-host/internal/liveness	2.174s
ok  	github.com/novox/mesh-host/internal/meshcli	1.587s
ok  	github.com/novox/mesh-host/internal/network	1.108s
ok  	github.com/novox/mesh-host/internal/outward	1.076s
ok  	github.com/novox/mesh-host/internal/profile	1.532s
ok  	github.com/novox/mesh-host/internal/reachable	1.094s
ok  	github.com/novox/mesh-host/internal/store	1.256s
ok  	github.com/novox/mesh-host/internal/system	1.095s
ok  	github.com/novox/mesh-host/internal/tunnel	1.097s
ok  	github.com/novox/mesh-host/internal/units	1.054s
ok  	github.com/novox/mesh-host/internal/upgrade	1.198s
ok  	github.com/novox/mesh-host/internal/witness	4.707s
ok  	github.com/novox/mesh-host/packaging	1.091s
?   	github.com/novox/mesh-host/rootsearch	[no test files]
ok  	github.com/novox/mesh-host/validate	1.093s
FAIL
--- what failed, picked from the whole of its output (the whole is in the build's log)
--- FAIL: TestAnAccessTheMeshMayNotKeepYetIsSaidAsAWaitOfItsOwnKind (0.00s)
    kept_test.go:39: not waiting with one wait: {state:unhealthy reason:it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12) waits:[] act:<nil> entries:[]}
FAIL	github.com/novox/mesh-host/cmd/mesh-host	4.721s
--- FAIL: TestAKeptFolderCarriesAnEntryPerUserAndNothingElseOfItChanges (0.00s)
    kept_test.go:144: an empty folder was not kept: applying "radarr.movies": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed, and one other resource also failed
--- FAIL: TestTheToolRunnersEntryIsTheWidestUseAnyModuleGivesIt (0.00s)
    kept_test.go:199: applying "reader.books": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed, and one other resource also failed
--- FAIL: TestWhatIsMadeInAKeptFolderIsGivenItsUsersRights (0.00s)
    kept_test.go:219: applying "radarr.downloads": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestAFolderThatHoldsDataIsTakenOnlyOnAWarrantAndLetGoEntryByEntry (0.00s)
    kept_test.go:319: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestAMissingFolderIsMadeWhereItsDataLivesAndWaitsWhereItsDiskIsNot (0.00s)
    kept_test.go:428: a missing folder under a mounted dataset was not made: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestTheSweepPutsBackWhatAnAppNarrowedAndCoversTheFolderOverLooks (0.00s)
    kept_test.go:479: applying "sonarr.shows": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestNoWalkRunsWhereTheDiskIsNotThere (0.00s)
    kept_test.go:617: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestADiskMountedOverAFolderKeptEmptyIsNotKeptWithoutAWarrant (0.00s)
    kept_test.go:659: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestWideningTheMaskGivesTheOwningGroupNothingMore (0.00s)
    kept_test.go:707: applying "sonarr.shows": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestTheWatchOfAFolderRemovedIsLetGo (0.00s)
    kept_test.go:761: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestNoticeLostReArmsTheWatch (0.00s)
    kept_test.go:775: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestUsersGivenWhileNoticesAreHeardAreReadUnderTheLock (0.00s)
    kept_test.go:791: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestTheWatchEndsWithItsContext (0.00s)
    kept_test.go:817: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestAContainerWaitsWhileItsAccessesDiskIsNotThere (0.00s)
    kept_test.go:887: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestEntriesThatCouldNotBeDroppedAreSaidUntilTheyAre (0.00s)
    kept_test.go:916: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestEntriesLeftOnAFilesystemNoLongerAtTheFolderAreDroppedWhenItIsBack (0.00s)
    kept_test.go:953: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestAFolderKeptEmptyLeavesNoLeftoverWhenADiskMountsOverIt (0.00s)
    kept_test.go:998: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestAnotherFilesystemAtTheSameMountPointIsNotTaken (0.00s)
    kept_test.go:1076: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestADeviceRenamedIsTheSameFilesystem (0.00s)
    kept_test.go:1094: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestAMovedFolderIsNotTakenOnTheOldWarrant (0.00s)
    kept_test.go:1124: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestEntriesLeftOnTheFilesystemTheFolderIsOnAreNeverWalkedAway (0.00s)
    kept_test.go:1193: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestATakenOnOfTheOldFormIsNotTaken (0.00s)
    kept_test.go:1230: an old-form record is read as taken: root
--- FAIL: TestAnNFSExportIsNamedByItsSource (0.00s)
    kept_test.go:1278: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestAFilesystemsUUIDNamesItBeforeItsFsid (0.00s)
    kept_test.go:1320: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestAFilesystemNotNamedThisTimeIsNeverAMove (0.00s)
    kept_test.go:1402: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
--- FAIL: TestALeftoverSaysWhyItsWalkCouldNotRun (0.00s)
    oldshape_test.go:123: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed
FAIL	github.com/novox/mesh-host/internal/apply	4.114s

**Merge check** at `c85c2804` Judged: head `c85c2804a010` merged into trunk `dd9ab7927d96`; read beside it: mesh-catalog `23ea0f431faf`, mesh-controller `ba685b17f5e1`, mesh-controller-main `ba685b17f5e1`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **FAIL** — its merge-check.sh failed: --- FAIL: TestAnAccessTheMeshMayNotKeepYetIsSaidAsAWaitOfItsOwnKind (0.00s); and TestAKeptFolderCarriesAnEntryPerUserAndNothingElseOfItChanges, TestTheToolRunnersEntryIsTheWidestUseAnyModuleGivesIt, TestWhatIsMadeInAKeptFolderIsGivenItsUsersRights, TestAFolderThatHoldsDataIsTakenOnlyOnAWarrantAndLetGoEntryByEntry, TestAMissingFolderIsMadeWhereItsDataLivesAndWaitsWhereItsDiskIsNot and 21 more **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine - read by no module's build: cmd/mesh-host/grants_test.go, cmd/mesh-host/kept_test.go, cmd/mesh-host/units_test.go, internal/apply/access_test.go, internal/apply/grants_test.go, internal/apply/identities_test.go, internal/apply/kept_test.go, internal/apply/mesh_names_test.go, internal/apply/oldshape_test.go, internal/apply/reads_test.go, internal/apply/vocabulary_test.go, internal/declaration/identity_test.go, internal/link/access_act_test.go Run by the build seat on ace as `build-1791825908540629227` (`builds --log build-1791825908540629227`). ``` files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T17:18:24Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T17:18:24Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-host notes: - cmd/mesh-host/grants_test.go, cmd/mesh-host/kept_test.go, cmd/mesh-host/units_test.go, internal/apply/access_test.go, internal/apply/grants_test.go, internal/apply/identities_test.go, internal/apply/kept_test.go, internal/apply/mesh_names_test.go, internal/apply/oldshape_test.go, internal/apply/reads_test.go, internal/apply/vocabulary_test.go, internal/declaration/identity_test.go and internal/link/access_act_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.013s this machine's tunnel key, made here; the private half stays in /tmp/TestKeyMakesTheTunnelKeyOnceAndKeepsIt4258774180/001/overlay.key. Issue the token for it — `token issue --new <name> --overlay-key <the line above>` — and enrol with that token. this machine's tunnel key, made here; the private half stays in /tmp/TestATokenThroughTheTunnelTakesItsOwnKey4141738697/001/overlay.key. Issue the token for it — `token issue --new <name> --overlay-key <the line above>` — and enrol with that token. --- FAIL: TestAnAccessTheMeshMayNotKeepYetIsSaidAsAWaitOfItsOwnKind (0.00s) kept_test.go:39: not waiting with one wait: {state:unhealthy reason:it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12) waits:[] act:<nil> entries:[]} flag provided but not defined: -jsom nox-mesh-host — the node-engine A daemon: its launcher runs it, and it applies what the mesh declares for this machine. The operator's command is nox (mesh-cli), on any node, from their own account (novox/hq ADR 0272); the subcommands here are for installing a machine, joining it, and rescuing one no mesh can reach, run as root at the machine. profile what this machine can be asked to do inventory what this machine is, and what it holds apply FILE make this machine match a declaration from a file reconcile make this machine match what the mesh last told it — or, before any mesh has, the bundle this host carries bundle show what this host carries key make this machine's tunnel key, or read the one it made, and print the public half: what its join token is issued for (novox/hq ADR 0169) enrol --token T join the mesh — through the tunnel when the token was issued for a key overlay take take over the tunnel found here (novox/hq ADR 0105): its key becomes this node's overlay key and the mesh is told, signed; --tunnel <iface> when several are up owned what this host has applied and still owns hand-over <dir> hand a directory used as found to the mesh: the next apply gives it its declared owner and mode. The operator's line is nox node hand-over <node> <dir> on the control-node; this is the same act for a machine with no mesh to reach judge-directories which directories this node is declared the walk that follows no link another account could make would refuse, read-only (novox/hq issue 358); run as root version --json machine-readable output --timeout how long any single probe may take (default 10s) --state where this node keeps what it knows (default /var/lib/mesh-host/state.json) --dry-run say what applying would change, and change nothing Both apply and reconcile say what they would change before changing anything, and refuse a declaration for the other mode than this node is in, or one older than what the mesh last said. It connects to nothing and listens on nothing. What it applies comes from a file. FAIL FAIL github.com/novox/mesh-host/cmd/mesh-host 4.721s ok github.com/novox/mesh-host/examples 1.018s ok github.com/novox/mesh-host/internal/accounts 1.496s --- FAIL: TestAKeptFolderCarriesAnEntryPerUserAndNothingElseOfItChanges (0.00s) kept_test.go:144: an empty folder was not kept: applying "radarr.movies": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed, and one other resource also failed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestTheToolRunnersEntryIsTheWidestUseAnyModuleGivesIt (0.00s) kept_test.go:199: applying "reader.books": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed, and one other resource also failed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestWhatIsMadeInAKeptFolderIsGivenItsUsersRights (0.00s) kept_test.go:219: applying "radarr.downloads": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestAFolderThatHoldsDataIsTakenOnlyOnAWarrantAndLetGoEntryByEntry (0.00s) kept_test.go:319: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestAMissingFolderIsMadeWhereItsDataLivesAndWaitsWhereItsDiskIsNot (0.00s) kept_test.go:428: a missing folder under a mounted dataset was not made: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestTheSweepPutsBackWhatAnAppNarrowedAndCoversTheFolderOverLooks (0.00s) kept_test.go:479: applying "sonarr.shows": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestNoWalkRunsWhereTheDiskIsNotThere (0.00s) kept_test.go:617: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestADiskMountedOverAFolderKeptEmptyIsNotKeptWithoutAWarrant (0.00s) kept_test.go:659: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestWideningTheMaskGivesTheOwningGroupNothingMore (0.00s) kept_test.go:707: applying "sonarr.shows": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestTheWatchOfAFolderRemovedIsLetGo (0.00s) kept_test.go:761: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestNoticeLostReArmsTheWatch (0.00s) kept_test.go:775: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestUsersGivenWhileNoticesAreHeardAreReadUnderTheLock (0.00s) kept_test.go:791: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestTheWatchEndsWithItsContext (0.00s) kept_test.go:817: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestAContainerWaitsWhileItsAccessesDiskIsNotThere (0.00s) kept_test.go:887: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestEntriesThatCouldNotBeDroppedAreSaidUntilTheyAre (0.00s) kept_test.go:916: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestEntriesLeftOnAFilesystemNoLongerAtTheFolderAreDroppedWhenItIsBack (0.00s) kept_test.go:953: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestAFolderKeptEmptyLeavesNoLeftoverWhenADiskMountsOverIt (0.00s) kept_test.go:998: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestAnotherFilesystemAtTheSameMountPointIsNotTaken (0.00s) kept_test.go:1076: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestADeviceRenamedIsTheSameFilesystem (0.00s) kept_test.go:1094: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestAMovedFolderIsNotTakenOnTheOldWarrant (0.00s) kept_test.go:1124: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestEntriesLeftOnTheFilesystemTheFolderIsOnAreNeverWalkedAway (0.00s) kept_test.go:1193: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestATakenOnOfTheOldFormIsNotTaken (0.00s) kept_test.go:1230: an old-form record is read as taken: root --- FAIL: TestAnNFSExportIsNamedByItsSource (0.00s) kept_test.go:1278: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestAFilesystemsUUIDNamesItBeforeItsFsid (0.00s) kept_test.go:1320: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestAFilesystemNotNamedThisTimeIsNeverAMove (0.00s) kept_test.go:1402: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. --- FAIL: TestALeftoverSaysWhyItsWalkCouldNotRun (0.00s) oldshape_test.go:123: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed 0 resource(s) were applied and remain; everything was attempted, so what is not listed as failed was done. FAIL FAIL github.com/novox/mesh-host/internal/apply 4.114s ok github.com/novox/mesh-host/internal/bootstrap 1.661s ok github.com/novox/mesh-host/internal/bundle 1.014s ok github.com/novox/mesh-host/internal/declaration 1.070s ok github.com/novox/mesh-host/internal/firewall 1.705s ok github.com/novox/mesh-host/internal/identity 1.174s ok github.com/novox/mesh-host/internal/image 1.074s ok github.com/novox/mesh-host/internal/inventory 1.016s ok github.com/novox/mesh-host/internal/link 10.532s ok github.com/novox/mesh-host/internal/liveness 2.174s ok github.com/novox/mesh-host/internal/meshcli 1.587s ok github.com/novox/mesh-host/internal/network 1.108s ok github.com/novox/mesh-host/internal/outward 1.076s ok github.com/novox/mesh-host/internal/profile 1.532s ok github.com/novox/mesh-host/internal/reachable 1.094s ok github.com/novox/mesh-host/internal/store 1.256s ok github.com/novox/mesh-host/internal/system 1.095s ok github.com/novox/mesh-host/internal/tunnel 1.097s ok github.com/novox/mesh-host/internal/units 1.054s ok github.com/novox/mesh-host/internal/upgrade 1.198s ok github.com/novox/mesh-host/internal/witness 4.707s ok github.com/novox/mesh-host/packaging 1.091s ? github.com/novox/mesh-host/rootsearch [no test files] ok github.com/novox/mesh-host/validate 1.093s FAIL --- what failed, picked from the whole of its output (the whole is in the build's log) --- FAIL: TestAnAccessTheMeshMayNotKeepYetIsSaidAsAWaitOfItsOwnKind (0.00s) kept_test.go:39: not waiting with one wait: {state:unhealthy reason:it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12) waits:[] act:<nil> entries:[]} FAIL github.com/novox/mesh-host/cmd/mesh-host 4.721s --- FAIL: TestAKeptFolderCarriesAnEntryPerUserAndNothingElseOfItChanges (0.00s) kept_test.go:144: an empty folder was not kept: applying "radarr.movies": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed, and one other resource also failed --- FAIL: TestTheToolRunnersEntryIsTheWidestUseAnyModuleGivesIt (0.00s) kept_test.go:199: applying "reader.books": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed, and one other resource also failed --- FAIL: TestWhatIsMadeInAKeptFolderIsGivenItsUsersRights (0.00s) kept_test.go:219: applying "radarr.downloads": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestAFolderThatHoldsDataIsTakenOnlyOnAWarrantAndLetGoEntryByEntry (0.00s) kept_test.go:319: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestAMissingFolderIsMadeWhereItsDataLivesAndWaitsWhereItsDiskIsNot (0.00s) kept_test.go:428: a missing folder under a mounted dataset was not made: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestTheSweepPutsBackWhatAnAppNarrowedAndCoversTheFolderOverLooks (0.00s) kept_test.go:479: applying "sonarr.shows": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestNoWalkRunsWhereTheDiskIsNotThere (0.00s) kept_test.go:617: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestADiskMountedOverAFolderKeptEmptyIsNotKeptWithoutAWarrant (0.00s) kept_test.go:659: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestWideningTheMaskGivesTheOwningGroupNothingMore (0.00s) kept_test.go:707: applying "sonarr.shows": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestTheWatchOfAFolderRemovedIsLetGo (0.00s) kept_test.go:761: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestNoticeLostReArmsTheWatch (0.00s) kept_test.go:775: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestUsersGivenWhileNoticesAreHeardAreReadUnderTheLock (0.00s) kept_test.go:791: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestTheWatchEndsWithItsContext (0.00s) kept_test.go:817: applying "lidarr.music": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestAContainerWaitsWhileItsAccessesDiskIsNotThere (0.00s) kept_test.go:887: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestEntriesThatCouldNotBeDroppedAreSaidUntilTheyAre (0.00s) kept_test.go:916: applying "radarr.movies": it is not there, and its nearest existing parent is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestEntriesLeftOnAFilesystemNoLongerAtTheFolderAreDroppedWhenItIsBack (0.00s) kept_test.go:953: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestAFolderKeptEmptyLeavesNoLeftoverWhenADiskMountsOverIt (0.00s) kept_test.go:998: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestAnotherFilesystemAtTheSameMountPointIsNotTaken (0.00s) kept_test.go:1076: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestADeviceRenamedIsTheSameFilesystem (0.00s) kept_test.go:1094: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestAMovedFolderIsNotTakenOnTheOldWarrant (0.00s) kept_test.go:1124: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestEntriesLeftOnTheFilesystemTheFolderIsOnAreNeverWalkedAway (0.00s) kept_test.go:1193: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestATakenOnOfTheOldFormIsNotTaken (0.00s) kept_test.go:1230: an old-form record is read as taken: root --- FAIL: TestAnNFSExportIsNamedByItsSource (0.00s) kept_test.go:1278: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestAFilesystemsUUIDNamesItBeforeItsFsid (0.00s) kept_test.go:1320: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestAFilesystemNotNamedThisTimeIsNeverAMove (0.00s) kept_test.go:1402: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed --- FAIL: TestALeftoverSaysWhyItsWalkCouldNotRun (0.00s) oldshape_test.go:123: applying "radarr.media": it is owned by root, and root's data is never kept: the operator places the data elsewhere or gives it an owner (novox/hq ADR 0325 §12); nothing was made or changed FAIL github.com/novox/mesh-host/internal/apply 4.114s ```

jschoubben added 1 commit 2026-10-12 17:35:02 +00:00

Give the kept-folder tests' folders an unprivileged owner when they run as root (hq ADR 0325) ... d12bba0109

The build seat runs merge-check as root, so every folder a test made was root's
data, which is never kept (§12), and 28 tests failed for that alone. A test's
folders now stand for an operator's: run as root, they are given to nobody before
they are judged. The root rule is unchanged.

mesh-admin commented 2026-10-12 17:37:30 +00:00

Author

Contributor

Copy Link

Copy Source

Merge check at d12bba01
Judged: head d12bba01090d merged into trunk dd9ab7927d96; read beside it: mesh-catalog 23ea0f431faf, mesh-controller ba685b17f5e1, mesh-controller-main ba685b17f5e1, mesh-tools 954e1a53eef9

• mesh/merge-gate: PASS — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host)
• mesh/repo-check: PASS — its merge-check.sh passed

Delivery plan — builds mesh-host → ace, g14, novox, shanks; no bus step

• tier 0: mesh-host
• ace: receives mesh-host
• g14: receives mesh-host
• novox: receives mesh-host
• shanks: receives mesh-host
• grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine
• read by no module's build: cmd/mesh-host/grants_test.go, cmd/mesh-host/kept_test.go, cmd/mesh-host/units_test.go, internal/apply/access_test.go, internal/apply/grants_test.go, internal/apply/identities_test.go, internal/apply/kept_test.go, internal/apply/mesh_names_test.go, internal/apply/oldshape_test.go, internal/apply/reads_test.go, internal/apply/vocabulary_test.go, internal/declaration/identity_test.go, internal/link/access_act_test.go

Run by the build seat on ace as build-1791826520616139124 (builds --log build-1791826520616139124).

--- the gate: mesh-host
mesh-host: ok
long-running resources without health: 0
files asking for a setting without saying whether it is trusted: 0
1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here
judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T17:18:24Z says they run
composing every machine as the mesh is
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
composing every machine with the change
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued
merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose)
judged by controller development build against the facts of 2026-10-12T17:18:24Z

machines:
  - a machine (f35): composes
  - holds mesh-dns-resolver (idt): composes
  - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes
  - a machine (yvbpsm): composes

a merge would rebuild 1 module(s) in 1 tier(s): mesh-host

notes:
  - cmd/mesh-host/grants_test.go, cmd/mesh-host/kept_test.go, cmd/mesh-host/units_test.go, internal/apply/access_test.go, internal/apply/grants_test.go, internal/apply/identities_test.go, internal/apply/kept_test.go, internal/apply/mesh_names_test.go, internal/apply/oldshape_test.go, internal/apply/reads_test.go, internal/apply/vocabulary_test.go, internal/declaration/identity_test.go and internal/link/access_act_test.go read by no module's build, and rebuild nothing (issue 280)
--- its merge-check.sh (go toolchain)
ok  	github.com/novox/mesh-host/cmd/mesh-bootstrap	1.014s
ok  	github.com/novox/mesh-host/cmd/mesh-host	7.423s
ok  	github.com/novox/mesh-host/examples	1.020s
ok  	github.com/novox/mesh-host/internal/accounts	1.475s
ok  	github.com/novox/mesh-host/internal/apply	20.245s
ok  	github.com/novox/mesh-host/internal/bootstrap	1.780s
ok  	github.com/novox/mesh-host/internal/bundle	1.026s
ok  	github.com/novox/mesh-host/internal/declaration	1.065s
ok  	github.com/novox/mesh-host/internal/firewall	1.672s
ok  	github.com/novox/mesh-host/internal/identity	1.111s
ok  	github.com/novox/mesh-host/internal/image	1.029s
ok  	github.com/novox/mesh-host/internal/inventory	1.029s
ok  	github.com/novox/mesh-host/internal/link	10.519s
ok  	github.com/novox/mesh-host/internal/liveness	2.109s
ok  	github.com/novox/mesh-host/internal/meshcli	1.559s
ok  	github.com/novox/mesh-host/internal/network	1.050s
ok  	github.com/novox/mesh-host/internal/outward	1.032s
ok  	github.com/novox/mesh-host/internal/profile	1.501s
ok  	github.com/novox/mesh-host/internal/reachable	1.056s
ok  	github.com/novox/mesh-host/internal/store	1.227s
ok  	github.com/novox/mesh-host/internal/system	1.058s
ok  	github.com/novox/mesh-host/internal/tunnel	1.062s
ok  	github.com/novox/mesh-host/internal/units	1.052s
ok  	github.com/novox/mesh-host/internal/upgrade	1.173s
ok  	github.com/novox/mesh-host/internal/witness	20.410s
ok  	github.com/novox/mesh-host/packaging	1.054s
?   	github.com/novox/mesh-host/rootsearch	[no test files]
ok  	github.com/novox/mesh-host/validate	1.051s

**Merge check** at `d12bba01` Judged: head `d12bba01090d` merged into trunk `dd9ab7927d96`; read beside it: mesh-catalog `23ea0f431faf`, mesh-controller `ba685b17f5e1`, mesh-controller-main `ba685b17f5e1`, mesh-tools `954e1a53eef9` - `mesh/merge-gate`: **PASS** — every machine composes with the change as it did without (4 of 4 compose) (modules: mesh-host) - `mesh/repo-check`: **PASS** — its merge-check.sh passed **Delivery plan** — builds mesh-host → ace, g14, novox, shanks; no bus step - tier 0: mesh-host - ace: receives mesh-host - g14: receives mesh-host - novox: receives mesh-host - shanks: receives mesh-host - grants step: if this changes what the bus's user list says (a new tool, subject or user), novox is sent that list alone, every build there kept, before mesh-host is judged on its first machine - read by no module's build: cmd/mesh-host/grants_test.go, cmd/mesh-host/kept_test.go, cmd/mesh-host/units_test.go, internal/apply/access_test.go, internal/apply/grants_test.go, internal/apply/identities_test.go, internal/apply/kept_test.go, internal/apply/mesh_names_test.go, internal/apply/oldshape_test.go, internal/apply/reads_test.go, internal/apply/vocabulary_test.go, internal/declaration/identity_test.go, internal/link/access_act_test.go Run by the build seat on ace as `build-1791826520616139124` (`builds --log build-1791826520616139124`). ``` --- the gate: mesh-host mesh-host: ok long-running resources without health: 0 files asking for a setting without saying whether it is trusted: 0 1 manifest(s) checked. Judged against the seats this binary carries; a claim on one of the mesh's own seats is judged fully at registration, and a seat declared by a module not given here reads as unknown. Identities judged on a 6-character machine name, against the bounds of the providers given here judging 0 module(s) changed against 4 machine(s), as the snapshot of 2026-10-12T17:18:24Z says they run composing every machine as the mesh is the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued composing every machine with the change the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued the bus's user list leaves out 5 user(s) the mesh has minted no credential for: controller, node.f35, node.idt, node.ygcyr, node.yvbpsm. Each is a user that cannot connect until one is issued merge gate: PASS — every machine composes with the change as it did without (4 of 4 compose) judged by controller development build against the facts of 2026-10-12T17:18:24Z machines: - a machine (f35): composes - holds mesh-dns-resolver (idt): composes - holds git, holds mesh-artifact-store, holds mesh-broker, holds mesh-catalog, holds mesh-delivery, holds mesh-dns-resolver, holds mesh-store, holds mesh-vault, holds npm-package-registry, the control node, the hub (ygcyr): composes - a machine (yvbpsm): composes a merge would rebuild 1 module(s) in 1 tier(s): mesh-host notes: - cmd/mesh-host/grants_test.go, cmd/mesh-host/kept_test.go, cmd/mesh-host/units_test.go, internal/apply/access_test.go, internal/apply/grants_test.go, internal/apply/identities_test.go, internal/apply/kept_test.go, internal/apply/mesh_names_test.go, internal/apply/oldshape_test.go, internal/apply/reads_test.go, internal/apply/vocabulary_test.go, internal/declaration/identity_test.go and internal/link/access_act_test.go read by no module's build, and rebuild nothing (issue 280) --- its merge-check.sh (go toolchain) ok github.com/novox/mesh-host/cmd/mesh-bootstrap 1.014s ok github.com/novox/mesh-host/cmd/mesh-host 7.423s ok github.com/novox/mesh-host/examples 1.020s ok github.com/novox/mesh-host/internal/accounts 1.475s ok github.com/novox/mesh-host/internal/apply 20.245s ok github.com/novox/mesh-host/internal/bootstrap 1.780s ok github.com/novox/mesh-host/internal/bundle 1.026s ok github.com/novox/mesh-host/internal/declaration 1.065s ok github.com/novox/mesh-host/internal/firewall 1.672s ok github.com/novox/mesh-host/internal/identity 1.111s ok github.com/novox/mesh-host/internal/image 1.029s ok github.com/novox/mesh-host/internal/inventory 1.029s ok github.com/novox/mesh-host/internal/link 10.519s ok github.com/novox/mesh-host/internal/liveness 2.109s ok github.com/novox/mesh-host/internal/meshcli 1.559s ok github.com/novox/mesh-host/internal/network 1.050s ok github.com/novox/mesh-host/internal/outward 1.032s ok github.com/novox/mesh-host/internal/profile 1.501s ok github.com/novox/mesh-host/internal/reachable 1.056s ok github.com/novox/mesh-host/internal/store 1.227s ok github.com/novox/mesh-host/internal/system 1.058s ok github.com/novox/mesh-host/internal/tunnel 1.062s ok github.com/novox/mesh-host/internal/units 1.052s ok github.com/novox/mesh-host/internal/upgrade 1.173s ok github.com/novox/mesh-host/internal/witness 20.410s ok github.com/novox/mesh-host/packaging 1.054s ? github.com/novox/mesh-host/rootsearch [no test files] ok github.com/novox/mesh-host/validate 1.051s ```

mesh-admin merged commit ef26dba275 into main 2026-10-12 17:50:59 +00:00

mesh-admin referenced this pull request 2026-10-12 17:51:56 +00:00

Give the controller the contract it can fill: tool runners by name, the take act's access id, wait reasons and ACL support (hq ADR 0325) #94

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

jschoubben miel.truyen

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#93