Register R401 and R561: an outside secret nobody gave was made; a plan's id was pasted into SQL (hq issues 401, 561) #87

Merged

mesh-admin merged 2 commits from fix/401-replay into main 2026-10-12 18:22:12 +00:00

Conversation 2 Commits 2 Files Changed 1

+25

mesh-admin commented 2026-10-12 16:37:38 +00:00

Contributor

Copy Link

Copy Source

Two register entries in replays/register.go, after R341.

R401 (issue 401: the send made a random value for an own secret issued outside the mesh that nobody gave)

InRepository in mesh-controller. Fix: 1e28342 (merge of mesh-controller #262); the commit before is its first parent (c672b3d). Test: TestReplay401 in cmd/mesh-controller/replay401_test.go, taken from Home: mesh-controller at HomeRef: f3c15e0 (the head of mesh-controller #274). Needs the store (MESH_TEST_POSTGRES), as R237 does.

Why a test of its own: the fix's test TestTheSendMakesNoValueForAnOutsideSecretNobodyGave reads inventory.GivenOwnSecret, which the fix added, so its file does not build on the commit before. mesh-controller #274 adds a replay written with only pre-fix names (the R237 pattern; here in its own PR because the fix had merged). Merge mesh-controller #274 first; f3c15e0 stays reachable once it merges.

R561 (issue 561: a plan's id was pasted into the SQL that reads it)

InRepository in mesh-controller. Fix: f8daec0 (merge of mesh-controller #268); commit before is its first parent. Test: TestAPlanIdHoldingAQuoteIsReadAsAPlainId in internal/inventory/plan_id_test.go, from the fix itself. The file is new and uses only names present before (ForTest, Plan, SavePlan, PlanByID, RecentPlans): go vet builds it laid over f8daec0^1. Store-backed, already in mesh-controller's testdata/store-tests.

Proof

go run ./cmd/prove R401 R561 in replays/, with a throwaway postgres 17 as MESH_TEST_POSTGRES:

R401 (issue 401): PROVED — before its fix fails, on its fix passes
  before: replay401_test.go:58: the send placed a value for smb-credentials, which nobody gave: map[id:mounts.needs-smb-credentials path:/var/lib/mesh/mounts/smb-credentials sealed:… type:file]
R561 (issue 561): PROVED — before its fix fails, on its fix passes
  before: plan_id_test.go:27: PlanByID("x' or '1'='1") answered plan-561, a plan of another id

Tested. sh merge-check.sh at the root and in replays/: exit 0 (gofmt, vet, register tests). The replays themselves are not run there, as for every entry.

Replays for hq issues 401 and 561. Not merged.

Two register entries in `replays/register.go`, after R341. ## R401 (issue 401: the send made a random value for an own secret issued outside the mesh that nobody gave) InRepository in mesh-controller. Fix: 1e28342 (merge of mesh-controller #262); the commit before is its first parent (c672b3d). Test: `TestReplay401` in `cmd/mesh-controller/replay401_test.go`, taken from `Home: mesh-controller` at `HomeRef: f3c15e0` (the head of mesh-controller #274). Needs the store (`MESH_TEST_POSTGRES`), as R237 does. Why a test of its own: the fix's test `TestTheSendMakesNoValueForAnOutsideSecretNobodyGave` reads `inventory.GivenOwnSecret`, which the fix added, so its file does not build on the commit before. mesh-controller #274 adds a replay written with only pre-fix names (the R237 pattern; here in its own PR because the fix had merged). **Merge mesh-controller #274 first**; f3c15e0 stays reachable once it merges. ## R561 (issue 561: a plan's id was pasted into the SQL that reads it) InRepository in mesh-controller. Fix: f8daec0 (merge of mesh-controller #268); commit before is its first parent. Test: `TestAPlanIdHoldingAQuoteIsReadAsAPlainId` in `internal/inventory/plan_id_test.go`, from the fix itself. The file is new and uses only names present before (ForTest, Plan, SavePlan, PlanByID, RecentPlans): `go vet` builds it laid over f8daec0^1. Store-backed, already in mesh-controller's `testdata/store-tests`. ## Proof `go run ./cmd/prove R401 R561` in replays/, with a throwaway postgres 17 as `MESH_TEST_POSTGRES`: R401 (issue 401): PROVED — before its fix fails, on its fix passes before: replay401_test.go:58: the send placed a value for smb-credentials, which nobody gave: map[id:mounts.needs-smb-credentials path:/var/lib/mesh/mounts/smb-credentials sealed:… type:file] R561 (issue 561): PROVED — before its fix fails, on its fix passes before: plan_id_test.go:27: PlanByID("x' or '1'='1") answered plan-561, a plan of another id **Tested.** `sh merge-check.sh` at the root and in replays/: exit 0 (gofmt, vet, register tests). The replays themselves are not run there, as for every entry. Replays for hq issues 401 and 561. Not merged.

mesh-admin added 1 commit 2026-10-12 16:37:39 +00:00

Register R401: the send made a value for an own secret issued outside the mesh that nobody gave (hq issue 401) ... e63459dd70

Proved: fails on mesh-controller 1e28342^1, passes on 1e28342 (the fix, #262). The replay is mesh-controller #274's TestReplay401, since the fix's own test reads what the fix added.

mesh-admin commented 2026-10-12 16:38:16 +00:00

Author

Contributor

Copy Link

Copy Source

Delivery novox/mesh-lab@3c655d83e11e — delivered since 2026-10-12T18:22:44Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Group fix/401-replay, in order: novox/mesh-controller@f3c15e00af → novox/mesh-lab@3c655d83e1

• composed together: pass — the change touches no module of the mesh's graph

Transitions

• 2026-10-12 17:01 (new) → proposed (announced): novox/mesh-lab#87's head announced
• 2026-10-12 17:06 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit
• 2026-10-12 17:06 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
• 2026-10-12 18:22 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
• 2026-10-12 18:22 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

<!-- mesh-delivery:view --> **Delivery** `novox/mesh-lab@3c655d83e11e` — **delivered** since 2026-10-12T18:22:44Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Group** `fix/401-replay`, in order: novox/mesh-controller@f3c15e00af50 → novox/mesh-lab@3c655d83e11e - composed together: pass — the change touches no module of the mesh's graph **Transitions** - 2026-10-12 17:01 (new) → proposed (announced): novox/mesh-lab#87's head announced - 2026-10-12 17:06 proposed → checked (checked): a verdict names this commit and the trunk's head as its trunk commit - 2026-10-12 17:06 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-12 18:22 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-12 18:22 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben added 1 commit 2026-10-12 17:01:20 +00:00

Register R561: a plan's id was pasted into the SQL that reads it (hq issue 561) ... 3c655d83e1

Proved: fails on mesh-controller f8daec0^1, passes on f8daec0 (the fix, #268).

mesh-admin changed title from Register R401: the send made a value for an own secret issued outside the mesh that nobody gave (hq issue 401) to Register R401 and R561: an outside secret nobody gave was made; a plan's id was pasted into SQL (hq issues 401, 561) 2026-10-12 17:01:30 +00:00

mesh-admin reviewed 2026-10-12 17:13:07 +00:00

mesh-admin left a comment

Author

Contributor

Copy Link

Copy Source

Verdict: approve at 3c655d83e1

Independent review (registers R401 and R561, delivery group fix/401-replay).

What I checked:

1. Both entries follow the register's conventions as R237 and R233 do: a comment saying the incident, its date, why the test is laid over the commit before and that Fix is the merge of its pull request; InRepository kind, full 40-character Fix shas, What/Asserts/Package/Test/Files. R401 uses Home/HomeRef as the other controller replays whose test lives outside the fix do. TestEveryReplayIsWhole passes.
2. R401: Fix 1e28342 is the merge of mesh-controller #262 (issue 401); the test file comes from f3c15e00 (mesh-controller #274's head), and uses only names present on 1e28342^1.
3. R561: Fix f8daec0 is the merge of mesh-controller #268 (issue 561); internal/inventory/plan_id_test.go is in that fix and uses only ForTest, SavePlan, PlanByID, RecentPlans, which exist on f8daec0^1.
4. Ran go run ./cmd/prove R401 R561 in replays/ with a throwaway Postgres as MESH_TEST_POSTGRES: both PROVED. R401 fails before its fix with "the send placed a value for smb-credentials, which nobody gave"; R561 fails before with PlanByID("x' or '1'='1") answered plan-561. Both pass on their fixes.

Statuses at this head: mesh/merge-gate, mesh/repo-check and mesh/delivery all success; mergeable. This head carries no mesh/delivery-group status of its own, while mesh-controller #274 shows the group fix/401-replay pending (1 of 2 members ready), so merge only once the group's composed check passes for both heads.

Non-blocking:

• R561's Asserts says "RecentPlans takes its limit as a parameter", but the test's RecentPlans call passes before the fix too (an int limit was never injectable), so the replay proves only the PlanByID half. Consider dropping that clause or saying it is held by the fix's own test.
• R401's HomeRef f3c15e00 must stay reachable: mesh-controller #274 should be merged with a merge commit, not squashed.

Verdict: approve at 3c655d83e11e0a53a93c3aa4c7bc09238db63db3 Independent review (registers R401 and R561, delivery group fix/401-replay). What I checked: 1. Both entries follow the register's conventions as R237 and R233 do: a comment saying the incident, its date, why the test is laid over the commit before and that Fix is the merge of its pull request; InRepository kind, full 40-character Fix shas, What/Asserts/Package/Test/Files. R401 uses Home/HomeRef as the other controller replays whose test lives outside the fix do. TestEveryReplayIsWhole passes. 2. R401: Fix 1e28342 is the merge of mesh-controller #262 (issue 401); the test file comes from f3c15e00 (mesh-controller #274's head), and uses only names present on 1e28342^1. 3. R561: Fix f8daec0 is the merge of mesh-controller #268 (issue 561); internal/inventory/plan_id_test.go is in that fix and uses only ForTest, SavePlan, PlanByID, RecentPlans, which exist on f8daec0^1. 4. Ran go run ./cmd/prove R401 R561 in replays/ with a throwaway Postgres as MESH_TEST_POSTGRES: both PROVED. R401 fails before its fix with "the send placed a value for smb-credentials, which nobody gave"; R561 fails before with PlanByID("x' or '1'='1") answered plan-561. Both pass on their fixes. Statuses at this head: mesh/merge-gate, mesh/repo-check and mesh/delivery all success; mergeable. This head carries no mesh/delivery-group status of its own, while mesh-controller #274 shows the group fix/401-replay pending (1 of 2 members ready), so merge only once the group's composed check passes for both heads. Non-blocking: - R561's Asserts says "RecentPlans takes its limit as a parameter", but the test's RecentPlans call passes before the fix too (an int limit was never injectable), so the replay proves only the PlanByID half. Consider dropping that clause or saying it is held by the fix's own test. - R401's HomeRef f3c15e00 must stay reachable: mesh-controller #274 should be merged with a merge commit, not squashed.

mesh-admin merged commit 5c1c6f56c9 into main 2026-10-12 18:22:12 +00:00

mesh-admin deleted branch fix/401-replay 2026-10-12 18:22:12 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

mesh-admin

Labels

No items

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

jschoubben miel.truyen

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-lab#87