jschoubben
3a486014fc
mesh/merge-gate pass: the change touches no module of the mesh's graph
mesh/repo-check pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; it…
mesh/delivery superseded: a newer head of the same pull request
The bus the controller composes and raises, at its commit, for one machine; the mesh's runtime serving the router and the Telegram channel on their own credentials; a fake Bot API as the phone. It links the operator's account with the code shown on the desk, refuses an approval in the hour after a link, performs an approval exactly once with who and how in the warrant and the router's record, refuses a replayed tap and a redelivered warrant, tells the operator when another account answers, drops a tap from a group, does nothing on Decline and on expiry, offers no approval while an agent can become root where the channel runs, and has the bus refuse every forged warrant, ask and tap. live-acceptance.sh is the same after rollout, with a drill the operator approves on the phone.
35 lines
1.7 KiB
Bash
35 lines
1.7 KiB
Bash
#!/bin/sh
|
|
# mesh-check-toolchain: typescript
|
|
# mesh-check-also: go replays/merge-check.sh
|
|
#
|
|
# The lab's own check (novox/hq ADR 0237 as amended): the second layer of a pull request's merge check,
|
|
# `mesh/repo-check`, run by the build seat — and by hand.
|
|
#
|
|
# The mesh builds no module from the lab, so no gate runs for its pull requests (`mesh/merge-gate` says the
|
|
# change touches no module of the graph); this is all that is checked before a change to it merges. The lab
|
|
# is in two languages, and each part runs in its own toolchain's container (novox/hq issue 302):
|
|
#
|
|
# - this script, in the TypeScript toolchain: installed from the lock file, type-checked, sources and
|
|
# tests, and the unit suite;
|
|
# - replays/merge-check.sh, in the Go toolchain, declared on the line above: the replays register and its
|
|
# prover formatted, vetted and compiled, and the register's own tests.
|
|
#
|
|
# **Said, never passed silently**: the integration suite raises a lab on a workstation, and the replays
|
|
# raise containers through the container runtime — neither is given to code nobody has approved. The
|
|
# replays run from the lab's main, reviewed, in every gate of a core change; a change to them is proven by
|
|
# `go run ./replays/cmd/prove` by hand before it merges.
|
|
set -eu
|
|
|
|
npm ci --no-audit --no-fund --loglevel=error
|
|
npm run typecheck
|
|
npm test
|
|
|
|
# By hand, with Go at hand, the Go part runs here too; on the build seat it runs in the Go toolchain.
|
|
if command -v go >/dev/null 2>&1; then
|
|
sh replays/merge-check.sh
|
|
sh asks/merge-check.sh
|
|
else
|
|
echo "replays/ (Go) is checked by replays/merge-check.sh, which the build seat runs in the Go toolchain"
|
|
fi
|
|
echo "NOT RUN HERE: the integration suite and the replays — they need a lab and the container runtime"
|