route-proxy moves out of the controller's repository (issue 1126 group R) #1

2026-11-02T11:31:27Z

mesh-tools commented

2026-11-02 11:31:27 +00:00

Issue 1126 (remove the controller), delivery group feat/1126-removal: mesh-sdk, mesh-delivery, mesh-catalog, mesh-host, mesh-tools, mesh-networking. Decision: ADR 0590 (the controller ends by its unassignment; each sensitive vault verb judges its own caller). Also folds in mesh-catalog #593's commits and the fixes of issues 1748, 1926, 1930.

Tests: offline untagged suites of every module against mesh-sdk abf5eac, go vet -tags integration, the bus removal integration test; see the review record.

Reviewed-by: review-1126@shanks at 759a7bff12

https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Issue 1126 (remove the controller), delivery group feat/1126-removal: mesh-sdk, mesh-delivery, mesh-catalog, mesh-host, mesh-tools, mesh-networking. Decision: ADR 0590 (the controller ends by its unassignment; each sensitive vault verb judges its own caller). Also folds in mesh-catalog #593's commits and the fixes of issues 1748, 1926, 1930. Tests: offline untagged suites of every module against mesh-sdk abf5eac, go vet -tags integration, the bus removal integration test; see the review record. Reviewed-by: review-1126@shanks at 759a7bff129bd485792f8c822fe622f6b4fb6e22 https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools added 68 commits 2026-11-02 11:31:27 +00:00

A route is a grant, and a provider is told where its consumer is e1d63500f0

novox/hq 08-connectivity §3, built. The mirror of a database grant: there the
consumer supplies a name and receives credentials; here it supplies a target
and receives a name. Nothing new in the vocabulary — a route is a provision
like any other.

One field was missing and it is the one that matters for anything reaching
back: a contribution now carries where the mesh says that machine is. A reverse
proxy is told to send traffic to a consumer and has to open a connection, so
without it every provider implementing a provision would have to know how the
mesh names machines — a convention leaking into every module.

The proxy itself is an example, not part of the control plane: the contract is
the file, not this program. It replaces its table whole rather than merging,
because the file is the whole truth about who has a route and merging would
keep serving a name whose module was unassigned — the stale-route fault
08-connectivity lists as open, reintroduced one level down. A name it does not
serve is refused by saying which it does: a route withdrawn and a name that
never existed are different things.

The proxy can obtain a public certificate, and asks staging by default 0f21ae2dde

Work breakdown 1.4. The mesh's own authority certifies internal names
and always did; a name reachable from outside needs one the world
already trusts, and there was no ACME anywhere in this repository.

Uses acme/autocert from x/crypto, which was already a dependency — one
indirect addition (x/net, for idna) and no new direct one.

Three things worth more than the feature:

**Staging is the default** (novox/hq 04-ISSUES/004). Production issuance
is rate-limited per domain and per account and does not replenish
quickly. Defaulting to production would leave the safe path depending on
remembering to opt out, on exactly the work most likely to iterate. A
staging certificate is trusted by no browser, so the mistake announces
itself on the first request rather than a fortnight later.

**A certificate is only asked for on a name the mesh routes here.**
Without that policy, anything that can reach the port and send a name
triggers an order for it — a scan becomes a stream of failed orders
against the account's rate limit, and the proxy looks healthy
throughout. What it may certify is what it was told to serve.

**A private issuer is trusted by naming a file, never by skipping
verification.** Skip would still apply on the day this points at a
public issuer, and nothing would say so.

TLS is opt-in: without TLS_LISTEN the proxy serves plain HTTP exactly as
before, which is what an internal-only mesh wants. With it and no cache,
it refuses rather than defaulting — every restart would otherwise order
new certificates, silently, until the rate limit says it does not.

route-proxy: an empty ACME_CA_BUNDLE means the system trust store 1fba76c768

Piece A of ADR 0056 (selectable issuer). A provider that serves an empty root —
public-acme, whose root already ships in the OS trust store — leaves route-proxy's
CA bundle file existing but empty, because the mesh writes it unconditionally from
${bound:acme-ca:root}. Read that as "trust the system roots", the same as an unset
bundle, instead of failing with "holds no certificate this can trust". A bundle
that holds bytes but no parseable certificate is still refused.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

route-proxy: an ACME account belongs to the authority that issued it fae039eba6

autocert keeps its account key at one fixed name, `acme_account+key`, in whatever
directory it is given, and reuses it for ever. That is right while the authority
stays the same and silently wrong the moment it does not. Re-initialising the
internal CA makes a new authority with a new root: it has never heard of the
account in the cache, rejects every use of it, and autocert has no path back from
that. Nothing is re-registered, no order ever reaches the CA, and issuance stops
with nothing saying why — until somebody guesses that deleting the cache directory
by hand is the answer.

Name the directory after the authority instead of sharing one between all of them:
a digest of the ACME directory URL and the root this proxy was told to verify it
with. A re-initialised CA has a new root, the mesh delivers it as a changed bundle,
the proxy restarts on that file and lands in a directory with no account in it, so
autocert registers afresh and orders again. The healing is that "is this account
still valid" never has to be asked — an account is only ever found where it is
still valid, which needs no error codes, no probe at startup and no network call
that can itself fail.

It closes a latent one of the same shape: pointing ACME_DIRECTORY at production
after testing against staging reused the staging account, because the cache had no
idea the two were different.

Trailing whitespace around the delivered root is not a new authority — the mesh
writes that file, and a newline coming or going must not throw away an account.
Old directories are left on disk, unused: they hold the only copy of certificates
that may still be valid, and this program is not the thing that should decide a
certificate is finished with.

A proxy already holding certificates orders them once more on the first start after
this, because its account moves. Free against the lab's own CA and against staging;
one issuance per name against a public authority.

novox/hq ADR 0056

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

The routing record is 0066, not 0056 e45c81e240

0056 is 'the authority is the control plane, not a database'. A citation
pointing at the wrong decision is worse than none: it reads as corroboration.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

route-proxy: a route carries the policy applied to a request cd4bd5083c

Implements novox/hq ADR 0108, closing issue 116. The proxy's request path was a host lookup
and a forward, so it applied nothing — while the ingress it replaces relies on four things it
had none of.

Path scoping came first because it is a prerequisite, not a sibling. The table mapped a host
to one target, so a host could not be routed two ways, and the refusal this issue turns on
matches a path on a host already routed to a workload. No amount of authentication or source
filtering would have made it expressible. The table is now host to an ordered list of rules,
matched on path prefix.

The order is total, not just by priority. Sorting on priority alone leaves rules that share
one in whatever order the map produced, so the same declaration would serve differently
between restarts — a fault that works, and works differently each time, which is the hardest
kind to believe when reported. Within a priority the longer path wins, which is also the
intuitive reading.

auth names a secret and never holds one. A declaration carrying a credential is refused
whole rather than served unprotected, so the option ADR 0108 rejected cannot return by
accident. A secret that cannot be read makes the route refuse and say so, rather than serve
the workload unprotected — a gate that cannot check is not a gate that opens, and the
alternative turns a missing file into a silently public admin surface.

Authentication costs one bcrypt comparison on every path including an unknown user, so an
unknown user is not measurably faster than a known one with a wrong password. That difference
is a way to enumerate a route's users from outside it.

Redirects keep the request's own path and query, or canonicalising one name onto another
would land every deep link on the front page and raise no error doing it.

Eleven tests, four of them for the capabilities and two for the failure modes that rot
quietly: the credential-in-a-declaration refusal, and the unreadable secret failing closed.
Nothing else breaks if those stop working, so nothing else would report it.

No new dependency: bcrypt comes from the x/crypto module already required.

route-proxy: a priority is an ordering, not a port 3397cb3f47

Found reviewing my own change before merging it, and it was load-bearing rather than cosmetic.

Priority was read with asPort, which caps at 65535. A rule declared above that silently became
priority 0 and stopped shadowing the route it exists to shadow. The one real rule this has to
reproduce is declared at 100000 — so path scoping and refusal would both have shipped looking
complete, passing their tests, and doing nothing on the only case that motivated them.

A priority is an ordering and has no range. asWhole takes any whole number the mesh wrote and
rejects a non-integral one, which was not meant as a priority.

Also: a host may now be routed on some paths and not others, which made the 404 dishonest — it
said "no route for this name" while listing that very name as served, a contradiction an
operator has to disbelieve the proxy to get past. An uncovered path now says so, and a name
that is genuinely not served still lists what is.

Two regression tests, both through the proxy rather than against the parser, because the parser
was where the bug looked fine.

Merge pull request 'route-proxy: a route carries the policy applied to a request' (#58 ) from issue/116-route-proxy-has-no-auth-or-ip-restriction into main e693143685

route-proxy serves a route's internal-name alias, never certifies it edb85c0416

A route now consumed with two hosts when the mesh composed both — the
same host under internal-name reaches the same rule as its public name,
restoring the convenience a predecessor proxy gave for reaching a service
over the VPN without a public TLS round trip (the field composeName now
writes, feat/route-carries-internal-alias — this branch depends on that
one landing for internal-name to ever be populated; builds and tests
clean without it, just serves nothing extra).

Never certified: onlyWhatTheMeshSaid used routed(), which answered yes
for any host in the table regardless of how it got there. A new
eligibleForACME() checks a parallel 'public' set instead — every host
reached through a route's own name, never one reached only through its
internal-name — so an internal alias is proxied but never given its own
failing ACME order. routed() is unchanged and still used for the 404
message, which legitimately wants 'is this host served at all.'

Merge pull request 'route-proxy serves a route's internal-name alias, never certifies it' (#61 ) from feat/route-proxy-serves-internal-alias into main ed58eb2c80

route-proxy: a second authority for internal names, and a target a route names the scheme of d46b5327b1

Internal aliases were served over plain HTTP only — correctly refused a
public certificate (no public CA can validate a private name), and then
left with nothing. The mesh has two authorities for its two name spaces
(08-connectivity §2), so the proxy now takes an optional internal ACME
directory and dispatches at the handshake by the same question HostPolicy
already answers: which authority may certify this name at all.

A route may also say its target speaks https, with insecure for a backend
whose own certificate nothing would trust — the shape Mailu's webmail
front needs, and the exception: everything else the mesh hands this proxy
stays plain http on the private network.

route-proxy: the challenge path falls through for real 4bb4970569

autocert's HTTPHandler answers 404 itself for a token it does not hold
and never consults its fallback on the challenge path — the
predecessor's exact fault, rediscovered live when Mailu's renewal died
behind this proxy on cutover day. tokenOrRoute probes each authority
against a buffered writer and hands a token none of them holds to plain
routing, so a consumer's own ACME client answers its own challenge
through an ordinary path-scoped route. Four tests pin it, including the
cache-key shape a restart-surviving token actually has.

Merge pull request 'route-proxy: the challenge path falls through for real' (#66 ) from fix/the-challenge-path-falls-through-for-real into main 3953757fd4

route-proxy: a policy refusal is also not-my-token 1edee852a6

autocert checks the host policy before the token and answers 403 — the
internal authority does this for every public name, so mail.novox.be's
challenge died on the internal manager's probe one commit after it
stopped dying on the public one's 404. Both shapes of refusal now fall
through to routing; a fifth test pins the 403 case with a refusing
policy.

Merge pull request 'route-proxy: a policy refusal is also not-my-token' (#67 ) from fix/a-policy-refusal-is-also-not-my-token into main c27c965262

A route may say the largest body it carries 91635ab5ac

Proxy configuration beside insecure, not a fifth policy — ADR 0108 closed that set at four, and both
of these tune how a request is carried rather than deciding what a name admits. A registry is the
case that needs it: image layers arrive as single requests of gigabytes and a proxy's own default
refuses them long before the workload is reached.

Absent is no limit, which is what every route already got. A limit that is not a whole positive
number of bytes takes the route with it, named in the log like a port that is not one — serving it
without the limit would carry exactly what the module said not to carry. Enforced on the declared
length where there is one, and while reading for a chunked body, which declares none: without the
second, a limit is advice.

Merge pull request 'A route may say the largest body it carries' (#68 ) from feat/a-route-may-limit-the-body-it-carries into main bae9fe1e4d

route-proxy: serve a route that names only its internal host 531431a42f

Since ADR 0138 an endpoint that reaches only the private network gets an
internal-name and no name, and the proxy skipped it as naming nothing, so
every internal-only module was unreachable by name (novox/hq issue 191).

The proxy is told its routes and the mesh on the bus, and serves internal names to the mesh only 70b3bef9ee

The proxy answered every routed name to any request carrying it, so an
internal-only route would have been public under its internal name. Each
membership now carries what its module receives, from the same
composition as its received file, and every machine's private-network
address, the list the packet filter's "from the mesh" is. The proxy
follows its membership, serves internal names only to those machines and
itself, and keeps the file until the bus has spoken (novox/hq ADR 0167,
issue 191).

The example images build from the Go the manifest pins b0d831cd08

Four example Dockerfiles named golang:1.25 while go.mod requires 1.26;
the control plane's image takes GO_BASE from the manifest and these did
not, so a build that could not fetch a newer toolchain failed at go mod
download (found running the lab through the mesh).

Merge pull request 'The example images build from the Go the manifest pins' (#216 ) from jschoubben/example-images-go-base into main 946cf93ac2

The intrusion-prevention seat serves status, banned, ban and unban; the proxy logs a refused name (hq ADR 0179) 961bf804c9

Every holder of node-intrusion-prevention owes the four verbs, as the packet filter's holder owes
its three (ADR 0170). The proxy says in its log when a name this mesh does not serve is asked for,
with the asking address last, so its own jail can read it.

The route proxy tells a backend the request was HTTPS, and for which name 6d0a6a5116

NewSingleHostReverseProxy sets only X-Forwarded-For, so a backend that writes its own addresses saw
the plain hop from the proxy: Gitea's Go import tag named an http clone URL and go get refused the
SDK's module path. The proxy now sets X-Forwarded-Proto, -Host and -For from the request it received,
and keeps the Host header as it was.

Merge pull request 'The route proxy tells a backend the request was HTTPS, and for which name' (#245 ) from fix/the-route-proxy-says-the-request-was-https into main 9aea1bd264

Stamp no commit in this repository's own image recipes either (hq issue 363, review of #292 ) 99b2737b79

The genesis image copies the whole clone with .git, so its controller
carried the commit it was built at, as the bundles did.

Bring build-agent and route-proxy in whole (issue 1019) d82f24b51a

Vendor route-proxy's SDK so its provider builds offline (issue 1019) f0c6ce265c

One route-proxy Dockerfile: the module's, which the Makefile builds (issue 1019) 5d20d96c57

Review round 1 of milestone 5: the move settles changed rows under the lock; reports counted by kind; route-proxy at the new SDK; the plan pass never revives an ended assignment; the store's mirror is refused once moved (issues 1090, 1092, 1093) bef006075e

1090/1092: the move tests pick each report by kind and expect three, all already, on the second run. 1090-1093: under the share lock the switch reads the rows again and writes every key whose value differs from its row (and ends an assignment the store dropped) before recording the kind, so an update the old controller made after the first pass is not lost. 1093: route-proxy is pinned at mesh-sdk f185aedb and vendored; the controller uses only the SDK's asks package. KeepAssignmentPlans decides each key by keepStep, which never makes or revives an assignment. AssignmentsMirrorToWrite refuses once the assignments are moved.

Merge pull request 'Builds, rollouts and assignments live on the bus, each assignment naming its commit, build and rollout (design 47 milestone 5, issues 1089-1095)' (#379 ) from feat/chain-on-the-bus-controller into main eb2dcf1a18

Pin route-proxy to a commit of mesh-sdk main, since the pinned one is on a feature branch only (issue 1669) 50751428f2

Announce the pull request's head again, so its delivery is made with its base and asks the Approve (issue 1726; tree unchanged) faca99b6bf

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635) fa19caf2c1

A bundle is built only from its module's directory (ADR 0480 clause 4), so the proxy leaves
examples/ and the controller's internal/broker; the broker keeps no second copy of what the
proxy shares with mesh-sdk. The image and its Dockerfile go, and a test holds that only
build-agent declares one (clause 11).

Merge main (upgrade safety's declared packages, issue 1840) and pin the R4e mesh-sdk member's final head 875c680d, re-vendored here and in modules/route-proxy; the controller announces declared-packages readable (issue 1790, D1; E) 638734fc12

Pin mesh-sdk at the R4e member's final head 104533e8 and vendor it (R4e E) 857ecaf04d

The SDK's S1 and S2 review fixes landed after 875c680d.

Delete vendor/ and the route proxy's: the build module fetches the modules, the root image builds with -mod=mod (issue 1305, C6) ff4c7b7919

Revert "Delete vendor/ and the route proxy's: the build module fetches the modules, the root image builds with -mod=mod (issue 1305, C6)" bad5cf5c54

This reverts commit ff4c7b7919.

Merge pull request 'R4g+R5 (mesh-controller): the controller asks no build, build-agent and the merge gate go, register by reference (design 47)' (#448 ) from feat/r4g into main 02273b8eaf

Reviewed-on: novox/mesh-controller#448

Delete the committed dependencies; builds resolve by go.sum (issue 1305) 2d5130cbb7

Merge pull request 'A module the catalogue no longer holds ends deleted instead of failing the plan; vendor/ goes; tests name verbs that exist (issues 1922, 1305, 1931)' (#449 ) from fix/1922-removed-module into main 9cc6ed04de

Reviewed-on: novox/mesh-controller#449

Give route-proxy a new build: the controller's sweep removed its last build's files from the store, so novox and ace cannot apply (issue 1933) ecf3519592

Merge pull request 'Give route-proxy a new build: the controller's sweep removed its last build's files from the store, so novox and ace cannot apply (issue 1933)' (#450 ) from fix/1933-rebuild-route-proxy into main 9ca01594c3

Reviewed-on: novox/mesh-controller#450

Give route-proxy a build the fixed controller takes in, dropping the incident note #450 added (issue 1933) bab562df63

Reword route-provider's stdout line, so route-proxy's tree differs from the 01:52 build whose files are gone (issue 1933) 4a90e698aa

Give route-proxy its state on the bus and three tools, so a site's route, certificate and last answer are read from the mesh instead of with curl (issue 774) 3e14a13b1a

The web front kept nothing on the bus: whether grafana or drive was routed, where to, with which
certificate, and what it last answered could only be learned with curl or the container's log.

The proxy now keeps `routes` and `unrouted` (announced readable, keyed <node>.<name>), written on
change by one writer: route set changes, certificates stored by autocert's cache or failing at a
handshake, upstream answers that differ from the last written (or are a minute old), and names
refused in a request or a handshake. The provider helper's bundle serves route_proxy_routes,
route_proxy_route and route_proxy_unrouted from those states.

Quick: log the routes at start and grep the journal. Thorough: the state on the bus and the tools
that read it, mesh-wide, in one call. Chose thorough: the operator's question is mesh-wide and
recurs, and the log says nothing about certificates or answers.

Tests: two table tests added (the ledger, the tools), both failing without the change; four
authority tests and four skipped-route tests merged into two, so the module has four fewer.

Keep a scan out of route-proxy's unrouted state: only names under a served domain, a few a minute, no visitor address (issue 774) d2e5323b7c

Review of 3e14a13b: a scanner's random Host or SNI names each became a key, bounded only by the
bucket's lifetime and size, and every failed write was retried at each change and logged each time.

A refused name is now kept by name only under the registrable domain of a name the proxy serves, and
at most five new names a minute; every other refusal is counted in memory and written once a minute
under <node>._other (last minute, since start), which route_proxy_unrouted shows. A refused write of
that state is dropped and logged once until a write succeeds; trimming memory to 4096 names moved
from the request to the writer. The visitor's address is no longer kept: the journal has it.

Quick: drop unrouted keys from strangers by a fixed allow-list. Thorough: bound by the proxy's own
domains, by rate, and by never retrying. Chose thorough: the scan is constant on a public machine.

Merge pull request 'The web front keeps what it serves, its certificates and what it refuses on the bus, with tools to read them (issue 774)' (#485 ) from feat/route-proxy-tools into main dd52c9cce1

Answer route-proxy's routes from the seat mesh-provisioner's plans and keys, not the controller's assignments, so a route the seat keys for a module not handed is marked provided and its new builds are no longer withheld (issue 774) 69bffee443

Start route-proxy's provider helper only once Serve holds the runtime's channel, so its first watch is never refused and the helper never stops until a restart (issue 774, review) fd74e38ee0

Merge pull request 'The web front's route helper reads the seat's plans, so a route-only module's route is provided (issue 774)' (#486 ) from fix/route-proxy-reads-plans into main c7493f4889

Serve route-proxy's routes from the seat mesh-provisioner's plans alone and drop its received routes file, since a route is a provision and the file is the deprecated path (issue 774, research 072 row 34; needs the mesh-sdk pin carrying plan entries' given and Conn.Read) 373565c2f7

Publish route-proxy's contract as a Go module of its own: the route a consumer asks, its schema, the events the proxy says, what it keeps on the bus and its tools' arguments, so other modules use the contract by its version and the provisioner carries a route unread (issue 774, research 072 row 34) bf395f88ee

Serve route-proxy's routes through its own contract: decode each plan entry's opaque contribution with it, say each name served, withdrawn or refused on the bus, and take who is inside from the seat mesh-placement, since the membership went with the assignments stream (issue 774, research 072 rows 33 and 34) fa56e38429

Pin route-proxy at the group's mesh-sdk head acbf80a and its contract at the published tag v0.1.0, so it builds and reads the contributed payload; refresh its manifest digest for the events its contract names (issue 774) 26dea32f5f

Merge pull request 'route-proxy from the provisioner's plans with its own contract; the controller forwards accounts to the vault (issue 774)' (#487 ) from feat/072-moves into main de46374d10

Dial a route at the machine port its module's placement assigned, from the mesh-sdk whose plans carry it (issue 774, research 072 row 34) 70b8bff570

route-proxy from plans dialled every route at the software's own port: gitea at 127.0.0.1:3000
(published at 20000) and grafana on ace at 3000 (published at 20012), and public sites answered
502. The proxy already reaches a module beside it over loopback and one elsewhere at the plan's
address; the plan now carries the assigned port, and a test composes the plan with the SDK and
reads it as the proxy does, so the two cannot drift again.

The controller, NATS-native: no piece moves; route-proxy only.

Check route-proxy's composed targets over the live shapes in an existing test's place, and pin the mesh-sdk that keeps unassigned bare ports (issue 774, research 072 row 34) d550c6da7a

The table covers gitea and grafana moved by the placement, influxdb's bare port, mailu's and
photos' fixed mappings and home-assistant on the host's network; it replaces the loopback test it
subsumes, so route-proxy's test count does not grow.

The controller, NATS-native: no piece moves; route-proxy only.

Merge pull request 'route-proxy dials the machine port its plans now carry (issue 774)' (#488 ) from fix/route-ports into main 3dec14334e

Declare credential form none for the provision, which hands consumers no credential 0afee8c2fc

The manifest judge refuses an offer that says no credential form (issue 1585).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Pin mesh-sdk at the judge-less release head in the controller and route-proxy 2adbc5c82d

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Pin mesh-sdk at the head after review round 1 c3a2e71d2e

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Pin the group's mesh-sdk head after the gofmt fix 03ac1f7f35

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Merge pull request 'The controller takes the indexer's verdict instead of judging manifests; route-proxy declares its credential form (ADR 0578, 0579)' (#489 ) from feat/judge-once into main 3ef81c0fe6

Move route-proxy out of the controller's repository, which is archived with the controller 6f038810fd

route-proxy provides `route` to five modules and lived in novox/mesh-controller, archived once the controller is
removed (issue 1126). Its history comes along (git filter-repo of modules/route-proxy and its earlier home
examples/route-proxy). Its contract's Go module path names this repository, and route-proxy builds the contract from
its own tree through a replace, so no tag is needed before the first build. The two manifest tests that held its
public ACME account and mounted program lived in the controller's internal/ownmanifest; they move beside the module.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Join the forge's first commit of mesh-networking 8c89b84045

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

# Conflicts:
#	README.md

Pin mesh-sdk to the group head of issue 1126 30cb63e29f

Every member builds against mesh-sdk f569924, the head of feat/1126-removal, so the group is checked as one contract.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Say that the seat mesh-provisioner composes route-proxy's plans, since the controller ended d2c5057fdf

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Pin mesh-sdk to the group head of issue 1126

mesh/delivery-group group feat/1126-removal rejected: composed together: the checker's verdict at the members' heads (c35fdd232bcd): shanks

Details

mesh/delivery closed: a newer head of the same pull request

Details

mesh/check failed: shanks: the check of novox/mesh-networking#1 failed: go mod verify in modules/route-proxy: go: git.novox.be/novox/mesh-networking/m…

6c15ff3f0e

Every member builds against mesh-sdk abf5eac, the head of feat/1126-removal, so the group is checked as one contract.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools commented

2026-11-02 11:31:40 +00:00

Delivery novox/mesh-networking@759a7bff129b — closed since 2026-11-02T13:19:39Z

Group feat/1126-removal: novox/mesh-catalog@fa6dc3a48b, novox/mesh-delivery@e2cb398186, novox/mesh-host@049c3b8c11, novox/mesh-sdk@abf5eace77, novox/mesh-tools@e475d9f849

Transitions

2026-11-02 12:55 (new) → proposed (announced): novox/mesh-networking#1's head announced
2026-11-02 12:55 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-02 13:19 ready → closed (closed): the pull request closed unmerged

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-networking@759a7bff129b` — **closed** since 2026-11-02T13:19:39Z **Group** `feat/1126-removal`: novox/mesh-catalog@fa6dc3a48b0c, novox/mesh-delivery@e2cb3981866e, novox/mesh-host@049c3b8c11c9, novox/mesh-sdk@abf5eace7791, novox/mesh-tools@e475d9f849ca **Transitions** - 2026-11-02 12:55 (new) → proposed (announced): novox/mesh-networking#1's head announced - 2026-11-02 12:55 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-02 13:19 ready → closed (closed): the pull request closed unmerged The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools commented

2026-11-02 11:52:41 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

nox-agent added 1 commit 2026-11-02 12:55:43 +00:00

Keep route-proxy's contract a package of its own module, not a second module behind a replace

mesh/delivery-group group feat/1126-removal rejected: composed together: the checker's verdict at the members' heads (6593d973ff2e): the composition

Details

mesh/delivery closed: the pull request closed unmerged

Details

mesh/check failed: the composition: route-proxy is defined twice, in novox/mesh-controller and novox/mesh-networking | 759a7bff129b on fe0392e05f62 | …

759a7bff12

The group's check failed at go mod verify: the build module's workspace carries one module, so the replace of
./contract named a go.mod it never placed; and ADR 0573 clause 1 refuses a path into another tree. Nothing outside
route-proxy imports the contract today; when one must, it moves into the networking domain's package (research 081).
Issue 1126.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools commented

2026-11-02 12:55:51 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools closed this pull request

2026-11-02 13:19:39 +00:00

mesh-tools commented

2026-11-02 13:19:42 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-networking#1