586 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
jschoubben	001f4f23aa	The node seat's acts reads one act by its id (issue 774, ADR 0563 §9)	2026-10-28 10:19:31 +01:00
jschoubben	11b3e6a95d	The node-engine's declared state acts: created by the grants part as a placed module's, its manifest placed on every node, and written by each node's engine under its own keys alone (issue 774, ADR 0563 §2, §3)	2026-10-28 10:13:07 +01:00
jschoubben	277a5bd34d	Merge feat/774-l3-563 (f80d5d3) into the L3 assembly: a node's grants carry both the vault's sign and its node seat node-engine (issue 774)	2026-10-28 10:02:41 +01:00
jschoubben	f80d5d3d86	The vault's secret-ask is said to answer the callers its manifest names (issue 774, ADR 0563 §8)	2026-10-28 10:00:47 +01:00
jschoubben	5993dab6d1	Merge commit 'ec821f6' into asm-l3/774-vault-mints	2026-10-28 09:58:50 +01:00
jschoubben	c285af02f9	Merge commit '4b226aa' into asm-l3/774-vault-mints ... # Conflicts: # go/buscompose/buscompose_test.go # go/buscompose/userlist_switch.go	2026-10-28 09:58:50 +01:00
jschoubben	49e853986b	A module's trusted list of callers in the SDK, so the vault's secret-ask answers the callers its manifest names as the runtime proved them (issue 774, ADR 0563 §8)	2026-10-28 09:58:27 +01:00
jschoubben	5a2eb2b480	Merge commit 'c527fc7' into asm-l3/774-vault-mints	2026-10-28 09:58:13 +01:00
jschoubben	bec931e72e	A node's engine answers its own node's node-engine verbs, says the seat's events and asks the operator as node-engine-<node>, and no other account answers them (issue 774, ADR 0563 §1, §3, §6)	2026-10-28 09:45:48 +01:00
jschoubben	fa512c8637	The node seat node-engine: held by every node's engine, its six verbs and three events, and no module may claim it (issue 774, ADR 0563 §1)	2026-10-28 09:43:40 +01:00
jschoubben	ec821f6199	Merge remote-tracking branch 'origin/main' into feat/774-l3-sign	2026-10-28 09:28:41 +01:00
jschoubben	c07cdaf2f4	Bundle the mesh's authorities by certificate, and check a node's certificate against every one a bundle holds (issue 774, ADR 0550 §2)	2026-10-28 09:27:17 +01:00
jschoubben	de72cb9a11	The vault signs: the contract of its state signers, its verb sign and its event signed, a node's grants to ask it and to read what it trusts, and the authority composed as a bundle (issue 774, ADR 0550 §2)	2026-10-28 09:26:12 +01:00
jschoubben	4b226aa78f	Placed: a module in the first revision heard of a node's key stands since before it, so the seed's placement does not leave out what already ran (issue 774)	2026-10-28 09:18:11 +01:00
jschoubben	02645b5a0f	One reader of the catalogue's placement and the toolchain gate over it, in place of the three copies over the controller's assignments (issue 774, ADR 0549 §3, issue 1940); the assigner may read the lease (ADR 0549 §5)	2026-10-28 09:15:39 +01:00
jschoubben	18e2e05bb5	buscompose: the assigner may read the controller's lease, to choose where grants are read from (issue 774)	2026-10-28 09:11:27 +01:00
jschoubben	0b0c669b49	delivery: the grants part's grant keys and the source the assigner reads (a1; issue 774) ... Why: the grants part writes grants.<module>.<fp> in shadow beside the controller's; the assigner switches source only when the lease is handed away.	2026-10-28 09:10:15 +01:00
jschoubben	c527fc7222	Checker seat test: the try replaces both shell commands (issue 774)	2026-10-28 09:09:58 +01:00
jschoubben	2a1ad896fa	Checker seat: the try's verb also replaces docker run postgres, as the controller's try did (ADR 0547 §10, issue 774)	2026-10-28 09:09:23 +01:00
mesh-tools	be77f66563	Merge pull request 'frombus: blame only the modules a refusal names, and say which providers another node cannot run (issue 1126, group fix/1126-shadow-bodies)' (#113) from fix/1126-shadow-bodies into main	2026-10-28 07:46:23 +00:00
jschoubben	362a3f1378	A refusal for want of a provider names the modules another node cannot run in this composition, and a refusal naming no placed module is answered at once (issue 1126, probe #532) ... ace and g14 answered 'nothing in this mesh provides artifact-store … assign distribution to a node' while novox runs it: a module another node cannot run in this composition (catalogue Resolution.Unhostable) offers nothing, silently. The refusal now names each such module and what it lacks, and each node left out. And the culprit search composed the whole mesh once per placed module for a refusal no stub changes (ace's answer took 7m46s): only the modules the refusal names are tried, at most 8.	2026-10-28 01:39:07 +01:00
mesh-tools	03da552cb3	Merge pull request 'Shadow answers show both bodies of each difference (secrets masked); a folded module is judged inside; the bus membership is carried (issue 1126, group fix/1126-shadow-shows)' (#112) from fix/1126-shadow-shows into main	2026-10-28 00:21:47 +00:00
jschoubben	4e0c57771e	Bound the bodies an answer shows, naming the rest (issue 1126)	2026-10-28 01:09:02 +01:00
jschoubben	b31c4580aa	A candidate answer shows every differing resource, masked; a module folded in the node's own is judged there; the node's own carries its bus membership as it runs it (issue 1126, seed #531) ... novox's answer to seed #531 named 15 resources by id alone, so why each differed was guessed. ModuleDiffers.Bodies keeps every differing resource with both bodies, each value under a key a secret could be in masked (the same, another seal of the same value, another value). The five old-form modules read 'removed' because the agent also lists them by module from the declaration kept before the switch; they are judged inside the node's own. And the node's own lacked bus-membership, which only the controller composes from its store: the membership the node runs is carried, until the grants part hands it sealed.	2026-10-28 01:08:49 +01:00
mesh-tools	47eb100992	Merge pull request 'frombus: a stub keeps its module's directories; compose returns nothing once its run ended (issue 1126, group fix/1126-switch-safe)' (#111) from fix/1126-switch-safe into main	2026-10-27 23:52:19 +00:00
jschoubben	7359d187db	A stub keeps its module's directories, so the places its own secrets and data name still resolve (issue 1126: novox refused nats's ${dir:mesh-state})	2026-10-28 00:21:45 +01:00
mesh-tools	47b1dcf08f	Merge pull request 'Shadow answers name every refusal, carry old-form builds as they run, and compare a deleted placement (issue 1126, group fix/1126-shadow-all)' (#110) from fix/1126-shadow-all into main	2026-10-27 22:44:08 +00:00
jschoubben	e32d777530	A deleting head's answer compares the controller's compositions with what runs, and is refused only without returning; fold the shadow's tests into TestInput (issue 1126, review of the shadow, round 1)	2026-10-27 23:32:31 +01:00
jschoubben	472d5f3144	A node's have says whose compositions it applies, and its answer to a head deleting its placement says it returns to the controller's (issue 1126, the seed's revert) ... The check of the seed's revert (mesh-catalog #526) failed on 'would stop running node': the shadow answered a deleted placement as everything removed, while the node keeps what runs. HaveNode.Composes and ComposesWhy say whether a node applies its own compositions or the controller's; CandidateAnswer.Returns answers a deleted placement, verdict same, naming nothing composed.	2026-10-27 23:22:54 +01:00
jschoubben	2fd5ffdd62	A node's answer names every module it cannot compose, a folded module of an old-form build is left to the node as it runs, and no store reached says why (issue 1126, the seed's shadow) ... The seed's shadow answers named the first refusal only (ace: baserow's archive, novox: de-spiegel), so each round showed one more. A build that cannot be read or taken in, and a module the composition refuses, are now each composed as a stub and named. A module folded into the node's own composition whose manifest names a build (de-spiegel, nats, photos, systemd-resolved: haves naming a build-... id) runs a build only the controller holds: it is composed as a stub and its resources are carried as the node runs them.	2026-10-27 23:17:05 +01:00
jschoubben	3f7957e169	Merge commit 'a5d0e64' into feat/774-vault-mints	2026-10-27 23:01:44 +01:00
jschoubben	a5d0e64200	Checker seat test: fold into the closed-set seats test, no new test function (issue 774)	2026-10-27 23:00:38 +01:00
jschoubben	9fdd33b03e	Checker seat: the try's end by hand is a verb too (issue 774)	2026-10-27 22:49:44 +01:00
jschoubben	2e8c2a7f4c	Seat mesh-delivery-checker: the try and its read are verbs of the checker's own seat, replacing sh merge-check.sh (ADR 0547 §10, issue 774)	2026-10-27 22:49:06 +01:00
jschoubben	d688f106e9	Name the vault's verb issue-account on its seat, so its holder may serve it (issue 774, ADR 0561 §9)	2026-10-27 22:42:53 +01:00
jschoubben	cfe6094f46	Say when the lease is handed away, let the vault and the grants part read it, and let the grants part create the consumers an account needs, so both turn on at the lease write alone (issue 774, ADR 0561 §3, §6)	2026-10-27 22:28:54 +01:00
jschoubben	bee33f4715	Build a minted account's value as the controller does, byte for byte, so a runtime reads the vault's unchanged (issue 774, ADR 0561 §2)	2026-10-27 22:19:53 +01:00
jschoubben	2ecc94062e	Say which bus accounts the grants part wants, in a state only the vault reads, and what the vault says when it mints one, so the vault can mint from the grants part's word (issue 774, ADR 0561 §2)	2026-10-27 22:19:26 +01:00
mesh-tools	d48365aed0	Merge pull request 'frombus: a node composing itself takes its modules from their builds and reads what providers elsewhere serve (issue 1126, group fix/1126-node-creds)' (#109) from fix/1126-node-creds into main	2026-10-27 20:32:30 +00:00
jschoubben	7a8e9f9706	Wait for a done key whose artifact names no reference, as the controller's take-in does, and hold the fold guard with a row (issue 1126, review round 1)	2026-10-27 21:12:13 +01:00
jschoubben	d7a758894a	Leave a module the node runs inside its own composition to its manifest, as the fold composes it, so taking builds in moves no folded module (issue 1126)	2026-10-27 21:11:20 +01:00
jschoubben	04de3e5da2	Compose a node's own modules from their builds and read what providers elsewhere serve, so a self-composing node hands moved modules and settles served settings as the controller does (issue 1126) ... frombus composed every module from the indexer's raw manifest: no moved module was handed, so the node stood in for own secrets the vault leaves to the provisioner (the seed's refusals on all four nodes), and a provider elsewhere had no config values, so mailu's served domain refused shanks. - takein: the controller's take-in of a done key (artifacts, launchers, the templates archive's texts, Resolve) as one SDK rule; catalogue.Launchers holds the launcher rule buildstep now delegates to. - frombus: each module placed on the composing node, and each kept at another build (Scope.KeptAt, a fingerprint), composes from its built manifest; another node's modules give the keys their served values fill (Reader.Served). - buscompose: Declared.Served and Principal.ServedReads grant every node the read of exactly those keys of mesh-config_resolved. - compose.ArtifactStoreAddress: the store as the node's composition routes to it.	2026-10-27 21:11:20 +01:00
mesh-tools	9f92233a28	Merge pull request 'process: a module's own bus connection, subjects and durable consumer in one helper (issue 1242)' (#108) from fix/1242-bus-helper into main	2026-10-27 19:49:19 +00:00
jschoubben	8ad9372b19	Name another module's own-stream subject in the SDK too (issue 1242)	2026-10-27 20:38:20 +01:00
jschoubben	3236cbad43	Give a module's own credential its dial, subjects and durable consumer in mesh-sdk, so a part no longer hand-writes them (issue 1242)	2026-10-27 20:36:14 +01:00
mesh-tools	a262c7dbe0	Merge pull request 'A node folds a placed module with no new-form build into its own composition, as the controller does, so the tunnel and the bus are not dropped when nodes compose themselves (issue 1126)' (#107) from fix/1126-fold into main	2026-10-27 08:09:03 +00:00
jschoubben	05b6783103	Fold a module no new-form build names into the node's own composition, as the controller does, so a self-composing node keeps the tunnel and the bus (issue 1126) ... mesh-wireguard (built by nobody) and every module a node runs inside its own composition (Node.InOwn, from frombus.InOwn of what it runs) were cut out as skipped: every node's shadow answered differs to the placement seed, and a node composing itself after it would drop their resources. compositions now folds them in place, module taken off, filled paths with them, as mesh-controller's compositionsOf does; a want naming a new-form build still moves one out.	2026-10-27 08:50:26 +01:00
mesh-tools	56de5ba840	Merge pull request 'A placement change is answered by the nodes it places: the candidate contract, composing a given placement, and replicated seats in the placement check (issue 1126, ADR 0559)' (#106) from feat/1126-l2b into main	2026-10-27 07:21:03 +00:00
mesh-tools	43eef46c41	Merge pull request 'A build step names the process that runs it, so a restarted build module clears what a gone process left running (issue 1890)' (#105) from fix/1890-step-owner into main	2026-10-27 07:19:36 +00:00
jschoubben	cadd7b1b2f	Ask the vault in a candidate answer only for credentials of modules the node runs, and refuse a stand-in of a running module, so a placement that adds a module is answered as added (issue 1126, ADR 0559 §4)	2026-10-27 02:43:10 +01:00