692 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
jschoubben	0c99e847a2	Merge pull request 'One codec for the grants part's memberships state, so its writer and readers cannot drift (issue 774)' (#134) from fix/memberships-shape into main ... Reviewed-on: #134	2026-10-30 14:42:04 +00:00
jschoubben	83cf97b690	Refuse an old wrapper of a held-back membership, so a reader falls back to the assignments stream ... The grants part's old build wrote its wrapper for every membership, a held-back one too, with the unpublished composition inside; the new part never rewrites such a key, so the decoder took the held-back membership as given. It now reads a wrapper only when its published says published or unchanged. The codec's rows join the round-trip test (mesh-sdk is over its unit budget). Review round 1 of issue 774's fix.	2026-10-30 15:36:23 +01:00
jschoubben	46d4b4da5e	One codec for the grants part's memberships, so its writer and the tool runner cannot drift ... The grants part wrote its own wrapper into mesh-grants_memberships while the tool runner read the value as a bare membership: novox's tool runner served no tool. EncodeGrantsMembership writes the bare membership; DecodeGrantsMembership and BareGrantsMembership read it, still read the old wrapper for the transition, and refuse a value naming no node or module instead of answering an empty membership. Issue 774 (the bus login list, L3). Quick fix: write the bare membership in the grants part alone. Thorough, chosen: one codec in mesh-sdk both sides use, because a hand-built test fixture agreed with the mistake and hid it.	2026-10-30 15:23:17 +01:00
mesh-tools	2b1e148bf5	Merge pull request 'Design 47's last milestones as one release: the contracts for health, control records, provisioning and history leaving the controller (issues 774, 1126, 1952, 1953, 1954, 1955, 1289)' (#133) from feat/774-l3-reland into main	2026-10-30 11:01:40 +00:00
jschoubben	2da0de75c3	Merge main's parse-only new words into the release, which supersedes them with its full implementation (issue 774)	2026-10-30 01:11:16 +01:00
mesh-tools	044ead7db8	Merge pull request 'Read the release's new manifest words and seat names, with no change of meaning, so the running parts accept design 47's manifests (issue 774)' (#132) from fix/774-new-words-first into main	2026-10-30 00:10:04 +00:00
jschoubben	78c9ec8817	Accept the release's new manifest words and know its new seats by name, meaning nothing new yet, so delivery 1's readers parse the release's catalogue before any part reads them (issue 774)	2026-10-30 00:35:35 +01:00
jschoubben	6e4a3014cb	Keep the provisioner client's needs grant for one release, removed after the lease write, so the client before V3 still writes its needs while its delivery reaches each node (issue 1954)	2026-10-30 00:14:53 +01:00
jschoubben	007b6fd45f	Drop stdio.Discover, the self-check's discovery and its read of the withheld hearings, which no probe uses now that the operator dropped D-root, D3 and D-heard (issue 1952)	2026-10-30 00:02:07 +01:00
jschoubben	8fe3467753	Let a provider not ready yet wait and keep serving what it served, so a restarted gitea no longer stops serving its consumers until its keys load (issue 1954)	2026-10-30 00:02:07 +01:00
jschoubben	fa5a6aeff5	Let a bundle ask the runtime who answers a verb, and the self-check's own account ask the bus's discovery, so D-root and D3 find holders without the controller (issue 1955)	2026-10-29 23:58:21 +01:00
jschoubben	31e90aaa0f	Keep when each data item was first seen and when and why it was retired in its reading, so the self-check's D13 judges a new or retired item from disk-load's state (issue 1955, ADR 0571 clause 3)	2026-10-29 23:56:06 +01:00
jschoubben	7bd0f6c2bd	Name the artifact sweep's seat mesh-artifact-sweep for its scope, grant the provisioner client its machine's plans in place of the needs, and keep the grants part's withheld hearings in one layout, so the seat names follow ADR 0121 and the client and the self-check read the bus (issue 1955, ADR 0571 clause 2, ADR 0570 clause 2)	2026-10-29 23:53:51 +01:00
jschoubben	f3677eb6f3	Carry the engine's verdict on each account declared never to become root, and its contract, in the node's health report, so the self-check's DA and D-root judge on the machine's own word (issue 1952, ADR 0266) ... NodeHealth.Root: each such account's verdict (healthy, unhealthy with its way to root, unknown while the setuid search runs), the module and resource declaring it. NodeHealth.Contract: the engine's statement contract, so a reader tells an engine older than the judging. Test: a row in TestTheControlRecordsReadTheirWritersValues, read back byte-equal.	2026-10-29 23:48:08 +01:00
jschoubben	992ea0ab66	Let restic's bundle, not its night's process, write each item's last good night, since the night runs as the operator's account with no bus account (issue 1955, ADR 0436 §1-2)	2026-10-29 23:41:16 +01:00
jschoubben	85f5fd0b22	Fail the grants table test for any row whose user is not composed, so a row can never pass for a missing user (issue 1955)	2026-10-29 23:38:59 +01:00
jschoubben	9f0bb1cfa4	Move restic's last good night per item into the sdk's health layouts, so restic's night process writes it and the self-check reads one layout (issue 1955, ADR 0571 clause 3)	2026-10-29 23:37:37 +01:00
jschoubben	08fc70783a	Read the bus through a module's declared states in frombus, with the runtime's adapter in fromruntime, so mesh-provisioner and disk-load compose from one reader instead of two copies (issue 1955)	2026-10-29 23:31:34 +01:00
jschoubben	bb993dd606	Keep the builder's history as its own log that readers declare and follow, the memberships as the grants part's state, and refuse a module's own stream, so every module's data is in the bus's predefined forms and readable by its tools (issue 1955, ADR 0571 clauses 1, 4, 5, 7)	2026-10-29 23:28:21 +01:00
jschoubben	196c5b6af2	Compose a node's placed data items from the bus and move the readings layout into the sdk, so disk-load measures without a composed file and restic, mounts, nfs-server and the self-check read one layout (issue 1955, ADR 0571 clause 3)	2026-10-29 23:16:56 +01:00
jschoubben	dc78524e38	Let the artifact store's seat holder read the controller's lease, so its sweep starts only once the lease names no controller (issue 1955, ADR 0571 clause 2)	2026-10-29 23:10:46 +01:00
jschoubben	f9a496d3e1	Carry each build's repository, directory and commit in the builder's log, so the indexer, the outside-built registrations and the assigner read where a build came from there (issue 1955)	2026-10-29 23:09:47 +01:00
jschoubben	7fdbadc655	Add the seat artifact-store, the seat-holders state with its reader, and the builder's log layout, so the store's sweep, who holds which seat and build history leave the controller (issue 1955, ADR 0571 clauses 1, 2, 4)	2026-10-29 23:09:25 +01:00
jschoubben	6eae0765f4	Name the machines a failing network part points at, so the watchman holds it there as the controller does without any machine's address (issue 774) ... NetworkPart.Targets: the hub's machine for "hub", the machine whose tunnel address is each resolver's; empty where the part is the machine's own. Filled by the node-engine from its tunnel's peers. Test: a row in TestTheControlRecordsReadTheirWritersValues, read back byte-equal.	2026-10-29 23:02:54 +01:00
jschoubben	94d0de5c19	Move the node's health report layout into the sdk and let each node write only its own key while the watchman reads them, so the six machine alerts leave the controller (issue 774)	2026-10-29 22:58:05 +01:00
jschoubben	58a83249c8	Give a provision the vault itself provides no credential beside it, since its offer is the value (issue 1954, ADR 0570 clause 6)	2026-10-29 22:53:15 +01:00
jschoubben	6b8c694381	Make every offer say its credential's form, pair or none where it names no own secret or issuer, and read no default, so the vault never mints a login for a provider that takes none (issue 1954, ADR 0570)	2026-10-29 22:47:32 +01:00
jschoubben	dedd988fc9	Export a bus in memory and a mesh whose plan hands a module with a provision, so mesh-provisioner's whole test composes a real plan (issue 1954 H5)	2026-10-29 22:44:49 +01:00
jschoubben	f701db0516	Key a provision's credential as the vault's own provision secret-<provision> and say what a provision depends on, so a provider waits for its credential and its own requirements (issue 1954, ADR 0570 clauses 3, 6)	2026-10-29 22:43:56 +01:00
jschoubben	161fba56ae	Hold the provisioner's records to one writer in the credential table: only mesh-provisioner writes provisions and plans, readers only read, and it writes none of the grants part's states (issue 1954 L6-P5, ADR 0570 clauses 1, 8)	2026-10-29 22:42:21 +01:00
jschoubben	692dbf9a17	Bind every provider by mesh-provisioner's plans and provision keys instead of the controller's assignments, act once a provision's dependencies are provided, say the outcome in its entry, and retire a consumer only on the operator's yes (issue 1954 L6-P3, P4, ADR 0570 clauses 2, 3, 5)	2026-10-29 22:41:50 +01:00
jschoubben	66ff33dbd3	Name a provision's credential as the vault's own names it, read each node's provisions by its engine, and give mesh-config's held values their layout in the sdk, so the vault, the engine and the composition checks read one form (issue 1954, issue 1953 D7)	2026-10-29 22:39:29 +01:00
jschoubben	6e39ed1852	Refuse a want's rule past the eighth in the refusals table, now that the eighth rule exists (issue 1954 D1)	2026-10-29 22:37:41 +01:00
jschoubben	56514aa4a2	Add the assigner's eighth rule, every provision the build requires provided, so a want waits on its provisions as ADR 0570 §4 decides (issue 1954 D1)	2026-10-29 22:37:11 +01:00
jschoubben	4a967933b3	Lay out a provision as a key of mesh-provisioner holding a reference and never a value, and a plan as a key of its own, so the holder, the vault, the clients and the providers read one record (issue 1954 L6-P2, ADR 0570 clauses 1, 2)	2026-10-29 22:32:15 +01:00
jschoubben	233b6be5dd	Compose each node's provisioning plans from the bus alone, in a Planning mode that reads no secret, so mesh-provisioner composes the plans the controller did (issue 1954 L6-P1, ADR 0570 clause 2)	2026-10-29 22:31:02 +01:00
jschoubben	4204afd240	Name mesh-config's compare, take-over and hand-back on its seat, so callers reach the config switch ADR 0565 decides by the seat (issue 1953)	2026-10-29 22:28:45 +01:00
jschoubben	2d2aa7ba9b	Carry the catalogue's predefined list on the bridge's merged message, so the indexer keeps it without the controller's mirror (issue 1953 L5-D1, ADR 0565 §2)	2026-10-29 22:21:12 +01:00
jschoubben	2e5cc4f166	Let a module's log keep its entries for an age, so the hand-act log holds each act 400 days as ADR 0565 decides instead of refusing when full (issue 1953 S-age)	2026-10-29 22:17:50 +01:00
jschoubben	bc6c8a6d24	Let a bundle write a key with its own time to live and hear its expiry, so pulses, settles and bounds expire on the bus through the runtime (issue 1952)	2026-10-29 22:14:42 +01:00
jschoubben	20cac82ab7	Give the control records their layouts, a person's policy and its one derivation, and the engine's own packages key, so the assigner, the indexer and the nodes keep them without the controller (issue 1953 L5-S2, S3, S4)	2026-10-29 22:14:01 +01:00
jschoubben	fbd00c8943	Refuse a manifest that lists its claimed seat's event among its own emits, so a holder never says a seat event where no consumer hears it (issue 1952, second of a kind)	2026-10-29 22:10:44 +01:00
jschoubben	7df90445ad	Add the seats mesh-wants and mesh-hand-acts, the engine's packages verb, the act layout and a recorder that falls back to the controller's log while the seat has no holder, so the control records have homes the lease does not hold (issue 1953 L5-S1, S2, S4)	2026-10-29 22:09:16 +01:00
jschoubben	32f5ce3712	Refuse a tools account secret under a parent the runtime cannot pass, so the rule covers the module's 0700 mesh place too (issue 1952 S5, ADR 0564 Limits 4)	2026-10-29 22:00:43 +01:00
jschoubben	8e3d7a4c3c	Give a tools bundle's bus-account secret to the runtime's account and refuse it where that account cannot reach, so the bus tools can read their credential (issue 1952 S5, ADR 0564 Limits 4)	2026-10-29 21:59:11 +01:00
jschoubben	b6ef01d6c6	Let the watchman hear the bus module's slow consumers and closed connections and read the provisioner reports, and never the bus's API audit, so S9 and S21 have their facts without the vault's hashes (issue 1952 S5)	2026-10-29 21:57:50 +01:00
jschoubben	7000bd5049	Let a tools bundle declare its own bus account and what it may remove, so the bus tools remove the controller's dead-letter consumer and the node-engine's acts on a declared account with no idle service (issue 1952 S5, ADR 0564 Limits 4)	2026-10-29 21:52:52 +01:00
jschoubben	69fcb6c1c1	Fit the watchman's grant to what L4 does: hear its watchdogs' words and read a source's age and message, never deliver again or drop, so it holds no more than its job (issue 1952 S5)	2026-10-29 21:44:53 +01:00
jschoubben	2a04bf0ac5	Let the watchman read and delete a given-up message only on the streams dead letters come from, each by name and never a bucket's, so keeping dead letters cannot read every bucket (issue 1952 S5)	2026-10-29 21:43:15 +01:00
jschoubben	0b12b62a01	A failure among the change's own tests ends the check ask's level there, so the rest of the suite is not paid for (issue 1289) ... Quick fix chosen (in askrun.go, the one place every build module's check ask runs): own-test packages already ran first, but the rest ran after their failure (issue 1921). 1921 still holds past them.	2026-10-29 21:41:19 +01:00