610 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
jschoubben	222d605f6f	The node seat node-engine: held by every node's engine, its six verbs and three events, and no module may claim it (issue 774, ADR 0563 §1)	2026-10-28 21:54:04 +01:00
jschoubben	3a8997c58a	Bundle the mesh's authorities by certificate, and check a node's certificate against every one a bundle holds (issue 774, ADR 0550 §2)	2026-10-28 21:54:04 +01:00
jschoubben	d6db3f38e6	The vault signs: the contract of its state signers, its verb sign and its event signed, a node's grants to ask it and to read what it trusts, and the authority composed as a bundle (issue 774, ADR 0550 §2)	2026-10-28 21:54:04 +01:00
jschoubben	18a47ac3c7	Placed: a module in the first revision heard of a node's key stands since before it, so the seed's placement does not leave out what already ran (issue 774)	2026-10-28 21:54:04 +01:00
jschoubben	1386219d4d	One reader of the catalogue's placement and the toolchain gate over it, in place of the three copies over the controller's assignments (issue 774, ADR 0549 §3, issue 1940); the assigner may read the lease (ADR 0549 §5)	2026-10-28 21:54:04 +01:00
jschoubben	10d4d2f845	Checker seat test: the try replaces both shell commands (issue 774)	2026-10-28 21:54:04 +01:00
jschoubben	b3100c55a1	Checker seat: the try's verb also replaces docker run postgres, as the controller's try did (ADR 0547 §10, issue 774)	2026-10-28 21:54:04 +01:00
jschoubben	0062bdc4a6	buscompose: the assigner may read the controller's lease, to choose where grants are read from (issue 774)	2026-10-28 21:54:04 +01:00
jschoubben	a1a688b19e	delivery: the grants part's grant keys and the source the assigner reads (a1; issue 774) ... Why: the grants part writes grants.<module>.<fp> in shadow beside the controller's; the assigner switches source only when the lease is handed away.	2026-10-28 21:54:04 +01:00
jschoubben	54b17164ef	Checker seat test: fold into the closed-set seats test, no new test function (issue 774)	2026-10-28 21:54:04 +01:00
jschoubben	3ed9a0e342	Checker seat: the try's end by hand is a verb too (issue 774)	2026-10-28 21:54:04 +01:00
jschoubben	9b5657a3d6	Seat mesh-delivery-checker: the try and its read are verbs of the checker's own seat, replacing sh merge-check.sh (ADR 0547 §10, issue 774)	2026-10-28 21:54:04 +01:00
jschoubben	1d4637e46b	Name the vault's verb issue-account on its seat, so its holder may serve it (issue 774, ADR 0561 §9)	2026-10-28 21:54:04 +01:00
jschoubben	fefa8b88ea	Say when the lease is handed away, let the vault and the grants part read it, and let the grants part create the consumers an account needs, so both turn on at the lease write alone (issue 774, ADR 0561 §3, §6)	2026-10-28 21:54:04 +01:00
jschoubben	8d9b3f779d	Build a minted account's value as the controller does, byte for byte, so a runtime reads the vault's unchanged (issue 774, ADR 0561 §2)	2026-10-28 21:54:04 +01:00
jschoubben	da506bb3b8	Say which bus accounts the grants part wants, in a state only the vault reads, and what the vault says when it mints one, so the vault can mint from the grants part's word (issue 774, ADR 0561 §2)	2026-10-28 21:54:04 +01:00
mesh-tools	af08be36a2	Merge pull request 'A waiting ask hears its step's end even when its own watch goes deaf (four lost checks, 2026-10-28)' (#121) from fix/lost-check into main	2026-10-28 20:40:58 +00:00
mesh-tools	6b43afa2ab	Merge pull request 'One predicate for a module the mesh provides itself (mesh-wireguard), used by the placement check (issue 1126)' (#120) from fix/1126-provided into main	2026-10-28 20:39:20 +00:00
jschoubben	f91340fe82	buildrun: open a steps watch again that closed having heard nothing, up to 3 closes in a row ... A watch that closed at once was left for good, so an ask whose own watch went deaf was read only at a reconnect (review of fix/lost-check).	2026-10-28 20:35:02 +01:00
jschoubben	6aeb401095	buildrun: read an ask's step at every step end of its build module, so a deaf watch loses no end ... mesh-catalog #553's verdict stayed running after its step passed on shanks at 19:09:31Z on 2026-10-28: the watch of that one step key, opened at 18:46:05Z, heard neither the start nor the end and never closed. HeardEnds stands between Asker and each ask's watch: nudged at each step end of the same build module (HearEnds: one watch per steps state) and at a reconnect, every waited ask reads its keys now; a watch that closes is opened again, at most 3 times. The checker and the builder both wait through it. Tests: a section of the asker's test (deaf, nudged by another module and by its own, a watch that closes); counts unchanged.	2026-10-28 20:29:30 +01:00
jschoubben	5228a5782d	Name the modules the mesh provides itself in one predicate, so the seed's check takes the private network as the composer and the grants part do (issue 1126)	2026-10-28 20:12:51 +01:00
mesh-tools	d7c790d242	Merge pull request 'The seat mesh-placement's contract, and node grants for its states (issue 1126, delivery 1 of 2)' (#119) from feat/1126-grants-first into main	2026-10-28 18:21:33 +00:00
jschoubben	38dbe1d3a3	Let a node agent hear the creation of the seat's placement and candidates, so it binds them with no timer (ADR 0567 §9, issue 1126)	2026-10-28 18:47:13 +01:00
jschoubben	a2dbcf670b	Bound a proposal's answers and ask by pulse keys whose expiry the holder hears, and name a hand-back proposal, so no timer waits (ADR 0567 §4, §7, issue 1126)	2026-10-28 18:43:39 +01:00
jschoubben	e987a8280b	Let a module's config values be proposed before the lease write: only a layer's places and accesses wait (ADR 0567 §13, issue 1126)	2026-10-28 18:42:05 +01:00
jschoubben	45f5f76811	Keep the placement ask among the assigner's asks: its Approve's level, not its kind, needs the proof (ADR 0567 §5, issue 1126)	2026-10-28 18:30:00 +01:00
jschoubben	4b4a173d84	Let withdraw mark a proposal for its holder to end, since the holder's process alone says the seat's events (ADR 0567 §2, issue 1126)	2026-10-28 18:21:59 +01:00
jschoubben	0282229fd9	Name the placement ask and a proposal's again and warrant, so the holder asks through the teller as its other asks (ADR 0567 §5, §10, issue 1126)	2026-10-28 18:20:27 +01:00
jschoubben	5a2a7eebfd	Hold that a check's node names reach the digest tool too, so a kept verdict misses when they change (ADR 0567 §12, issue 1126)	2026-10-28 18:17:08 +01:00
jschoubben	004bbc2ce2	Carry every node's name on a check ask to the names check, so no repository lists them (ADR 0567 §12, issue 1126)	2026-10-28 18:13:57 +01:00
jschoubben	fed64292f0	Read build capacity as an integer and build hours as one window, default 0: no repository names a node (ADR 0567 §12, issue 1126)	2026-10-28 18:13:18 +01:00
jschoubben	7a82384e21	Grant a node's agent the seat's placement and candidates, so it composes from the seat's state (ADR 0567 §3, §9, issue 1126)	2026-10-28 18:12:09 +01:00
jschoubben	7c565f2aa5	Move Intended and JudgeAnswers into mesh-sdk for a proposal: a difference is shown, only a refusal or silence fails (ADR 0567 §4, issue 1126)	2026-10-28 18:11:18 +01:00
jschoubben	edc6f269f3	Name the seat's states, candidates by proposal and the proposal itself, so readers and the holder share one contract (ADR 0567 §1-§6, issue 1126)	2026-10-28 18:09:38 +01:00
jschoubben	902e3c9e96	Refuse placement files on a forge message and delete placement-seed: no repository holds placement (ADR 0567 §11, issue 1126)	2026-10-28 18:09:38 +01:00
jschoubben	c16e6213e1	Define the seat mesh-placement with its seven verbs, so placement has one contract whoever holds it (ADR 0567, issue 1126)	2026-10-28 18:05:16 +01:00
mesh-tools	98f2f24069	Merge pull request 'A node holds the one module it cannot compose and applies the rest, as its shadow already answers (group fix/1126-apply-culprit, issue 1126)' (#118) from fix/1126-apply-culprit into main	2026-10-28 16:34:46 +00:00
jschoubben	0de3006415	A module refused alone is held, composed as what runs of it, on the node that applies as in its answer: one rule for both paths (issue 1126) ... The applying path (frombus.Compose) composed with no culprit, so one module's refusal came back as the whole node's: novox's apply would have refused all its modules for de-spiegel's unset route names. composeEach is now the one rule Compose and Answer both follow: - a module whose stub changes the refusal is held (compose.Node.Held); in the applying path a stand-in for a module placed here holds that module; only a refusal of no single module refuses the node; - a held module is composed from what runs of it (compose.Carried of its own composition in Running) and carried in the node's own wherever that runs it, folded or leaving the fold, so the node's own apply never removes it (issue 1945 by a new path) and what the others read of it is what runs; - none of a held module's own composition is in what is applied; - a module whose composition differs when the held ones are composed as stubs is held too; the node's own differing refuses the node; - since a held module is composed from its new manifest, what reads that manifest is held with it: the providers of what it contributes to (the proxy its routes) and, when it listens, the filter's holder. Quick fix weighed: a culprit loop in Compose alone. Thorough, chosen: one shared function, since the kind met twice (seed-8 shadow, now the apply), and review rounds 1 and 2 found its leaks.	2026-10-28 17:22:35 +01:00
mesh-tools	7aedd28f01	Merge pull request 'A module's own refusal refuses that module, not the node; contributions say unset values in config words; a folded module owns its manifest's paths (issue 1126, group fix/1126-seed-8)' (#117) from fix/1126-seed-8 into main	2026-10-28 13:27:05 +00:00
jschoubben	f387581b6b	A module's own refusal refuses that module, not the node: a stub whose contributions still fail the same is tried bare (issue 1126, seed-8: novox refused the whole candidate for de-spiegel's unset route names)	2026-10-28 14:07:59 +01:00
jschoubben	eda82b1598	A folded module owns its manifest's paths, as the controller tells node-files them, not every path it runs at (issue 1126, seed-8: f1-circuits, snake and txt-game shifted node-tools' owned paths on ace)	2026-10-28 14:07:59 +01:00
jschoubben	06742d0448	A contribution's unset required value is refused in its module's own form's words, as a file's is (issue 1126, seed-8: de-spiegel in the config form was told ${setting:…} and settings set)	2026-10-28 14:07:59 +01:00
mesh-tools	3d021445f7	Merge pull request 'A build module may say its node is not eligible, so asks go to a node that can build (group fix/ace-tun)' (#116) from fix/ace-tun into main	2026-10-28 13:07:40 +00:00
jschoubben	1618837ea9	A build seat's puller takes nothing while its module finds its node cannot build, and says why ... A node whose module proves a need of the machine missing (ace's /dev/net/tun, 2026-10-28) pulled image asks and failed each one; judged ineligible, its capacity is 0 with the reason, as build hours are, so the asks go to a node that can build them (issue 1126 note).	2026-10-28 12:50:16 +01:00
mesh-tools	6097e4f3e0	Merge pull request 'A file's secrets are sealed values entry by entry, masked and named per secret (issue 1126; group fix/1126-seed-same-3)' (#115) from fix/1126-seed-same-3 into main	2026-10-28 11:40:35 +00:00
jschoubben	8520a4c099	Only a file's secrets are split entry by entry when masked and named: a vault box under vault-sealed is one masked word and one path, judged whole by what it opens to (issue 1126, C1; review of seed-same-3, round 1)	2026-10-28 12:22:37 +01:00
jschoubben	70de9429e5	A file's secrets are sealed values entry by entry: each a slot of its own, kept where it opens to the value that runs, masked and named per secret (issue 1126, C1; the seed-7 probe: about 45 files on ace and novox differed by their secrets' bytes alone)	2026-10-28 12:02:39 +01:00
mesh-tools	79eb58efe4	Merge pull request 'Compose as the controller does, so a node's shadow can answer same (issue 1126, group fix/1126-seed-same)' (#114) from fix/1126-seed-same into main	2026-10-28 09:46:24 +00:00
jschoubben	3028c7ec4e	A drifted own secret is read from a resource id as a node runs it, its module's name first (only-office.needs-jwt), so the node agent finds what to hand the vault (issue 1126, cause C4; review round 2) ... delivery.OwnNeedName reads <module>.needs-<name> and the bare needs-<name>; OwnValuesDiffer and the node agent use it. The fixtures carry the id shape captured from novox's shadow answer.	2026-10-28 10:00:29 +01:00
jschoubben	1062b33d32	A node's shadow answer counts the values that drifted from the vault's, and names the own secrets among them (issue 1126, cause C4) ... delivery.OwnValuesDiffer, ValuesDiffer and WithValuesDiffer read the shown bodies masked as another value; a candidate answer carries values_differ. The node agent hands the vault those own secrets' running values through move-in's replace_running, so no seat verb and no bus grant changes here.	2026-10-28 09:49:03 +01:00