Compose as the controller does, so a node's shadow can answer same (issue 1126, group fix/1126-seed-same) #114

2026-10-28T09:05:44Z

mesh-tools commented

2026-10-28 09:05:44 +00:00

Delivery group fix/1126-seed-same (mesh-sdk, mesh-host, mesh-delivery, mesh-catalog), design 47 milestone L2. Probe #534 had all four nodes answer 'differs'; issue 1126 notes 53-56 name causes C1-C6. This member:

C1: a sealed value is named by its slot (resource and field): delivery.Seals / SealsIn / KeepSeals; compareOne keeps a running box where it opens to the same value.
C2: one rule for laid values (catalogue.LaidSource / LaidValue: mesh, node and module sources), as the controller's laidSources.
C3: ownedPaths skips a seat path that steps back for a seat held here, so the owner of /etc/resolv.conf no longer depends on seat order.
C5: compose.Carried replaces the stub for folded modules of an old-form build: their running containers and directories, their paths in RunsAt.
C6 (quick fix): the running .kept file is carried when there is no operator export. Thorough fix (the export in the object store) needs vault and grant work; not here.
T1: each bodies entry names its differing JSON paths (never a value, never inside a secret key); answers fitted to 160 KiB.
C4: OwnValuesDiffer / OwnNeedName and the answer's values_differ count, read by the node and the vault.

Quick vs thorough: C1, C2, C3, C5 thorough (one rule in the SDK, used by node and view); C6 quick, said above.
Tests: rows in existing tests only, each fails without its fix; gofmt, vet (also -tags integration), go test pass.
Accepted difference: the controller composes resolv.conf's owner as networkmanager by name order, against its own step-back rule; the node is right (issue 1126 note 57).

Reviewed-by: rev-seed-same@shanks at 3028c7ec4e

Delivery group fix/1126-seed-same (mesh-sdk, mesh-host, mesh-delivery, mesh-catalog), design 47 milestone L2. Probe #534 had all four nodes answer 'differs'; issue 1126 notes 53-56 name causes C1-C6. This member: - C1: a sealed value is named by its slot (resource and field): delivery.Seals / SealsIn / KeepSeals; compareOne keeps a running box where it opens to the same value. - C2: one rule for laid values (catalogue.LaidSource / LaidValue: mesh, node and module sources), as the controller's laidSources. - C3: ownedPaths skips a seat path that steps back for a seat held here, so the owner of /etc/resolv.conf no longer depends on seat order. - C5: compose.Carried replaces the stub for folded modules of an old-form build: their running containers and directories, their paths in RunsAt. - C6 (quick fix): the running <module>.kept file is carried when there is no operator export. Thorough fix (the export in the object store) needs vault and grant work; not here. - T1: each bodies entry names its differing JSON paths (never a value, never inside a secret key); answers fitted to 160 KiB. - C4: OwnValuesDiffer / OwnNeedName and the answer's values_differ count, read by the node and the vault. Quick vs thorough: C1, C2, C3, C5 thorough (one rule in the SDK, used by node and view); C6 quick, said above. Tests: rows in existing tests only, each fails without its fix; gofmt, vet (also -tags integration), go test pass. Accepted difference: the controller composes resolv.conf's owner as networkmanager by name order, against its own step-back rule; the node is right (issue 1126 note 57). Reviewed-by: rev-seed-same@shanks at 3028c7ec4ed21b14e58d5043c22d54c3bbcbb2bc

mesh-tools added 3 commits 2026-10-28 09:05:44 +00:00

Compose as the controller does, so a node's shadow can answer same (issue 1126, C1 C2 C3 C5 C6, T1) 16b8d8a1ee

Seals are reused and compared by slot (resource, field), never across resources;
one rule says which resolved config values are laid; a seat path that steps back
is owned by the seat it steps back for, whatever the seat order; a folded module
of an old-form build is composed from what runs of it; the operator export's file
is carried as it runs; a differing resource names its differing JSON paths, found
before its bodies are cut, and an answer is fitted to the node's key.

A node's shadow answer counts the values that drifted from the vault's, and names the own secrets among them (issue 1126, cause C4) 1062b33d32

delivery.OwnValuesDiffer, ValuesDiffer and WithValuesDiffer read the shown bodies masked as another value; a candidate
answer carries values_differ. The node agent hands the vault those own secrets' running values through move-in's
replace_running, so no seat verb and no bus grant changes here.

A drifted own secret is read from a resource id as a node runs it, its module's name first (only-office.needs-jwt), so the node agent finds what to hand the vault (issue 1126, cause C4; review round 2)

mesh/delivery merged: source.main moved to novox/mesh-sdk@79eb58efe4b0

Details

mesh/delivery-group group fix/1126-seed-same merged: every member is merged

Details

mesh/check failed: integration: github.com/novox/mesh-host/cmd/mesh-host.TestNatsANodeThePlacementNamesComposesAndAppliesItsOwn: the node did not comp…

3028c7ec4e

delivery.OwnNeedName reads <module>.needs-<name> and the bare needs-<name>; OwnValuesDiffer and the node agent use it.
The fixtures carry the id shape captured from novox's shadow answer.

mesh-tools commented

2026-10-28 09:05:49 +00:00

Delivery novox/mesh-sdk@3028c7ec4ed2 — merged since 2026-10-28T09:46:27Z

Source — source.main moved to novox/mesh-sdk@79eb58efe4. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group fix/1126-seed-same: novox/mesh-catalog@0974d1a57d, novox/mesh-delivery@2cccbfd096, novox/mesh-host@c912bcab6e, novox/mesh-sdk@3028c7ec4e

composed together: fail — the checker's verdict at the members' heads (3cb7f74b347d): integration: github.com/novox/mesh-host/cmd/mesh-host.TestNatsANodeThePlacementNamesComposesAndAppliesItsOwn

Transitions

2026-10-28 09:05 (new) → proposed (announced): novox/mesh-sdk#114's head announced
2026-10-28 09:05 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-28 09:46 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-sdk@3028c7ec4ed2` — **merged** since 2026-10-28T09:46:27Z **Source** — source.main moved to novox/mesh-sdk@79eb58efe4b0. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `fix/1126-seed-same`: novox/mesh-catalog@0974d1a57d99, novox/mesh-delivery@2cccbfd096d8, novox/mesh-host@c912bcab6e73, novox/mesh-sdk@3028c7ec4ed2 - composed together: fail — the checker's verdict at the members' heads (3cb7f74b347d): integration: github.com/novox/mesh-host/cmd/mesh-host.TestNatsANodeThePlacementNamesComposesAndAppliesItsOwn **Transitions** - 2026-10-28 09:05 (new) → proposed (announced): novox/mesh-sdk#114's head announced - 2026-10-28 09:05 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-28 09:46 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 79eb58efe4 into main

2026-10-28 09:46:24 +00:00

mesh-tools deleted branch fix/1126-seed-same

2026-10-28 09:46:25 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-sdk#114