Design 47's last milestones as one release: the contracts for health, control records, provisioning and history leaving the controller (issues 774, 1126, 1952, 1953, 1954, 1955, 1289) #133

2026-10-30T00:21:31Z

mesh-tools commented

2026-10-30 00:21:31 +00:00

Delivery 2 of design 47's single release (delivery group feat/774-l3-reland: mesh-sdk, mesh-delivery, mesh-catalog, mesh-host, mesh-controller, mesh-tools, hq). Records: ADR 0564 (v47), 0565 (v14), 0570 (v18), 0571 (v35), 0572 (v9).

This member holds the contracts: held modules serve their tools from what runs (L3 re-land, issue 1126); health seats, findings, per-key TTL (L4); hand-acts, mesh-wants, config candidates (L5); provisions and plans on mesh-provisioner, credential forms incl. "none", ErrNotReady, rule 8 (L6); the builder's build-log, mesh-artifact-sweep, seat holders, disk readings, memberships, the node health report (L7); a change's own failing test ends the level (R4c, issue 1289). The release's new manifest words are read by the running parts since delivery 1 (#132).

Quick vs thorough: thorough throughout (each contract lives here once, held to by catalog checks and grant rows); bent rules and drops are listed in the release plan.

Reviewed-by: rev-47@shanks at 2da0de75c3

Delivery 2 of design 47's single release (delivery group feat/774-l3-reland: mesh-sdk, mesh-delivery, mesh-catalog, mesh-host, mesh-controller, mesh-tools, hq). Records: ADR 0564 (v47), 0565 (v14), 0570 (v18), 0571 (v35), 0572 (v9). This member holds the contracts: held modules serve their tools from what runs (L3 re-land, issue 1126); health seats, findings, per-key TTL (L4); hand-acts, mesh-wants, config candidates (L5); provisions and plans on mesh-provisioner, credential forms incl. "none", ErrNotReady, rule 8 (L6); the builder's build-log, mesh-artifact-sweep, seat holders, disk readings, memberships, the node health report (L7); a change's own failing test ends the level (R4c, issue 1289). The release's new manifest words are read by the running parts since delivery 1 (#132). Quick vs thorough: thorough throughout (each contract lives here once, held to by catalog checks and grant rows); bent rules and drops are listed in the release plan. Reviewed-by: rev-47@shanks at 2da0de75c3f0087cff9c2f5ef789ca6dc3c59045

mesh-tools added 53 commits 2026-10-30 00:21:31 +00:00

A module composed as what runs of it serves its tools as they run, so the runtime no longer drops it (issue 1126) 52056010fe

After the take-over of placement on 2026-10-29, shanks's runtime stopped serving the folded systemd-resolved (the
node-resolver seat's verbs answer "nothing serves") and novox's the folded nats. Neither has a want: each runs inside
its node's own composition at a build of the old form (Scope.InOwn), and is composed as Carried of the indexer's
manifest. That manifest is the catalogue's, which no build resolved, so it has no bundles (catalogue/build.go: Bundles
are set only by a build's resolution), and the runtime's MESH_TOOL_MODULES and MESH_TOOL_ENV are made from bundles
(catalogue/runtime.go). The controller composed them from the resolved manifest its store kept.

The kind: a module composed as what runs of it (Stub, Carried: held, or folded at an old build) contributes to the
others from its manifest, not from what runs. For a held module with a new build it is the other way round: its new
bundles are served, which were never delivered.

- The quick fix: read the old-form build's resolved manifest for a folded module. One instance; a held module still
hands its new bundles.
- The thorough fix, chosen: compose.ToolsRunning reads what the node's runtime serves as it runs (its process's
MESH_TOOL_MODULES and MESH_TOOL_ENV, each bundle's archive), frombus gives it as Node.RunsTools, and every stubbed
module of the machine's runtime (held or carried) contributes those bundles, whatever its manifest says.

Tests: two rows (folded, held) added to TestCompositionsAreTheDeclarationSplitByModule; no new test function.

A data flag that differs alone moves no data: the judgement reads the data items first, and says the flag loudly (issue 1126) 94cee5d199

novox's mongodb and mssql asked a yes for moving their data on a toolchain move: the running side, read back from the
kept declaration, carries no data flag, and judge.go returned moves-data on the flag before it compared the data
directories and files, so a flag mismatch both raised a false ask and hid a real move. Now moves-data only when a
data item (a directory or file within the data places, or a process of a module with data) changes; a flag-only
difference is neither, with a WARNING in its words. One row changed and one added in TestJudgeMove.

A runtime that already dropped a carried module's tools serves them again, read from what runs and its build (issue 1126, review) 22c9ddd32b

rev-held2: ToolsRunning took a carried module's bundles from the runtime's MESH_TOOL_MODULES alone, and shanks had
already applied the drop of systemd-resolved, so its runs stayed empty and the drop permanent. Now every bundle
archive that runs at its module's BundlePath is a running bundle; one the runtime loads nothing of takes its loads and
words from the module's build (its built bundles, else its build's artifacts, by catalogue.BundleLoads, the rule a
build's resolution keeps, now one function). The runtime process and each archive are matched by their owning module
too, not only by id and path. A row added: the runtime already dropped it.

Add the four health seats, mesh-conditions, mesh-watchdogs, mesh-self-check and mesh-healers, so the controller's health has homes its lease does not hold (issue 1952 S1, ADR 0564 clause 1) 187fb63439

Give the condition keeper the controller's condition bodies, the findings layout and the take-over key, so readers change only the seat they hear (issue 1952 S2-S4, ADR 0564 clauses 2, 3, 7-9) 4fff214eeb

Let a state create a key with its own time to live, so a pulse, a settle or a hold bound expires on the bus with no timer (issue 1952 S6, ADR 0564 clauses 4, 7, 13) 575a05e49e

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13) 544720b00a

Refuse mesh-watcher and mesh-self-check on one node, so the watcher of the self-check never falls silent with it (issue 1952 S8, ADR 0564 clause 6, Limits 5) 83d928fe50

Grant the health holders what ADR 0564 gives them and nothing more: named reads of the lease and the controller's conditions and hand acts, the watchman's own dead-letter consumer, and the bus tools' removal account (issue 1952 S5) 5a47192b57

A failure among the change's own tests ends the check ask's level there, so the rest of the suite is not paid for (issue 1289) 0b12b62a01

Quick fix chosen (in askrun.go, the one place every build module's check ask runs): own-test packages already ran first, but the rest ran after their failure (issue 1921). 1921 still holds past them.

Let the watchman read and delete a given-up message only on the streams dead letters come from, each by name and never a bucket's, so keeping dead letters cannot read every bucket (issue 1952 S5) 2a04bf0ac5

Fit the watchman's grant to what L4 does: hear its watchdogs' words and read a source's age and message, never deliver again or drop, so it holds no more than its job (issue 1952 S5) 69fcb6c1c1

Let a tools bundle declare its own bus account and what it may remove, so the bus tools remove the controller's dead-letter consumer and the node-engine's acts on a declared account with no idle service (issue 1952 S5, ADR 0564 Limits 4) 7000bd5049

Let the watchman hear the bus module's slow consumers and closed connections and read the provisioner reports, and never the bus's API audit, so S9 and S21 have their facts without the vault's hashes (issue 1952 S5) b6ef01d6c6

Give a tools bundle's bus-account secret to the runtime's account and refuse it where that account cannot reach, so the bus tools can read their credential (issue 1952 S5, ADR 0564 Limits 4) 8e3d7a4c3c

Refuse a tools account secret under a parent the runtime cannot pass, so the rule covers the module's 0700 mesh place too (issue 1952 S5, ADR 0564 Limits 4) 32f5ce3712

Add the seats mesh-wants and mesh-hand-acts, the engine's packages verb, the act layout and a recorder that falls back to the controller's log while the seat has no holder, so the control records have homes the lease does not hold (issue 1953 L5-S1, S2, S4) 7df90445ad

Refuse a manifest that lists its claimed seat's event among its own emits, so a holder never says a seat event where no consumer hears it (issue 1952, second of a kind) fbd00c8943

Give the control records their layouts, a person's policy and its one derivation, and the engine's own packages key, so the assigner, the indexer and the nodes keep them without the controller (issue 1953 L5-S2, S3, S4) 20cac82ab7

Let a bundle write a key with its own time to live and hear its expiry, so pulses, settles and bounds expire on the bus through the runtime (issue 1952) bc6c8a6d24

Let a module's log keep its entries for an age, so the hand-act log holds each act 400 days as ADR 0565 decides instead of refusing when full (issue 1953 S-age) 2e5cc4f166

Carry the catalogue's predefined list on the bridge's merged message, so the indexer keeps it without the controller's mirror (issue 1953 L5-D1, ADR 0565 §2) 2d2aa7ba9b

Name mesh-config's compare, take-over and hand-back on its seat, so callers reach the config switch ADR 0565 decides by the seat (issue 1953) 4204afd240

Compose each node's provisioning plans from the bus alone, in a Planning mode that reads no secret, so mesh-provisioner composes the plans the controller did (issue 1954 L6-P1, ADR 0570 clause 2) 233b6be5dd

Lay out a provision as a key of mesh-provisioner holding a reference and never a value, and a plan as a key of its own, so the holder, the vault, the clients and the providers read one record (issue 1954 L6-P2, ADR 0570 clauses 1, 2) 4a967933b3

Add the assigner's eighth rule, every provision the build requires provided, so a want waits on its provisions as ADR 0570 §4 decides (issue 1954 D1) 56514aa4a2

Refuse a want's rule past the eighth in the refusals table, now that the eighth rule exists (issue 1954 D1) 6e39ed1852

Name a provision's credential as the vault's own names it, read each node's provisions by its engine, and give mesh-config's held values their layout in the sdk, so the vault, the engine and the composition checks read one form (issue 1954, issue 1953 D7) 66ff33dbd3

Bind every provider by mesh-provisioner's plans and provision keys instead of the controller's assignments, act once a provision's dependencies are provided, say the outcome in its entry, and retire a consumer only on the operator's yes (issue 1954 L6-P3, P4, ADR 0570 clauses 2, 3, 5) 692dbf9a17

Hold the provisioner's records to one writer in the credential table: only mesh-provisioner writes provisions and plans, readers only read, and it writes none of the grants part's states (issue 1954 L6-P5, ADR 0570 clauses 1, 8) 161fba56ae

Key a provision's credential as the vault's own provision secret-<provision> and say what a provision depends on, so a provider waits for its credential and its own requirements (issue 1954, ADR 0570 clauses 3, 6) f701db0516

Export a bus in memory and a mesh whose plan hands a module with a provision, so mesh-provisioner's whole test composes a real plan (issue 1954 H5) dedd988fc9

Make every offer say its credential's form, pair or none where it names no own secret or issuer, and read no default, so the vault never mints a login for a provider that takes none (issue 1954, ADR 0570) 6b8c694381

Give a provision the vault itself provides no credential beside it, since its offer is the value (issue 1954, ADR 0570 clause 6) 58a83249c8

Move the node's health report layout into the sdk and let each node write only its own key while the watchman reads them, so the six machine alerts leave the controller (issue 774) 94d0de5c19

Name the machines a failing network part points at, so the watchman holds it there as the controller does without any machine's address (issue 774) 6eae0765f4

NetworkPart.Targets: the hub's machine for "hub", the machine whose tunnel address is each resolver's; empty where the
part is the machine's own. Filled by the node-engine from its tunnel's peers. Test: a row in
TestTheControlRecordsReadTheirWritersValues, read back byte-equal.

Add the seat artifact-store, the seat-holders state with its reader, and the builder's log layout, so the store's sweep, who holds which seat and build history leave the controller (issue 1955, ADR 0571 clauses 1, 2, 4) 7fdbadc655

Carry each build's repository, directory and commit in the builder's log, so the indexer, the outside-built registrations and the assigner read where a build came from there (issue 1955) f9a496d3e1

Let the artifact store's seat holder read the controller's lease, so its sweep starts only once the lease names no controller (issue 1955, ADR 0571 clause 2) dc78524e38

Compose a node's placed data items from the bus and move the readings layout into the sdk, so disk-load measures without a composed file and restic, mounts, nfs-server and the self-check read one layout (issue 1955, ADR 0571 clause 3) 196c5b6af2

Keep the builder's history as its own log that readers declare and follow, the memberships as the grants part's state, and refuse a module's own stream, so every module's data is in the bus's predefined forms and readable by its tools (issue 1955, ADR 0571 clauses 1, 4, 5, 7) bb993dd606

Read the bus through a module's declared states in frombus, with the runtime's adapter in fromruntime, so mesh-provisioner and disk-load compose from one reader instead of two copies (issue 1955) 08fc70783a

Move restic's last good night per item into the sdk's health layouts, so restic's night process writes it and the self-check reads one layout (issue 1955, ADR 0571 clause 3) 9f0bb1cfa4

Fail the grants table test for any row whose user is not composed, so a row can never pass for a missing user (issue 1955) 85f5fd0b22

Let restic's bundle, not its night's process, write each item's last good night, since the night runs as the operator's account with no bus account (issue 1955, ADR 0436 §1-2) 992ea0ab66

Carry the engine's verdict on each account declared never to become root, and its contract, in the node's health report, so the self-check's DA and D-root judge on the machine's own word (issue 1952, ADR 0266) f3677eb6f3

NodeHealth.Root: each such account's verdict (healthy, unhealthy with its way to root, unknown while the setuid search
runs), the module and resource declaring it. NodeHealth.Contract: the engine's statement contract, so a reader tells an
engine older than the judging. Test: a row in TestTheControlRecordsReadTheirWritersValues, read back byte-equal.

Name the artifact sweep's seat mesh-artifact-sweep for its scope, grant the provisioner client its machine's plans in place of the needs, and keep the grants part's withheld hearings in one layout, so the seat names follow ADR 0121 and the client and the self-check read the bus (issue 1955, ADR 0571 clause 2, ADR 0570 clause 2) 7bd0f6c2bd

Keep when each data item was first seen and when and why it was retired in its reading, so the self-check's D13 judges a new or retired item from disk-load's state (issue 1955, ADR 0571 clause 3) 31e90aaa0f

Let a bundle ask the runtime who answers a verb, and the self-check's own account ask the bus's discovery, so D-root and D3 find holders without the controller (issue 1955) fa5a6aeff5

Let a provider not ready yet wait and keep serving what it served, so a restarted gitea no longer stops serving its consumers until its keys load (issue 1954) 8fe3467753

Drop stdio.Discover, the self-check's discovery and its read of the withheld hearings, which no probe uses now that the operator dropped D-root, D3 and D-heard (issue 1952) 007b6fd45f

Keep the provisioner client's needs grant for one release, removed after the lease write, so the client before V3 still writes its needs while its delivery reaches each node (issue 1954) 6e4a3014cb

Merge main's parse-only new words into the release, which supersedes them with its full implementation (issue 774)

mesh/check being carried to 2da0de75c3f0 on 044ead7db83e | from mesh-catalog 12c2574c9d54 | novox/mesh-sdk#133 in group feat/774-l3-reland

mesh/delivery merged: source.main moved to novox/mesh-sdk@2b1e148bf58e

Details

mesh/delivery-group group feat/774-l3-reland merged: every member is merged

Details

2da0de75c3

mesh-tools commented

2026-10-30 00:21:35 +00:00

Delivery novox/mesh-sdk@2da0de75c3f0 — merged since 2026-10-30T11:01:43Z

Source — source.main moved to novox/mesh-sdk@2b1e148bf5. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group feat/774-l3-reland: novox/hq@0c450cad25, novox/mesh-catalog@f3a57dcc56, novox/mesh-controller@8b32e04e2f, novox/mesh-delivery@8edc83950c, novox/mesh-host@015334020a, novox/mesh-sdk@2da0de75c3, novox/mesh-tools@250aa73a56

Transitions

2026-10-30 00:21 (new) → proposed (announced): novox/mesh-sdk#133's head announced
2026-10-30 00:21 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-30 11:01 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-sdk@2da0de75c3f0` — **merged** since 2026-10-30T11:01:43Z **Source** — source.main moved to novox/mesh-sdk@2b1e148bf58e. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `feat/774-l3-reland`: novox/hq@0c450cad258e, novox/mesh-catalog@f3a57dcc56fb, novox/mesh-controller@8b32e04e2f8b, novox/mesh-delivery@8edc83950cea, novox/mesh-host@015334020ad2, novox/mesh-sdk@2da0de75c3f0, novox/mesh-tools@250aa73a5631 **Transitions** - 2026-10-30 00:21 (new) → proposed (announced): novox/mesh-sdk#133's head announced - 2026-10-30 00:21 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-30 11:01 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-30 08:58:52 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools commented

2026-10-30 09:36:07 +00:00

mesh-delivery: not merged. The merge of this pull request into main at 2da0de75c3 was declined: the operator, via telegram (user id verified), chose Decline. A new head asks the operator again.

mesh-delivery: **not merged.** The merge of this pull request into main at 2da0de75c3f0087cff9c2f5ef789ca6dc3c59045 was declined: the operator, via telegram (user id verified), chose Decline. A new head asks the operator again.

mesh-tools merged commit 2b1e148bf5 into main

2026-10-30 11:01:40 +00:00

mesh-tools deleted branch feat/774-l3-reland

2026-10-30 11:01:41 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-sdk#133