Placement keyed per node and module, no ASSIGNMENTS stream, and plan entries carrying a consumer's contribution (issue 774) #148

2026-10-31T09:59:49Z

mesh-tools commented

2026-10-31 09:59:49 +00:00

This repository:

Carry what a consumer contributes in its plan entry as one opaque payload, so a provider serving from the seat's plans reads it with its own contract and the provisioner knows no provision's fields (issue 774, research 072 row 34)
Say what the controller's lease turns now that the vault mints whoever holds it: grants' consumers, the grant source, retirement and rotation (issue 774)
Let a node composing itself hand a module exactly when the vault judged its plan handed, through one rule (catalogue.AssignmentHands), so the vault and the node never judge postgres's secrets two ways again (issue 774)
Take the plan entry's Given and ConsumerAt back out: route-proxy's seat defines its own contract and the provisioner's plan stays generic (the operator, 2026-10-31; issue 774). process.Conn.Read stays.
Say which machines are inside the private network from placement, for route-proxy, whose membership read goes with the assignments stream (issue 774, research 072 rows 33 and 34)
Carry each contribution, composed, and the consumer's address in its plan entry, and let a process read another module's state, so route-proxy serves routes from the seat's plans alone (issue 774, research 072 row 34)
Keep placement. in step after each commit, so a reader of the form before alone follows every write and the delivery's members need no order (issue 774, research 072 row 37)
Stop declaring and reading the ASSIGNMENTS stream: a runtime reads its membership from the grants part's state, and the stream is deleted at the lease write and must not be made again (issue 774, research 072 row 33)
Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37)
Let the bus module's tools delete the stream ASSIGNMENTS at the lease write, the only stream a bus account may delete (issue 774, research 072 row 33)

Issue 774 (L3 of design 47: nothing is left with the controller), research 072 rows 11, 26, 33, 34 and 37.

Delivery group feat/072-moves, one check and one Approve: mesh-sdk acbf80ad, mesh-catalog 8439ec11, mesh-delivery a313c3e8, mesh-tools be2fc2e9, mesh-host 8bdfddab, mesh-control 7a169eae. Every member pins mesh-sdk acbf80ad, except the controller root, which stays on main's pin on purpose (the controller is deprecated; its change is kept minimal). route-proxy's contract is the published tag modules/route-proxy/contract/v0.1.0; these pins are set by hand one last time (ADR 0573; issue 1585 builds the automatic rebuild).

What it does: the seat mesh-placement keeps one key per node (<node>.node) and per module (<node>.<module>), the legacy placement.<node> mirrored while readers move; the ASSIGNMENTS stream is no longer declared and mesh-grants reads memberships from its own state; mesh-hand-acts copies the controller's hand acts once; route-proxy serves routes from the provisioner's plans through its own contract; the vault is the only issuer of bus accounts, the controller forwarding to it since the take-over (2026-10-27).

Quick fix vs thorough fix (review round 2): the reviewer found that the vault and the controller could both mint an account before the take-over. The take-over was recorded on 2026-10-27, and the operator ruled out a hand-back (2026-10-31), so the window cannot recur; no change. The manifest of mesh-grants claiming no seat mesh-grants (ADR 0547 §5) is noted on issue 774 for the controller's removal.

Before delivery: no membership is held back (grants_membership: 0 at pass 140611). Do not roll mesh-delivery back after the key conversion.

Tests: each repository's unit suite, go vet and go vet -tags integration are clean at these heads (review round 2, 2026-10-31 10:40).

Reviewed-by: rev-072@shanks at acbf80ad91

**This repository:** - Carry what a consumer contributes in its plan entry as one opaque payload, so a provider serving from the seat's plans reads it with its own contract and the provisioner knows no provision's fields (issue 774, research 072 row 34) - Say what the controller's lease turns now that the vault mints whoever holds it: grants' consumers, the grant source, retirement and rotation (issue 774) - Let a node composing itself hand a module exactly when the vault judged its plan handed, through one rule (catalogue.AssignmentHands), so the vault and the node never judge postgres's secrets two ways again (issue 774) - Take the plan entry's Given and ConsumerAt back out: route-proxy's seat defines its own contract and the provisioner's plan stays generic (the operator, 2026-10-31; issue 774). process.Conn.Read stays. - Say which machines are inside the private network from placement, for route-proxy, whose membership read goes with the assignments stream (issue 774, research 072 rows 33 and 34) - Carry each contribution, composed, and the consumer's address in its plan entry, and let a process read another module's state, so route-proxy serves routes from the seat's plans alone (issue 774, research 072 row 34) - Keep placement.<node> in step after each commit, so a reader of the form before alone follows every write and the delivery's members need no order (issue 774, research 072 row 37) - Stop declaring and reading the ASSIGNMENTS stream: a runtime reads its membership from the grants part's state, and the stream is deleted at the lease write and must not be made again (issue 774, research 072 row 33) - Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37) - Let the bus module's tools delete the stream ASSIGNMENTS at the lease write, the only stream a bus account may delete (issue 774, research 072 row 33) Issue 774 (L3 of design 47: nothing is left with the controller), research 072 rows 11, 26, 33, 34 and 37. **Delivery group `feat/072-moves`, one check and one Approve:** mesh-sdk acbf80ad, mesh-catalog 8439ec11, mesh-delivery a313c3e8, mesh-tools be2fc2e9, mesh-host 8bdfddab, mesh-control 7a169eae. Every member pins mesh-sdk acbf80ad, except the controller root, which stays on main's pin on purpose (the controller is deprecated; its change is kept minimal). route-proxy's contract is the published tag `modules/route-proxy/contract/v0.1.0`; these pins are set by hand one last time (ADR 0573; issue 1585 builds the automatic rebuild). **What it does:** the seat mesh-placement keeps one key per node (`<node>.node`) and per module (`<node>.<module>`), the legacy `placement.<node>` mirrored while readers move; the ASSIGNMENTS stream is no longer declared and mesh-grants reads memberships from its own state; mesh-hand-acts copies the controller's hand acts once; route-proxy serves routes from the provisioner's plans through its own contract; the vault is the only issuer of bus accounts, the controller forwarding to it since the take-over (2026-10-27). **Quick fix vs thorough fix (review round 2):** the reviewer found that the vault and the controller could both mint an account before the take-over. The take-over was recorded on 2026-10-27, and the operator ruled out a hand-back (2026-10-31), so the window cannot recur; no change. The manifest of mesh-grants claiming no seat `mesh-grants` (ADR 0547 §5) is noted on issue 774 for the controller's removal. **Before delivery:** no membership is held back (`grants_membership`: 0 at pass 140611). Do not roll mesh-delivery back after the key conversion. **Tests:** each repository's unit suite, `go vet` and `go vet -tags integration` are clean at these heads (review round 2, 2026-10-31 10:40). Reviewed-by: rev-072@shanks at acbf80ad910a3492dd9a970ac17f9b29579c4e56

mesh-tools added 10 commits 2026-10-31 09:59:49 +00:00

Let the bus module's tools delete the stream ASSIGNMENTS at the lease write, the only stream a bus account may delete (issue 774, research 072 row 33) d352fe51b4

Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37) 4c54aec972

The node key <node>.node is a write's commit: it names each placed module with its value's digest, the
module keys carry the value they replace until it lands, so a reader never composes half a write. Every
reader goes through PlacementKeys/PlacementsOf, which read the legacy placement.<node> too while the
change is delivered.

Stop declaring and reading the ASSIGNMENTS stream: a runtime reads its membership from the grants part's state, and the stream is deleted at the lease write and must not be made again (issue 774, research 072 row 33) 7a9c8570cb

Keep placement.<node> in step after each commit, so a reader of the form before alone follows every write and the delivery's members need no order (issue 774, research 072 row 37) a320f8e2cd

Carry each contribution, composed, and the consumer's address in its plan entry, and let a process read another module's state, so route-proxy serves routes from the seat's plans alone (issue 774, research 072 row 34) a4e7629742

Say which machines are inside the private network from placement, for route-proxy, whose membership read goes with the assignments stream (issue 774, research 072 rows 33 and 34) 98d5306d6b

Take the plan entry's Given and ConsumerAt back out: route-proxy's seat defines its own contract and the provisioner's plan stays generic (the operator, 2026-10-31; issue 774). process.Conn.Read stays. 2d1d8def75

Let a node composing itself hand a module exactly when the vault judged its plan handed, through one rule (catalogue.AssignmentHands), so the vault and the node never judge postgres's secrets two ways again (issue 774) 085f17e935

Say what the controller's lease turns now that the vault mints whoever holds it: grants' consumers, the grant source, retirement and rotation (issue 774) de8e82c06f

Carry what a consumer contributes in its plan entry as one opaque payload, so a provider serving from the seat's plans reads it with its own contract and the provisioner knows no provision's fields (issue 774, research 072 row 34)

mesh/delivery merged: source.main moved to novox/mesh-sdk@fbbfae7629bf

Details

mesh/delivery-group group feat/072-moves merged: every member is merged

Details

mesh/check failed: shanks: the check of novox/mesh-controller#487 failed: go mod download in modules/route-proxy: go: git.novox.be/novox/mesh-controll…

acbf80ad91

mesh-tools commented

2026-10-31 09:59:56 +00:00

Delivery novox/mesh-sdk@acbf80ad910a — merged since 2026-10-31T10:30:59Z

Source — source.main moved to novox/mesh-sdk@fbbfae7629. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group feat/072-moves: novox/mesh-catalog@8439ec117c, novox/mesh-controller@7a169eae76, novox/mesh-delivery@a313c3e843, novox/mesh-host@8bdfddab4a, novox/mesh-sdk@acbf80ad91, novox/mesh-tools@be2fc2e9b6

composed together: fail — the checker's verdict at the members' heads (10e5c18979c3): shanks

Transitions

2026-10-31 09:59 (new) → proposed (announced): novox/mesh-sdk#148's head announced
2026-10-31 09:59 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-31 10:30 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-sdk@acbf80ad910a` — **merged** since 2026-10-31T10:30:59Z **Source** — source.main moved to novox/mesh-sdk@fbbfae7629bf. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `feat/072-moves`: novox/mesh-catalog@8439ec117cb9, novox/mesh-controller@7a169eae76ef, novox/mesh-delivery@a313c3e84380, novox/mesh-host@8bdfddab4aab, novox/mesh-sdk@acbf80ad910a, novox/mesh-tools@be2fc2e9b6ac - composed together: fail — the checker's verdict at the members' heads (10e5c18979c3): shanks **Transitions** - 2026-10-31 09:59 (new) → proposed (announced): novox/mesh-sdk#148's head announced - 2026-10-31 09:59 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-31 10:30 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit fbbfae7629 into main

2026-10-31 10:30:58 +00:00

mesh-tools deleted branch feat/072-moves

2026-10-31 10:30:58 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-sdk#148