jschoubben 409c56685d Keep a held module's contributions when only its own secret is missing, and say a provider's move as consumers joining or leaving (issue 774) ...

A module held for an own secret never made (nextcloud's admin on novox, 2026-10-30) was composed as a bare stub, so
its contributions left postgres's grants and keycloak's clients, and their helpers would have retired its login.
The culprit now tries leaving out its own secrets alone before its whole offer.

JudgeMove said a changed received-, bound- or secret- file as "where its data is kept"; it now names the consumers
that join or leave. The judgement stays a move: its yes is what kept nextcloud's login.

Quick fix: leave out own secrets alone before the whole offer. Thorough fix (not here): carry a held module's last
contributions from what runs into its providers' received files whatever part of it fails to compose.

2026-10-31 00:21:33 +01:00

..

buildrun

The placement reader names the seat mesh-placement's state, held by the assigner, as L2 moved it (issue 774, ADR 0567)

2026-10-28 21:54:04 +01:00

testdata

Give a composition its value, its canonical digest and its files by digest; key a dotted module escaped (issue 1943, S2; issue 1150)

2026-10-24 16:26:32 +02:00

answer_paths.go

Only a file's secrets are split entry by entry when masked and named: a vault box under vault-sealed is one masked word and one path, judged whole by what it opens to (issue 1126, C1; review of seed-same-3, round 1)

2026-10-28 12:22:37 +01:00

assigner_test.go

Refuse a want's rule past the eighth in the refusals table, now that the eighth rule exists (issue 1954 D1)

2026-10-29 22:37:41 +01:00

assigner.go

Add the assigner's eighth rule, every provision the build requires provided, so a want waits on its provisions as ADR 0570 §4 decides (issue 1954 D1)

2026-10-29 22:37:11 +01:00

builder_reference_test.go

Name the error of a fetch whose lock waits for an unpublished package (issue 1587, ADR 0500 §6)

2026-10-22 18:00:02 +02:00

builder_test.go

Let a module that builds no artifact have a done key that can be delivered (issue 1613, the lead's request for the builder lane)

2026-10-22 17:59:55 +02:00

builder.go

Key a building key's asks by build seat language, so a builder taking it over knows whose steps to watch (issue 1887 A4b)

2026-10-23 15:44:57 +02:00

buildrecord_test.go

Give delivery.Module a path and BuildRecord the artifacts a build made, so the builder can find a module and compare digests (issue 1588)

2026-10-21 09:04:43 +00:00

buildrecord.go

Cite ADR 0478's accepted clause numbers

2026-10-21 12:45:04 +02:00

candidate_paths_test.go

Carry a candidate module's named paths, so the builder's fetch for a candidate names them (issue 1758, ADR 0499 §2, the builder lane's request)

2026-10-22 18:06:49 +02:00

checker_test.go

delivery: a verdict names the siblings it read and the commits it was carried from, and a composition its fingerprint set, so a trunk or sibling move is carried, not judged again (ADR 0548 §5, §6; issue 568 S2)

2026-10-26 11:25:07 +01:00

checker.go

delivery: a verdict names the siblings it read and the commits it was carried from, and a composition its fingerprint set, so a trunk or sibling move is carried, not judged again (ADR 0548 §5, §6; issue 568 S2)

2026-10-26 11:25:07 +01:00

composed_compare.go

Only a file's secrets are split entry by entry when masked and named: a vault box under vault-sealed is one masked word and one path, judged whole by what it opens to (issue 1126, C1; review of seed-same-3, round 1)

2026-10-28 12:22:37 +01:00

composed_keys_test.go

Let the judgement beside a composition say unchanged: equal to the declaration the node last applied (issue 1943; ADR 0540 clause 9)

2026-10-24 21:17:14 +02:00

composed_seals.go

A file's secrets are sealed values entry by entry: each a slot of its own, kept where it opens to the value that runs, masked and named per secret (issue 1126, C1; the seed-7 probe: about 45 files on ace and novox differed by their secrets' bytes alone)

2026-10-28 12:02:39 +01:00

composed_signature_test.go

Bundle the mesh's authorities by certificate, and check a node's certificate against every one a bundle holds (issue 774, ADR 0550 §2)

2026-10-28 21:54:04 +01:00

composed_signature.go

Merge main (the R4g finish: the composer command) into feat/r6 (issue 1943)

2026-10-24 23:01:18 +02:00

composed_value_test.go

Let the node's own composition carry its files' filled paths, and refuse a composition that would have a provisioner's file written empty (issue 1945)

2026-10-25 01:46:36 +02:00

composed_value.go

Let the node's own composition carry its files' filled paths, and refuse a composition that would have a provisioner's file written empty (issue 1945)

2026-10-25 01:46:36 +02:00

composed.go

Merge main (the R4g finish: the composer command) into feat/r6 (issue 1943)

2026-10-24 23:01:18 +02:00

control_records_test.go

Carry the engine's verdict on each account declared never to become root, and its contract, in the node's health report, so the self-check's DA and D-root judge on the machine's own word (issue 1952, ADR 0266)

2026-10-29 23:48:08 +01:00

control_records.go

Name a provision's credential as the vault's own names it, read each node's provisions by its engine, and give mesh-config's held values their layout in the sdk, so the vault, the engine and the composition checks read one form (issue 1954, issue 1953 D7)

2026-10-29 22:39:29 +01:00

delivery_test.go

Compare haves with SameHave in the round-trip tests, now that a have carries a list (issue 1126)

2026-10-26 20:20:12 +01:00

delivery.go

Name the seat's states, candidates by proposal and the proposal itself, so readers and the holder share one contract (ADR 0567 §1-§6, issue 1126)

2026-10-28 18:09:38 +01:00

fingerprint2_test.go

Compute the source fingerprint's new form beside src1, and its key part (issue 1356)

2026-10-20 01:40:35 +00:00

fingerprint2.go

Compute the source fingerprint's new form beside src1, and its key part (issue 1356)

2026-10-20 01:40:35 +00:00

fingerprint_test.go

Prove the source fingerprint against three builds the live builder recorded (issue 1203)

2026-10-19 11:03:46 +02:00

fingerprint.go

Prove the source fingerprint against three builds the live builder recorded (issue 1203)

2026-10-19 11:03:46 +02:00

forge_inputs_test.go

Carry the catalogue's predefined list on the bridge's merged message, so the indexer keeps it without the controller's mirror (issue 1953 L5-D1, ADR 0565 §2)

2026-10-29 22:21:12 +01:00

gate_test.go

A settle ask's group begins with a colon, which no branch name holds, so a branch named settle/... still merges on its Approve (review of issue 1280)

2026-10-26 21:12:31 +01:00

gate.go

A settle ask's group begins with a colon, which no branch name holds, so a branch named settle/... still merges on its Approve (review of issue 1280)

2026-10-26 21:12:31 +01:00

grants.go

delivery: the grants part's grant keys and the source the assigner reads (a1; issue 774)

2026-10-28 21:54:04 +01:00

handed.go

delivery: the bus node hands the loaded list's hashes to the vault, sealed, in the bus module's have (ADR 0547 clause 9, issue 1945)

2026-10-26 11:28:38 +01:00

held_test.go

Give the controller seat the verb held and the event artifacts-gone, so the builder rebuilds a done key whose blob the artifact store no longer holds (issue 1937)

2026-10-24 04:07:22 +02:00

held.go

Give the controller seat the verb held and the event artifacts-gone, so the builder rebuilds a done key whose blob the artifact store no longer holds (issue 1937)

2026-10-24 04:07:22 +02:00

history_records.go

Keep the builder's history as its own log that readers declare and follow, the memberships as the grants part's state, and refuse a module's own stream, so every module's data is in the bus's predefined forms and readable by its tools (issue 1955, ADR 0571 clauses 1, 4, 5, 7)

2026-10-29 23:28:21 +01:00

indexer2_test.go

Test the indexer's manifests, the new fields of modules and candidates, and the fpset (issue 1357)

2026-10-20 01:44:22 +00:00

judge_test.go

Keep a held module's contributions when only its own secret is missing, and say a provider's move as consumers joining or leaving (issue 774)

2026-10-31 00:21:33 +01:00

judge.go

Keep a held module's contributions when only its own secret is missing, and say a provider's move as consumers joining or leaving (issue 774)

2026-10-31 00:21:33 +01:00

manifests_mailu_test.go

Test a 21 KB manifest round trip byte for byte, on mailu's manifest copied from mesh-catalog (issue 1357)

2026-10-20 06:02:43 +00:00

manifests.go

Add the layout of the indexer's manifests bucket: the key by digest and its value (issue 1357)

2026-10-20 01:43:17 +00:00

module_newform_test.go

Accept a modules value with the new fingerprint alone, and say mesh/check is the required status (issue 1851, S7 and S16, ADR 0453 §6, ADR 0503 §3 §5)

2026-10-22 17:46:56 +02:00

module_paths_test.go

Keep each artifact's named paths in the modules value, so the checker needs no manifest to see a change touch them (issue 1758, ADR 0499, lead decision L8)

2026-10-22 18:00:24 +02:00

motion_test.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

motion.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

namedtree_layouts_test.go

Carry each named path's git object beside a module's other inputs (issue 1758, S3, ADR 0499 §2-§3)

2026-10-22 17:27:58 +02:00

namedtree_test.go

Compute a module's narrowed tree in one function, so every caller gives the merge's value (issue 1758, S2, ADR 0499 §2)

2026-10-22 17:27:02 +02:00

namedtree.go

Compute a module's narrowed tree in one function, so every caller gives the merge's value (issue 1758, S2, ADR 0499 §2)

2026-10-22 17:27:02 +02:00

nodehealth.go

Carry the engine's verdict on each account declared never to become root, and its contract, in the node's health report, so the self-check's DA and D-root judge on the machine's own word (issue 1952, ADR 0266)

2026-10-29 23:48:08 +01:00

noderecord_test.go

The vault signs: the contract of its state signers, its verb sign and its event signed, a node's grants to ask it and to read what it trusts, and the authority composed as a bundle (issue 774, ADR 0550 §2)

2026-10-28 21:54:04 +01:00

noderecord.go

The vault signs: the contract of its state signers, its verb sign and its event signed, a node's grants to ask it and to read what it trusts, and the authority composed as a bundle (issue 774, ADR 0550 §2)

2026-10-28 21:54:04 +01:00

own_drift.go

A drifted own secret is read from a resource id as a node runs it, its module's name first (only-office.needs-jwt), so the node agent finds what to hand the vault (issue 1126, cause C4; review round 2)

2026-10-28 10:00:29 +01:00

placed.go

The placement reader names the seat mesh-placement's state, held by the assigner, as L2 moved it (issue 774, ADR 0567)

2026-10-28 21:54:04 +01:00

placement_candidate.go

Keep as today what a node keeps today and what is held only behind it, saying how; a stub hands and collects nothing of its own (issue 1126)

2026-10-28 23:49:22 +01:00

placement_proposal.go

Let the seed carry the differences its nodes found, each named in its brief for the operator to approve knowingly; a refusal or silence still fails (issue 1126)

2026-10-28 22:24:57 +01:00

placement_test.go

Refuse mesh-watcher and mesh-self-check on one node, so the watcher of the self-check never falls silent with it (issue 1952 S8, ADR 0564 clause 6, Limits 5)

2026-10-29 21:37:59 +01:00

placement.go

Refuse mesh-watcher and mesh-self-check on one node, so the watcher of the self-check never falls silent with it (issue 1952 S8, ADR 0564 clause 6, Limits 5)

2026-10-29 21:37:59 +01:00

preview.go

Carry each named path's git object beside a module's other inputs (issue 1758, S3, ADR 0499 §2-§3)

2026-10-22 17:27:58 +02:00

provided.go

Name the modules the mesh provides itself in one predicate, so the seed's check takes the private network as the composer and the grants part do (issue 1126)

2026-10-28 20:12:51 +01:00

put.go

Say the put's tools, not a seat's verbs, in the put's words (ADR 0546)

2026-10-25 21:08:10 +01:00

reach.go

A module with no floor holds no head back; a merge among its changes reads not yet on the machines (review of issue 1280, ADR 0556 clause 2)

2026-10-26 21:12:48 +01:00

signers.go

Bundle the mesh's authorities by certificate, and check a node's certificate against every one a bundle holds (issue 774, ADR 0550 §2)

2026-10-28 21:54:04 +01:00

source_test.go

A module's floor counts every running have, healthy or not; health stays in its words (ADR 0556 clause 2, insight)

2026-10-26 21:12:31 +01:00

source.go

Carry the catalogue's predefined list on the bridge's merged message, so the indexer keeps it without the controller's mirror (issue 1953 L5-D1, ADR 0565 §2)

2026-10-29 22:21:12 +01:00

stepasks_compose_test.go

Let the Go build seat carry a compose ask and its answer, so the assigner composes a group with its mesh-sdk head (issue 1622)

2026-10-24 03:51:35 +02:00

stepasks_key_test.go

Name an ask's step key <node>.<ask id> and its watch, so the asker learns which node took it and refuses other keys (issue 1887 A1b, ADR 0525 §6)

2026-10-23 15:11:44 +02:00

stepasks_test.go

Carry every node's name on a check ask to the names check, so no repository lists them (ADR 0567 §12, issue 1126)

2026-10-28 18:13:57 +01:00

stepasks.go

Carry every node's name on a check ask to the names check, so no repository lists them (ADR 0567 §12, issue 1126)

2026-10-28 18:13:57 +01:00

steps_test.go

Pack a build's output like the build agent and keep the steps state's shape (issues 1471, 1479), part 7 of 7

2026-10-20 20:06:48 +00:00

steps.go

End a step left by a previous process at once: every step names its owner (issue 1890)

2026-10-27 01:19:29 +01:00

stuck_test.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

stuck.go

Give the watchman's stuck keys a layout the controller reads (issue 1153)

2026-10-18 20:11:04 +02:00

toolchains_test.go

Carry manifests and lock hashes in the forge messages, keep a module's new-form inputs, and lay out the build modules' toolchain keys (design 47 R4c-1, issues 1442, 1443)

2026-10-20 18:20:15 +00:00

toolchains.go

Carry manifests and lock hashes in the forge messages, keep a module's new-form inputs, and lay out the build modules' toolchain keys (design 47 R4c-1, issues 1442, 1443)

2026-10-20 18:20:15 +00:00

trunk_test.go

Say in the fixture's comment how it was made; test an answered state without inputs (issue 1281)

2026-10-19 22:47:27 +00:00

trunk.go

Count a build record without a state as the outcome it is (issue 1281): the controller never stores state built

2026-10-19 22:39:29 +00:00

turns.go

delivery: a turn never holds the check of heads that wait in it, so two approved merges in one turn never hold each other's carry (ADR 0548 §3; issue 568, review round 1)

2026-10-26 12:12:53 +01:00

userlist.go

The bus node follows the grants part's sealed user list, and only the grants part reads the vault's hashes (ADR 0547 clauses 7, 9; issue 1945)

2026-10-26 11:53:11 +01:00

view_answers_test.go

Keep the placement ask among the assigner's asks: its Approve's level, not its kind, needs the proof (ADR 0567 §5, issue 1126)

2026-10-28 18:30:00 +01:00

view_answers.go

Keep the placement ask among the assigner's asks: its Approve's level, not its kind, needs the proof (ADR 0567 §5, issue 1126)

2026-10-28 18:30:00 +01:00

want_composed_test.go

Add the assigner's eighth rule, every provision the build requires provided, so a want waits on its provisions as ADR 0570 §4 decides (issue 1954 D1)

2026-10-29 22:37:11 +01:00