jschoubben 5cd8bf9520 Bound a run's input by the bus's value limit, 256 KiB (issue 1921) ...

The lead's ruling on milestone 47/B0: each referenced input is bounded
by the value limit the design already uses.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

2026-11-06 22:10:10 +01:00

..

testdata

Give a composition its value, its canonical digest and its files by digest; key a dotted module escaped (issue 1943, S2; issue 1150)

2026-10-24 16:26:32 +02:00

answer_paths.go

Remove the composition from mesh-sdk: compose, its bus and runtime readers, takein, validate, the composer's run and command, overlay's generator and delivery's move judge now live in the node-engine, and the placement judge in the assigner (ADR 0593 §1, §6, §7)

2026-11-02 18:45:00 +01:00

assigner_test.go

A node record states the reader capabilities its engine reads, a module value the ones its manifest needs, and a want of rule 9 or 10 reads (ADR 0614 §2, §4, issue 774)

2026-11-03 23:18:22 +01:00

assigner.go

A node record states the reader capabilities its engine reads, a module value the ones its manifest needs, and a want of rule 9 or 10 reads (ADR 0614 §2, §4, issue 774)

2026-11-03 23:18:22 +01:00

builder_reference_test.go

Name the error of a fetch whose lock waits for an unpublished package (issue 1587, ADR 0500 §6)

2026-10-22 18:00:02 +02:00

builder_test.go

Remove what nothing calls once the controller's repository is emptied: facts, the src1 computation, the recreation judge, and the build step's dead helpers (ADR 0593 §11)

2026-11-02 18:58:28 +01:00

builder.go

delivery, catalogue: the node-engine's compose-candidate verb, compositions carrying their plan or refusal, the kept import form and a build's imports on its key, so the engine alone composes and the indexer switches form without a rebuild (ADR 0593 §4, §6, §7)

2026-11-02 18:19:24 +01:00

buildrecord_test.go

Remove what nothing calls once the controller's repository is emptied: facts, the src1 computation, the recreation judge, and the build step's dead helpers (ADR 0593 §11)

2026-11-02 18:58:28 +01:00

buildrecord.go

Remove the controller from the delivery contract, and its command line client and hand composer

2026-11-02 11:36:26 +01:00

candidate_paths_test.go

Carry a candidate module's named paths, so the builder's fetch for a candidate names them (issue 1758, ADR 0499 §2, the builder lane's request)

2026-10-22 18:06:49 +02:00

checker_test.go

Name the checking program that judged a verdict (issue 1921)

2026-11-06 22:07:41 +01:00

checker.go

Name the checking program that judged a verdict (issue 1921)

2026-11-06 22:07:41 +01:00

compose_candidate_test.go

A node the sandbox did not judge is a field of the contract: composer.Machine.NotJudged and the answer's verdict not-judged, so the checker decides by them and never by words (ADR 0593 §9; the prepare's seams finding on "not judged")

2026-11-03 16:41:06 +01:00

compose_candidate.go

A node the sandbox did not judge is a field of the contract: composer.Machine.NotJudged and the answer's verdict not-judged, so the checker decides by them and never by words (ADR 0593 §9; the prepare's seams finding on "not judged")

2026-11-03 16:41:06 +01:00

composed_compare.go

Only a file's secrets are split entry by entry when masked and named: a vault box under vault-sealed is one masked word and one path, judged whole by what it opens to (issue 1126, C1; review of seed-same-3, round 1)

2026-10-28 12:22:37 +01:00

composed_keys_test.go

Let the judgement beside a composition say unchanged: equal to the declaration the node last applied (issue 1943; ADR 0540 clause 9)

2026-10-24 21:17:14 +02:00

composed_seals.go

A file's secrets are sealed values entry by entry: each a slot of its own, kept where it opens to the value that runs, masked and named per secret (issue 1126, C1; the seed-7 probe: about 45 files on ace and novox differed by their secrets' bytes alone)

2026-10-28 12:02:39 +01:00

composed_value_test.go

Let the node's own composition carry its files' filled paths, and refuse a composition that would have a provisioner's file written empty (issue 1945)

2026-10-25 01:46:36 +02:00

composed_value.go

delivery: a composition carries no signature, since the node applies only what it composes itself (ADR 0593 §6)

2026-11-02 19:02:33 +01:00

composed.go

mesh-sdk names no module: the core's credentials are what a manifest says (core-credentials), and the bus's upgrade policy is the one its manifest declares (issue 774, the operator 2026-11-03)

2026-11-03 16:41:06 +01:00

control_records_test.go

Name the expired enrolment's issued event by its id, and carry a node's login fall back in its health report

2026-11-02 01:41:36 +01:00

control_records.go

Name a provision's credential as the vault's own names it, read each node's provisions by its engine, and give mesh-config's held values their layout in the sdk, so the vault, the engine and the composition checks read one form (issue 1954, issue 1953 D7)

2026-10-29 22:39:29 +01:00

delivery_test.go

A module value carries the source revision at which its fingerprint last changed, a have says what the node keeps as it runs for a manifest that does not yet say it, and a want names a release only beside the yes it gave (ADR 0601 §1, §4; review round 1)

2026-11-03 16:41:06 +01:00

delivery.go

A module value carries the source revision at which its fingerprint last changed, a have says what the node keeps as it runs for a manifest that does not yet say it, and a want names a release only beside the yes it gave (ADR 0601 §1, §4; review round 1)

2026-11-03 16:41:06 +01:00

enginedata.go

Name the node-engine's data items state, so mesh-host writes and disk-load reads one shape (ADR 0577)

2026-11-01 00:05:38 +01:00

enginepackages.go

Work out a node's declared packages and their difference with the mirror in the SDK, so each engine writes its own key (ADR 0565 clause 6, issue 1953)

2026-11-01 16:02:06 +01:00

enrolment.go

Name the enrolment an address is reserved for, from its ask, and the issued event's id in one place

2026-11-02 01:41:36 +01:00

fingerprint2_test.go

delivery: the fingerprint's computation, the named tree, the package versions and the step runner leave mesh-sdk for the indexer and the builder, which alone compute them (ADR 0593 §1, §2)

2026-11-02 18:51:24 +01:00

fingerprint2.go

delivery: the fingerprint's computation, the named tree, the package versions and the step runner leave mesh-sdk for the indexer and the builder, which alone compute them (ADR 0593 §1, §2)

2026-11-02 18:51:24 +01:00

fingerprint.go

Remove what nothing calls once the controller's repository is emptied: facts, the src1 computation, the recreation judge, and the build step's dead helpers (ADR 0593 §11)

2026-11-02 18:58:28 +01:00

forge_inputs_test.go

delivery: the fingerprint's computation, the named tree, the package versions and the step runner leave mesh-sdk for the indexer and the builder, which alone compute them (ADR 0593 §1, §2)

2026-11-02 18:51:24 +01:00

gate_test.go

Move the joining token's shape into mesh-sdk, so the vault that makes it, mesh-cli and the engine read one type

2026-11-02 01:41:03 +01:00

gate.go

A settle ask's group begins with a colon, which no branch name holds, so a branch named settle/... still merges on its Approve (review of issue 1280)

2026-10-26 21:12:31 +01:00

grants.go

Remove the controller from the delivery contract, and its command line client and hand composer

2026-11-02 11:36:26 +01:00

handed.go

delivery: the bus node hands the loaded list's hashes to the vault, sealed, in the bus module's have (ADR 0547 clause 9, issue 1945)

2026-10-26 11:28:38 +01:00

held_test.go

Remove the controller's seat, the lease verbs and placement's adopt and hand-back; refuse any manifest naming the controller

2026-11-02 11:20:28 +01:00

held.go

Remove the controller's seat, the lease verbs and placement's adopt and hand-back; refuse any manifest naming the controller

2026-11-02 11:20:28 +01:00

history_records.go

delivery: the indexer's packages state and the imports a build reports, so only the indexer computes a fingerprint over what a module imports (ADR 0593 §2)

2026-11-02 18:15:35 +01:00

indexer2_test.go

Test the indexer's manifests, the new fields of modules and candidates, and the fpset (issue 1357)

2026-10-20 01:44:22 +00:00

manifests_mailu_test.go

Test a 21 KB manifest round trip byte for byte, on mailu's manifest copied from mesh-catalog (issue 1357)

2026-10-20 06:02:43 +00:00

manifests.go

Add the layout of the indexer's manifests bucket: the key by digest and its value (issue 1357)

2026-10-20 01:43:17 +00:00

module_newform_test.go

Accept a modules value with the new fingerprint alone, and say mesh/check is the required status (issue 1851, S7 and S16, ADR 0453 §6, ADR 0503 §3 §5)

2026-10-22 17:46:56 +02:00

module_paths_test.go

Keep each artifact's named paths in the modules value, so the checker needs no manifest to see a change touch them (issue 1758, ADR 0499, lead decision L8)

2026-10-22 18:00:24 +02:00

motion_test.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

motion.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

namedtree_layouts_test.go

delivery: the fingerprint's computation, the named tree, the package versions and the step runner leave mesh-sdk for the indexer and the builder, which alone compute them (ADR 0593 §1, §2)

2026-11-02 18:51:24 +01:00

namedtree.go

delivery: the fingerprint's computation, the named tree, the package versions and the step runner leave mesh-sdk for the indexer and the builder, which alone compute them (ADR 0593 §1, §2)

2026-11-02 18:51:24 +01:00

node_logins.go

Take the tunnel key at issue and place a joining node on the operator's yes, so the hub peers it before redeem

2026-11-02 01:41:36 +01:00

nodehealth.go

Name the expired enrolment's issued event by its id, and carry a node's login fall back in its health report

2026-11-02 01:41:36 +01:00

noderecord_test.go

A node record states the reader capabilities its engine reads, a module value the ones its manifest needs, and a want of rule 9 or 10 reads (ADR 0614 §2, §4, issue 774)

2026-11-03 23:18:22 +01:00

noderecord.go

A node record states the reader capabilities its engine reads, a module value the ones its manifest needs, and a want of rule 9 or 10 reads (ADR 0614 §2, §4, issue 774)

2026-11-03 23:18:22 +01:00

own_drift.go

A drifted own secret is read from a resource id as a node runs it, its module's name first (only-office.needs-jwt), so the node agent finds what to hand the vault (issue 1126, cause C4; review round 2)

2026-10-28 10:00:29 +01:00

packages.go

delivery: the fingerprint's computation, the named tree, the package versions and the step runner leave mesh-sdk for the indexer and the builder, which alone compute them (ADR 0593 §1, §2)

2026-11-02 18:51:24 +01:00

placed.go

Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37)

2026-10-31 09:21:04 +01:00

placement_candidate.go

Remove the controller from the delivery contract, and its command line client and hand composer

2026-11-02 11:36:26 +01:00

placement_keys.go

Say which machines are inside the private network from placement, for route-proxy, whose membership read goes with the assignments stream (issue 774, research 072 rows 33 and 34)

2026-10-31 09:28:15 +01:00

placement_proposal.go

Take the tunnel key at issue and place a joining node on the operator's yes, so the hub peers it before redeem

2026-11-02 01:41:36 +01:00

placement_test.go

Remove the composition from mesh-sdk: compose, its bus and runtime readers, takein, validate, the composer's run and command, overlay's generator and delivery's move judge now live in the node-engine, and the placement judge in the assigner (ADR 0593 §1, §6, §7)

2026-11-02 18:45:00 +01:00

placement.go

Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37)

2026-10-31 09:21:04 +01:00

preview.go

delivery: the fingerprint's computation, the named tree, the package versions and the step runner leave mesh-sdk for the indexer and the builder, which alone compute them (ADR 0593 §1, §2)

2026-11-02 18:51:24 +01:00

provided_overlay_test.go

delivery and catalogue import neither overlay nor buildcpu, so a change to the network generator or the build share code rebuilds only their own importers (ADR 0593 §1)

2026-11-02 18:25:11 +01:00

provided.go

delivery and catalogue import neither overlay nor buildcpu, so a change to the network generator or the build share code rebuilds only their own importers (ADR 0593 §1)

2026-11-02 18:25:11 +01:00

published_packages_test.go

delivery: the indexer's packages state and the imports a build reports, so only the indexer computes a fingerprint over what a module imports (ADR 0593 §2)

2026-11-02 18:15:35 +01:00

published_packages.go

delivery: the indexer's packages state and the imports a build reports, so only the indexer computes a fingerprint over what a module imports (ADR 0593 §2)

2026-11-02 18:15:35 +01:00

put.go

Say the put's tools, not a seat's verbs, in the put's words (ADR 0546)

2026-10-25 21:08:10 +01:00

reach.go

A module with no floor holds no head back; a merge among its changes reads not yet on the machines (review of issue 1280, ADR 0556 clause 2)

2026-10-26 21:12:48 +01:00

signers.go

Remove the controller from the delivery contract, and its command line client and hand composer

2026-11-02 11:36:26 +01:00

source_test.go

A node record states the reader capabilities its engine reads, a module value the ones its manifest needs, and a want of rule 9 or 10 reads (ADR 0614 §2, §4, issue 774)

2026-11-03 23:18:22 +01:00

source.go

A node record states the reader capabilities its engine reads, a module value the ones its manifest needs, and a want of rule 9 or 10 reads (ADR 0614 §2, §4, issue 774)

2026-11-03 23:18:22 +01:00

stepasks_compose_test.go

Bound a run's input by the bus's value limit, 256 KiB (issue 1921)

2026-11-06 22:10:10 +01:00

stepasks_key_test.go

Name an ask's step key <node>.<ask id> and its watch, so the asker learns which node took it and refuses other keys (issue 1887 A1b, ADR 0525 §6)

2026-10-23 15:11:44 +02:00

stepasks_run.go

Bound a run's input by the bus's value limit, 256 KiB (issue 1921)

2026-11-06 22:10:10 +01:00

stepasks_test.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

stepasks.go

Add the build seat's ask run: a program built from a change, run over the heads (issue 1921)

2026-11-06 22:06:09 +01:00

steps_test.go

Pack a build's output like the build agent and keep the steps state's shape (issues 1471, 1479), part 7 of 7

2026-10-20 20:06:48 +00:00

steps.go

End a step left by a previous process at once: every step names its owner (issue 1890)

2026-10-27 01:19:29 +01:00

stuck_test.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

stuck.go

Give the watchman's stuck keys a layout the controller reads (issue 1153)

2026-10-18 20:11:04 +02:00

token_test.go

Move the joining token's shape into mesh-sdk, so the vault that makes it, mesh-cli and the engine read one type

2026-11-02 01:41:03 +01:00

token.go

Name the expired enrolment's issued event by its id, and carry a node's login fall back in its health report

2026-11-02 01:41:36 +01:00

toolchains_test.go

Agree a toolchain by strict majority and name the nodes that sit out (ADR 0584, issue 1578)

2026-11-01 15:20:26 +01:00

toolchains.go

Agree a toolchain by strict majority and name the nodes that sit out (ADR 0584, issue 1578)

2026-11-01 15:20:26 +01:00

trunk_test.go

Say in the fixture's comment how it was made; test an answered state without inputs (issue 1281)

2026-10-19 22:47:27 +00:00

trunk.go

Count a build record without a state as the outcome it is (issue 1281): the controller never stores state built

2026-10-19 22:39:29 +00:00

turns.go

delivery: a turn never holds the check of heads that wait in it, so two approved merges in one turn never hold each other's carry (ADR 0548 §3; issue 568, review round 1)

2026-10-26 12:12:53 +01:00

userlist.go

Remove the controller from the delivery contract, and its command line client and hand composer

2026-11-02 11:36:26 +01:00

verdicts_test.go

A manifest whose judge does not know a field has the verdict waits, held like a refusal by every reader (ADR 0578); in a modules value it is written as a refusal naming the fields, so a reader pinned before holds it too

2026-11-03 16:41:06 +01:00

verdicts.go

A manifest whose judge does not know a field has the verdict waits, held like a refusal by every reader (ADR 0578); in a modules value it is written as a refusal naming the fields, so a reader pinned before holds it too

2026-11-03 16:41:06 +01:00

view_answers_test.go

Keep the placement ask among the assigner's asks: its Approve's level, not its kind, needs the proof (ADR 0567 §5, issue 1126)

2026-10-28 18:30:00 +01:00

view_answers.go

Keep the placement ask among the assigner's asks: its Approve's level, not its kind, needs the proof (ADR 0567 §5, issue 1126)

2026-10-28 18:30:00 +01:00

want_composed_test.go

A node record states the reader capabilities its engine reads, a module value the ones its manifest needs, and a want of rule 9 or 10 reads (ADR 0614 §2, §4, issue 774)

2026-11-03 23:18:22 +01:00