jschoubben f913918a60 Take the tunnel key at issue and place a joining node on the operator's yes, so the hub peers it before redeem ...

The operator's decision of 2026-11-02 01:05: issue requires overlay_key, the machine's tunnel public key; the vault's
enrolment-token tunnel declares all five fields a token needs (hub_key, hub_endpoint, address, key, range). An
add-node is proposed at the yes with the tunnel key alone; the identity keys come whole at redeem or not at all. A new
remove-node, mesh-enrolment's alone on the same warrant and the proposal's one change, takes a joining node running
nothing off placement when its enrolment ends unconfirmed (RemovedNodes names the key the holder deletes; LayChanges
lays nothing for it and refuses a node that runs modules or holds seats). NodeLogin gains Acts, the hand acts that
warranted its rotations. Tested as rows of TestPlacement, TestNodeRecord and the two seat tests; no new test function
(1438 unit tests).

(issue 774, review round 1b)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

2026-11-02 01:41:36 +01:00

..

buildrun

Decline a build ask for another toolchain instead of failing it (ADR 0584 clause 2, issue 1578)

2026-11-01 15:24:13 +01:00

testdata

Give a composition its value, its canonical digest and its files by digest; key a dotted module escaped (issue 1943, S2; issue 1150)

2026-10-24 16:26:32 +02:00

answer_paths.go

Only a file's secrets are split entry by entry when masked and named: a vault box under vault-sealed is one masked word and one path, judged whole by what it opens to (issue 1126, C1; review of seed-same-3, round 1)

2026-10-28 12:22:37 +01:00

assigner_test.go

Refuse a want's rule past the eighth in the refusals table, now that the eighth rule exists (issue 1954 D1)

2026-10-29 22:37:41 +01:00

assigner.go

Add the assigner's eighth rule, every provision the build requires provided, so a want waits on its provisions as ADR 0570 §4 decides (issue 1954 D1)

2026-10-29 22:37:11 +01:00

builder_reference_test.go

Name the error of a fetch whose lock waits for an unpublished package (issue 1587, ADR 0500 §6)

2026-10-22 18:00:02 +02:00

builder_test.go

Let a module that builds no artifact have a done key that can be delivered (issue 1613, the lead's request for the builder lane)

2026-10-22 17:59:55 +02:00

builder.go

Key a building key's asks by build seat language, so a builder taking it over knows whose steps to watch (issue 1887 A4b)

2026-10-23 15:44:57 +02:00

buildrecord_test.go

Give delivery.Module a path and BuildRecord the artifacts a build made, so the builder can find a module and compare digests (issue 1588)

2026-10-21 09:04:43 +00:00

buildrecord.go

Cite ADR 0478's accepted clause numbers

2026-10-21 12:45:04 +02:00

candidate_paths_test.go

Carry a candidate module's named paths, so the builder's fetch for a candidate names them (issue 1758, ADR 0499 §2, the builder lane's request)

2026-10-22 18:06:49 +02:00

checker_test.go

delivery: a verdict names the siblings it read and the commits it was carried from, and a composition its fingerprint set, so a trunk or sibling move is carried, not judged again (ADR 0548 §5, §6; issue 568 S2)

2026-10-26 11:25:07 +01:00

checker.go

delivery: a verdict names the siblings it read and the commits it was carried from, and a composition its fingerprint set, so a trunk or sibling move is carried, not judged again (ADR 0548 §5, §6; issue 568 S2)

2026-10-26 11:25:07 +01:00

composed_compare.go

Only a file's secrets are split entry by entry when masked and named: a vault box under vault-sealed is one masked word and one path, judged whole by what it opens to (issue 1126, C1; review of seed-same-3, round 1)

2026-10-28 12:22:37 +01:00

composed_keys_test.go

Let the judgement beside a composition say unchanged: equal to the declaration the node last applied (issue 1943; ADR 0540 clause 9)

2026-10-24 21:17:14 +02:00

composed_seals.go

A file's secrets are sealed values entry by entry: each a slot of its own, kept where it opens to the value that runs, masked and named per secret (issue 1126, C1; the seed-7 probe: about 45 files on ace and novox differed by their secrets' bytes alone)

2026-10-28 12:02:39 +01:00

composed_signature_test.go

Bundle the mesh's authorities by certificate, and check a node's certificate against every one a bundle holds (issue 774, ADR 0550 §2)

2026-10-28 21:54:04 +01:00

composed_signature.go

Merge main (the R4g finish: the composer command) into feat/r6 (issue 1943)

2026-10-24 23:01:18 +02:00

composed_value_test.go

Let the node's own composition carry its files' filled paths, and refuse a composition that would have a provisioner's file written empty (issue 1945)

2026-10-25 01:46:36 +02:00

composed_value.go

Let the node's own composition carry its files' filled paths, and refuse a composition that would have a provisioner's file written empty (issue 1945)

2026-10-25 01:46:36 +02:00

composed.go

Merge main (the R4g finish: the composer command) into feat/r6 (issue 1943)

2026-10-24 23:01:18 +02:00

control_records_test.go

Name the expired enrolment's issued event by its id, and carry a node's login fall back in its health report

2026-11-02 01:41:36 +01:00

control_records.go

Name a provision's credential as the vault's own names it, read each node's provisions by its engine, and give mesh-config's held values their layout in the sdk, so the vault, the engine and the composition checks read one form (issue 1954, issue 1953 D7)

2026-10-29 22:39:29 +01:00

delivery_test.go

Let the lease key name its ask and time, and the user-list key say the lease is handed

2026-11-02 00:15:20 +01:00

delivery.go

Name the seat's states, candidates by proposal and the proposal itself, so readers and the holder share one contract (ADR 0567 §1-§6, issue 1126)

2026-10-28 18:09:38 +01:00

enginedata.go

Name the node-engine's data items state, so mesh-host writes and disk-load reads one shape (ADR 0577)

2026-11-01 00:05:38 +01:00

enginepackages.go

Work out a node's declared packages and their difference with the mirror in the SDK, so each engine writes its own key (ADR 0565 clause 6, issue 1953)

2026-11-01 16:02:06 +01:00

enrolment.go

Name the expired enrolment's issued event by its id, and carry a node's login fall back in its health report

2026-11-02 01:41:36 +01:00

fingerprint2_test.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

fingerprint2.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

fingerprint_test.go

Prove the source fingerprint against three builds the live builder recorded (issue 1203)

2026-10-19 11:03:46 +02:00

fingerprint.go

Prove the source fingerprint against three builds the live builder recorded (issue 1203)

2026-10-19 11:03:46 +02:00

forge_inputs_test.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

gate_test.go

Move the joining token's shape into mesh-sdk, so the vault that makes it, mesh-cli and the engine read one type

2026-11-02 01:41:03 +01:00

gate.go

A settle ask's group begins with a colon, which no branch name holds, so a branch named settle/... still merges on its Approve (review of issue 1280)

2026-10-26 21:12:31 +01:00

grants.go

delivery: the grants part's grant keys and the source the assigner reads (a1; issue 774)

2026-10-28 21:54:04 +01:00

handed.go

delivery: the bus node hands the loaded list's hashes to the vault, sealed, in the bus module's have (ADR 0547 clause 9, issue 1945)

2026-10-26 11:28:38 +01:00

held_test.go

Give the controller seat the verb held and the event artifacts-gone, so the builder rebuilds a done key whose blob the artifact store no longer holds (issue 1937)

2026-10-24 04:07:22 +02:00

held.go

Give the controller seat the verb held and the event artifacts-gone, so the builder rebuilds a done key whose blob the artifact store no longer holds (issue 1937)

2026-10-24 04:07:22 +02:00

history_records.go

Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37)

2026-10-31 09:21:04 +01:00

indexer2_test.go

Test the indexer's manifests, the new fields of modules and candidates, and the fpset (issue 1357)

2026-10-20 01:44:22 +00:00

judge_test.go

Add the node-engine verb composition to the seat's contract, and the resources two compositions differ in (issue 774)

2026-10-31 00:23:42 +01:00

judge.go

Add the node-engine verb composition to the seat's contract, and the resources two compositions differ in (issue 774)

2026-10-31 00:23:42 +01:00

manifests_mailu_test.go

Test a 21 KB manifest round trip byte for byte, on mailu's manifest copied from mesh-catalog (issue 1357)

2026-10-20 06:02:43 +00:00

manifests.go

Add the layout of the indexer's manifests bucket: the key by digest and its value (issue 1357)

2026-10-20 01:43:17 +00:00

module_newform_test.go

Accept a modules value with the new fingerprint alone, and say mesh/check is the required status (issue 1851, S7 and S16, ADR 0453 §6, ADR 0503 §3 §5)

2026-10-22 17:46:56 +02:00

module_paths_test.go

Keep each artifact's named paths in the modules value, so the checker needs no manifest to see a change touch them (issue 1758, ADR 0499, lead decision L8)

2026-10-22 18:00:24 +02:00

motion_test.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

motion.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

namedtree_layouts_test.go

Carry each named path's git object beside a module's other inputs (issue 1758, S3, ADR 0499 §2-§3)

2026-10-22 17:27:58 +02:00

namedtree_test.go

Compute a module's narrowed tree in one function, so every caller gives the merge's value (issue 1758, S2, ADR 0499 §2)

2026-10-22 17:27:02 +02:00

namedtree.go

Compute a module's narrowed tree in one function, so every caller gives the merge's value (issue 1758, S2, ADR 0499 §2)

2026-10-22 17:27:02 +02:00

node_logins.go

Take the tunnel key at issue and place a joining node on the operator's yes, so the hub peers it before redeem

2026-11-02 01:41:36 +01:00

nodehealth.go

Name the expired enrolment's issued event by its id, and carry a node's login fall back in its health report

2026-11-02 01:41:36 +01:00

noderecord_test.go

Take the tunnel key at issue and place a joining node on the operator's yes, so the hub peers it before redeem

2026-11-02 01:41:36 +01:00

noderecord.go

The vault signs: the contract of its state signers, its verb sign and its event signed, a node's grants to ask it and to read what it trusts, and the authority composed as a bundle (issue 774, ADR 0550 §2)

2026-10-28 21:54:04 +01:00

own_drift.go

A drifted own secret is read from a resource id as a node runs it, its module's name first (only-office.needs-jwt), so the node agent finds what to hand the vault (issue 1126, cause C4; review round 2)

2026-10-28 10:00:29 +01:00

packages.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

placed.go

Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37)

2026-10-31 09:21:04 +01:00

placement_candidate.go

Keep as today what a node keeps today and what is held only behind it, saying how; a stub hands and collects nothing of its own (issue 1126)

2026-10-28 23:49:22 +01:00

placement_keys.go

Say which machines are inside the private network from placement, for route-proxy, whose membership read goes with the assignments stream (issue 774, research 072 rows 33 and 34)

2026-10-31 09:28:15 +01:00

placement_proposal.go

Take the tunnel key at issue and place a joining node on the operator's yes, so the hub peers it before redeem

2026-11-02 01:41:36 +01:00

placement_test.go

Take the tunnel key at issue and place a joining node on the operator's yes, so the hub peers it before redeem

2026-11-02 01:41:36 +01:00

placement.go

Keep the seat mesh-placement's state as one key per module and node, so a node watches its own keys and a change writes only the modules it moves (issue 774, research 072 row 37)

2026-10-31 09:21:04 +01:00

preview.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

provided.go

Let the merge preview and the provided manifest decode instead of judging (ADR 0578 §3)

2026-11-01 02:18:56 +01:00

put.go

Say the put's tools, not a seat's verbs, in the put's words (ADR 0546)

2026-10-25 21:08:10 +01:00

reach.go

A module with no floor holds no head back; a merge among its changes reads not yet on the machines (review of issue 1280, ADR 0556 clause 2)

2026-10-26 21:12:48 +01:00

signers.go

Add the vault's enrolment verbs to its seat, so mesh-enrolment asks the vault to mint and sign and holds nothing

2026-11-02 01:41:03 +01:00

source_test.go

A module's floor counts every running have, healthy or not; health stays in its words (ADR 0556 clause 2, insight)

2026-10-26 21:12:31 +01:00

source.go

Let a verdict warn of what a stricter judge found in a manifest it accepted before (ADR 0579 §1)

2026-11-01 02:43:10 +01:00

stepasks_compose_test.go

Let the Go build seat carry a compose ask and its answer, so the assigner composes a group with its mesh-sdk head (issue 1622)

2026-10-24 03:51:35 +02:00

stepasks_key_test.go

Name an ask's step key <node>.<ask id> and its watch, so the asker learns which node took it and refuses other keys (issue 1887 A1b, ADR 0525 §6)

2026-10-23 15:11:44 +02:00

stepasks_test.go

Carry mesh package versions in build asks and fingerprints

2026-11-01 02:40:12 +01:00

stepasks.go

Name the agreed toolchain in a check ask and decline it on a node off that toolchain (ADR 0584, issue 1578)

2026-11-01 15:33:43 +01:00

steps_test.go

Pack a build's output like the build agent and keep the steps state's shape (issues 1471, 1479), part 7 of 7

2026-10-20 20:06:48 +00:00

steps.go

End a step left by a previous process at once: every step names its owner (issue 1890)

2026-10-27 01:19:29 +01:00

stuck_test.go

Read whether a module is being delivered on a node in one place, so the view and the condition keeper judge a delivery alike (issue 1952 S7, ADR 0564 clause 13)

2026-10-29 21:37:59 +01:00

stuck.go

Give the watchman's stuck keys a layout the controller reads (issue 1153)

2026-10-18 20:11:04 +02:00

token_test.go

Move the joining token's shape into mesh-sdk, so the vault that makes it, mesh-cli and the engine read one type

2026-11-02 01:41:03 +01:00

token.go

Name the expired enrolment's issued event by its id, and carry a node's login fall back in its health report

2026-11-02 01:41:36 +01:00

toolchains_test.go

Agree a toolchain by strict majority and name the nodes that sit out (ADR 0584, issue 1578)

2026-11-01 15:20:26 +01:00

toolchains.go

Agree a toolchain by strict majority and name the nodes that sit out (ADR 0584, issue 1578)

2026-11-01 15:20:26 +01:00

trunk_test.go

Say in the fixture's comment how it was made; test an answered state without inputs (issue 1281)

2026-10-19 22:47:27 +00:00

trunk.go

Count a build record without a state as the outcome it is (issue 1281): the controller never stores state built

2026-10-19 22:39:29 +00:00

turns.go

delivery: a turn never holds the check of heads that wait in it, so two approved merges in one turn never hold each other's carry (ADR 0548 §3; issue 568, review round 1)

2026-10-26 12:12:53 +01:00

userlist.go

Let the lease key name its ask and time, and the user-list key say the lease is handed

2026-11-02 00:15:20 +01:00

verdicts_test.go

Let a verdict warn of what a stricter judge found in a manifest it accepted before (ADR 0579 §1)

2026-11-01 02:43:10 +01:00

verdicts.go

Let a verdict warn of what a stricter judge found in a manifest it accepted before (ADR 0579 §1)

2026-11-01 02:43:10 +01:00

view_answers_test.go

Keep the placement ask among the assigner's asks: its Approve's level, not its kind, needs the proof (ADR 0567 §5, issue 1126)

2026-10-28 18:30:00 +01:00

view_answers.go

Keep the placement ask among the assigner's asks: its Approve's level, not its kind, needs the proof (ADR 0567 §5, issue 1126)

2026-10-28 18:30:00 +01:00

want_composed_test.go

Add the assigner's eighth rule, every provision the build requires provided, so a want waits on its provisions as ADR 0570 §4 decides (issue 1954 D1)

2026-10-29 22:37:11 +01:00