fix: keep the credential this node holds current

day01 commented

2026-08-12 08:02:01 +00:00

Owner

A node credential lasts fifteen minutes. Nothing on this side ever took a replacement, so a runner worked for one term and was then locked out of the control plane with no way back but a fresh enrolment token.

The session now takes a Rotated credential and writes it down through a store the daemon points at the registration file, before it reads anything else. The credential it replaces is already dead on the control plane, so failing to keep the new one is an error rather than something to carry on past.

Heartbeats come back with it. Nothing else on the session speaks while a job runs, so a busy node looked exactly like a dead one and lost its leases for it, and a rotation offered on an open session needs the node to be saying something to be offered at all. Room is measured on every beat rather than repeating what was true when the session opened, and a host that cannot be measured says it is alive anyway instead of going quiet over it.

Needs syncode/control #14, which issues the replacement this keeps.

A node credential lasts fifteen minutes. Nothing on this side ever took a replacement, so a runner worked for one term and was then locked out of the control plane with no way back but a fresh enrolment token. The session now takes a `Rotated` credential and writes it down through a store the daemon points at the registration file, before it reads anything else. The credential it replaces is already dead on the control plane, so failing to keep the new one is an error rather than something to carry on past. Heartbeats come back with it. Nothing else on the session speaks while a job runs, so a busy node looked exactly like a dead one and lost its leases for it, and a rotation offered on an open session needs the node to be saying something to be offered at all. Room is measured on every beat rather than repeating what was true when the session opened, and a host that cannot be measured says it is alive anyway instead of going quiet over it. Needs `syncode/control` #14, which issues the replacement this keeps.

day01 added 1 commit 2026-08-12 08:02:03 +00:00

fix: keep the credential this node holds current

		A node credential lasts fifteen minutes. Nothing on this side ever took a
replacement, so a runner worked for one term and was then locked out of the
control plane with no way back but a fresh enrolment token.

The session now takes a `Rotated` credential and writes it down through a
store the daemon points at the registration file, before it reads anything
else. The credential it replaces is already dead on the control plane, so
failing to keep the new one is an error rather than something to carry on
past.

Heartbeats come back with it. Nothing else on the session speaks while a job
runs, so a busy node looked exactly like a dead one and lost its leases for
it, and a rotation offered on an open session needs the node to be saying
something to be offered at all. Room is measured on every beat rather than
repeating what was true when the session opened, and a host that cannot be
measured says it is alive anyway instead of going quiet over it.

day01 merged commit 6edd6bf709 into %!s()

2026-08-12 08:17:16 +00:00

day01 deleted branch fix/keep-the-node-credential-current

2026-08-12 08:17:17 +00:00

fix: keep the credential this node holds current #52