8000 feat(mesh): worker nodes run jobs as their own user of the database, with files over the mesh by adeelahmad · Pull Request #595 · adeelahmad/lense · GitHub
[go: up one dir, main page]
Skip to content

feat(mesh): worker nodes run jobs as their own user of the database, with files over the mesh - #595

Merged
adeelahmad merged 3 commits into
mainfrom
claude/project-thread-6dqeie
Oct 18, 2026
Merged

feat(mesh): worker nodes run jobs as their own user of the database, with files over the mesh#595
adeelahmad merged 3 commits into
mainfrom
claude/project-thread-6dqeie

Conversation

@adeelahmad
@adeelahmad adeelahmad commented Oct 18, 2026
Copy link
Copy Markdown
Owner

Description

Before: a machine that joined as a worker node sat on the mesh and did nothing. Auto scaling's cloud machines joined, then had nothing to run.

After: on a worker node, lens node also runs lens worker and keeps it running. The worker uses this install's database over the mesh, signed in as a database user made only for that node, never the server's root. Its jobs fetch their files from the primary over the mesh, as plain bytes (GET /api/v1/mesh/node/media/{id}, cached on the node with an ETag), and a vault's files never leave the primary. The node never gets the archive's secret, so it runs transcribe and diarize with that machine's models and skips any other step LENS_WORKER_STEPS names. A worker that serves some namespaces takes only their jobs. An auto scaling group on machines elsewhere counts only the jobs a worker node takes, so it never launches a paid machine for work that machine wouldn't run.

How:

  • mesh.grant_database / revoke_database give each worker node its own owner user on Lens's one database (DEFINE USER … ON DATABASE). The user is removed with the node and made again with a new password on undo.
  • GET /api/v1/mesh/node/worker hands the node its credentials, which go only into the worker's environment. They are not written to the node's disk.
  • SURREAL_AUTH=database makes the store sign in at database level.
  • jobs.claim filters by the node's namespaces.
  • scaling.unit_steps narrows a joining group's queue metrics. The group shows unit_steps, and waiting_for says when none of its steps can run on a node.

Motivation and Context

Part of the Nebula network with a Nodes settings page. This follows #553 (the mesh container) and #591 (another machine joins as a node). Settings › Nodes and Network comes next.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change; ! in the title)

Checklist:

  • The title is a Conventional Commit.
  • My code follows the code style of this project (make hooks checks it on commit).
  • I added or updated tests.
  • My change requires documentation updates, and I have updated docs/ accordingly.
  • Users need more than the title: changelog.d/mesh-workers.md.

Done questions (AGENTS.md)

  • Goal: worker nodes now run jobs, which is part of the mesh ask. It merges on green CI.
  • Agents: the node and its worker run on their own. Auto scaling's agents see unit_steps and waiting_for over the API, MCP and the assistant.
  • Zero setup: the install line with LENS_JOIN sets it all up. No new prerequisite.
  • Fewest clicks: no clicks. The worker starts by itself once the node is on the mesh.
  • Configurable: LENS_WORKER_STEPS narrows the steps. Settings › Nodes (next PR) shows each worker's state and log.
  • Light: nothing changes on the primary. Models are fetched on the node on first use.
  • Private and secure: database-level user per node, never root. The archive secret is never sent to nodes. Vault files and other namespaces' files are refused. The threat model has a new entry point.
  • Cost: local models only on nodes, and a scaling group never launches a machine for jobs it won't take.
  • User decides: worker nodes come only from a join token an admin made. Defaults are unchanged.
  • Upgrades: no stored-data shape change. A node's DB user is made at join and on undo.
  • Honest: docs/mesh.md and docs/scaling.md say the mesh is in progress and that cloud machines have not been tried on a real cloud yet.
  • Tests (test_mesh_workers.py, test_a_group_elsewhere_counts_only_the_jobs_a_node_takes), docs and make openapi output updated.
  • Open standards: Nebula and SurrealDB users. No new dependencies.
  • Refine later (docs/mesh.md): steps that write files or need provider keys on nodes, handing back jobs a node can't do, spot-notice drain.
  • Reuse: reuses lens worker, jobs.claim, keyring.open_plain and the scaling metrics.

Generated by Claude Code

claude added 2 commits October 18, 2026 12:26
@claude
feat(mesh): worker nodes run jobs as their own user of the database, …
4f2f360 
…with files over the mesh

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTrHPwWHtEvFJFq3M1YpH4
@claude
docs(readme): the mesh's In progress line links its open pull request
453211e 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTrHPwWHtEvFJFq3M1YpH4
@adeelahmad
adeelahmad force-pushed the claude/project-thread-6dqeie branch from 8d56af8 to 453211e Compare October 18, 2026 12:27
@claude
feat(mesh): auto scaling may launch onto worker nodes now that they r…
33a5bd4 
…un lens worker

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTrHPwWHtEvFJFq3M1YpH4
@adeelahmad
adeelahmad merged commit 061c26b into main Oct 18, 2026
12 checks passed
@adeelahmad
adeelahmad deleted the claude/project-thread-6dqeie branch October 18, 2026 12:53
This was referenced Oct 18, 2026
Merged
Merged
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@adeelahmad @claude
0