Repository navigation
Messages addressed to/from the mesh hub bypass session portal and import hubs #1118
Description
What is failing
The MeshWeaver.Messaging.MessageHub is detecting messages that are addressed from or to the mesh hub (mesh/{id}) when the mesh hub is architecturally a pure router — it should never be the sender or target of work. Messages are instead supposed to flow through a dedicated session portal hub (for REST/Blazor/MCP traffic) or an import hub (for bulk imports).
Probable cause
Two patterns appear in the logs:
- Outbound:
RawJson has the mesh hub as sender (sender: mesh/{id}, target: {something})— some component is setting the mesh hub's own address as the sender on outgoing messages. - Inbound: Messages such as
PatchDataChangeRequest,ValidateTokenRequest,ValidateTokenResponseare routed withtarget: mesh/{id}— senders (portals, API token handlers) are addressing the mesh hub directly rather than the appropriate session portal hub.
This could be caused by:
- A bug in address resolution / address translation when a portal hub creates a message and the raw mesh hub address leaks in instead of the portal hub's address
- Code that directly constructs message addresses using the mesh hub identity instead of the correct session hub identity
- A misconfiguration where session portal hubs are not being assigned their own hub identity and fall back to the mesh hub
Confidence: Moderate — the log message is intentionally diagnostic and the symptom is clear, but without the source code of MessageHub we cannot pinpoint the exact line where the wrong address is set.
Impact
Medium severity. 721 occurrences in ~8 hours across all 6 memex-portal-deployment pods. The log is rate-limited to once per role+type, so the actual frequency is higher. The message is logged at fail: level, indicating the system considers this a correctness violation. It does not appear to crash the hub, but it means:
- The mesh hub is being asked to execute work (handler lookup, deserialization) that it should never do — a performance and correctness concern as load grows
- Token validation (
ValidateTokenRequest) and data change requests are going through the wrong routing path, potentially bypassing session-level scoping and authorization checks
Where to look
MeshWeaver.Messaging.MessageHub— the class that emits theROUTER_TRAFFICdiagnostic. Look for the place where it compares the sender/target address against its own identity and logs the warning.- Address assignment in session portal hub setup — how the portal hub's identity is assigned and how it translates/intercepts addresses when forwarding messages. The portal hub may be using the raw mesh hub address instead of its own.
MeshWeaver.Messagingrouting layer — specifically the code path that constructsRawJsonenvelopes from incoming messages, which appears to be where the sender address gets set to the mesh hub.- Callers sending
PatchDataChangeRequestandValidateToken*messages — these are being sent withtarget: mesh/{id}instead of a portal hub address.
Evidence
| Fingerprint | b6dc7a15e653fc41 |
| Category | MeshWeaver.Messaging.MessageHub |
| Severity | Error |
| Namespace | memex |
| Pods | memex-portal-deployment-7f65668566-qdk6j, memex-portal-deployment-84855f7679-z4rsp, memex-portal-deployment-6956d54bb5-l6mxv, memex-portal-deployment-666657df96-jq49m, memex-portal-deployment-8476467cb6-nkbhh, memex-portal-deployment-575dc48bfb-wq7s8 |
| Occurrences | 862 |
| First seen | 2026-08-10 01:08:41Z |
| Last seen | 2026-08-10 09:48:10Z |
Recent log lines
2026-08-10 07:34:22Z memex-portal-deployment-575dc48bfb-wq7s8 fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/l_cWjTNjd0Gx9zIk1SoW_A, target: Instances/_Notification/83nZe9gZYEShvHp58hDNlg). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
2026-08-10 07:34:22Z memex-portal-deployment-575dc48bfb-wq7s8 fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/l_cWjTNjd0Gx9zIk1SoW_A, target: Instances/Deployment/_Activity/compile-202608100109308946cd9c50d826c47349f494db88ce96282). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
2026-08-10 07:34:22Z memex-portal-deployment-575dc48bfb-wq7s8 fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/l_cWjTNjd0Gx9zIk1SoW_A, target: Instances/_Activity/import-a62727f11a4703b8-20260809175155703-4f4c6329). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
2026-08-10 07:34:22Z memex-portal-deployment-575dc48bfb-wq7s8 fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/l_cWjTNjd0Gx9zIk1SoW_A, target: Instances/Skill/deployment-activity). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
2026-08-10 08:41:24Z memex-portal-deployment-575dc48bfb-wq7s8 fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/l_cWjTNjd0Gx9zIk1SoW_A, target: Store/Catalog). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
2026-08-10 09:48:09Z memex-portal-deployment-8476467cb6-nkbhh fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/35aYwsypeEuvQ7ho-sbDaA, target: DoublePendulum). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
2026-08-10 09:48:10Z memex-portal-deployment-8476467cb6-nkbhh fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/35aYwsypeEuvQ7ho-sbDaA, target: DataModelling). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
2026-08-10 09:48:10Z memex-portal-deployment-8476467cb6-nkbhh fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/35aYwsypeEuvQ7ho-sbDaA, target: ClaudeCode). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
2026-08-10 09:48:10Z memex-portal-deployment-8476467cb6-nkbhh fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/35aYwsypeEuvQ7ho-sbDaA, target: ClaimsDeepfield). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
2026-08-10 09:48:10Z memex-portal-deployment-8476467cb6-nkbhh fail: MeshWeaver.Messaging.MessageHub[0]
ROUTER_TRAFFIC: RawJson has the mesh hub as sender (sender: mesh/35aYwsypeEuvQ7ho-sbDaA, target: BusinessRules). The mesh hub is the ROUTER and must not execute work — it belongs on a hub of its own (session portal hub for REST/Blazor/MCP, import hub for bulk imports). Reported once per role+type for this hub.
Opened automatically from Admin/_LogIncident/b6dc7a15e653fc41. Recurrences are folded into this issue rather than opening new ones.
Activity
rbuergi commentedon Aug 10, 2026
Duplicate of #1113 — same defect, filed separately by the log-watcher's first live sweep (the re-filing defect is itself tracked). Keeping #1113 as canonical.
ci: gen-manifests.py becomes the platform's, configured per repo (Plu…