Design 39 bus-and-switch: C1, the licence manager runs as its own account, its service and its tools in its own runtime

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ
2026-11-12 09:16:05 +01:00
parent 044b913a9e
commit 12a98c2183
1 changed files with 6 additions and 0 deletions
@@ -535,3 +535,9 @@ written; they are cited as "design 39 bus-and-switch B*n*".
 - **B44** (§12's leases, review round 1): the carry-over carries each lease still live at its run, as a `leases` key with
  its remaining lifetime, so the new manager never refreshes a licence the old one holds a refresh lease on, whatever the
  order in which the delivery stops one and starts the other; an expired lease is counted read and not written (P3, P7).
+- **C1** (the operator, 2026-11-12: "the licence manager module should have a service part and a tools part"; met live
+  when the manager, run inside the machine's tool runner, was issued none of its own logs): the module declares
+  `runs-as claude-licence-manager` with an account of its own, as the vault and the mail reader do. Its own runtime runs
+  the service part (the carry-over at start, the usage timer, the switch rule, the conditions) and serves the tools part
+  beside it, so every kept entry, log and secret of §1 to §20 is issued to its own account, never to the tool runner's.
+  The tools act only through the running service: no tool keeps a second copy of what the service does (P1, P7).