novox/hq
9
0
Fork 0
Code Issues Pull Requests 2 Releases Wiki Activity

Merge pull request 'Design 39 bus-and-switch: the lead's answers to the prepare's 22 questions' (#558) from design/39-licence-answers into main

Browse Source
This commit was merged in pull request #558.
This commit is contained in:
mesh-tools
2026-11-11 22:00:34 +00:00
parent 18639c7392 2bf174b57c
commit 173d6d2cd4
1 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
03-DESIGN/01-to-be/39-milestones/bus-and-switch.md
+45
View File
@@ -447,3 +447,48 @@ tool's effect (the manifest's mark).*
- every entry the manager keeps is read by `licences_kept`, and every act it takes by itself is started by a tool - every entry the manager keeps is read by `licences_kept`, and every act it takes by itself is started by a tool
(§37 to §45); (§37 to §45);
- live: a login to a new account on a node is adopted and listed with its usage (§46). - live: a login to a new account on a node is adopted and listed with its usage (§46).
## The lead's answers to the prepare's questions
The prepare's design questions (2026-11-11), each answered by the lead in one line against
[the principles](../../../00-META/principles.md), as the operator's way of working says. A developer builds these as
written; they are cited as "design 39 bus-and-switch B*n*".
- **B1** (`licence-put` is not in the vault's seat definition): the vault's seat definition in mesh-contracts gains the
verb, and mesh-contracts joins this milestone as a second member of its delivery group (P5).
- **B2** (the validator refuses bus state by template from mesh-vault): `licence-bindings` stays in the vault's old
`state` section (P7).
- **B3** (who may read a licence's grant): no machine guard on `licence-put` or `get`; the generation guard stays.
Inside the mesh every module is trusted, and who may do what is not a question (P6; the operator's instruction
who-may-is-not-the-operators-question).
- **B4** (the manager has no vault key to seal to): two steps with a key made for the call, as `move-in` does (P7).
- **B5** (the vault numbers generations itself): the caller's generation is the record's generation (P8).
- **B6** (the vault takes only lower-case names): §10's key form is lower-case (P7).
- **B7** (claude-code needs the licence's key and the account's identity): `binding.changed` and `current` carry `key`,
and `current` keeps `identity` (P1, P3).
- **B8** (`get` names no consumer): the access token goes to machine M when any binding of a consumer on M names that
licence (P7).
- **B9** (no line names the `invokes` entries or claude-code's `consumes mesh-vault.secret-changed`): each is declared
in its module's manifest (P1).
- **B10** (`bindings` takes no `consumer`): an optional `consumer` argument; the §3 fields answered unpaged; the vault
reads it once at start (P7).
- **B11** (one generation counter for every consumer): a counter per consumer, from the higher of its own and its
node's last reported generation; `GenerationsAbove` goes (P7).
- **B12** (holdings unknown after a restart): the manager says `holdings.asked` at every start (P1).
- **B13** (`offered` key holds a colon; two outcomes §5 does not list): the key goes through §10's key form, and all
five outcomes are kept (P7).
- **B14** (`since` and `adoptedFrom` have no column; the live database's name): `since` is the carry-over's time,
`adoptedFrom` comes from the audit, and §14 checks the database the module's binding names (P7).
- **B15** (§20 retires `grant-key`, §1 and A3 keep it): only the sealing at rest goes now; `grant-key` is retired in
the module's next change, with the store database (P7).
- **B16** (`licence.bound`, `licence.released`, `licence.rotated`): dropped; `binding.changed` and the audit log
cover them (P8).
- **B17** (the conditions' scope and id): scope `module`, id `claude-licence-manager` (P7).
- **B18** (no mesh or node level for a module's own setting in mesh-config): the settings are the module's own values
on the manager's node, set and read through mesh-config as any module's own setting (P7).
- **B19** (`current`'s health thresholds and §34's field names): failing at `failures_to_notify`, expiring within
`refresh_warn_days`; today's field names are kept (P7).
- **B20** (the audit log is full): the act fails loudly and says so (P3).
- **B21** (no tool reads the vault's `licence-bindings`): `vault_first_views` and `vault_first_view_again` cover it (P4).
- **B22** (three internal forms): `bindings` stays at form 0; each reader decodes the event bodies with fixtures
copied from the writer; nothing to build for an inheriting consumer (P7).