From 550487fc901815c40839ac998458e1b9bd75a5a8 Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 19 Oct 2026 11:02:57 +0200 Subject: [PATCH] Say in the as-is of bus logins that a module's process may have a login of its own (ADR 0436, ADR 0438) --- 03-DESIGN/00-as-is/16-logins-on-the-bus.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/03-DESIGN/00-as-is/16-logins-on-the-bus.md b/03-DESIGN/00-as-is/16-logins-on-the-bus.md index 952d91db..a8acf604 100644 --- a/03-DESIGN/00-as-is/16-logins-on-the-bus.md +++ b/03-DESIGN/00-as-is/16-logins-on-the-bus.md @@ -2,9 +2,11 @@ layer: as-is status: implemented code: [mesh-controller, mesh-tools] -updated: 2026-10-16 +updated: 2026-10-19 decisions: - "ADR 0106" + - "ADR 0436" + - "ADR 0438" --- # Logins on the bus, as they run @@ -25,6 +27,16 @@ Nothing marks what a tool does.** Read from the controller's and the tool runner - **The caller is in the address.** A call's address carries the caller's name, so the runtime takes the caller from the address, never from the message. For a seat every machine holds, the address also names the machine. +- **A module's process may have a login of its own** (ADR 0436, delivered 2026-10-19 in mesh-controller #390 and + mesh-sdk #36). A `process` resource that declares `bus` runs as a user its module makes and gets one login per + machine, named by machine, module and process. It may emit its declared events, take work from its module's own + work-queue stream through the one consumer the controller makes for it, use its module's states, read the + router's records of its module's asks, call the verbs it declares, and listen only on its own inbox. It can + answer no call and hold no seat. `module issue` delivers its password as the module's own secret + `broker-`, readable by that user alone. mesh-mail's sender is the first such process: it holds the + mail passwords that the tool runner may not read, and sends each mail the operator approved, which the tools + record as queued before they put it on its work queue (ADR 0438). + ## What it cannot do - **No expiry.** A login lives until its record is deleted and the list rewritten on the bus's node.