From 12a98c21832e2c97eaf22f4a77b4440afc77f0f6 Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 12 Nov 2026 09:16:05 +0100 Subject: [PATCH 1/3] Design 39 bus-and-switch: C1, the licence manager runs as its own account, its service and its tools in its own runtime Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ --- 03-DESIGN/01-to-be/39-milestones/bus-and-switch.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md index d610e3ea..5b5f6ab6 100644 --- a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md +++ b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md @@ -535,3 +535,9 @@ written; they are cited as "design 39 bus-and-switch B*n*". - **B44** (§12's leases, review round 1): the carry-over carries each lease still live at its run, as a `leases` key with its remaining lifetime, so the new manager never refreshes a licence the old one holds a refresh lease on, whatever the order in which the delivery stops one and starts the other; an expired lease is counted read and not written (P3, P7). +- **C1** (the operator, 2026-11-12: "the licence manager module should have a service part and a tools part"; met live + when the manager, run inside the machine's tool runner, was issued none of its own logs): the module declares + `runs-as claude-licence-manager` with an account of its own, as the vault and the mail reader do. Its own runtime runs + the service part (the carry-over at start, the usage timer, the switch rule, the conditions) and serves the tools part + beside it, so every kept entry, log and secret of §1 to §20 is issued to its own account, never to the tool runner's. + The tools act only through the running service: no tool keeps a second copy of what the service does (P1, P7). From 00c436dd1580a25b21306820b208d52e1ddf94cb Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 12 Nov 2026 09:36:39 +0100 Subject: [PATCH 2/3] Design 39 bus-and-switch: C2, the manager replaces a key pair it cannot read Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ --- 03-DESIGN/01-to-be/39-milestones/bus-and-switch.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md index 5b5f6ab6..f5423e43 100644 --- a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md +++ b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md @@ -541,3 +541,8 @@ written; they are cited as "design 39 bus-and-switch B*n*". the service part (the carry-over at start, the usage timer, the switch rule, the conditions) and serves the tools part beside it, so every kept entry, log and secret of §1 to §20 is issued to its own account, never to the tool runner's. The tools act only through the running service: no tool keeps a second copy of what the service does (P1, P7). +- **C2** (review of C1: the key-pair file the manager wrote in its state directory under the tool runner's account, + which the node-engine does not hand to the new owner): when the manager cannot read the key pair it finds, it makes a + new one in its place and says so in its journal; every use passes the public key per ask, so nothing depends on the + old pair (P3, P7). The node-engine handing a program-written directory's contents to a new owner (every module that + moves to `runs-as`) is noted on its issue, not built here. From 3b383de72e5b8a281abcab2263dc6d07decccd4a Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 12 Nov 2026 10:18:38 +0100 Subject: [PATCH 3/3] Design 39 bus-and-switch: C3, the manager's logs in the logs section main issues --- 03-DESIGN/01-to-be/39-milestones/bus-and-switch.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md index f5423e43..7e271802 100644 --- a/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md +++ b/03-DESIGN/01-to-be/39-milestones/bus-and-switch.md @@ -546,3 +546,6 @@ written; they are cited as "design 39 bus-and-switch B*n*". new one in its place and says so in its journal; every use passes the public key per ask, so nothing depends on the old pair (P3, P7). The node-engine handing a program-written directory's contents to a new owner (every module that moves to `runs-as`) is noted on its issue, not built here. +- **C3** (met live after C1: the manager, now in its own runtime, was still issued none of its logs): the two logs + `usage` and `audit` are declared in the manifest's `logs` section, the form the runtime on main issues today; the + states stay templates. The move of logs to templates is design 47 milestone G's (P7).