Design 47: a node never applies a stand-in, and composes nothing of its own until the vault seals its secrets to it (issue 1126)

2026-10-26 18:59:06 +01:00
parent b6572acd72
commit a6cc3d2e0b
1 changed files with 5 additions and 3 deletions
@@ -717,9 +717,11 @@ backup holder backs up nothing, and the have says so.
  plus exactly these reads and the bucket-creation advisories of issue 1790.
 - **A node composes its own once the catalogue places it.** Its agent reads its key `placement.<node>` at start:
  with one it composes its own, without one it applies the controller's compositions as before, so nothing changes
-  on a node before the seeded placement file reaches it. Until its own secrets and issued credentials come sealed
-  from the vault (ADR 0550 §5), a module with an own secret is left out of the node's own composition: it keeps
-  running what it runs and does not move.
+  on a node before the seeded placement file reaches it. A node never applies a stand-in: a composition that stands
+  in for a value its input lacks (an own secret, a credential, a vault box, the certificate) is refused whole, said,
+  and the node keeps running what it runs; the bus's user list alone is held out of the apply, since the bus node
+  follows it apart. So until a node's own secrets and credentials come sealed from the vault (ADR 0550 §5), a node
+  with any module holding one composes nothing of its own.
 - **Composed again on events, never on a timer.** A changed input at the same fingerprint (a setting or given
  value, a secret rotated or moved, a credential issued, a provider's contribution, a peer added to the hub) is
  composed again when its event is heard, and applied as a revision of what runs (ADR 0547 §2).