Design 47: every read a node's account gains to compose, and that a module with an own secret does not move until the vault seals it to the node (issue 1126, ADR 0555)

2026-10-26 18:49:09 +01:00
parent 5bb109e36e
commit b6572acd72
1 changed files with 16 additions and 5 deletions
@@ -703,12 +703,23 @@ backup holder backs up nothing, and the have says so.
  public halves of its sealing and serving keys, the certificate issued for its internal name, its outward links
  and networks, and its node-engine's contract. Written at start and when an observed fact changes, only when it
  differs (ADR 0555 §3). Whether the hub took its found tunnel over, and which node enrolled under a carried
-  peer's key, are read from the placement and the records together, never written. Every node's account reads
-  every node's `<node>.node`: a grant the grants part's composer gives and the controller's frozen copy does not.
+  peer's key, are read from the placement and the records together, never written.
+- **What a node's account reads to compose.** The grants part's composer gives every node's account these reads,
+  each read only, and the controller's frozen copy none of them (ADR 0555):
+  - every node's `<node>.node` of the node-engine's have bucket: the other nodes' records;
+  - every key of the indexer's `placement`: where modules run and what a person decided of each node;
+  - every key of the indexer's `modules` and `manifests`: the manifests it composes from;
+  - every key of the builder's `builds`: the manifest of a build its want names when that is not the trunk's;
+  - mesh-config's `resolved` values of its own node alone, `<node>.>`.
  Since the take-over the grants part's list is the one the bus loads; after a `hand-back` the controller's list
-  holds, without that read, and nodes keep applying while composing their own fails loudly until the next
-  `take-over`. mesh-sdk's composer test holds the copy to every grant of the controller's golden plus exactly that
-  read and the bucket-creation advisories of issue 1790.
+  holds, without these reads, and nodes keep applying while composing their own fails loudly until the next
+  `take-over`. mesh-sdk's composer test holds the copy, user for user, to every grant of the controller's golden
+  plus exactly these reads and the bucket-creation advisories of issue 1790.
+- **A node composes its own once the catalogue places it.** Its agent reads its key `placement.<node>` at start:
+  with one it composes its own, without one it applies the controller's compositions as before, so nothing changes
+  on a node before the seeded placement file reaches it. Until its own secrets and issued credentials come sealed
+  from the vault (ADR 0550 §5), a module with an own secret is left out of the node's own composition: it keeps
+  running what it runs and does not move.
 - **Composed again on events, never on a timer.** A changed input at the same fingerprint (a setting or given
  value, a secret rotated or moved, a credential issued, a provider's contribution, a peer added to the hub) is
  composed again when its event is heard, and applied as a revision of what runs (ADR 0547 §2).