ADR 0121: a seat carries the protocol of its role

novox/hq

The mesh's own seats said who does a job and nothing about what may be said to
them or by them, and that gap showed up three times in one day looking like three
different problems: a build machine with three audiences for one outcome and no way
to derive a grant for any of them; an event genuinely about a role with nowhere to
live but the namespace of whichever module holds that role today; and a catalogue
catching up on builds, where every option needed a grant the design refuses.

One cause — the mesh has roles it cannot describe. So the `mesh-*` seats take the
same three fields a module's seat has, and the machinery that already derives
authority, queues and consumers from a declared seat does it for these too.

Builds become work submitted to a role, and `mesh.build.request`,
`mesh.control.built` and the BUILDS stream retire. A work queue shared by several
build machines is exactly what a seat's `accepts` is, so a second mechanism for it
was two places a permission could be wrong. The outcome is the seat's own event,
which means one publish still reaches whoever asked, the controller that records it
and the catalogue that places it — the fan-out a shared exchange gave for free,
written as a subject the mesh derived rather than a topology somebody configured.

That also avoids the grant that ruled out the alternatives: no holder needs
permission to publish into an asker's inbox.

The blocking gap is now named rather than incidental: the shared library has no way
for a module to publish on a seat. The build machine is Go and reaches the bus
directly, so it is unaffected; the artifact-store event waits.

This commit is contained in:

jschoubben

2026-09-27 15:24:17 +02:00

parent c4a8455e2e

commit c8f430290e

4 changed files with 125 additions and 5 deletions

									
										02-DECISIONS/README.md
									
		+1
		
												View File
												
				@@ -136,6 +136,7 @@ python3 00-META/checks/index.py            fail if stale

				- **0117** — [The bus is the only broker](0117-the-bus-is-the-only-broker.md)  *(superseded)*

				- **0119** — [AMQP is a provision, not the bus](0119-amqp-is-a-provision-not-the-bus.md)

				- **0120** — [The mesh bus is required, not ambient](0120-the-mesh-bus-is-required-not-ambient.md)

				- **0121** — [A seat carries the protocol of its role](0121-a-seat-carries-the-protocol-of-its-role.md)

				### Its tiers, from the bottom up