Design 47: a model-access consumer placed before the vault serves licences is refused by the guard (issue 1126)

This commit is contained in:
2026-10-26 19:09:16 +01:00
parent a6cc3d2e0b
commit df4ff3d039
@@ -721,7 +721,9 @@ backup holder backs up nothing, and the have says so.
in for a value its input lacks (an own secret, a credential, a vault box, the certificate) is refused whole, said,
and the node keeps running what it runs; the bus's user list alone is held out of the apply, since the bus node
follows it apart. So until a node's own secrets and credentials come sealed from the vault (ADR 0550 §5), a node
with any module holding one composes nothing of its own.
with any module holding one composes nothing of its own. Likewise a consumer of `model-access` answered by a
licence record, placed before the vault serves licences (ADR 0550 §3, issue 569), is refused by the same guard and
its node keeps what runs; none is placed today.
- **Composed again on events, never on a timer.** A changed input at the same fingerprint (a setting or given
value, a secret rotated or moved, a credential issued, a provider's contribution, a peer added to the hub) is
composed again when its event is heard, and applied as a revision of what runs (ADR 0547 §2).