From df4ff3d039f25b0262b16fd1ba3b58a821f731dd Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 26 Oct 2026 19:09:16 +0100 Subject: [PATCH] Design 47: a model-access consumer placed before the vault serves licences is refused by the guard (issue 1126) --- 03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md index 53052594..7e474066 100644 --- a/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md +++ b/03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md @@ -721,7 +721,9 @@ backup holder backs up nothing, and the have says so. in for a value its input lacks (an own secret, a credential, a vault box, the certificate) is refused whole, said, and the node keeps running what it runs; the bus's user list alone is held out of the apply, since the bus node follows it apart. So until a node's own secrets and credentials come sealed from the vault (ADR 0550 §5), a node - with any module holding one composes nothing of its own. + with any module holding one composes nothing of its own. Likewise a consumer of `model-access` answered by a + licence record, placed before the vault serves licences (ADR 0550 §3, issue 569), is refused by the same guard and + its node keeps what runs; none is placed today. - **Composed again on events, never on a timer.** A changed input at the same fingerprint (a setting or given value, a secret rotated or moved, a credential issued, a provider's contribution, a peer added to the hub) is composed again when its event is heard, and applied as a revision of what runs (ADR 0547 §2).