novox/hq
3
0
Fork 0
Code Issues 5 Pull Requests 4 Releases Wiki Activity

The operator's agent and its licence manager are modules: ADR 0181–0183, to-be 36 and 39 #286

Merged
mesh-admin merged 1 commits from feat/claude-code-module into main 2026-10-02 15:23:38 +00:00
Conversation 2 Commits 1 Files Changed 12
+838 -1
mesh-admin commented 2026-10-02 11:30:21 +00:00
Contributor
Copy Link
Copy Source

The predecessor's agent module was retired and its six files stayed on both workstations, telling every session to use tools that no longer exist. This is the design of its successor, revised during review on the operator's directions: the host is module-agnostic, the controller has no part, and a real licence manager hands out the correct licence in every situation.

Three records

  • ADR 0181 (reconstructed, dated 2026-09-27): the operator account is a node fact stated by the operator; the home is derived unless stated; a resource may be placed under it owned by the account; a node with no account refuses one. What the controller shipped without a record.
  • ADR 0182: inside a home the module owns the directory and the files it places, writes into the tool's own files for its few keys, never declares a credential's content, and holds everything else as found. A predecessor's leftovers are found: the operator removes them once.
  • ADR 0183: claude-licence-manager holds the mesh seat anthropic-licence-manager and owns the Anthropic licences, their grants (encrypted with a key the vault made for it), bindings per touchpoint, usage and audit. One rotation source under a lease. A token travels module to module, sealed to each node's module key, on request/reply, never as an event. The agent module alone writes what the agent reads. The host delivers package and state and knows nothing else. Stated as a bounded exception to ADR 0113; dated mechanism notes on ADR 0050 and 0113.

Two designs

  • To-be 36, claude-code: the mesh's part of the agent's configuration lives in the agent's machine-wide managed directory (settings, tool servers, instruction file), owned whole by the module and written by its code as tools the node's tool runtime serves (ADR 0175); nothing under the home but the credentials file for a subscription licence; the API-key licence via the key-helper writes nothing under the home; the console gains a node-scoped provision (to-be 34 amended); extra MCP servers are settings with an mcp_configure tool; one agent directory per machine shared by every session; the six predecessor files are the operator's to remove.
  • To-be 39, claude-licence-manager: store, the two licence kinds, keeping a grant alive (lease, floor, cadence, cooldowns, the vendor's reason logged), the hand-over to nodes, who gets which licence with the predecessor's fallbacks (node agent, mesh session, worker), adoption with the identity guard, the seat's verbs.

To-be 14, 29 and 34 carry dated notes; the glossary gains operator account. Numbers were taken across main and every open branch after two collisions today. cycle.py, records.py, index.py pass on top of #296.

Not decided, named in the designs: an automated switch on exhaustion; whether an OAuth refresh token is single-use (to measure in the lab); the package-repository seat for a distribution that does not carry the agent's package.

The predecessor's agent module was retired and its six files stayed on both workstations, telling every session to use tools that no longer exist. This is the design of its successor, revised during review on the operator's directions: the host is module-agnostic, the controller has no part, and a real licence manager hands out the correct licence in every situation. **Three records** - **ADR 0181** (reconstructed, dated 2026-09-27): the operator account is a node fact stated by the operator; the home is derived unless stated; a resource may be placed under it owned by the account; a node with no account refuses one. What the controller shipped without a record. - **ADR 0182**: inside a home the module owns the directory and the files it places, writes *into* the tool's own files for its few keys, never declares a credential's content, and holds everything else as found. A predecessor's leftovers are found: the operator removes them once. - **ADR 0183**: `claude-licence-manager` holds the mesh seat `anthropic-licence-manager` and owns the Anthropic licences, their grants (encrypted with a key the vault made for it), bindings per touchpoint, usage and audit. One rotation source under a lease. A token travels module to module, sealed to each node's module key, on request/reply, never as an event. The agent module alone writes what the agent reads. The host delivers package and state and knows nothing else. Stated as a bounded exception to ADR 0113; dated mechanism notes on ADR 0050 and 0113. **Two designs** - **To-be 36, `claude-code`**: the mesh's part of the agent's configuration lives in the agent's machine-wide managed directory (settings, tool servers, instruction file), owned whole by the module and written by its code as tools the node's tool runtime serves (ADR 0175); nothing under the home but the credentials file for a subscription licence; the API-key licence via the key-helper writes nothing under the home; the console gains a node-scoped provision (to-be 34 amended); extra MCP servers are settings with an `mcp_configure` tool; one agent directory per machine shared by every session; the six predecessor files are the operator's to remove. - **To-be 39, `claude-licence-manager`**: store, the two licence kinds, keeping a grant alive (lease, floor, cadence, cooldowns, the vendor's reason logged), the hand-over to nodes, who gets which licence with the predecessor's fallbacks (node agent, mesh session, worker), adoption with the identity guard, the seat's verbs. To-be 14, 29 and 34 carry dated notes; the glossary gains *operator account*. Numbers were taken across main and every open branch after two collisions today. `cycle.py`, `records.py`, `index.py` pass on top of #296. **Not decided, named in the designs:** an automated switch on exhaustion; whether an OAuth refresh token is single-use (to measure in the lab); the package-repository seat for a distribution that does not carry the agent's package.
mesh-admin commented 2026-10-02 12:25:22 +00:00
Author
Contributor
Copy Link
Copy Source

Number collision: ADR 0169 is on main since 13:00Z today — 0169-the-firewall-seat-serves-its-verbs.md (PR 285). cycle.py refuses two records sharing a number, so this branch, landing last, takes the next free ones: 0170–0172 for its three records (nothing open uses 0170+ at 13:10Z). Playbook 03's rule on renumbering: once, in the branch that lands last.

Number collision: ADR **0169** is on main since 13:00Z today — `0169-the-firewall-seat-serves-its-verbs.md` (PR 285). `cycle.py` refuses two records sharing a number, so this branch, landing last, takes the next free ones: 0170–0172 for its three records (nothing open uses 0170+ at 13:10Z). Playbook 03's rule on renumbering: once, in the branch that lands last.
mesh-admin commented 2026-10-02 12:51:53 +00:00
Author
Contributor
Copy Link
Copy Source

Correction to my note above: the machine-joins record took 0169 on main first (13:17 local), so my firewall-seat record renumbers to 0170 (PR on decision/0170-renumbered-and-built). On main now: 0169 (machine joins), 0170 (firewall seat), 0172 (the lab is a module). Free for this branch's remaining records: 0171, 0173, 0174. cycle.py now refuses two decision records sharing a number, so a stale number here will be caught at the check.

Correction to my note above: the machine-joins record took 0169 on main first (13:17 local), so **my** firewall-seat record renumbers to **0170** (PR on `decision/0170-renumbered-and-built`). On main now: 0169 (machine joins), 0170 (firewall seat), 0172 (the lab is a module). Free for this branch's remaining records: 0171, 0173, 0174. `cycle.py` now refuses two decision records sharing a number, so a stale number here will be caught at the check.
jschoubben force-pushed feat/claude-code-module from 8e27116cd0 to e3a5862c5a 2026-10-02 14:37:50 +00:00 Compare
mesh-admin changed title from The operator's agent is a module: ADR 0169–0171 and to-be 36 for the claude-code successor to The operator's agent is a module: ADR 0176–0178 and to-be 36 for the claude-code successor (being revised: licence manager module) 2026-10-02 14:37:56 +00:00
mesh-admin changed title from The operator's agent is a module: ADR 0176–0178 and to-be 36 for the claude-code successor (being revised: licence manager module) to The operator's agent and its licence manager are modules: ADR 0176–0178, to-be 36 and 37 2026-10-02 14:54:50 +00:00
jschoubben added 1 commit 2026-10-02 15:22:15 +00:00
The operator's agent and its licence manager are modules: ADR 0181–0183, to-be 36 and 39 7b1dabbce0 
The predecessor's agent module was retired and its six files stayed on both workstations telling
every session to use tools that no longer exist. This is its successor's design, revised during
review on the operator's directions: the host is module-agnostic, the controller has no part, and a
real licence manager hands out the correct licence in every situation.

- ADR 0181 (reconstructed): the operator account is a node fact stated by the operator; the home is
  derived unless stated; a resource may be placed under it owned by the account; a node with no
  account refuses one. What the controller shipped on 2026-09-27 without a record.
- ADR 0182: inside a home the module owns the directory and the files it places, writes into the
  tool's own files for its few keys, never declares a credential's content, and holds everything
  else as found; a predecessor's leftovers are the operator's to remove once.
- ADR 0183: claude-licence-manager holds the mesh seat anthropic-licence-manager and owns the
  Anthropic licences, grants (encrypted with a key the vault made for it), bindings per touchpoint,
  usage and audit; one rotation source under a lease; a token travels module to module sealed to
  each node's module key on request/reply, never as an event; the agent module alone writes what
  the agent reads; the host delivers package and state and knows nothing else. A bounded exception
  to ADR 0113; dated mechanism notes on ADR 0050 and 0113.
- To-be 36 (claude-code): the mesh's part of the agent's configuration lives in the agent's
  machine-wide managed directory, owned whole by the module and written by its code; nothing under
  the home but the credentials file of a subscription licence; the API-key licence through the
  key-helper; the console as a node-scoped provision (to-be 34 amended); MCP servers as settings
  with an mcp_configure tool; one agent directory per machine shared by every session.
- To-be 39 (claude-licence-manager): store, the two licence kinds, keeping a grant alive, the
  hand-over, who gets which licence with the predecessor's fallbacks, adoption with the identity
  guard, the seat's verbs.

Numbers taken across main and every open branch at the time of the merge; to-be 14, 29 and 34
carry dated notes; the glossary gains "operator account".
jschoubben force-pushed feat/claude-code-module from e710abd9b8 to 7b1dabbce0 2026-10-02 15:22:15 +00:00 Compare
mesh-admin changed title from The operator's agent and its licence manager are modules: ADR 0176–0178, to-be 36 and 37 to The operator's agent and its licence manager are modules: ADR 0181–0183, to-be 36 and 39 2026-10-02 15:22:40 +00:00
mesh-admin merged commit 4af731df19 into main 2026-10-02 15:23:38 +00:00
mesh-admin deleted branch feat/claude-code-module 2026-10-02 15:23:38 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/hq#286