2026-09-27 17:06:40 +00:00
1 changed files with 28 additions and 8 deletions
@@ -150,6 +150,29 @@ paper is wrong until there is a second mesh to find out.
      and names no broker module anywhere in its source. What remains is naming `nats` instead of
      the deprecated broker where a genesis module set is declared, which is scenario and installer
      configuration — carried with 1.6 rather than before it.
 - [ ] 1.7 **the composition, delivered** — the controller gathering its principals, composing the
      file, and asserting the streams and consumers on start.
      > **This corrects a tick, not a decision.** Tasks 1.3 and 1.4 are ticked and they are honest
      > about what they built — the composer, the derivation, the permission model, the stream and
      > consumer definitions, the asserter, all pure and held by unit tests and a golden
      > composition. What nobody wrote is the *caller*. Measured on the feature branch: outside the
      > package that defines them, there is **not one** use of the composer, the permission
      > derivation, the stream set, the stream asserter or the principal type. Step 1's "done when"
      > claims "every account and permission composed from the manifests", and a mesh raised today
      > would stand up a server with no user list at all.
      >
      > It also needs state the mesh does not keep. Design 25 §4 says the file holds bcrypt
      > hashes, and passwords are "minted and sealed exactly as today" — but today the mesh mints a
      > password, hands it to the broker through a management call, seals the plaintext to the
      > holder and **keeps nothing**. There is no management call here, so the hash has to survive
      > for every later recomposition: the first thing a person's access change or a new module
      > touches is a file that must still contain every other user's password. No bcrypt hash is
      > stored anywhere in the controller today.
      >
      > Named as its own task rather than folded into 1.3 so the gap is visible: the parts of
      > step 1 exist and the mesh does not yet do any of it.
 - [ ] 1.6 the genesis-broker bed — **deferred**: beds are run once, at the end, rather than per
      step (novox/hq design 22's rule, and the operator's instruction). Every claim step 1 makes
      is covered by a unit test or was demonstrated against the real server; what the bed adds is
@@ -324,11 +347,8 @@ pays for itself furthest away.
      the subject-alternative-name constraint recorded under 3.6 is that client's, because it takes
      PEM strings with no verify hook. A host checks the fingerprint and nothing else.
-      Still outstanding: **something that composes an enrolment user per live token.** Nothing does,
+      Nothing here composes an enrolment user per live token, and that is **1.7's**, not this
-      on either bus — on the old one the account is made imperatively through the broker's
+      task's: it is one input to a composition that does not happen at all yet.
      management API when a token is issued, and here there is no management API, so issuing a token
      has to recompose the server's configuration. That is the last piece of enrolment on the new
      bus, and it is the only thing between the two links and a mesh raised on NATS from nothing.
 - [x] 3.6 the tool runtime's client on NATS, behind the unchanged sdk contract — round-tripped
      against a real server: a tool answered across two connections, a throwing handler reaching
      the caller as an error rather than a timeout, an event delivered once with its key, body,
@@ -414,9 +434,9 @@ it, and the beds that need a mesh living on NATS can finally run.
      held by a `nak`-with-delay cycle still reaches the enrolling node, proving the reply travels
      in the payload and not the transport field the consumer's ack has claimed. The server-enforced
      permissions were proved at step 1 and are not re-proved here
-      — **waiting on one thing only**: an enrolment user composed per live token (3.5). Both links
+      — **waiting on 1.7, the composition.** Both links speak NATS and every claim above has a unit
-      speak NATS and every claim above has a unit test or a check against a running server behind
+      test or a check against a running server behind it; what none of them needs is a bus that
-      it; what no test can stand in for is a mesh raising itself, which is what this bed is
+      composed its own accounts, because each supplies its own. A mesh raising itself does need one
 - [ ] 4.2 a build source's change reaches the builder over the bus, and the build that follows is
      the one the change asked for — **blocked by
      [issue 127](../../04-ISSUES/127-a-module-event-derives-a-subject-nothing-publishes/00-report.md)**