Designs 34 and 46: sessions wait on any event, and the approval mark gates calls and marked waits, delivered with design 47's milestone G #540

2026-11-11T01:53:48Z

mesh-tools commented

2026-11-11 01:53:48 +00:00

Two milestone parts delivered in design 47 milestone G's group, by the operator's answers of 2026-11-11.

Design 34, every-event (34-milestones/every-event.md, §1-§37): the tool runner hears every event and every module's stream, mail included (ADR 0670, ADR 0671); a session's mesh_wait on a marked event or stream (a restricted stream counts as marked) runs only on the operator's warrant for that one wait (the operator, ~02:40 CET: "respect any requires-approval config on the topics").
Design 46, milestone 7, the approval mark (46-milestones/7-approval-mark.md, §1-§24), rewritten for the mesh as it is now built: marks read from the catalog half, the grants part's deny for a runner without approval-mark/1 (ADR 0286 §7-§9 kept), the hand-act on the seat mesh-hand-acts, asks on operator-channel. The operator chose "Build the gate in G" (02:26), "Call again (as designed)" (02:40) and "Mark them in G" for the forge's branch-protection loosening (02:47; it runs only on the operator's own warrant per act).
No new decision records (the operator, 2026-11-11); each line departing from a record says so in its Why.
Known limit: a process running as the machine's account can read the tool runner's or the forge's credential and go around the gate (issue 1966 note 193).
Review by architectural domain: three rounds, all musts answered; the record is kept beside milestone G's working files.
Open with the operator: whether to drop the bus read from the secrets check (every-event §22, §31); on expiry 04:33 UTC it is dropped by a further reviewed commit here.

Reviewed-by: review-security-and-upgrade, review-seams-and-tools, review-running-and-testing, review-health-and-events (round 3) for lead-47@shanks at de62fe5852

https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

Two milestone parts delivered in design 47 milestone G's group, by the operator's answers of 2026-11-11. - **Design 34, every-event** (`34-milestones/every-event.md`, §1-§37): the tool runner hears every event and every module's stream, mail included (ADR 0670, ADR 0671); a session's `mesh_wait` on a marked event or stream (a restricted stream counts as marked) runs only on the operator's warrant for that one wait (the operator, ~02:40 CET: "respect any requires-approval config on the topics"). - **Design 46, milestone 7, the approval mark** (`46-milestones/7-approval-mark.md`, §1-§24), rewritten for the mesh as it is now built: marks read from the catalog half, the grants part's deny for a runner without `approval-mark/1` (ADR 0286 §7-§9 kept), the hand-act on the seat `mesh-hand-acts`, asks on `operator-channel`. The operator chose "Build the gate in G" (02:26), "Call again (as designed)" (02:40) and "Mark them in G" for the forge's branch-protection loosening (02:47; it runs only on the operator's own warrant per act). - No new decision records (the operator, 2026-11-11); each line departing from a record says so in its Why. - Known limit: a process running as the machine's account can read the tool runner's or the forge's credential and go around the gate (issue 1966 note 193). - Review by architectural domain: three rounds, all musts answered; the record is kept beside milestone G's working files. - Open with the operator: whether to drop the bus read from the secrets check (every-event §22, §31); on expiry 04:33 UTC it is dropped by a further reviewed commit here. Reviewed-by: review-security-and-upgrade, review-seams-and-tools, review-running-and-testing, review-health-and-events (round 3) for lead-47@shanks at de62fe58523a8121ba2914336dcb5457cf67c09f https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

mesh-tools added 9 commits 2026-11-11 01:53:48 +00:00

Design 34: a session waits on any event, the tool runner hearing every one (ADR 0670) 024627f658

Watchers reread on a timer because mesh_wait refuses every event outside a list of five,
and the delivery status view's events, which playbooks have watchers wait on, are not on
it. ADR 0670 grants the tool runner every event subject and drops the list; this writes
that as milestone every-event, one delivery group of mesh-sdk, mesh-delivery and
mesh-tools, and puts design 34 in the main-file-and-parts shape.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

Design 34 every-event: write in the four domain reviews' findings c232b1fb81

The reviews found waits that time out for ever on a misspelt name, refusals that would
loop a watcher, an acceptance no answer could prove, readers still describing the list,
and no way back said. Each is now a design line; the stream-events lines are written for
the recommended option and marked pending the operator's answer.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

Design 34 every-event: the review reads a stream's subjects with nats_streams d758964ca9

No tool answered which subjects a stream holds, so the secret review could not find an
event the list missed; a module's tools read everything it holds, so the nats module's
tool gains that read, built first as a small fix.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

Design 34 every-event: hear every module stream, and gate a marked wait on the operator's warrant aec610a6f4

The operator chose every module stream, mail too (ADR 0671), so the stream
lines hold and the restricted-stream deny goes. The operator also asked that
a wait respect the approval mark; that extends ADR 0286 to events and has the
tool runner's gate hold it, so those lines are written pending the record.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

Build the approval mark in milestone G and let a marked wait use it ca1fbf7867

The operator answered "Build the gate in G" and wants no new records: the
marked-wait lines now hold by the operator's answers, each departure said in
its Why, and design 46's milestone 7 becomes a part a builder reads whole,
written to the mesh as built (marks read from the bus, the capability hold,
the client's claim in bus state, the hand-act seat), delivered with G and
every-event.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

Answer round 1 of the domain review of the approval mark and marked waits a6c9b96be3

The bus withholds a marked subject from a runner that does not honour the
mark again, as ADR 0286 has it; marks follow G's catalog half; a recording,
a stuck gate, an absent router and a start before the marks are read each
have a stated answer, so nothing runs unasked and nothing fails silently.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

Write the operator's answers on the approval mark into milestone 7 636b2be7ac

Call again stands by the operator's choice; the credential file's reach is
a known limit, as G's shared account is; and the forge's two loosening acts
move to a marked tool of their own, so tightening stays unasked.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

Answer round 2 of the domain review of the approval mark bddf6ce95a

A stuck state recovers as a kept call, a node with no or stale readings is
denied, the caller-named subjects are withheld too, and the per-machine key
form and the client's prefix are named, so no path serves a marked tool
unasked; the forge's loosening is marked by the operator's answer.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

Answer round 3 of the domain review of the approval mark

mesh/delivery closed: a newer head of the same pull request

Details

mesh/check pass de62fe58523a on c74546a16f78 | unit 43 run, 0 kept, 1 skipped | integration 43 run, 0 kept, 1 skipped | composition passed in 69s on 4…

de62fe5852

The client's node prefix stays on its own keys, so the router's record is
still read where the router writes it; the remaining notes say where the
runner's version is read and what each limit costs.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

mesh-tools commented

2026-11-11 01:53:53 +00:00

Delivery novox/hq@95ae1dd6ed90 — merged since 2026-11-11T02:08:02Z

Source — source.main moved to novox/hq@7dfb6f0b7b. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-11-11 02:03 (new) → proposed (announced): novox/hq#540's head announced
2026-11-11 02:03 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-11 02:08 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/hq@95ae1dd6ed90` — **merged** since 2026-11-11T02:08:02Z **Source** — source.main moved to novox/hq@7dfb6f0b7b15. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-11-11 02:03 (new) → proposed (announced): novox/hq#540's head announced - 2026-11-11 02:03 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-11 02:08 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

jschoubben added 1 commit 2026-11-11 02:03:16 +00:00

Read the secrets list and every mark from the module catalog alone

mesh/delivery merged: source.main moved to novox/hq@7dfb6f0b7b15

Details

mesh/check being carried to 95ae1dd6ed90 on 7dfb6f0b7b15 | from c74546a16f78

95ae1dd6ed

The operator answered that only the indexer uses the manifests, to build
the module catalog; so the secrets review and the tool runner read the
catalog revision, and the bus read and its nats tool extension go.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

mesh-tools commented

2026-11-11 02:03:20 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: its head de62fe5852 is no longer the pull request's head, or the pull request closed. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: its head de62fe58523a is no longer the pull request's head, or the pull request closed. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools merged commit 7dfb6f0b7b into main

2026-11-11 02:08:01 +00:00

mesh-tools deleted branch design/34-wait-on-any-event

2026-11-11 02:08:02 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#540