jschoubben
ce6ae943b7
Both lines of work numbered from the same point, so four decision records and one design document existed twice with different content. The trunk keeps its numbers and this branch yields — the only rule that scales, because the trunk's are already cited by what merged before them. 0117 the bus is the only broker -> 0125 0118 a module declares its own seats -> 0126 0119 amqp is a provision, not the bus -> 0127 0120 the mesh bus is required -> 0128 0123 a seat carries its role's protocol -> 0129 0124 the predecessor is ending -> 0130 design 29, what a module declares -> design 32 Applied to the code repositories too, because a stale reference is worse when numbers collide than when they dangle: the reader lands on a real record that decided something else. Two reconciliations the merge forced, both real: **0110 was marked wholly superseded and was not.** Its successor says in as many words that everything 0110 decided about what a seat *is* stands untouched — and two records that landed on the trunk rest on exactly that part. So it is accepted again, extended rather than replaced, with a note saying which of its claims moved and where. **A seat's protocol becomes columns, not fields.** The trunk moved the seat set out of compiled code into a table the controller owns. This branch had added what a role accepts, emits and serves to the Go slice. The decision is unaffected and the mechanism is better for it: giving a role a protocol is now a write rather than a rebuild, which is the trunk's own argument applied to what this branch added. One check still fails and it fails on main too: a record resting on ADR 0112 while that is still 'proposed'. Left alone — it is not this merge's to answer.
5.7 KiB
topic, status, date, deciders, reconstructed, supersedes
| topic | status | date | deciders | reconstructed | supersedes |
|---|---|---|---|---|---|
| the mesh | accepted | 2026-09-26 | jochen | false | 02-DECISIONS/0125-the-bus-is-the-only-broker.md |
127. AMQP is a provision, not the bus
Context
ADR 0125 decided that the bus is the only broker, and went
one step further than it had grounds for: it also decided that the amqp interface — a module
requiring a message broker of its own — "is not carried forward" and "retires with the
compatibility broker rather than gaining a successor", with the two modules declaring it converted
to the bus in step 4.
The operator's correction: AMQP is deprecated as the mesh's transport, not abolished as a
service. The broker module keeps running and keeps answering amqp requirements. It is no
longer a core part of the mesh — "it's just a module like mssql now."
What 0117 conflated is two different reasons a module might ask for a broker, which look identical in a manifest:
- To talk to other modules. Wrong under one bus, and the thing 0117 was right to refuse: a private broker used as inter-module transport is a second bus, with every guarantee crossing a seam and no scoping the mesh can see.
- Because it genuinely needs an AMQP broker, the way something needs a database — a queue for its own internals, or interop with software that speaks AMQP and nothing else. That is a backing service, and the mesh has a word for backing services already.
0117 saw the first and legislated against both. The second is ordinary, and forbidding it would make the mesh unable to run a large class of perfectly normal software while claiming that as architecture.
Considered Options
- Keep 0117 as written — retire the interface, convert the two modules. Rejected by the operator, and wrongly reasoned besides: it treats "needs an AMQP broker" as always a mistake.
- Keep the broker as the predecessor's compatibility module, as ADR 0106 framed it, with a retirement condition. Rejected: it is not single-purpose and its clients are not only the predecessor's, so the retirement condition describes a day that will not come.
- The broker is an ordinary provider module of an ordinary provision. Adopted.
Decision
The mesh's bus is NATS and only NATS. Everything 0117 decided about the bus stands: one bus,
a module's messaging is subjects on it scoped by what it declares, no module is handed a bus of
its own, and the mesh-broker seat is the NATS server's.
amqp remains a provision a module may require, answered by the broker module the way
postgres-database is answered by the store module or a database is answered by mssql. It is not
deprecated as an interface; the software behind it is simply no longer the mesh's nervous system.
The broker module stops being foundation. It claims no seat — mesh-broker is the NATS
server's — it is not raised at genesis, nothing in the mesh requires it, and a mesh that never
installs it is a complete mesh. It is installed when something wants it, like any other provider.
The rule that survives, stated so it can be applied: inter-module communication goes over the bus. A module may hold a broker, a database or a cache as a backing service; it may not use one as a channel to another module. The line is not which software is involved, it is whether a second module is on the other end.
Neither amqp-ping nor amqp-email-forwarder needs converting. 0117 put that work in step 4;
it is removed. They require a backing service and a provider answers.
Consequences
- The "compatibility broker" framing is wrong and goes. There is no
lavinmq-compat, no single purpose and no retirement condition. Design 25 §5 is corrected. - ADR 0106's progressive insight was itself wrong and is corrected by a second one there. It said 0117 would make 0106's "one purpose — the predecessor's clients" sentence true by moving the mesh's modules off. Nothing moves off; the sentence is simply not what the broker is.
- The seat change stands, for a better reason than 0117 gave: not because a broker cannot be
provisioned, but because this broker is not the mesh's bus. The broker module drops its
mesh-brokerclaim and thenatsmodule takes it. - Step 4 loses two conversions; step 1 and the WBS are otherwise unaffected.
- What got harder: the rule is now a judgement rather than a prohibition. "Is this a backing service or a channel to another module?" has to be asked in review, where 0117 could have answered it with a parser. That is the honest cost of allowing the legitimate case.
How it is checked
- A module's own messaging needs no
requires. The check from 0117, unchanged: a module declaring onlyemitsandconsumesreaches its subjects and is refused every other. - The broker holds no seat. A manifest test: the broker module claims nothing, and a mesh raised without it is complete — genesis names it nowhere.
amqpresolves like any provision. A resolution test: a module requiring it is answered by the provider, refused when none is assigned, and neither case touches the bus.- What cannot be checked mechanically, and is said rather than implied: that a module holding a broker is not using it to reach another module. Review, not a parser.