mesh-issues: record who acted as the caller the runtime proves (hq issue 365)

The tool runner now takes a call's caller from the subject it arrived on and
hands it to the module through the SDK (stdio.CallerOf); the tracker records
that bus user on what each verb writes instead of unproven. Never from the
arguments, which still refuse any caller, and unproven where the runtime proves
none. Needs mesh-sdk's go/caller.go (pinned at its branch head until merged).

modules/mesh-issues/README.md

@@ -45,9 +45,9 @@ issue is taken over, and the reason is noted on it. A worker with no move, note,
 issue for `worker-stale-after` (default `24h`) is stale and may be taken over from without a reason, still noted.
 The tracker's own writes (the triage, the duplicate check, the delivery notes) keep no worker current. The `moved`
 event carries `by` (the worker; who acted, for a move naming none), `since`, `caller` (who acted, as the runtime
-proves it: `unproven` today), and `took-over-from`, `take-over` or `released` when they apply. `by` is what the
-worker says it is: the runtime does not yet tell a module its caller (hq issue 340), so the worker lets agents and
-people see each other; it is not a lock against a false name.
+proves it: see *Who acted*), and `took-over-from`, `take-over` or `released` when they apply. `by` is what the
+worker says it is, not who called, so the worker lets agents and people see each other; it is not a lock against
+a false name.
 
 **An issue with a folder in hq** (`record` at open: the folder's name, without the number) is whole in the
 tracker like any other: the folder holds its narrative, the tracker its status. Until the import of
@@ -138,8 +138,8 @@ It is a verb on the seat, callable by any agent, because it can do only this:
   A folder numbered at or past the setting `first-number` without an issue in the tracker is refused on its
   own: a folder from the tracker's time carries a number the tracker gave.
 - **It cannot forge an issue's history.** An issue it writes is `opened-by: import`, its `opened` the date
-  the report gave, and it carries `imported: {at, by, commit, from}` — when, who ran the import (the bus
-  credential, `unproven` until the runtime proves it), the commit of hq and the document. Each is an
+  the report gave, and it carries `imported: {at, by, commit, from}` — when, who ran the import (the caller,
+  as the runtime proves it), the commit of hq and the document. Each is an
   `imported` event. What it writes comes from hq's `main` as the records module holds it, which is reviewed
   in pull requests.
 - **What it keeps is bounded** as every verb's text is: the title 200 bytes, the report 64 KiB, one issue
@@ -197,7 +197,7 @@ sessions writing a record at once never take one number.
 
 - **A reserved number is spent forever**, whether or not its record ever lands; it is never handed out again.
   Each is kept in the state `reservations` under `decision-0292` or `research-046` with who reserved it
-  (`by`, from the caller as for every verb: `unproven` until the runtime names the caller), when (`at`) and
+  (`by`, the caller as for every verb), when (`at`) and
   `for`, and said as the event `mesh-issues.reserved`. A reservation whose write cannot be confirmed is
   refused, and its number stays spent.
 - **A refused reserve takes no number**: a kind other than `decision` or `research`, a `for` that is not one
@@ -230,10 +230,14 @@ is kept, and its answer says the event was not said (`announced: false`).
 
 ## Who acted
 
-ADR 0275 §5 records the caller from the bus credential, never from an argument. **The runtime does not yet
-tell a module who called it**: a tool call reaches a bundle as a name and arguments, and the tool runner is
-not told who called it either (hq issue 340). Until it does, every change is recorded as by `unproven`, no
-verb takes an argument naming a caller, and none can be given one.
+ADR 0275 §5 records the caller from the bus credential, never from an argument. **Who acted is the bus user
+that called** (hq issue 365): a call on a tool's caller-named subject carries the caller's bus user as its last
+token, the bus lets each user publish there with its own name alone, and the tool runner hands the module that
+user from the subject the call arrived on (mesh-sdk `stdio.CallerOf`) — `shanks.node-tools` for an agent on
+that machine's console, `person.<name>` for a person's credential. A call on the subject that names no caller
+(served beside it for one release, hq issue 464), or through a runtime from before issue 365, is recorded as
+by `unproven`. No verb takes an argument naming a caller, and none can be given one. The caller is only as sound
+as the credential, which ADR 0266 keeps agents from reading (hq issue 333).
 
 ## Settings