From b63e8ae58ac3bf23027de29358e8598283ce8f44 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Wed, 11 Nov 2026 23:32:31 +0100
Subject: [PATCH] M-8: the bindings verb answers each licence's key (issue
 1409)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Each binding the verb bindings answers carries its licence's key beside the
§3 fields, as binding.changed does, so the vault's first view matches a
token's secret name to the binding without the key form of its own.

Builds: design 39 bus-and-switch §17, B10, B25 (hq 128236e7 and after, PR #561)

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ
---
 .../cmd/claude-licence-manager/manager.go              | 10 ++++++----
 .../cmd/claude-licence-manager/manager_test.go         |  4 ++++
 .../cmd/claude-licence-manager/store.go                |  6 ++++--
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/modules/claude-licence-manager/cmd/claude-licence-manager/manager.go b/modules/claude-licence-manager/cmd/claude-licence-manager/manager.go
index 6262c4bf5..ead306c05 100644
--- a/modules/claude-licence-manager/cmd/claude-licence-manager/manager.go
+++ b/modules/claude-licence-manager/cmd/claude-licence-manager/manager.go
@@ -749,15 +749,17 @@ func Health(l Licence, now time.Time, s Settings) string {
 	return "ok"
 }
 
-// BindingsOf is every binding, or the one of consumer when one is named (B10): a list either way, unpaged.
+// BindingsOf is every binding, or the one of consumer when one is named (B10): a list either way, unpaged, each with
+// its licence's key beside the §3 fields (B25).
 func (m *Manager) BindingsOf(ctx context.Context, consumer string) ([]Binding, error) {
 	all, err := m.Store.Bindings(ctx)
-	if err != nil || consumer == "" {
-		return all, err
+	if err != nil {
+		return nil, err
 	}
 	out := []Binding{}
 	for _, b := range all {
-		if b.Consumer == consumer {
+		if consumer == "" || b.Consumer == consumer {
+			b.Key = KeyFor(b.Licence)
 			out = append(out, b)
 		}
 	}
diff --git a/modules/claude-licence-manager/cmd/claude-licence-manager/manager_test.go b/modules/claude-licence-manager/cmd/claude-licence-manager/manager_test.go
index 31156bd76..b2ec649cd 100644
--- a/modules/claude-licence-manager/cmd/claude-licence-manager/manager_test.go
+++ b/modules/claude-licence-manager/cmd/claude-licence-manager/manager_test.go
@@ -339,6 +339,10 @@ func TestCurrentHoldsNoToken(t *testing.T) {
 	if bs, _ := mm.m.BindingsOf(ctx, "laptop"); len(bs) != 1 || bs[0].Consumer != "laptop" {
 		t.Fatalf("bindings of laptop: %v", bs)
 	}
+	// design 39 bus-and-switch B25: the verb bindings answers each binding's licence key beside the §3 fields.
+	if bs, _ := mm.m.BindingsOf(ctx, ""); len(bs) == 0 || bs[0].Key != KeyFor(bs[0].Licence) {
+		t.Fatalf("bindings answered %+v", bs)
+	}
 }
 
 func TestNothingTheManagerPublishesKeepsOrListsCarriesAToken(t *testing.T) {
diff --git a/modules/claude-licence-manager/cmd/claude-licence-manager/store.go b/modules/claude-licence-manager/cmd/claude-licence-manager/store.go
index 774a8c44c..bdfdf67ed 100644
--- a/modules/claude-licence-manager/cmd/claude-licence-manager/store.go
+++ b/modules/claude-licence-manager/cmd/claude-licence-manager/store.go
@@ -34,8 +34,10 @@ type Licence struct {
 // Binding is one consumer's binding (ADR 0206, §3): the licence, kind and generation it should hold, since when, and
 // why and by whom it was moved last.
 type Binding struct {
-	Consumer   string `json:"consumer"`
-	Licence    string `json:"licence"`
+	Consumer string `json:"consumer"`
+	Licence  string `json:"licence"`
+	// Key is the licence's key (§10), answered by the verb bindings (B25); the store keeps none.
+	Key        string `json:"key,omitempty"`
 	Kind       string `json:"kind,omitempty"`
 	Generation int64  `json:"generation"`
 	Since      string `json:"since,omitempty"`