A member's go.mod names the oldest version a module accepts; the check builds the group's own heads whatever it names. go.sum lines of mesh packages are left out.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
A have of the bus module heard while the placement did not yet name its node as holding the bus
adopted nothing, and nothing adopted it again until the have changed, so a vault could stay without
the bus node's adoption and the loaded list's revision for good. The vault now keeps each node's
latest have and, on the placement's next change, adopts from the bus node's kept have if it was not
adopted: the placement's event, no timer. The rotation test now writes the have before the
placement (its wait for the vault's picture is gone), so it takes this path every run.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
The rotation test failed twice under parallel runs ("never: the rotation begins"), from two races in
its player. The player refused mesh/subscribe, so the placement events it said never reached the
vault: when the vault's first view was answered before the test wrote the placement, the vault never
knew the bus node. And the test wrote the bus node's have right after the placement, so the vault
could hear the have before it applied the placement, adopt nothing, and never learn the loaded list's
revision. The player now answers mesh/subscribe and holds a family's events until it is subscribed,
as the module's consumer does; the test writes the placement only after the vault's first view and
the have only once the vault's picture holds every placement key (vault_first_views), so both orders
are fixed rather than waited out.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
Every module that imports mesh-sdk requires its group head; each requires the mesh-contracts seats and clients it
imports, and mesh-contracts/go through the SDK's seat list. The placeholder versions are gone.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
mesh-sdk holds neither asks nor asker, nor the vault's answer types, and mesh-delivery's
sdk/views is mesh-sdk's go/views (a1-progress.md, the rewrite map for the join): thirteen
modules switch to the operatorchannel contract and client, mesh-sdk's channel package and
meshvault, with go.mod requiring each at the group pin (nats: meshbroker too). The gate
holds the checks mesh-sdk dropped (an ask's id is its key's asking, at least one option),
with a row that fails without them; claude-code refuses a router record whose times do
not parse, as its JSON decode did, with a row.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
mesh-vault gains the state findings (old section); past two minutes without the assigner's first view it writes
first-view-unanswered naming the owner and the tool, the answer deletes it. mesh-conditions reads mesh-vault.findings
and holds a row for the kind.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
Six states (modules, manifests, predefined, config-candidates, placement, wants) are asked of the owners' read
tools at start and kept from their views.<state> events, a gap asks again; a reader started while an owner is
down keeps asking and writes a finding past two minutes. The builder's builds has no owner tool and stays a
read. The returning node-engine's event is read by its node token (ADR 0618 as built). Tools
config_first_views and config_first_view_again.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
retire takes the definition's warrant (the hand act's id, naming node, module, name and ask) and answers
retired; own-retired, renamed, retiring and retired carry exactly the definition's bodies on its subjects.
The whole-module tests decode what the module published strictly into the generated types. The modules
require mesh-contracts, to be pinned with the group (a local replace in an uncommitted go.work until then).
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
The caller must be on the vault's trusted list retire-callers (the holder of mesh-config alone) and carry
a hand act it recorded for exactly this node, module and name. A waiter on rotated or own-replaced does
not wake on own-retired. Reviewer note of issue 1966: HandedOf returns a placement read error instead of
dropping the modules placed there.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
mesh/check being carried to 237a534ca4d3 on 7a7db0166ad2 | from dd458cb155f5, mesh-host 4d47ff5ce743
The vault leaves a handed module's own secrets out of `own`, judged by the plan in its assignment, and nothing read
that judgement: on 2026-11-04 the circle on ace (no plan, so not handed, so refused, so no plan) could be told only by
reading the provisioner's plans beside the node-engine's refusals. own_handed answers, per module the vault keeps an
own secret of on the machine or that is placed there, handed or not and why.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
mesh/delivery-group group feat/sdk1 rejected: composed together: the checker's verdict at the members' heads (6b0f5a2e9397): integration: meshbuildgo/cmd/mesh-…
mesh/check failed: integration: meshbuildgo/cmd/mesh-build-go… | 68e7a2ddbfb9 on ee75d4327ce5 | judged by the candidate's mesh-build-go at 773f299aed81
mesh/check pass 019614aedc14 on fe7c5ccb64bf | unit 6028 run, 142 kept, 16 skipped | integration 6091 run, 174 kept, 25 skipped | over bound: unit, in…
With the controller gone nothing made the pair row of a new consumer: the vault minted only for a provider
handed to the provisioner (ADR 0349 clause 17's premise, that a holder filled the old way gets the controller's
value). A node composing its own now asks the vault for its credentials (own, ADR 0547 §2, ADR 0550 §5), so the
vault makes the first value of a shared or per-login provision for every holder, create-only (issue 1126; ADR
0570 §6). A remake or a rotation still waits while a holder is filled the old way. A credential asked of the
vault in mesh-provisioner's provisions starts a pass at once, one pass at a time, and vault_status answers each
provider and provision's last outcome as `credentials`.
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
mesh/delivery-group group feat/1126-removal rejected: composed together: the checker's verdict at the members' heads (a523066f1791): integration: meshbuildgo/c…
mesh/check failed: integration: meshbuildgo/cmd/mesh-build-go… | 7f8701637f9d on 32c4c52261c4 | judged by the candidate's mesh-build-go at b82f7f676986
nox cleanup delete without --confirm deletes nothing; the vault refuses it
for its missing confirm alone and judges only a confirmed delete, and nox
records the warranting act only for that one (issue 1126 review 2).
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
The controller is not placed (ADR 0590), yet the vault still answered a
caller named controller alone (accept), took its relay of who asked
(secret-ask, rotate's by) and sealed it the core's credentials. Those
branches and accept go with their tests; a node's account alone is never
minted or rotated here. The sensitive-verb judge now needs the act's verb to
be the vault's own, mesh-vault.<verb>, not any verb ending so (issue 1126
review 1).
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
mesh-hand-acts records one what per act, so an approve of two consumers
could never be warranted. The judge reads each word of the act's what as a
name, and nox records one act listing the consumers (issue 1126 review 1).
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
Each sensitive vault verb judges its own caller, and nox reaches the vault
as its machine's runtime, never as a person, so it could use none of them.
Before rotate, retire approve, cleanup delete and secret export nox records
the act through mesh-hand-acts (the vault verb as its verb, what it acts on
as its what) and names it as act; a refused recording calls the vault not at
all (ADR 0590 §8, issue 1126 review 1).
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
move-asks copied the controller's record of asks into the vault's once;
the controller is not placed (ADR 0590) and nothing else calls it. move-in
stays: the node-engine calls it. The drift test names the node's own
composition now that the controller composes for none (issue 1126).
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
The controller judged the operator's account for approving or deleting a
retirement, rotating a secret and exporting sealed copies; it is not
placed, and these verbs are reached through the mesh MCP server on each
machine. Each now answers the operator's account (person.<name>), or a
caller naming its own recorded hand act for that verb and subject, and
nothing else (ADR 0590 §8, issue 1126).
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
The controller ended by its unassignment and its lease key expired, so the
gate on a handed lease kept retirement, rotation and node-login rotation off
for good (issue 1126, A3). Drop the gate, the lease watch and the manifest's
read of mesh-controller.lease; vault_status no longer reports a lease.
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
jschoubben