The licence manager keeps its data on the bus and switches licences by itself at 99% (issue 1409) #657

2026-11-12T00:12:02Z

mesh-tools commented

2026-11-12 00:12:02 +00:00

Issue 1409; design 39 bus-and-switch §1-§52 with the lead's answers A1-A4, B1-B44 (hq main). Delivery group feat/39-licence-switch with mesh-contracts (merge together).

The operator, 2026-11-11: switch every node to a licence with room when usage reaches 99% (configurable), done by the licence manager itself; Postgres replaced by the bus's own storage; useful tools; as much state as possible.

claude-licence-manager: kept data on the bus (state licences, bindings, leases, offered, carried, conditions; logs usage, audit); the carry-over of today's rows at first start, live leases included, acting verbs refused until it ends; grants and tokens in the vault; the automatic switch with its settings (default 99%), licence.switched and a tell to the operator; conditions no-room, near-limit, usage-unread, carry-over-failed, settings..invalid; eight tools; whole tests against an embedded bus and a real postgres.
mesh-vault: licence-put, the state licence-bindings followed from binding.changed and the manager's bindings, the get rule for licence secrets, vault_first_view_again takes of.
claude-code: its binding from events, its token from the vault.

This delivery moves data (told to the operator before it): the carry-over copies the store database's rows onto the bus and the vault. The database stays read-only; its drop is the module's next change, with the operator's Approve.

Tests: manager 65 unit / 4 integration; vault 141 / 2; claude-code 211 / 0; all within budget. 33 repository checks pass; the manifest judge (local re-creation) accepts all three, 0 new findings.

Reviewed-by: mesh-code-reviewer@shanks at dbcba161d5 (round 2 of 3, approved)
Pushed-by: fix-1965@shanks

https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

Issue 1409; design 39 bus-and-switch §1-§52 with the lead's answers A1-A4, B1-B44 (hq main). Delivery group feat/39-licence-switch with mesh-contracts (merge together). The operator, 2026-11-11: switch every node to a licence with room when usage reaches 99% (configurable), done by the licence manager itself; Postgres replaced by the bus's own storage; useful tools; as much state as possible. - claude-licence-manager: kept data on the bus (state licences, bindings, leases, offered, carried, conditions; logs usage, audit); the carry-over of today's rows at first start, live leases included, acting verbs refused until it ends; grants and tokens in the vault; the automatic switch with its settings (default 99%), `licence.switched` and a tell to the operator; conditions no-room, near-limit, usage-unread, carry-over-failed, settings.<setting>.invalid; eight tools; whole tests against an embedded bus and a real postgres. - mesh-vault: `licence-put`, the state `licence-bindings` followed from `binding.changed` and the manager's `bindings`, the get rule for licence secrets, `vault_first_view_again` takes `of`. - claude-code: its binding from events, its token from the vault. **This delivery moves data** (told to the operator before it): the carry-over copies the store database's rows onto the bus and the vault. The database stays read-only; its drop is the module's next change, with the operator's Approve. Tests: manager 65 unit / 4 integration; vault 141 / 2; claude-code 211 / 0; all within budget. 33 repository checks pass; the manifest judge (local re-creation) accepts all three, 0 new findings. Reviewed-by: mesh-code-reviewer@shanks at dbcba161d57cb9e485fb97df8c3db990c5c5641c (round 2 of 3, approved) Pushed-by: fix-1965@shanks https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

mesh-tools added 32 commits 2026-11-12 00:12:02 +00:00

M-1: a licence's key form, and an adoption whose key is taken is refused e995e40519

A key of the bus takes fewer characters than a licence's name; the key is the store's
alone, and two names that write the same key would overwrite each other.

Builds: design 39 bus-and-switch §10, B6

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-2: the manager's manifest asks for its kept data by template 1c03299721

Eight bus-state entries in the typed long form; the old state and the reads of
claude-code.holdings go, and so does the run-once prepare, since nothing writes the
tables again. The database and grant-key stay as the carry-over's read-only source.
The manifest declares its new events, its consumption of holdings-changed, the
operator channel it uses, the verbs it invokes, six settings and its eight tools.

Builds: design 39 bus-and-switch §1, §9, §21, §23, §27, §33, §37-§44, A3, B9, B16

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

V-1: the vault serves licence-put, keeping the caller's newest generation e85cf002a4

A licence's grant and access token move into the vault (ADR 0550 §3), handed in two steps
with a key made for the call, as move-in does; the caller's generation is the record's,
an older one is refused, and secret-changed names the secret and its generation.

Builds: design 39 bus-and-switch §15, B3, B4, B5, B6

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

C-1: a node's holdings are said as holdings-changed, and again when asked 4179be7a56

The licence manager follows the nodes' holdings by an event and asks for them with
holdings.asked, instead of reading the agent module's state (ADR 0596 §2). The state
holdings stays the module's own.

Builds: design 39 bus-and-switch §23

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-8: current answers the licence and its health, never the token f29a9ad563

The vault hands every token (ADR 0550 §3); current names the licence, its key, kind,
generation, health and access expiry, and keeps the account's identity for the agent's
account file. bindings takes an optional consumer, answered unpaged.

Builds: design 39 bus-and-switch §18, B7, B10, B19

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-7: every grant and access token lives in the vault 5ca3876bea

The manager hands what the vendor answers to licence-put, the grant first and then the
access, at the licence's next generation, and reads a grant with get for one act; it keeps
no token at rest (ADR 0550 §3). The sealing at rest goes; opening stays for the carry-over.

Builds: design 39 bus-and-switch §15, §16, §20, §45, B15

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-3: licences and bindings kept in the bus's own storage 15094d6e72

The state licences holds one key per licence by its key form, never a secret, with its
latest reading beside it; the state bindings, the same local name the consumers read,
holds each consumer's licence, kind, generation, since, why and by, written by the store
itself. Each consumer counts its own generations, past what its node reported.

Builds: design 39 bus-and-switch §2, §3, B11, B22

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-4: leases and offered grants kept in the bus's own storage 9770dab09e

A lease is a key created with a two-minute lifetime, which fails while another holds it:
the bus's own compare-and-set keeps one rotation source (ADR 0183 §6). An offered grant's
outcome is kept under its fingerprint in the key form for 90 days, every outcome kept.

Builds: design 39 bus-and-switch §4, §5, B13

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-5: the usage and audit logs kept in the bus's own storage 2b604e0dad

Every reading is appended under its licence's key with the vendor's answer whole (ADR
0054), and every act under its kind, never rewritten; an act whose audit entry the log
does not take fails and says so. The memory store goes: the tests run the bus store over
a bus kept in memory.

Builds: design 39 bus-and-switch §6, §7, B20

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-6: today's rows carried over once, before the manager does anything else (issue 1409) 9cc62818f4

At its first start the manager reads the six tables of its database, read
only, and writes them into its kept data and its grants into the vault at
generation 1, then carried.postgres; until then only its read verbs answer.
A second start never opens the database, and a stopped run is done again
whole without doubling a log entry. The store's write code and its postgres
test go: nothing writes the database again.

Builds: design 39 bus-and-switch §1, §8, §11, §12, §13, A3, B14

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-9: every change of a binding is said as binding.changed (issue 1409) 3991211993

Bind, switch, release, a login's move and a rotation's advance each say one
binding.changed per consumer moved, with the licence's key, after the key of
bindings is written or deleted; a switch through the verbs says one
licence.switched with the from, to, consumers, by and why the audit's
switched entry also holds. licence.bound, released and rotated are said no
more. An adoption advances the consumers already bound before it moves the
login's nodes, so each is said once.

Builds: design 39 bus-and-switch §21, §27 (the verb's switch), §36, B7, B16

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-8: the bindings verb answers each licence's key (issue 1409) b63e8ae58a

Each binding the verb bindings answers carries its licence's key beside the
§3 fields, as binding.changed does, so the vault's first view matches a
token's secret name to the binding without the key form of its own.

Builds: design 39 bus-and-switch §17, B10, B25 (hq 128236e7 and after, PR #561)

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

V-2: the vault keeps the licence bindings from binding.changed and a first view (issue 1409) 256a412590

The vault consumes the licence manager's binding.changed and, at its start,
asks the seat's bindings until it answers; it keeps each consumer's licence,
the licence's key and the generation in its own state licence-bindings,
never an older generation, deleting a released consumer's key. The state is
in the vault's old state section, and holds no secret.

Builds: design 39 bus-and-switch §17, B2, B9, B10, B22, B25

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

V-3: a licence's token goes only to a machine a binding names (issue 1409) 110c631b5f

The vault's get judges a licence's secret by a rule of its own, before the
asker rule: a grant goes to any proven caller, and an access token to a
machine on which a consumer's binding in licence-bindings names that
licence's key; a refusal names the rule and is recorded.

Builds: design 39 bus-and-switch §16, §17, A1, B3, B8, B25

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

C-2: a node follows its licence binding by binding.changed and a first view (issue 1409) 6eccfc286a

The agent module consumes the manager's binding.changed, acting only on the
one naming its node's consumer, and each time it hears those events anew asks
the seat's bindings for its own consumer as its first view; its read of the
manager's bindings state goes.

Builds: design 39 bus-and-switch §22, B9, B10, B22

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

C-3: a node takes its licence token from the vault (issue 1409) 31ce47d1cc

The agent module asks the seat's current which licence it holds and its key,
then the vault's get for that licence's access secret sealed to its own key:
at its start, on a binding.changed with a newer generation than it applied,
and on the vault's secret-changed for the licence it holds. The applied
binding keeps the licence's key, so the vault's event is matched by the
carried key, never one formed here.

Builds: design 39 bus-and-switch §19, §18, B7, B9, B11

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-10: the manager hears what each node holds as holdings-changed (issue 1409) bd65b023bd

The manager consumes the agent module's holdings-changed, keeping each report
as its node's latest and considering them at once, in place of reading the
agent module's state; once it hears them, at every start after its
carry-over, it says holdings.asked with its time and who asks, so every node
says what it holds again.

Builds: design 39 bus-and-switch §23, §46, B12, B22

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-11: each reading keeps its three reset times, and a licence's room (issue 1409) 6cf98386e9

The usage reading flattens the session, weekly and sonnet windows each with
its reset time, keeps it beside the licence with when it was read, and says
it as usage.read; a failed answer keeps the last percentages and writes the
vendor's status and reason. A licence's room is 100 less the higher of its
session and weekly windows, known only for a subscription read within
usage_stale_minutes whose refresh is healthy; an API key's is never known.

Builds: design 39 bus-and-switch §24, §25, §48, §2

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-12: the switch's settings, read again at every reading (issue 1409) 954e3afe56

The settings gain switch_auto, switch_at_pct, room_below_pct, warn_at_pct,
usage_minutes and usage_stale_minutes with the manifest's defaults and
bounds, a value outside its bound keeping the default. The settings file is
read again at every reading, each changed value written in the audit under
settings, and the usage timer follows usage_minutes. A room or warning above
switch_at_pct is found as an invalid pair naming both values.

Builds: design 39 bus-and-switch §33, §24

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-13: a licence at its threshold moves every consumer, in one act (issue 1409) 4e10ab7b2e

After each reading of a licence with consumers whose session or weekly
window is at or above switch_at_pct, the manager moves every consumer bound
to it, when switch_auto is on and the settings are valid, to the other
licence with known room whose windows are both below room_below_pct and the
most room, the first by name on a tie. Each consumer moves as the switch verb
does, by usage, and says binding.changed; the act says one licence.switched
and one audit entry switched with the window, its percentage and reset and
the target's room, and is told to the operator; the switch verb is not told.
By hand the rule runs with switch_auto off, and dry answers the moves alone.

Builds: design 39 bus-and-switch §26, §27, §28, §32, §33, B22

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-14: the manager's conditions, kept in its state and said on the operator channel (issue 1409) 9e545658a5

Each condition the manager holds is written in its state conditions with its
body and since, then said on the operator channel's condition accept under
claude-licence-manager, scope module; it is said again only when its words
change, and said cleared, its key deleted, once it no longer holds. At its
start, after the carry-over's run, it judges every kind anew: raised again
each it holds, cleared each kept key it no longer holds. The kinds:
carry-over-failed, settings.<setting>.invalid for a pair above
switch_at_pct and for a setting outside its bound, and per licence no-room
when the rule finds no target, near-limit at warn_at_pct with consumers, and
usage-unread once its latest success, or its adoption when none, is older
than usage_stale_minutes. Headlines name counts and short names, cut at 60.

Builds: design 39 bus-and-switch §9, §11, §29, §30, §31, §33, B17, B34, B36, B37, B38, B39

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-15: the manager's tools read all it keeps and start by hand all it does (issue 1409) baaf2e56dd

The licences verb answers each licence's organisation, latest usage with its
reset times, its room or why it is not known, whether it is where a full
licence's consumers move next, when and from where it was adopted and its open
conditions. The usage verb takes since, a limit of at most 2000 and raw. The
module's tools: licences_switches from the audit, licences_read_usage and
licences_switch_now with dry, licences_settings with the level mesh-config
answers (the manifest invokes its config verb), licences_kept over every
bus-state entry with its fill, licences_resync, licences_conditions and
licences_carried with its run, refused once carried. An acting tool waits for
the carry-over.

Builds: design 39 bus-and-switch §34, §35, §37, §38, §39, §40, §41, §42, §43, §44, §47, §20, §11, B9, B18, B40

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-16: the manager whole on a real bus and today's database on a real postgres (issue 1409) b8ce072c9f

The built binary played as its runtime plays it, its kept data in a real
nats-server's buckets and streams, today's rows in a real postgres: a start
stopped at a table says carry-over-failed and acts on nothing, the next
carries every row and a further one writes nothing; an unreachable database
calls no vendor; a reading at the threshold moves four consumers in one act
and no-room is raised and cleared on the operator channel's subject, read
through its client; a new login is adopted, listed and a target.

Builds: design 39 bus-and-switch §9, §11, §12, §13, §23, §26, §28, §29, §46, B41

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-17: the manager's README says what it keeps on the bus and how it switches (issue 1409) a8131809b2

Builds: design 39 bus-and-switch §52, §1 to §13, §21, §23 to §46

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

C-4: the agent module's README says it follows its binding by event and takes its token from the vault (issue 1409) 3b92e02862

Builds: design 39 bus-and-switch §52, §19, §22, §23, B33

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

V-4: the vault's first-view tools cover the licence bindings, and its README says the licence secrets (issue 1409) 9cf5c1ddbd

vault_first_views lists the licence bindings' first view beside the
assignments'; vault_first_view_again asks the one its new argument `of`
names, and both when it is absent.

Builds: design 39 bus-and-switch §52, §15 to §17, B21, B42

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

V-3 fix: no access token before the first view is answered, and a first view keeps a newer event's key (issue 1409) 36d9d73984

Review round 1, finding 1, and the lead's answer B43. Until the vault's first
view of the licence bindings is answered since its start, licence-put's
access token is refused, saying why. A first view removes a consumer's key it
does not name only when that key was written before the view was asked. The
newer generation's binding staying over a first view (B32) was built in V-2's
keep and is named here.

Builds: design 39 bus-and-switch §17, B31, B32, B43

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-6 fix: each carried binding is said as binding.changed (issue 1409) 6a57bb7218

Review round 1, finding 2: a reader's first view taken while the carry-over
runs is brought up to date by the event said after each key is written.

Builds: design 39 bus-and-switch §12, §21

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-3 fix: an adopted licence says where it came from, and a newer login keeps its reading (issue 1409) cc8a354f75

Review round 1, finding 3: adoptedFrom is the node a login came from, or
where an API key came from; a newer login of the same account keeps the
latest reading and generation the key holds.

Builds: design 39 bus-and-switch §2, §34, §46

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-15 fix: resync hands the vault each access token built from its grant (issue 1409) b8e8be619d

Review round 1, finding 4: the vault hands a licence's access token only to
a machine a binding names, so licences_resync builds it from the grant (the
key itself for an API key) instead of reading it back.

Builds: design 39 bus-and-switch §15, §17, §42, B23, B24

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-11 fix: a reading takes its licence's lease, and a grant the vault does not answer is a failed reading (issue 1409) c8e321c8e1

Review round 1, finding 5: the reading reads the grant under the licence's
lease (another run holding it reads nothing that round), and a grant the
vault refuses writes readError, keeps the percentages and goes on to the
next licence, so the conditions are still said after the round.

Review round 1, finding 6: these answers were built by earlier commits that
did not name them: B26, B27, B28 and B29 by M-6 (9cc62818), B30 by M-9
(39912119), B35 by M-11 (6cf98386); B23 and B24 by V-1 (e85cf002) and M-7
(5ca3876b), named again in b8e8be61; B31 and B32 in 36d9d739.

Builds: design 39 bus-and-switch §4, §16, §24, §31, B23, B24, B26, B27, B28, B29, B30, B34, B35

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

M-6 fix: the carry-over carries each live lease with its remaining lifetime (issue 1409)

mesh/delivery-group group feat/39-licence-switch merged: every member is merged

Details

mesh/check checking dbcba161d57c on d9f2b7bcfa07

mesh/delivery merged: source.main moved to novox/mesh-catalog@d9f2b7bcfa07

Details

dbcba161d5

The lead's answer B44: a lease the bundle before held in today's database
and still live at the run is written to `leases` under the bus's key form
with what is left of its lifetime, so no refresh races it whatever the
delivery's order; an expired one is counted read and not written.

Builds: design 39 bus-and-switch §4, §12, B44

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

mesh-tools commented

2026-11-12 00:12:07 +00:00

Delivery novox/mesh-catalog@dbcba161d57c — merged since 2026-11-12T00:13:06Z

Source — source.main moved to novox/mesh-catalog@d9f2b7bcfa. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group feat/39-licence-switch: novox/mesh-catalog@dbcba161d5, novox/mesh-contracts@3eba6b8299

Transitions

2026-11-12 00:12 (new) → proposed (announced): novox/mesh-catalog#657's head announced
2026-11-12 00:12 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-12 00:13 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@dbcba161d57c` — **merged** since 2026-11-12T00:13:06Z **Source** — source.main moved to novox/mesh-catalog@d9f2b7bcfa07. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `feat/39-licence-switch`: novox/mesh-catalog@dbcba161d57c, novox/mesh-contracts@3eba6b8299e0 **Transitions** - 2026-11-12 00:12 (new) → proposed (announced): novox/mesh-catalog#657's head announced - 2026-11-12 00:12 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-12 00:13 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit d9f2b7bcfa into main

2026-11-12 00:13:05 +00:00

mesh-tools deleted branch feat/39-licence-switch

2026-11-12 00:13:05 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#657