The licence manager runs as its own account, so its own logs are issued to it and its carry-over can finish (issue 1409) #659

2026-11-12T08:39:19Z

mesh-tools commented

2026-11-12 08:39:19 +00:00

Issue 1409; design 39 bus-and-switch C1 and C2 (hq PR #571). The operator, 2026-11-12: "the licence manager module should have a service part and a tools part".

Live symptom: run inside novox's tool runner, the delivered manager (#657) was issued none of its logs (usage, audit), so its carry-over cannot finish; condition carry-over-failed since 01:08 UTC; no token refreshed.

C1: runs-as claude-licence-manager with its own account (user resource, owners, own-secrets broker, secrets-owner), as the vault and the mail reader; invokes gains claude-code.claude_code_grant; its runtime runs the service and serves the tools.
C2: a key pair the manager cannot read (left by the tool runner's account) is made anew, written beside and renamed over, said in its journal.

Tests: 72 unit (was 70), 4 whole tests on an embedded bus; each new test failed first. 33 repository checks pass; the judge accepts the manifest (local re-creation).

Reviewed-by: mesh-code-reviewer@shanks at 8291502cbb (round 2 of 3, approved)
Pushed-by: fix-1965@shanks

https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

Issue 1409; design 39 bus-and-switch C1 and C2 (hq PR #571). The operator, 2026-11-12: "the licence manager module should have a service part and a tools part". Live symptom: run inside novox's tool runner, the delivered manager (#657) was issued none of its logs (`usage`, `audit`), so its carry-over cannot finish; condition carry-over-failed since 01:08 UTC; no token refreshed. - C1: `runs-as claude-licence-manager` with its own account (user resource, owners, own-secrets broker, secrets-owner), as the vault and the mail reader; `invokes` gains `claude-code.claude_code_grant`; its runtime runs the service and serves the tools. - C2: a key pair the manager cannot read (left by the tool runner's account) is made anew, written beside and renamed over, said in its journal. Tests: 72 unit (was 70), 4 whole tests on an embedded bus; each new test failed first. 33 repository checks pass; the judge accepts the manifest (local re-creation). Reviewed-by: mesh-code-reviewer@shanks at 8291502cbbafe6460ca0ce865ad512f2a09949ef (round 2 of 3, approved) Pushed-by: fix-1965@shanks https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

mesh-tools added 2 commits 2026-11-12 08:39:19 +00:00

C1: the licence manager runs as its own account, its service and its tools in its own runtime (issue 1409) 8d2497b65e

Run inside the machine's tool runner, the manager was issued none of its own logs and states, so the carry-over
failed live ("keeps no log called usage ... it was issued: none"). It now declares runs-as claude-licence-manager,
makes that account, owns what it places on its machine and its secrets, reaches the bus with its own broker secret,
and invokes a node's claude_code_grant, which the tool runner's account could ask and its own could not.

The whole tests play the manager's own runtime: they issue only the states, logs, asks and events its manifest
names, and fail on a manifest without runs-as; a unit test holds every ask in the code to the manifest's invokes.

Builds: design 39 bus-and-switch C1

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

C2: a key pair the manager cannot read is made anew in its place (issue 1409)

mesh/delivery merged: source.main moved to novox/mesh-catalog@6181d9afb3e5

Details

mesh/check checking 8291502cbbaf on 6181d9afb3e5

8291502cbb

Moved to its own account, the manager finds manager-key.json still owned by the tool runner's account, which the
node-engine does not hand over; it skipped making a pair because the file existed, and every verb answered the read
error. Now a pair it cannot read is replaced by a new one, renamed over it, and said in its journal; every use passes
the public key per ask, so nothing depends on the old pair.

Builds: design 39 bus-and-switch C2

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

mesh-tools commented

2026-11-12 08:39:24 +00:00

Delivery novox/mesh-catalog@8291502cbbaf — merged since 2026-11-12T08:41:51Z

Source — source.main moved to novox/mesh-catalog@6181d9afb3. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-11-12 08:39 (new) → proposed (announced): novox/mesh-catalog#659's head announced
2026-11-12 08:39 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-12 08:41 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@8291502cbbaf` — **merged** since 2026-11-12T08:41:51Z **Source** — source.main moved to novox/mesh-catalog@6181d9afb3e5. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-11-12 08:39 (new) → proposed (announced): novox/mesh-catalog#659's head announced - 2026-11-12 08:39 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-12 08:41 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 6181d9afb3 into main

2026-11-12 08:41:49 +00:00

mesh-tools deleted branch fix/1409-own-runtime

2026-11-12 08:41:50 +00:00

jschoubben referenced this issue from a commit

2026-11-12 09:26:45 +00:00

C3: the manager's two logs in the logs section the runtime issues (issue 1409)

mesh-tools referenced this pull request

2026-11-12 09:26:51 +00:00

The licence manager declares its logs in the logs section, so they are issued and its carry-over can finish (issue 1409) #660

Sign in to join this conversation.