Files

T

jschoubben 0bfc72d230 Make the controller checks strict: nothing names the placed-nowhere controller

controllerdeps refuses any manifest naming the controller's seat, states or
buckets, the lease and the entries once kept to its write among them, and
any module file naming one of its buckets (ADR 0590 §5). The words check
refuses a controller address in any text a module shows. The handacts check
and noplacement's list of assignments readers are folded into it (issue 1126 B10).

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

2026-11-02 12:29:56 +01:00

cmd/mesh-hand-acts

Make the controller checks strict: nothing names the placed-nowhere controller

2026-11-02 12:29:56 +01:00

.gitignore

Design 47's last milestones: the keeper, self-check, healers, hand-acts, provisioner, vault, artifact sweep, disk readings, credential forms (issues 774, 1952, 1953, 1954, 1955)

2026-10-30 02:21:51 +01:00

go.mod

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

go.sum

Pin mesh-sdk at c21d8fd, the removal group's head, so every member builds the same contract (issue 774)

2026-11-02 00:53:42 +01:00

module.json

mesh-hand-acts and mesh-healers stop reading the controller's hand-act log (ADR 0571 §13)

2026-11-02 00:17:52 +01:00

README.md

Make the controller checks strict: nothing names the placed-nowhere controller

2026-11-02 12:29:56 +01:00

README.md

mesh-hand-acts

Holds the seat mesh-hand-acts (novox/hq ADR 0565 §10, §11): the hand-act log, moved out of the controller. Go, one binary (cmd/mesh-hand-acts), served by a runtime of its own on its own bus account (runs-as), so that its account alone writes the log.

What it keeps

the log acts (the stream LOG_mesh-hand-acts_acts, a module log of ADR 0297, as ADR 0565 §10 has it a stream): every act appended in its order under its key act-<ns>-<n> (warrant-<asker>-<ask> for a warrant), in the layout of the controller's log. The log keeps each act 400 days (max-age-days) and refuses a new act when full rather than drop one; hand-acts says how full it is against its cap. Each act is said as act-recorded.
mesh-hand-acts_warrants: one key <asker>.<ask> per warrant, made once by create before its act is appended, so of several instances one records it; a warrant whose act was lost is written again from the router's record.

Its verbs

mesh-hand-acts.hand-act: what, why, cause, the condition addressed, and the act's verb (a repair when not given; hand-act drill for a drill, whose cause is always drill). Who did it is the caller the runtime proves.
mesh-hand-acts.warranted: asker and ask. Read from the router's own record of that ask (messenger.asks), never from the caller, and recorded once per ask; an ask still open, ended without a choice or another asker's is refused.
mesh-hand-acts.hand-acts: this log (the controller's acts were copied into it once), newest first, with the causes repaired by hand twice within a fortnight; warrants=true lists the warrants.
hand_acts_copied and hand_acts_copy (research 072 row 26): the controller's hand acts are copied once into this seat's log, each with its own key, time and author. It runs at the module's start while the old bucket is readable and no marker (copied, key controller-hand-acts) says it was done, and by the tool; an act already in the log is never appended again, and hand-acts counts a copied act once. hand_acts_copied says whether, when and how many. The lease write has no hook to run it from, so the start is the trigger; hand_acts_copy with top_up=true, asked after the lease write, appends any act the controller wrote since the copy (a finished copy is otherwise a no-op).

No act is written to both logs: every recorder calls this seat from its delivery, and the controller keeps its own acts in its own bucket until it loses its lease.