A person may be issued, listed and revoked

Design 25 §7's first item, which existed as a permission model and as nothing a person could actually be given. There is a record now, and three commands. Their authority is a list of tools and nothing else. Not a module: they hold no seat, nothing is addressed to them, nothing is delivered to them, and they have no consumer to acknowledge. What they have is permission to ask — which is why there is no scope and no node in the record. Stating what somebody may call replaces what was there rather than adding to it: a list that could only grow is a permission nobody can take back. Forgetting somebody takes their credential with them, because a person's row gone with their bus user left behind is a credential that still works and that nothing derives — the worst of both, since it keeps working and nobody can explain why. The credential is printed once and the mesh keeps only a hash, the same contract a token has. And it starts working at the next composition rather than immediately, because the bus's users are a file — said out loud in both the issue and the revoke messages, since "revoked" that still works for another minute is worth knowing about. Four properties held by test, each a way of being wrong that would not announce itself: a person may publish exactly the tool subjects they were given and nothing on control, nodes or events; they cannot answer a request; changing the list removes what is no longer named; and forgetting them revokes them.
2026-09-27 17:07:19 +02:00
parent 8e2824201a
commit 53e8f5bdd8
5 changed files with 355 additions and 3 deletions
@@ -0,0 +1,19 @@
+-- A person who may call the mesh's tools from a workstation.
+--
+-- novox/hq design 25 §7. Everything else that reaches the bus is a machine or a module running on
+-- one; this is the exception the mesh has always had informally — somebody at a terminal — and never
+-- recorded. Until now "the operator" meant whoever held the keys, which is a role and not a record,
+-- so nothing could say who may call what.
+--
+-- **The authority is a list of tools and nothing else.** A person is not a module: they hold no seat,
+-- nothing is addressed to them, nothing is delivered to them, and they have no consumer to
+-- acknowledge. What they have is permission to ask. That is why there is no scope column and no node
+-- column — a person is not on a machine.
+create table person (
+    name    text        primary key,
+    -- The tools this person may invoke, each `<module>.<tool>`, or the single entry `*` for an
+    -- administrator. Stored as given: the permission is derived from it at every composition, so a
+    -- normalised form here would be a second opinion about authority (novox/hq ADR 0043).
+    invokes text[]      not null default '{}',
+    created timestamptz not null default now()
+);