Serve a trusted holder from a runtime of its own account, refuse it in the machine's runtime, and say while an agent can become root where it runs (hq ADR 0259 §8)

internal/broker/membership.go

@@ -172,7 +172,7 @@ func PlacementsOf(r Records, interchangeable map[string]bool) Placements {
 			for _, s := range d.Holds {
 				if s.Kinded && s.Kind != "" {
 					p.Kinds = append(p.Kinds, KindHeld{Seat: s.Name, Kind: s.Kind, Module: d.Module, Node: node,
-						Capabilities: s.Capabilities})
+						Capabilities: placedCapabilities(s.Capabilities, d.RunsAs)})
 				}
 			}
 		}
@@ -190,6 +190,20 @@ func PlacementsOf(r Records, interchangeable map[string]bool) Placements {
 	return p
 }
 
+// placedCapabilities is what a kind's claim promises, as far as its placement lets the router believe it
+// (novox/hq ADR 0259 §8): `verified-sender` only from a holder that runs as an account of its own, on a bus
+// account of its own — never one the machine's runtime carries as the operator's account.
+func placedCapabilities(declared []string, runsAs string) []string {
+	var out []string
+	for _, c := range declared {
+		if c == "verified-sender" && runsAs == "" {
+			continue
+		}
+		out = append(out, c)
+	}
+	return out
+}
+
 func kindListed(list []KindHeld, k KindHeld) bool {
 	for _, x := range list {
 		if x.Seat == k.Seat && x.Kind == k.Kind && x.Module == k.Module && x.Node == k.Node {

internal/broker/nats.go

@@ -77,6 +77,9 @@ type Seat struct {
 	Records []string
 	// Capabilities are what this principal's claim of a kinded bench promises (ADR 0234 §2).
 	Capabilities []string
+	// DeclaredBy is the module that declares the seat. On a kinded bench it alone submits work to a kind
+	// and answers its proofs (novox/hq ADR 0259 §8): the router, not any user or watcher of the bench.
+	DeclaredBy string
 }
 
 // A Principal is one user of the bus. Its permissions are derived from what it declares and
@@ -710,6 +713,16 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			pub = append(pub, stateGrants(stateAccess{Module: d.Module, Node: p.Node, Keeps: stateNames(d.State),
 				PerMachine: perMachineNames(d.State), Reads: d.Reads, KeyedReads: d.KeyedReads})...)
 		}
+		// **Never the traffic of a trusted holder** (novox/hq ADR 0259 §8): the machine's runtime runs as the
+		// operator's account, which every agent runs as, so a module saying warrants or speaking for a kind
+		// that proves its sender is never composed into it — refused here, naming it, whatever registration
+		// let through.
+		for _, d := range p.Carries {
+			if why := trustedTraffic(d); why != "" {
+				return Permissions{}, fmt.Errorf("%s on %s is carried by the machine's runtime, and %s: it runs "+
+					"as an account of its own, never the runtime's (novox/hq ADR 0259)", d.Module, p.Node, why)
+			}
+		}
 		// **And the seat traffic of the modules it carries** (novox/hq ADR 0259 §3): a bundle reaches the
 		// bus only through its runtime, so the runtime is granted the union. That one module's code does
 		// not publish under another's name or kind through it is the runtime's to keep, from the seat

internal/broker/seattraffic.go

@@ -137,7 +137,8 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 			switch {
 			case namesVerb(s.ByCaller, a):
 				t.Publish = append(t.Publish, seatSubject(s, "accept", a+"."+module))
-			case s.Kinded:
+			case s.Kinded && module == s.DeclaredBy:
+				// Work for a kind is put on its queue by the bench's own router, and by no other user.
 				t.Publish = append(t.Publish, seatSubject(s, "accept", a+".*"))
 			}
 		}
@@ -158,8 +159,11 @@ func SeatTrafficOf(module string, holds, uses, watches []Seat) SeatTraffic {
 			for _, e := range w.Emits {
 				t.Subscribe = append(t.Subscribe, seatSubject(w, "event", e+".*"))
 			}
-			for _, v := range w.Proofs {
-				t.Answers = append(t.Answers, seatSubject(w, "proof", v+".*"))
+			if module == w.DeclaredBy {
+				// A code is answered by the bench's own router, and by no other watcher.
+				for _, v := range w.Proofs {
+					t.Answers = append(t.Answers, seatSubject(w, "proof", v+".*"))
+				}
 			}
 		}
 	}
@@ -228,15 +232,16 @@ func SeatTrafficObjects(users []Principal) ([]Stream, []Consumer) {
 				Subjects:  []string{"mesh.seat." + seat + ".accept.>"},
 				Retention: RetentionWorkQueue,
 				MaxAge:    7 * 24 * 60 * 60,
-				Why: "work submitted to the " + seat + " seat; its holders take it, each kind its own, " +
-					"and it queues while nobody does",
+				Why:       "work submitted to the " + seat + " seat; its holders take it, each kind its own, and it queues while nobody does",
 			}
 			consumers[w.Consumer] = Consumer{
 				Name:           w.Consumer,
 				Stream:         w.Stream,
 				Filters:        []string{w.Filter},
 				AckWaitSeconds: 60,
-				MaxDeliver:     5,
+				// No bound on redelivery: a channel away for a day keeps its work, offered again later and
+				// later by its holder's runtime (novox/hq ADR 0259; the correctness review of 2026-10-08).
+				MaxDeliver: 0,
 				Why: module + " holds " + seat + "; it pulls one ask at a time and acknowledges once it has " +
 					"recorded it, so a crash redelivers rather than loses",
 			}
@@ -264,3 +269,37 @@ func SeatTrafficObjects(users []Principal) ([]Stream, []Consumer) {
 	sort.Slice(cs, func(i, j int) bool { return cs[i].Name < cs[j].Name })
 	return ss, cs
 }
+
+// trustedTraffic is why a module's seat traffic is the trusted holder's (novox/hq ADR 0259 §8), or "": it
+// says a seat's event to one caller each (a warrant), or holds a kind of a kinded bench that proves its sender.
+func trustedTraffic(d Declared) string {
+	for _, s := range d.Holds {
+		for _, e := range s.Emits {
+			if namesVerb(s.ByCaller, e) {
+				return "it says " + s.Name + "'s " + e + " to one caller each"
+			}
+		}
+		if s.Kinded && namesVerb(s.Capabilities, "verified-sender") {
+			return "it holds " + s.Name + " of kind " + s.Kind + ", which proves its sender"
+		}
+	}
+	return ""
+}
+
+// TrafficQueues is the work queue of every seat naming its caller or its kind that accepts work, held or not
+// (novox/hq ADR 0259 §3): what is submitted before a holder is assigned waits for it.
+func TrafficQueues(seats []Seat) []Stream {
+	var out []Stream
+	seen := map[string]bool{}
+	for _, s := range seats {
+		if len(s.Accepts) == 0 || !s.isNewTraffic() || seen[s.Name] {
+			continue
+		}
+		seen[s.Name] = true
+		out = append(out, Stream{Name: seatStreamName(s.Name), Subjects: []string{"mesh.seat." + s.Name + ".accept.>"},
+			Retention: RetentionWorkQueue, MaxAge: 7 * 24 * 60 * 60,
+			Why: "work submitted to the " + s.Name + " seat; its holders take it, each kind its own, and it queues while nobody does"})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}

internal/broker/seattraffic_test.go

@@ -13,12 +13,13 @@ func operatorChannel() Seat {
 }
 
 func channelSeat(kind string) Seat {
-	return Seat{Name: "channel", Scope: "mesh", Accepts: []string{"show", "edit", "send"}, Kinded: true, Kind: kind}
+	return Seat{Name: "channel", Scope: "mesh", Accepts: []string{"show", "edit", "send"}, Kinded: true, Kind: kind,
+		DeclaredBy: "messenger"}
 }
 
 func intakeSeat(kind string) Seat {
 	return Seat{Name: "intake", Scope: "mesh", Emits: []string{"choice", "link"}, Proofs: []string{"code"},
-		Kinded: true, Kind: kind}
+		Kinded: true, Kind: kind, DeclaredBy: "messenger"}
 }
 
 func allowed(patterns []string, subject string) bool {
@@ -80,7 +81,7 @@ func TestOnlyTheHolderPublishesAWarrant(t *testing.T) {
 		Nodes: []string{"anchor"},
 		Assigned: map[string][]Declared{"anchor": {
 			{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")},
-				Watches: []Seat{{Name: "intake", Emits: []string{"choice", "link"}, Kinded: true, Proofs: []string{"code"}}}},
+				Watches: []Seat{{Name: "intake", Emits: []string{"choice", "link"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}},
 			{Module: "mesh-delivery", Uses: []Seat{operatorChannel()}},
 			{Module: "telegram", Holds: []Seat{channelSeat("telegram"), intakeSeat("telegram")}},
 		}},
@@ -150,7 +151,7 @@ func TestAKindedHolderReachesItsOwnKindAndNoOther(t *testing.T) {
 func TestTheWatcherAnswersProofsAndHearsEveryKind(t *testing.T) {
 	got := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "messenger",
 		Uses:    []Seat{channelSeat("")},
-		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}}}})
+		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
 	for _, s := range []string{"mesh.seat.intake.event.choice.telegram", "mesh.seat.intake.proof.code.desktop"} {
 		if !allowed(got.Subscribe, s) {
 			t.Errorf("the router does not hear %s", s)
@@ -248,7 +249,7 @@ func TestTheRoutersMembershipNamesEveryKindAndItsCapabilities(t *testing.T) {
 	desk.Capabilities = []string{"choice"}
 	router := Declared{Module: "messenger", Holds: []Seat{operatorChannel()}, Uses: []Seat{channelSeat("")}}
 	records := Records{Nodes: []string{"anchor", "laptop"}, Assigned: map[string][]Declared{
-		"anchor": {router, {Module: "telegram", Holds: []Seat{tg}}},
+		"anchor": {router, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"}},
 		"laptop": {{Module: "desk-channel", Holds: []Seat{desk}}},
 	}}
 	where := PlacementsOf(records, nil)
@@ -270,3 +271,70 @@ func TestTheRoutersMembershipNamesEveryKindAndItsCapabilities(t *testing.T) {
 		t.Error("an asker is told the channels")
 	}
 }
+
+// novox/hq ADR 0259 §8: only the bench's own router answers its proofs and puts work on a kind's queue.
+func TestOnlyTheBenchsRouterAnswersProofsAndSubmitsWork(t *testing.T) {
+	other := perms(t, Principal{Kind: KindModule, Node: "anchor", Module: "eavesdropper",
+		Uses:    []Seat{channelSeat("")},
+		Watches: []Seat{{Name: "intake", Emits: []string{"choice"}, Kinded: true, Proofs: []string{"code"}, DeclaredBy: "messenger"}}})
+	if allowed(other.Subscribe, "mesh.seat.intake.proof.code.telegram") {
+		t.Error("a watcher that is not the router answers codes")
+	}
+	if allowed(other.Publish, "mesh.seat.channel.accept.show.telegram") {
+		t.Error("a user that is not the router puts work on a kind's queue")
+	}
+	if !allowed(other.Subscribe, "mesh.seat.intake.event.choice.telegram") {
+		t.Error("a watcher no longer hears the bench's events")
+	}
+}
+
+// novox/hq ADR 0259 §8: the machine's runtime runs as the operator's account; it never carries a module
+// that says warrants or speaks for a kind proving its sender, and such a module has its own account.
+func TestTheMachinesRuntimeNeverCarriesATrustedHolder(t *testing.T) {
+	tg := channelSeat("telegram")
+	tg.Capabilities = []string{"choice", "verified-sender"}
+	for name, d := range map[string]Declared{
+		"the router":         {Module: "messenger", Holds: []Seat{operatorChannel()}},
+		"a verified channel": {Module: "telegram", Holds: []Seat{tg}},
+	} {
+		if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
+			Carries: []Declared{d}}); err == nil || !strings.Contains(err.Error(), "an account of its own") {
+			t.Errorf("%s was composed into the machine's runtime: %v", name, err)
+		}
+	}
+	desk := channelSeat("desktop")
+	desk.Capabilities = []string{"choice"}
+	if _, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule,
+		Carries: []Declared{{Module: "desk-channel", Holds: []Seat{desk}}}}); err != nil {
+		t.Errorf("a channel proving nothing was refused: %v", err)
+	}
+	users, err := Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {
+		{Module: RuntimeModule}, {Module: "telegram", Holds: []Seat{tg}, RunsAs: "telegram"},
+		{Module: "messenger", Holds: []Seat{operatorChannel()}, RunsAs: "messenger"},
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, u := range users {
+		if u.Kind == KindNodeTools {
+			for _, d := range u.Carries {
+				if d.RunsAs != "" {
+					t.Errorf("the machine's runtime carries %s", d.Module)
+				}
+			}
+			if _, err := PermissionsFor(u); err != nil {
+				t.Errorf("the runtime could not be composed: %v", err)
+			}
+		}
+	}
+}
+
+// novox/hq ADR 0259 §8: verified-sender reaches the router only from a holder of its own account.
+func TestVerifiedSenderIsBelievedOnlyFromAHolderOfItsOwnAccount(t *testing.T) {
+	if got := placedCapabilities([]string{"choice", "verified-sender"}, ""); namesVerb(got, "verified-sender") {
+		t.Errorf("a carried holder keeps verified-sender: %v", got)
+	}
+	if got := placedCapabilities([]string{"choice", "verified-sender"}, "telegram"); !namesVerb(got, "verified-sender") {
+		t.Errorf("a holder of its own account lost verified-sender: %v", got)
+	}
+}

internal/broker/users.go

@@ -50,6 +50,9 @@ type Declared struct {
 	// Checks are the module's own tools its health asks, each `<module>.<tool>` (novox/hq ADR 0240, to-be
 	// 48 §3): the machine's node-engine asks them of its own node tools, and is granted that and no more.
 	Checks []string
+	// RunsAs is the account the module runs as in a runtime of its own (novox/hq ADR 0259 §8): it is never
+	// carried by the machine's runtime, and reaches the bus on its own account.
+	RunsAs string
 }
 
 // Records is what composing a user list needs to know about the mesh, and nothing more.
@@ -120,10 +123,13 @@ func Users(r Records) ([]Principal, error) {
 			})
 		}
 		if runtimeHere {
-			out = append(out, Principal{
-				Kind: KindNodeTools, Node: node, Module: RuntimeModule,
-				Carries: append([]Declared(nil), r.Assigned[node]...),
-			})
+			var carried []Declared
+			for _, d := range r.Assigned[node] {
+				if d.RunsAs == "" {
+					carried = append(carried, d)
+				}
+			}
+			out = append(out, Principal{Kind: KindNodeTools, Node: node, Module: RuntimeModule, Carries: carried})
 		}
 	}
 	for _, node := range sortedCopy(r.Enrolling) {