A tool's grant covers the machine-addressed subject, and a credential names the seats its module claims (hq ADR 0159)

`invokes: [<module>.<tool>]` now grants `mesh.mod.<module>.tool.<tool>` and the same with the
machine as its last token, which is how a call reaches one machine's instance. The broker
credential the mesh writes carries `claims`: each seat the module claims, its scope, and the verbs
the seat promises, so the runtime serves them on the seat's subjects; the holder's grant, composed
from the holding, is what admits the subscription.

cmd/mesh-controller/modules.go

@@ -584,16 +584,25 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 // (`rollout mint`, design 28 task 5.2) rather than the one in this process's environment.
 func issueWith(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest,
 	node, busAddress string, known broker.Broker, reachable, user, password string) error {
+	// The seats this module claims, with the verbs each promises (novox/hq ADR 0159): the runtime
+	// serves a claimed seat's verbs with its tools of the same name, and the bus admits only the
+	// holder's subscription — so the runtime tries each claim and the grant decides. Written here
+	// because this file is the one thing the mesh writes that the runtime reads before it speaks.
+	claims, err := claimsFor(ctx, inv, m)
+	if err != nil {
+		return err
+	}
 	held, err := json.Marshal(struct {
-		URL         string `json:"url"`
-		Fingerprint string `json:"fingerprint,omitempty"`
-		Node        string `json:"node"`
-		Module      string `json:"module"`
-		User        string `json:"user"`
-		Password    string `json:"password"`
+		URL         string       `json:"url"`
+		Fingerprint string       `json:"fingerprint,omitempty"`
+		Node        string       `json:"node"`
+		Module      string       `json:"module"`
+		User        string       `json:"user"`
+		Password    string       `json:"password"`
+		Claims      []seatClaimed `json:"claims,omitempty"`
 	}{
 		URL: "nats://" + reachable, Fingerprint: known.Fingerprint,
-		Node: node, Module: m.Module, User: user, Password: password,
+		Node: node, Module: m.Module, User: user, Password: password, Claims: claims,
 	})
 	if err != nil {
 		return err
@@ -680,3 +689,36 @@ func namesNoInstallation(m catalogue.Manifest) error {
 		"on purpose under %s with its reason, or take it out:\n  - %s",
 		m.Module, catalogue.NamesOnPurpose, strings.Join(named, "\n  - "))
 }
+
+// seatClaimed is one seat a module claims, as its runtime needs it: the name, the scope (a
+// node-scoped seat's verb carries the machine, design 33 §4) and the verbs the seat promises.
+type seatClaimed struct {
+	Seat   string   `json:"seat"`
+	Scope  string   `json:"scope"`
+	Serves []string `json:"serves,omitempty"`
+}
+
+// claimsFor joins a module's claims with the seats' protocols from the mesh's records.
+func claimsFor(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest) ([]seatClaimed, error) {
+	if len(m.Claims) == 0 {
+		return nil, nil
+	}
+	seats, err := inv.Seats(ctx)
+	if err != nil {
+		return nil, err
+	}
+	byName := map[string]catalogue.Seat{}
+	for _, s := range seats {
+		byName[s.Name] = s
+	}
+	var out []seatClaimed
+	for _, c := range m.Claims {
+		claimed := seatClaimed{Seat: c.Name, Scope: c.At()}
+		if s, known := byName[c.Name]; known {
+			claimed.Scope = s.Scope
+			claimed.Serves = catalogue.VerbNames(s.Serves)
+		}
+		out = append(out, claimed)
+	}
+	return out, nil
+}