3 Commits

Include renames

Author	SHA1	Message	Date
jochen	f75cd0239d	Hear a restricted stream only from a module's own account, never the tool runner's (issue 727) ... The tool runner's bus account carried the heard grants, consumer and bind word of every module it runs, and every agent session on that machine reaches the bus as that account, so any session could pull a granted module's consumer on MAIL. Per ADR 0376 §1 the controller now composes a restricted stream's consumer, grants and bind word only for a module that declares runs-as; registration refuses a consumes of a restricted stream without runs-as (§2), and a grant that composes nothing is said in doctor (D-heard) and in the controller's log on every raise and send.	2026-10-15 14:11:37 +02:00
jochen	743e6478a7	Remove a restricted stream's consumer when the bus refuses to narrow it, so its wider filters deliver nothing more (ADR 0363 §6, review of PR 338)	2026-10-14 22:05:47 +02:00
jochen	ee13e75bf3	Let a module declare a stream of its own and restrict who hears it by a trusted config value (hq issue 718, ADR 0363) ... mesh-mail's events must live on a stream of their own and reach only the modules the operator granted an account (ADR 0359 §2, §4). The controller now creates a module's declared stream, publishes its events on mesh.stream.<module>.event.<event>, and composes a consumer's durable consumer, filters and bus grants on a restricted stream only where its consumes asks and the provider's trusted value names it; a consumer that loses its grant has its consumer removed on the next assertion. Nothing changes while no manifest declares a stream.	2026-10-14 21:52:45 +02:00