5 Commits

Include renames

Author	SHA1	Message	Date
jochen	d03e24f423	Age a restricted stream's dead letters out with it and never show their body (issue 728) ... DEAD_LETTERS kept a message given up on MAIL forever and showed it whole to any caller of dead-letters, outside the grant and past MAIL's week. Per ADR 0376 §3-§6: the kept copy carries a per-message time to live of what is left of its stream's age (a copy already past it is kept without its body), DEAD_LETTERS and EVENTS allow per-message TTL, the list and show give no body or own headers for it, delivering it again needs a minute left and the copy keeps the time left, and its max-deliveries condition clears saying how many aged out undelivered and from which stream.	2026-10-15 14:11:37 +02:00
jochen	f75cd0239d	Hear a restricted stream only from a module's own account, never the tool runner's (issue 727) ... The tool runner's bus account carried the heard grants, consumer and bind word of every module it runs, and every agent session on that machine reaches the bus as that account, so any session could pull a granted module's consumer on MAIL. Per ADR 0376 §1 the controller now composes a restricted stream's consumer, grants and bind word only for a module that declares runs-as; registration refuses a consumes of a restricted stream without runs-as (§2), and a grant that composes nothing is said in doctor (D-heard) and in the controller's log on every raise and send.	2026-10-15 14:11:37 +02:00
jochen	743e6478a7	Remove a restricted stream's consumer when the bus refuses to narrow it, so its wider filters deliver nothing more (ADR 0363 §6, review of PR 338)	2026-10-14 22:05:47 +02:00
jochen	ede2772b3c	Deliver a module stream's given-up message again only while its consumer is still granted it (ADR 0363 §7)	2026-10-14 21:55:55 +02:00
jochen	ee13e75bf3	Let a module declare a stream of its own and restrict who hears it by a trusted config value (hq issue 718, ADR 0363) ... mesh-mail's events must live on a stream of their own and reach only the modules the operator granted an account (ADR 0359 §2, §4). The controller now creates a module's declared stream, publishes its events on mesh.stream.<module>.event.<event>, and composes a consumer's durable consumer, filters and bus grants on a restricted stream only where its consumes asks and the provider's trusted value names it; a consumer that loses its grant has its consumer removed on the next assertion. Nothing changes while no manifest declares a stream.	2026-10-14 21:52:45 +02:00