The controller may ask any module's tool

The control plane is the way in for tool calls (novox/hq ADR 0095): a person or an agent asks through it, so it alone may publish to every module's tool subject. The first ask on the new bus was refused the publish.
Merge pull request 'A module serves every tool under its own name, and may answer' (#116 ) from fix/a-module-serves-its-own-namespace into main
2026-09-28 04:21:25 +02:00 · 2026-09-28 02:14:52 +00:00 · 2026-09-28 02:05:35 +00:00 · 2026-09-28 04:05:32 +02:00
3 changed files with 12 additions and 3 deletions
@@ -127,9 +127,13 @@ func readinessOf(ctx context.Context, inv *inventory.Inventory) (broker.Readines
 	if address != "" {
 		// One dial, briefly. "Is it answering" is the one fact records cannot hold, and a mesh about
 		// to move onto a server that is not there should hear it here rather than afterwards.
-		if conn, err := nats.Connect(broker.BareAddress(address), nats.Timeout(5*time.Second)); err == nil {
+		//
+		// **Dialled the way the mesh dials it** — credential and pin — because a bare connect to a
+		// bus that requires TLS and a user fails at the handshake, and the check then reported a
+		// standing server as absent (seen live, 2026-09-28).
+		if js, err := broker.Dial(address, nats.Timeout(5*time.Second)); err == nil {
 			state.ServerStanding = true
-			conn.Close()
+			js.Close()
 		}
 	}

@@ -181,6 +181,11 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		for _, seat := range meshSeatsTheControllerUses {
 			pub = append(pub, "mesh.seat."+seat+".accept.>")
 		}
+		// Every module's tools: **the control plane is the way in** (novox/hq ADR 0095). A person
+		// or an agent asks through it and every question passes one process where an audit
+		// belongs — so it, alone among principals, may call any tool by name. The first `ask` on
+		// the new bus was refused the publish (2026-09-28).
+		pub = append(pub, "mesh.mod.*.tool.>")

 		// The two events it reacts to, and its ack subject on the stream they arrive from
 		// (streams.go). **Each named, not a pattern**: `mesh.mod.*.event.>` would make the
@@ -24,7 +24,7 @@ accounts {
    jetstream: enabled
    users = [
      { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: {
-        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "_INBOX.enrol.>", "mesh.control.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>"] }
+        publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "_INBOX.enrol.>", "mesh.control.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>"] }
        subscribe: { allow: ["$JS.API.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.gitea.event.pull.merged", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built"] }
        allow_responses: { max: 1, ttl: "1m" }
      } }
Author	SHA1	Message	Date
jschoubben	0baf727f36	The controller may ask any module's tool The control plane is the way in for tool calls (novox/hq ADR 0095): a person or an agent asks through it, so it alone may publish to every module's tool subject. The first ask on the new bus was refused the publish.	2026-09-28 04:21:25 +02:00
mesh-admin	94dd49a968	Merge pull request 'A module serves every tool under its own name, and may answer' (#116 ) from fix/a-module-serves-its-own-namespace into main	2026-09-28 02:14:52 +00:00
mesh-admin	220b79f5cd	Merge pull request 'rollout check dials the bus the way the mesh does' (#115 ) from fix/the-check-dials-as-the-mesh-does into main	2026-09-28 02:05:35 +00:00
jschoubben	e62201e227	rollout check dials the bus the way the mesh does The probe connected bare, and a bus that requires TLS and a user refused it at the handshake — so the check reported the standing server as absent. It now dials with the controller's own credential and pin, which is the one fact the check is there to report.	2026-09-28 04:05:32 +02:00