Merge pull request 'The bus composer grants mesh-grants publishing memberships, nothing more (ADR 0547, the operator's one grant of 2026-10-25 22:31)' (#468) from fix/1945-memberships into main

Reviewed-on: #468

cmd/mesh-controller/addresses_integration_test.go

@@ -111,6 +111,11 @@ func TestTheControlPlaneIsToldWhereTheNodePutTheStoreAndTheBroker(t *testing.T)
 		Kind: inventory.BusController, Node: "anchor", Module: "mesh-controller"}, "bootstrap"); err != nil {
 		t.Fatal(err)
 	}
+	// Seeded with the credential the controller already uses, so it is sealed: an account counts as issued only once
+	// sealed (ADR 0543 §2, PR #467), and genesis's seed is the credential in use.
+	if err := open.inventory.MarkBusAccountSealed(ctx, "anchor.mesh-controller"); err != nil {
+		t.Fatal(err)
+	}
 	if _, err := assign(ctx, open, "anchor", "mesh-controller"); err != nil {
 		t.Fatal(err)
 	}

cmd/mesh-controller/compose_input_credentials_integration_test.go

@@ -217,6 +217,11 @@ func TestTheAdaptersInputCarriesTheOwnSecretsTheBoxesTheLicencesAndTheBus(t *tes
 		Module: "objects"}, "a-password"); err != nil {
 		t.Fatal(err)
 	}
+	// Minted and sealed to its node: an account counts as issued, and is named among the minted, only once sealed
+	// (ADR 0543 §2, PR #467).
+	if err := inv.MarkBusAccountSealed(ctx, "anchor.objects"); err != nil {
+		t.Fatal(err)
+	}
 	if err := inv.PutBusMembership(ctx, "laptop", "sealed-membership"); err != nil {
 		t.Fatal(err)
 	}

internal/broker/membership_test.go

@@ -72,6 +72,17 @@ func TestAnAccountMayReadItsOwnMembershipAndNoOthers(t *testing.T) {
 	has(t, perms.Subscribe, "mesh.assignment.anchor.postgres")
 	has(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.anchor.postgres")
 	hasNot(t, perms.Subscribe, "mesh.assignment.>")
+	hasNot(t, perms.Publish, "mesh.assignment.*.*")
+	// The grants part alone publishes memberships (ADR 0547 §5), and defines no stream.
+	grants, err := PermissionsFor(Principal{Kind: KindModule, Node: "anchor", Module: GrantsModule, PasswordHash: "x"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	has(t, grants.Publish, "mesh.assignment.*.*")
+	has(t, grants.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
+	hasNot(t, perms.Publish, "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.*.*")
+	hasNot(t, grants.Publish, "$JS.API.STREAM.CREATE.>")
+	hasNot(t, grants.Publish, "mesh.assignment.>")
 }
 
 // The runtime arriving on a machine changes nothing about what each module is issued (to-be 38 WP2):

internal/broker/nats.go

@@ -915,6 +915,12 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
 		}
+		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
+		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each
+		// first so it publishes only what changed, and no stream it defines.
+		if p.Module == GrantsModule {
+			pub = append(pub, "mesh.assignment.*.*", "$JS.API.DIRECT.GET."+AssignmentsStream+".mesh.assignment.*.*")
+		}
 		// The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a).
 		if p.Module == ViewModule {
 			pub = append(pub, BuildBacklogReads()...)
@@ -1581,6 +1587,10 @@ func ComposeAccounts(principals []Principal) (string, error) {
 // from them. No other principal is granted the subjects below, and nothing is a wildcard over them.
 const WatchmanModule = "mesh-delivery-watchman"
 
+// GrantsModule is the one module whose principal publishes the modules' memberships (novox/hq ADR 0547 §5): the grants
+// part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
+const GrantsModule = "mesh-grants"
+
 // The bus's own events, imported into MESH from the default system account `$SYS` under subjects of MESH's own
 // (novox/hq ADR 0431 §1, issue 1147): the server says an account's connections opening and closing only to the system
 // account, and the list of an account's connections only to a request made there. `$SYS` holds no user, so nobody