Only CONSUMER.INFO was missing from a machine's grants; the rest was already there

Golden: a machine's user may bind its consumer, ack, and hear its inbox
A machine may bind its consumer and hear the answer
2026-09-28 01:17:40 +02:00 · 2026-09-28 01:17:15 +02:00 · 2026-09-28 01:16:46 +02:00 · 2026-09-27 23:08:35 +00:00 · 2026-09-28 01:08:11 +02:00 · 2026-09-27 23:03:42 +00:00
3 changed files with 17 additions and 2 deletions
@@ -340,6 +340,14 @@ func rolloutMint(ctx context.Context, again bool) error {
 			machines++

 		case broker.KindModule:
+			if p.Module == "mesh-controller" {
+				// The control plane is a module too, and its `broker` secret is the old bus's
+				// credential it is still using while this runs. Writing the new bus's blob there
+				// cut the mesh off from its own old bus mid-move (2026-09-28). Its new-bus credential
+				// is the controller principal's `bus` secret above; nothing else is needed here.
+				skipped++
+				continue
+			}
 			m, inShelf := shelf[p.Module]
 			if !inShelf {
 				skipped++
@@ -244,7 +244,14 @@ func PermissionsFor(p Principal) (Permissions, error) {
 	case KindNode:
 		// A host publishes its own node's control traffic and subscribes its own declaration —
 		// and nothing of any other node's.
-		pub = []string{"mesh.control." + p.Node + ".>"}
+		// And binding to its consumer, which asks the server about it (CONSUMER.INFO) — the one
+		// thing the host does that nothing granted. Found the first time a machine dialled a
+		// permissioned server: "this node cannot read its declarations" (2026-09-28). The ack and
+		// the inbox are granted below with every principal's.
+		pub = []string{
+			"mesh.control." + p.Node + ".>",
+			"$JS.API.CONSUMER.INFO.NODES." + p.Node,
+		}
 		sub = []string{"mesh.node." + p.Node + ".declare"}

 	case KindModule:
@@ -32,7 +32,7 @@ accounts {
        subscribe: { allow: ["_INBOX.enrol.one.>"] }
      } }
      { user: "node.one", password: "$2a$11$nnnnnnnnnnnnnnnnnnnnnn", permissions: {
-        publish: { allow: ["$JS.ACK.NODES.one.>", "mesh.control.one.>"] }
+        publish: { allow: ["$JS.ACK.NODES.one.>", "$JS.API.CONSUMER.INFO.NODES.one", "mesh.control.one.>"] }
        subscribe: { allow: ["_INBOX.node.one.>", "mesh.node.one.declare"] }
      } }
      { user: "one.telegram", password: "$2a$11$tttttttttttttttttttttt", permissions: {
Author	SHA1	Message	Date
jschoubben	2c2eb51878	Only CONSUMER.INFO was missing from a machine's grants; the rest was already there	2026-09-28 01:17:40 +02:00
jschoubben	aa2d0b51ea	Golden: a machine's user may bind its consumer, ack, and hear its inbox	2026-09-28 01:17:15 +02:00
jschoubben	64d154d9d7	A machine may bind its consumer and hear the answer Binding to a consumer asks the server about it and hears the answer on the client's inbox; hearing a declaration acknowledges it. A machine's user was granted none of that and was refused the first time one dialled a permissioned server: "this node cannot read its declarations". Its inbox is its own prefix, which the host now sets.	2026-09-28 01:16:46 +02:00
jschoubben	ffa390f916	Merge pull request 'The mint leaves the control plane's old-bus secret alone' (#101 ) from fix/mint-leaves-the-control-planes-old-secret-alone into main	2026-09-27 23:08:35 +00:00
jschoubben	4d62e6caf1	The mint leaves the control plane's old-bus secret alone The control plane is a module too, and its broker secret is the old bus's credential it is still using while the mint runs. Writing the new bus's blob there cut the mesh off from its own old bus mid-move. Its new-bus credential is the controller principal's bus secret; the module principal is skipped.	2026-09-28 01:08:11 +02:00
jschoubben	386ae676ca	Merge pull request 'The control plane mounts the bus secret it reads' (#100 ) from fix/the-controller-mounts-its-bus-secret into main	2026-09-27 23:03:42 +00:00