A tool's grant covers the machine-addressed subject, and a credential names the seats its module claims (ADR 0159) #185

2026-10-01T12:00:51Z

mesh-admin commented

2026-10-01 12:00:51 +00:00

novox/hq ADR 0159, issue 182. invokes: [<module>.<tool>] grants the plain subject and the same with the machine as its last token. The broker credential the mesh writes gains claims: each seat the module claims, its scope, and the verbs the seat promises, so the runtime (mesh-tools, same branch name) serves them on the seat's subjects; the holder's grant, composed from the holding, admits the subscription. Test: the grant covers both subjects. make check was green before the gofmt-only follow-up commit; no behaviour changed by it.

Merge first, before mesh-tools: the grant must exist before any runtime serves the second subject.

novox/hq ADR 0159, issue 182. `invokes: [<module>.<tool>]` grants the plain subject and the same with the machine as its last token. The broker credential the mesh writes gains `claims`: each seat the module claims, its scope, and the verbs the seat promises, so the runtime (mesh-tools, same branch name) serves them on the seat's subjects; the holder's grant, composed from the holding, admits the subscription. Test: the grant covers both subjects. `make check` was green before the gofmt-only follow-up commit; no behaviour changed by it. **Merge first**, before mesh-tools: the grant must exist before any runtime serves the second subject.

mesh-admin added 2 commits 2026-10-01 12:00:51 +00:00

A tool's grant covers the machine-addressed subject, and a credential names the seats its module claims (hq ADR 0159) 9fd5971212

`invokes: [<module>.<tool>]` now grants `mesh.mod.<module>.tool.<tool>` and the same with the
machine as its last token, which is how a call reaches one machine's instance. The broker
credential the mesh writes carries `claims`: each seat the module claims, its scope, and the verbs
the seat promises, so the runtime serves them on the seat's subjects; the holder's grant, composed
from the holding, is what admits the subscription.

gofmt ccae1ec303

mesh-admin merged commit 55c5c061ab into main

2026-10-01 12:01:29 +00:00

mesh-admin deleted branch feat/a-tool-call-names-the-machine

2026-10-01 12:01:29 +00:00

mesh-admin referenced this pull request

2026-10-01 12:43:56 +00:00

The mesh issues an assignment's subjects: a membership per module on a machine (ADR 0160) #188

jschoubben referenced this issue from a commit

2026-10-01 12:45:33 +00:00

A person invoking one tool holds it both ways it is addressed (the test, after #185)

Sign in to join this conversation.