Broker: the grants part may create a placed module's declared buckets, logs and streams, creation only (issue 1790; the operator's one-grant exception) #469

2026-10-26T08:16:36Z

mesh-tools commented

2026-10-26 08:16:36 +00:00

Issue 1790 (notes 8-10). The controller is frozen (ADR 0547 clause 1); the operator allowed this one grant on Telegram, 2026-10-26 08:54, as the memberships grant of 2026-10-25 22:31.

Research 072 ('The controller, NATS-native') piece moved: the grants piece, the creation of a module's declared bus objects. After this, the grants part creates a new manifest's buckets, logs and streams on the event, so no new module state waits for a controller start.

The same hunks as mesh-sdk's composer copy (nats.go, users.go, writers.go): the grants principal may publish $JS.API.STREAM.CREATE.<name> and $JS.API.STREAM.INFO.<name> for exactly the declared names, one subject each, no wildcard; never update, delete or purge. Nothing else in the controller changes; the mesh-sdk pin is unchanged. The test file is byte-equal to mesh-sdk's but for its package line.

Delivering this restarts the controller once; that start also raises the vault's waiting bucket mesh-vault_bus-accounts (issue 1945 note 70).

Tests: TestTheGrantsPartCreatesOnlyDeclaredStreams; go test -race ./internal/broker/..., go test -race ./... and go vet -tags integration ./... pass. Rules bent: no mesh-controller.try, as the operator directed on 2026-10-25.

Issue: 1790

Reviewed-by: review-create-buckets@shanks at 6927b02d4d

Issue 1790 (notes 8-10). The controller is frozen (ADR 0547 clause 1); the operator allowed this one grant on Telegram, 2026-10-26 08:54, as the memberships grant of 2026-10-25 22:31. Research 072 ('The controller, NATS-native') piece moved: the grants piece, the creation of a module's declared bus objects. After this, the grants part creates a new manifest's buckets, logs and streams on the event, so no new module state waits for a controller start. The same hunks as mesh-sdk's composer copy (nats.go, users.go, writers.go): the grants principal may publish `$JS.API.STREAM.CREATE.<name>` and `$JS.API.STREAM.INFO.<name>` for exactly the declared names, one subject each, no wildcard; never update, delete or purge. Nothing else in the controller changes; the mesh-sdk pin is unchanged. The test file is byte-equal to mesh-sdk's but for its package line. Delivering this restarts the controller once; that start also raises the vault's waiting bucket mesh-vault_bus-accounts (issue 1945 note 70). Tests: TestTheGrantsPartCreatesOnlyDeclaredStreams; `go test -race ./internal/broker/...`, `go test -race ./...` and `go vet -tags integration ./...` pass. Rules bent: no mesh-controller.try, as the operator directed on 2026-10-25. Issue: 1790 Reviewed-by: review-create-buckets@shanks at 6927b02d4d5806eb3b2253b40c430c7d2f698db8

mesh-tools added 1 commit 2026-10-26 08:16:36 +00:00

Grant the grants part creating the streams manifests declare, so a new module state no longer waits for a controller start

mesh/delivery merged: source.main moved to novox/mesh-controller@47e64f0284a9

Details

mesh/delivery-group group fix/1790-grants-create-buckets merged: every member is merged

Details

mesh/check checking 6927b02d4d58 on fda4859a95b8 | novox/mesh-controller#469 in group fix/1790-grants-create-buckets

6927b02d4d

The operator's one more grant in the frozen controller's composer (2026-10-26 08:54), beside the
memberships grant of 22:31 (ADR 0547 clause 1 and 5): mesh-grants' principal may publish
$JS.API.STREAM.CREATE.<stream> and $JS.API.STREAM.INFO.<stream> for each bucket
(KV_<module>_<state>), log (LOG_<module>_<log>) and module stream a placed module's manifest
declares, each by its own name, and nothing wider. The writers table lets it create, never update
or delete. Byte-equal with mesh-sdk's buscompose (fix/1790-grants-create-buckets), whose expected
lists this code wrote; the same test file holds both copies. Nothing else changes, and the mesh-sdk
pin stays.

Research 072: moves the grants piece (the grants part split out of the controller) one step, the
creation of a module's declared bus objects; the controller's raise at start stays until it loses
its lease.

Issue: 1790

mesh-tools commented

2026-10-26 08:16:39 +00:00

Delivery novox/mesh-controller@6927b02d4d58 — merged since 2026-10-26T08:17:20Z

Source — source.main moved to novox/mesh-controller@47e64f0284. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Group fix/1790-grants-create-buckets: novox/mesh-controller@6927b02d4d, novox/mesh-delivery@12f16bbebd, novox/mesh-sdk@136fa8b2a8

Transitions

2026-10-26 08:16 (new) → proposed (announced): novox/mesh-controller#469's head announced
2026-10-26 08:16 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-26 08:17 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@6927b02d4d58` — **merged** since 2026-10-26T08:17:20Z **Source** — source.main moved to novox/mesh-controller@47e64f0284a9. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Group** `fix/1790-grants-create-buckets`: novox/mesh-controller@6927b02d4d58, novox/mesh-delivery@12f16bbebd40, novox/mesh-sdk@136fa8b2a896 **Transitions** - 2026-10-26 08:16 (new) → proposed (announced): novox/mesh-controller#469's head announced - 2026-10-26 08:16 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-26 08:17 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools commented

2026-10-26 08:16:47 +00:00

mesh-delivery: the operator's Approve of this pull request's merge into main is ended: a head it covers moved on: the heads it covers are no longer the group's heads. Nothing is merged on it. The operator is asked again once the checks pass at the new head.

mesh-tools merged commit 47e64f0284 into main

2026-10-26 08:17:20 +00:00

mesh-tools deleted branch fix/1790-grants-create-buckets

2026-10-26 08:17:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#469