From 0baf727f3619e9fee33f3795986007d805ecd62f Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 28 Sep 2026 04:21:25 +0200 Subject: [PATCH] The controller may ask any module's tool The control plane is the way in for tool calls (novox/hq ADR 0095): a person or an agent asks through it, so it alone may publish to every module's tool subject. The first ask on the new bus was refused the publish. --- internal/broker/nats.go | 5 +++++ internal/broker/testdata/composed.conf | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/internal/broker/nats.go b/internal/broker/nats.go index 90d8c54..f8d3775 100644 --- a/internal/broker/nats.go +++ b/internal/broker/nats.go @@ -181,6 +181,11 @@ func PermissionsFor(p Principal) (Permissions, error) { for _, seat := range meshSeatsTheControllerUses { pub = append(pub, "mesh.seat."+seat+".accept.>") } + // Every module's tools: **the control plane is the way in** (novox/hq ADR 0095). A person + // or an agent asks through it and every question passes one process where an audit + // belongs — so it, alone among principals, may call any tool by name. The first `ask` on + // the new bus was refused the publish (2026-09-28). + pub = append(pub, "mesh.mod.*.tool.>") // The two events it reacts to, and its ack subject on the stream they arrive from // (streams.go). **Each named, not a pattern**: `mesh.mod.*.event.>` would make the diff --git a/internal/broker/testdata/composed.conf b/internal/broker/testdata/composed.conf index 22fea23..88dd7d1 100644 --- a/internal/broker/testdata/composed.conf +++ b/internal/broker/testdata/composed.conf @@ -24,7 +24,7 @@ accounts { jetstream: enabled users = [ { user: "controller", password: "$2a$11$cccccccccccccccccccccc", permissions: { - publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "_INBOX.enrol.>", "mesh.control.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>"] } + publish: { allow: ["$JS.ACK.CONTROL.controller.>", "$JS.ACK.EVENTS.controller.>", "$JS.API.>", "_INBOX.enrol.>", "mesh.control.>", "mesh.mod.*.tool.>", "mesh.node.>", "mesh.seat.mesh-build-machine.accept.>"] } subscribe: { allow: ["$JS.API.>", "_DELIVER.controller", "_DELIVER.controller.>", "_INBOX.controller.>", "mesh.control.>", "mesh.mod.gitea.event.pull.merged", "mesh.mod.mesh-catalog.event.catching-up", "mesh.mod.mesh-catalog.event.upgraded", "mesh.seat.mesh-build-machine.event.built"] } allow_responses: { max: 1, ttl: "1m" } } } -- 2.54.0