Grant the bus's own module the snapshot API and nothing else (hq ADR 0235) #90

2026-10-06T16:23:55Z

mesh-admin commented

2026-10-06 16:23:55 +00:00

The night's backup of the bus takes each stream through JetStream's snapshot API, run by the nats module under its own account (hq ADR 0235, to-be 43).

internal/broker: BusSnapshotGrants — $JS.API.STREAM.NAMES, $JS.API.STREAM.INFO.*, $JS.API.STREAM.SNAPSHOT.*, $JS.SNAPSHOT.ACK.>, its own inbox; no responses. A KindModule principal with SnapshotsTheBus gets exactly that (CheckWriters holds that none of it writes). Golden updated.
internal/inventory/busrecords.go: SnapshotsTheBus = the module claims mesh-broker (catalogue.BrokerSeat, new constant).
internal/catalogue/manifest.go: a module holding mesh-broker with a broker account that declares emits/consumes/uses/invokes/state/reads is refused (it would be granted nothing).
The controller's own grant is unchanged, so the installer's first user list (mesh-host examples/foundation-first-node-nats.lock) needs no change — TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose passes.
Nothing touches doctor/D1/D3/D13.

Tests: go test -race ./... with postgres:17 and MESH_TEST_DOCKER=1 all green; new snapshot_test.go, snapshot_live_test.go (composed grants against a throwaway nats:2.11: a whole snapshot taken, every write and wider subscription refused), bus_snapshot_test.go, inventory TestTheBussOwnModuleBecomesTheSnapshotUser; vet/gofmt clean.

Merge order: this first, then mesh-catalog feat/bus-snapshot, then hq.

The night's backup of the bus takes each stream through JetStream's snapshot API, run by the nats module under its own account (hq ADR 0235, to-be 43). - `internal/broker`: `BusSnapshotGrants` — `$JS.API.STREAM.NAMES`, `$JS.API.STREAM.INFO.*`, `$JS.API.STREAM.SNAPSHOT.*`, `$JS.SNAPSHOT.ACK.>`, its own inbox; no responses. A `KindModule` principal with `SnapshotsTheBus` gets exactly that (CheckWriters holds that none of it writes). Golden updated. - `internal/inventory/busrecords.go`: `SnapshotsTheBus` = the module claims `mesh-broker` (`catalogue.BrokerSeat`, new constant). - `internal/catalogue/manifest.go`: a module holding mesh-broker with a broker account that declares emits/consumes/uses/invokes/state/reads is refused (it would be granted nothing). - **The controller's own grant is unchanged**, so the installer's first user list (mesh-host `examples/foundation-first-node-nats.lock`) needs no change — `TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose` passes. - Nothing touches doctor/D1/D3/D13. Tests: `go test -race ./...` with postgres:17 and `MESH_TEST_DOCKER=1` all green; new `snapshot_test.go`, `snapshot_live_test.go` (composed grants against a throwaway nats:2.11: a whole snapshot taken, every write and wider subscription refused), `bus_snapshot_test.go`, inventory `TestTheBussOwnModuleBecomesTheSnapshotUser`; vet/gofmt clean. Merge order: this first, then mesh-catalog `feat/bus-snapshot`, then hq.

mesh-admin added 1 commit 2026-10-06 16:23:55 +00:00

Grant the bus's own module the snapshot API and nothing else (hq ADR 0235) 48581af35c

The night's backup of the bus takes each stream through JetStream's snapshot
API, run by the nats module under its own account. The module holding
mesh-broker is composed that account: stream names and info, the snapshot
request, its flow-control acks, its own inbox — no write, which the writers
table checks. A bus module declaring anything else to say on the bus is
refused by module check rather than silently granted nothing. The genesis
user list is unchanged: the controller's grants are.

mesh-admin merged commit 7aa98e64ce into main

2026-10-06 16:24:54 +00:00

mesh-admin deleted branch feat/bus-snapshot

2026-10-06 16:24:54 +00:00

mesh-admin commented

2026-10-06 23:10:00 +00:00

Delivery novox/mesh-controller@7aa98e64ce6c — delivered since 2026-10-06T23:05:28Z

Machines

build-agent on ace: sent
mesh-controller on novox: sent

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#90 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on
2026-10-06 23:05 held → delivering (go): its walk started on a word that was not this owner's: the controller's own path, which waits for nobody, or a person's plans go
2026-10-06 23:05 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-controller@7aa98e64ce6c` — **delivered** since 2026-10-06T23:05:28Z **Machines** - build-agent on ace: sent - mesh-controller on novox: sent **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-controller#90 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on - 2026-10-06 23:05 held → delivering (go): its walk started on a word that was not this owner's: the controller's own path, which waits for nobody, or a person's `plans go` - 2026-10-06 23:05 delivering → delivered (done): its walk is done: every machine of its deploy plan passed, or was left as its policy says The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin referenced this pull request

2026-10-12 13:33:32 +00:00

Raise a machine that refuses or only partly applies its declarations past one apply interval (issue 233) #263

mesh-admin referenced this pull request

2026-10-12 13:59:49 +00:00

Raise a machine that refuses or only partly applies its declarations past one apply interval (issue 233) #263

mesh-admin referenced this pull request

2026-10-13 00:04:13 +00:00

Add the replays of issues 279 and 412 (hq issues 279, 412) #285

mesh-admin referenced this pull request

2026-10-13 00:39:09 +00:00

Add the replays of issues 279 and 412 (hq issues 279, 412) #285