Archived
jschoubben
47bbb0cca6
CreateModuleAccount gives an assigned module its own broker account whose permissions ARE its manifest: declare and read its own <node>.<module>.events queue, read the events exchange to bind onto if it consumes, write the events exchange only if it emits. The account name carries the node (sealed per machine), the permissions carry the module (one cannot read another's queue). The builder becomes one instance of this rule rather than a separate kind. EnsureEventExchanges declares the bus the substrate owns — mesh.events, mesh.rpc, mesh.events.dead + a retention queue — idempotently, since a module account may not declare an exchange. Scope tested as patterns (no broker needed), and every management call verified against a real LavinMQ. Honest limit recorded in the code: LavinMQ has no topic permissions, so ADR 0047's emit-origin reservation (module.<self>.*) is stamped by the sdk, not enforced by the broker; a pure consumer like the audit logger is unaffected. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF