jschoubben f67d15536b Grant the grants part publishing the modules' memberships, and nothing more (ADR 0547 §5, issue 1945) ...

No membership is published since release 6 (issue 1945 notes 42, 47), so a seat-holding module placed now cannot
serve its seat or pull asks (mesh-build-go on ace, 2026-10-25). The operator decided at 22:31 that the grants part
publishes them from the first milestone: its principal, module mesh-grants, may publish mesh.assignment.*.* and no
stream definition. The SDK's copy of this composer gets the same line, so the two stay byte-equal.

Research 072 (the controller, NATS-native): this moves the memberships of its Bus row to the grants part.

2026-10-25 22:32:35 +01:00

..

testdata

Take done keys in from a durable pull consumer, a batch at a time (issue 1945, ADR 0544)

2026-10-25 17:59:20 +01:00

agreement_catalogue_test.go

Re-capture the catalogue at mesh-catalog feat/r6 3a1017f5 and excuse a derived subject whose module lives in another repository (issue 1945)

2026-10-24 20:37:04 +02:00

agreement_streams_test.go

Count a module's own stream events beside its emits in the catalogue agreement (issue 1249)

2026-10-19 15:31:13 +02:00

agreement.go

Event names are checked now, per manifest and across the catalogue

2026-09-27 14:43:16 +02:00

announced_test_helpers_test.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

announced_test.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

announced.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

broker_test.go

One bus: the AMQP transport is gone from the controller

2026-09-28 03:36:16 +02:00

broker.go

Work slower than the window says so, and one address is the bus's

2026-09-28 09:51:50 +02:00

buildbacklog_test.go

Grant the builder the build seats' streams' information and messages by name, so its take-over at start can tell an ask its key names is on its stream (issue 1910)

2026-10-23 16:59:03 +02:00

buildbacklog.go

Grant the builder the build seats' streams' information and messages by name, so its take-over at start can tell an ask its key names is on its stream (issue 1910)

2026-10-23 16:59:03 +02:00

bus_module_emits_test.go

Raise every bus user's slow consumer and closed connection as S9, from the bus module's events (hq issue 270, ADR 0357)

2026-10-14 08:41:47 +02:00

callers_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

callers_test.go

broker: grant each credential the tool calls that name it as the caller, and no other (hq issue 365)

2026-10-11 05:25:29 +02:00

callers.go

broker: grant each credential the tool calls that name it as the caller, and no other (hq issue 365)

2026-10-11 05:25:29 +02:00

cancelled_test.go

Take the controller's publish grants on node-build-agent and mesh-build-machine away, with the cancelled sets and the redelivery of its own asks: it asks no build seat (ADR 0525 §10, C3a)

2026-10-23 16:13:43 +02:00

cancelled.go

Take the controller's publish grants on node-build-agent and mesh-build-machine away, with the cancelled sets and the redelivery of its own asks: it asks no build seat (ADR 0525 §10, C3a)

2026-10-23 16:13:43 +02:00

composed_live_test.go

Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

2026-10-24 18:30:24 +02:00

composed_test.go

Merge main (#456, the pre-switch grants) into feat/r6 (issue 1945)

2026-10-24 22:02:32 +02:00

composed.go

Follow config from a durable consumer, compose again only what changed since, and hold the node only for a write (issue 1945, ADR 0545, review)

2026-10-25 18:27:43 +01:00

condition_grant_test.go

Prove a module may say a condition to the operator only under its own name (issue 1216)

2026-10-19 12:01:59 +02:00

config_owner_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

consumer_from_now_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

consumer_upgrade_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

controller_asks_test.go

Ask the operator for a condition's answers and act on the warrant, so release, stop, start and restart can be answered from any channel that proves who answered (hq ADR 0259)

2026-10-09 16:22:34 +02:00

controller_buckets_integration_test.go

Take a registered module's new done key in, compose it and grant it; at start delete the plans' buckets and compose every node and the replaced controller (issue 1945, B3, B5, B13)

2026-10-24 17:11:01 +02:00

controller_buckets_test.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

controller_buckets.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

declaration_files_live_test.go

Take mesh-sdk at 86f9a1a5 and name each node's bucket with its FileBucketFor, refusing a node name that could carry a wildcard (issues 1696, 1697; ADR 0488)

2026-10-21 16:05:24 +02:00

declaration_files_test.go

Take mesh-sdk at 86f9a1a5 and name each node's bucket with its FileBucketFor, refusing a node name that could carry a wildcard (issues 1696, 1697; ADR 0488)

2026-10-21 16:05:24 +02:00

declaration_files.go

Take mesh-sdk at 86f9a1a5 and name each node's bucket with its FileBucketFor, refusing a node name that could carry a wildcard (issues 1696, 1697; ADR 0488)

2026-10-21 16:05:24 +02:00

declared_packages_mirror_test.go

Merge main (upgrade safety's declared packages, issue 1840) and pin the R4e mesh-sdk member's final head 875c680d, re-vendored here and in modules/route-proxy; the controller announces declared-packages readable (issue 1790, D1; E)

2026-10-22 20:44:59 +02:00

delivery_gate_grant_test.go

Carry a module on the tool runner only when the runner has something of it to serve, so a part on its own credential has one writer (issue 1329)

2026-10-19 23:10:48 +00:00

delivery_parts_grant_test.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

derived_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

derived.go

Derive a worker per kind for the build seats and grant their users to put asks, so a build node pulls delivery, check and recheck in order and a session cannot ask (issue 1887 A6, ADR 0525 §2)

2026-10-23 15:54:45 +02:00

genesis_template_test.go

Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

2026-10-24 18:30:24 +02:00

grants_test.go

Declare the controller's grants bucket, written by the controller alone and readable through mesh-controller.grants, so the assigner can read its sixth rule's key (issue 1394, subtask C9a; ADR 0528 clause 2); the SDK pin moves to the layouts' commit, captured beside

2026-10-23 15:39:40 +02:00

have_bucket_live_test.go

The broker asserts the have bucket and grants each node its own keys of it, the controller none (issue 1136)

2026-10-18 19:04:55 +02:00

have_bucket_test.go

The have bucket takes a node's whole facts, as large as a chain value, never cut (issue 1162)

2026-10-18 23:51:56 +02:00

invokes_test.go

broker: grant each credential the tool calls that name it as the caller, and no other (hq issue 365)

2026-10-11 05:25:29 +02:00

issued_test.go

Let the controller ask an issued credential's tool in its own name, and seal it again over a remade pair (hq issue 526, ADR 0305)

2026-10-12 01:21:20 +02:00

jetstream_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

jetstream.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

log_integration_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

log_test.go

Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

2026-10-24 18:30:24 +02:00

log.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

membership_test.go

Grant the grants part publishing the modules' memberships, and nothing more (ADR 0547 §5, issue 1945)

2026-10-25 22:32:35 +01:00

membership.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

modstream_work_queue_test.go

Review round 1: a carried module's queue consumer survives PruneHeard, a work-queue stream's restricted metadata is proven on the server config (issue 1178)

2026-10-19 03:18:18 +02:00

modstreams_live_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

modstreams_test.go

Carry a module on the tool runner only when the runner has something of it to serve, so a part on its own credential has one writer (issue 1329)

2026-10-19 23:10:48 +00:00

modstreams_workqueue_integration_test.go

Let module issue mint and deliver a bus process's account (issue 1181)

2026-10-19 02:55:29 +02:00

modstreams.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

move_secrets_test.go

Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

2026-10-16 08:28:38 +00:00

msgttl_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

nats_golden_test.go

The bus's system account exports MESH's connect and disconnect events and connections request, heard only by the watchman (issue 1147)

2026-10-18 19:07:06 +02:00

nats_test.go

Grant each node-engine its own access-act ask, which it has subscribed to since ADR 0325 and was refused at every connect (issue 1945)

2026-10-25 01:42:28 +02:00

nats.go

Grant the grants part publishing the modules' memberships, and nothing more (ADR 0547 §5, issue 1945)

2026-10-25 22:32:35 +01:00

no_build_queue_test.go

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10)

2026-10-23 15:55:15 +02:00

node_key_test.go

Feature 57 (config and provisioning): release mesh-controller, the reviewed release branch merged with main, on top of main

2026-10-16 08:28:38 +00:00

onnats.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

process_grants_test.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

process_grants.go

Let module issue mint and deliver a bus process's account (issue 1181)

2026-10-19 02:55:29 +02:00

process_state_watch_test.go

issue 1840/S3b: prove a process may watch its own state's bucket and no other (AC9)

2026-10-22 14:23:58 +02:00

prov_applied_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

provisioner_have_test.go

Grant each provisioner client a read of its node's own have, so it refills when the node's own composition moves (issue 1945)

2026-10-25 01:58:27 +02:00

provisioner_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

provisioner_server_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

provisioner_test.go

Grant each provisioner client a read of its node's own have, so it refills when the node's own composition moves (issue 1945)

2026-10-25 01:58:27 +02:00

provisioner.go

Grant each provisioner client a read of its node's own have, so it refills when the node's own composition moves (issue 1945)

2026-10-25 01:58:27 +02:00

raise_live_test.go

Make a module's consumer from now and refuse a start word in consumes, so no part replays a week at its first start (issue 1279, ADR 0443)

2026-10-19 21:53:08 +02:00

raise.go

The bus's objects are raised on every start, and one switch says which bus

2026-09-27 02:59:05 +02:00

readiness_test.go

The move ends with the old broker going, not staying

2026-09-27 23:04:59 +02:00

readiness.go

The move ends with the old broker going, not staying

2026-09-27 23:04:59 +02:00

reads-outside

Mark the packages whose tests read files outside their directory, found by the review (issue 1935)

2026-10-24 04:38:51 +02:00

sdk_membership.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

seattools_test.go

Rename node-hosts-file to node-hostname, and refuse one seat claimed under two names (hq ADR 0223)

2026-10-05 23:43:15 +02:00

seattraffic_test.go

Bound the build seats' workers' deliveries, so an ask no run ends is offered at most five times even when the holder that says it is poison dies too (issue 1907)

2026-10-23 16:42:13 +02:00

seattraffic.go

Bound the build seats' workers' deliveries, so an ask no run ends is offered at most five times even when the holder that says it is poison dies too (issue 1907)

2026-10-23 16:42:13 +02:00

snapshot_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

snapshot_test.go

Grant the bus's own module the snapshot API and nothing else (hq ADR 0235)

2026-10-06 18:20:57 +02:00

state_integration_test.go

A state entry may say key-ttl and its bucket allows a time to live per key (issue 1154)

2026-10-18 20:53:42 +02:00

state_keyttl_test.go

A state entry may say key-ttl and its bucket allows a time to live per key (issue 1154)

2026-10-18 20:53:42 +02:00

state_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

state.go

Announce the controller's states, keep every module's word, and grant a read only where its owner announced the state readable; the copied list of the controller's mirrors goes (issue 1790, D1-D4, ADR 0495, ADR 0513 §3)

2026-10-22 19:05:04 +02:00

stream_names_agreement_test.go

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10)

2026-10-23 15:55:15 +02:00

streams_test.go

Delete the builder, the build asks, the build queue and the merge gate: the builder's keys are the only way a module is built (issues 1851, 1299, 1318; C2b-C5, C10)

2026-10-23 15:55:15 +02:00

streams.go

Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

2026-10-24 18:30:24 +02:00

system_exports_live_test.go

The system-exports reload test waits for the event naming the user it connected, past the watchman's own (issue 1169)

2026-10-19 01:06:56 +02:00

system_exports_test.go

The bus's system account exports MESH's connect and disconnect events and connections request, heard only by the watchman (issue 1147)

2026-10-18 19:07:06 +02:00

users_test.go

Compose a bus user only for a module that can read an account

2026-10-04 17:32:50 +02:00

users.go

Return a grant not written and retry the take-in under a condition; drop the plans' events; grant bucket-deleted, restic's backup word and the operator's hand path (issue 1945; the review's D1, F1, H1 and its notes)

2026-10-24 18:30:24 +02:00

vault_calls_live_integration_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

vault_calls_live_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

waits_test.go

Let the tool runner's account hear the event families its manifest names (issue 745, ADR 0367)

2026-10-14 23:05:14 +00:00

waits.go

Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

2026-10-22 09:53:56 +02:00

witness_grants_test.go

Read how a module says each resource is ready, and send it to engines that read it (hq ADR 0240, to-be 48 Phase B)

2026-10-07 16:17:50 +02:00

worker_type_change_test.go

Split the unit level from the integration level outside cmd, builder, link, catalogue, inventory; merge-check.sh times and bounds the unit level (issue 895)

2026-10-17 20:41:57 +02:00

writers_test.go

Grant release 6's compositions, wants and backups ahead of its switch (issue 1945)

2026-10-24 18:14:45 +02:00

writers.go

Merge main (#456, the pre-switch grants) into feat/r6 (issue 1945)

2026-10-24 22:02:32 +02:00