A holder says a held call's end on its seat's gated-ended, kept last per subject for a day in SEAT_<seat>_gated-ended,
which the grants part makes from the definition seatdef.Resolve gives (A-264). The caller is granted hearing
gated-ended.<caller>.> under its own escaped account name, and an ordered consumer on that stream filtered to it, from its
invokes of the marked verb by name; a module or process that answers a marked verb is granted saying the event to any
caller. No process of mesh-delivery holds a marked verb, so no holder here takes NewGateChannel.
Builds: design 47 G §677, §700, A-264, A-273
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
For a module that requires finding-events and is bound, the membership lists the stream its binding names, the subject
mesh.bus.<module>.finding-events.{event}.<node> and the finding events, so the tool runner carrying a stdio module (the
enrolment) says an emitted finding event there; the test holds the enrolment's membership.
Builds: design 47 G A-280, A-274, §529
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The account of the module claiming the seat mesh-recovery is granted the stream snapshot and
restore subjects with their chunk subjects, a stream's deletion and a durable consumer's
creation, only for the bus names of every kept data of every manifest the part holds and of
every restore point or aside kept-points names; never a stream of the mesh's own (CONTROL,
NODES, EVENTS, DEAD_LETTER*, PROV_APPLIED, CHECKS_*, SEAT_*, a seat's KV_). The writers table
names the account as a deleter of kept data's streams (ADR 0672 §4).
Builds: design 47 G §554, §565, A-230
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
While no entry of the revision invokes a queue of a build seat (seat:<seat>.accept.<queue>,
read by catalogue.QueueInvoke), the part composes no named worker, and at the first such
pass it purges accept.<queue>.* of each build seat's stream and deletes the named workers,
saying each in its journal; a failed read of the catalog half purges nothing. Its account
alone is granted the stream's purge and the named workers' delete. The hand tool
grants_named_purge records its hand act first, then asks the process to do it.
Builds: design 47 G §544, §600, §601, A-231
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The grants part follows the assignment half, reads each node's reading and the
runner its node-engine says running, and where the runner does not state
approval-mark/1 or the reading is not the running runner's, composes the
subscribe deny of every marked tool and verb the runtime carries, named in
grants_user_list's withheld and answered by the seat's verb withheld.
Builds: design 46 7 §6 (the deny's subjects, its cases, withheld in grants_user_list and the verb withheld), design 47 G §195, §309, lead answer A-203 (the assignment half followed by revision and assignment-revision; withheld's forms, keyed by node in the user list's state as the lead confirmed)
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
Where the runtime's permissions are composed, a runtime carrying the tool
runner subscribes mesh-sdk's EveryEvent (every seat's, module's and module
stream's events) and nothing else for it, replacing the per-family list.
Builds: design 34 every-event §6, §8, §25, §27
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The tool runner's manifest no longer names the event families it may wait
on (mesh-sdk EE-S2), so the grants part's copy of that list goes whole:
its subjects, its membership field and its record reading.
Builds: design 34 every-event §5, §7
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The node-engine of a node hears the kept events ended and restored through an ordered consumer, and calls the catch-up tool of a module placed on its node (its manifest's kept data name it); the verbs snapshot-kept, restore-kept and kept-points were granted already as the engine's invokes. No nodegrant mirror lives in mesh-delivery (it is mesh-host's).
Builds: design 47 G §406, §554, §631, A-108
The seat list's verbs saying `chunks: true` (ChunkVerbsOf, as KeptEventsOf) give the principal that answers the verb (a module's
own account for a seat it holds, the tool runner's for a carried module's) the publish of the chunk subjects and the
subscription to the acks, and an account naming the verb by name in `invokes` the reverse; a `*` entry none. The bus module's
keeper holds a standing grant of the restore subjects of the restricted streams, and only those.
Builds: design 47 G §681, A-45, A-60
Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h
The part binds its own durable on the node-engine's kept stream (HearKept, tried at every wake until the pass has made it),
the seat's holders are read from the manifest of the digest each node says it runs, and a node-engine's account is granted its
own node at the part its definition names (running.<node>.*) and its durable on the kept stream by name.
Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ
Builds: design 47 G §199, §249, §309
mesh/check checking a78c5700fdf4 on fb69c8dee691 | novox/mesh-delivery#188 in group fix/1966-requires-state
The grants part wrote a binding into a membership on the bus module's
created, but granted its subjects to no account but the ledger's, so
distribution's program and the tool runner carrying it were refused their
own key-value, object store and stream entries (issue 1966, ADR 0595 §1,
design 25 § 12.2). The kept bindings now reach Declared in the same pass that
writes them into the membership, and one function, boundOf, grants each to
the module's own account and the tool runner, as its old section is granted;
a process's bus.state names a key-value entry as an old state. The composed
membership carries the bindings, so grants_membership's two sides agree.
Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
The grants part built the node-engine's declaration with its consumes alone,
so a node's account was granted none of the engine manifest's invokes: ace's
engine could not publish mesh.seat.mesh-catalog.call.seat-definitions.node~ace,
read no seat list and composed nothing new. And its consumes of
mesh-catalog's seat-definition events were granted on the emitter's subject
only, where the engine subscribes the seat's (ADR 0636 §4).
The engine's declaration now carries its invokes and the seats it watches,
split by the same consumedOf a placed module's consumes are; the node's
account is granted the invokes as a module's are (in its own caller token
by callerNamed) and the watched events on each seat's subject by the same
watchedEvents a module's use. Its consumes stay granted on the emitter's
subjects too, so nothing granted before is taken away.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
The bus module's spend record must not be writable by the tool runner. A state declared read-only gets read on
the module's own account and the tool runner carrying it (direct get, a watch's consumer) and no publish on its
$KV subjects; the process whose bus state names it writes it. The judge rule and the manifest field follow
with mesh-sdk's read-only.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
The lead's ruling of 13:0x (registry milestone): mesh-broker's events are mesh.seat.mesh-broker.event.<event> on the
shared events stream like every seat's. The grants part and the watchman consume mesh-broker.<event> and no longer hear
the bus module's own stream, which is its history for its tool. The keeper's process account is composed the seat's
event subjects, and the acknowledgement of a snapshot's chunks of each entry it keeps, which ADR 0626 §1 grants and the
composition lacked; a row holds it to no subscription of a restricted stream's subjects and no consumer of one.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
A process of the bus module without keeps, or keeps on any other module, is composed nothing
of it. mesh-sdk's ProcessBus.Keeps is asked of A1 (a5-sdk-keeps.patch).
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
The keeper is asked by a person through its own state requests (CAT-N8); the acting verbs
are served by nobody on the bus and denied to every principal whose grant reaches them. The
bus module's tools bundle may read its module's own stream back (nats_history).
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
The grants are composed for the process of the module holding mesh-broker, from every
manifest's bus-state entries and the streams of the bindings kept; the writers table names
it beside the grants part as a definer of streams; the acting verbs are denied to every
principal whose grant reaches them, and neither the holder's own account nor the tool runner
serves the seat's verbs.
Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
ADR 0592 §5, §6, §9, §25 (the grants part's share by ADR 0593 §10): an object bucket and a stream that
keeps its history are created create-only with their caps and no age limit, refusing new data when full;
the owner alone writes its bucket and a module its grant names reads it; the part raises
mesh-grants.history-full once any passes 75 percent. Each engine also reads the indexer's manifest
verdicts by one key for compose-candidate.
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
ADR 0593 §6, §7: the grants part creates composed-<node> per node, grants each engine the writes of its
own bucket and a direct get of the indexer's candidates for compose-candidate, and grants
mesh-host.composed read-only, with the stream listing and creation advisory a per-node read needs, to
the provisioner, the assigner and the view alone; memberships issue it per node.
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
ADR 0593 §1: buscompose's engine moves from mesh-sdk into mesh-grants/internal/buscompose, its golden
user lists unchanged; the controller's raise and assert code is left behind, and the merged switch
test runs inside the part's whole integration test.
Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
jschoubben