Grant the bus keeper its account's information, which every bucket create asks first (recovery) #179

2026-11-08T22:07:10Z

mesh-tools commented

2026-11-08 22:07:10 +00:00

Recovery fix (instruction section recovery-fixes-merge-and-tell; the operator's full permission to deliver design 47, 2026-11-08).

Symptom. After the operator's yes, the bus module on novox runs fea2c02b, and its keeper's health has failed since 21:58 UTC: "nats.keeper starting: not ready yet". The keeper's journal shows Permissions Violation for Publish to "$JS.API.INFO" every 30 s. nats_keeper_health says that creating KV_distribution_* and KV_gitea_* is "refused for now: context deadline exceeded". nats_user_can novox.nats.keeper $JS.API.INFO publish answers false.

Cause. The client library's jetstream.CreateKeyValue asks $JS.API.INFO (AccountInfo, nats.go v1.54.0 jetstream/kv.go:618) before every bucket it creates. Grants' busStateKeeperGrants gives the keeper each stream's create but not that read.

Fix. $JS.API.INFO is added to the keeper's grants, and the keeper test asserts it. The test fails without the fix. The grant is read-only: it covers the account's limits and usage, never a stream's data. The keeper is the only caller of CreateKeyValue outside tests in mesh-delivery, mesh-host, mesh-sdk and mesh-catalog, so this covers every case of the kind.

Quick or thorough. They are the same change here: one composer, one principal.

Checked locally. go vet ./... and go test ./... in modules/mesh-grants.

Undo. Revert this merge.

https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5

Recovery fix (instruction section recovery-fixes-merge-and-tell; the operator's full permission to deliver design 47, 2026-11-08). **Symptom.** After the operator's yes, the bus module on novox runs fea2c02b, and its keeper's health has failed since 21:58 UTC: "nats.keeper starting: not ready yet". The keeper's journal shows `Permissions Violation for Publish to "$JS.API.INFO"` every 30 s. `nats_keeper_health` says that creating KV_distribution_* and KV_gitea_* is "refused for now: context deadline exceeded". `nats_user_can novox.nats.keeper $JS.API.INFO publish` answers false. **Cause.** The client library's `jetstream.CreateKeyValue` asks `$JS.API.INFO` (AccountInfo, nats.go v1.54.0 jetstream/kv.go:618) before every bucket it creates. Grants' `busStateKeeperGrants` gives the keeper each stream's create but not that read. **Fix.** `$JS.API.INFO` is added to the keeper's grants, and the keeper test asserts it. The test fails without the fix. The grant is read-only: it covers the account's limits and usage, never a stream's data. The keeper is the only caller of CreateKeyValue outside tests in mesh-delivery, mesh-host, mesh-sdk and mesh-catalog, so this covers every case of the kind. **Quick or thorough.** They are the same change here: one composer, one principal. **Checked locally.** `go vet ./...` and `go test ./...` in modules/mesh-grants. **Undo.** Revert this merge. https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5

mesh-tools added 1 commit 2026-11-08 22:07:10 +00:00

Grant the bus keeper its account's information, which every bucket create asks first

mesh/delivery merged: source.main moved to novox/mesh-delivery@3f96301177b1

Details

mesh/check checking 66f31c8e97a6 on f9cadbfdbb93

66f31c8e97

The keeper on novox (nats fea2c02b) has been refused $JS.API.INFO every 30 s since
21:58 UTC: the client library's CreateKeyValue asks the account's information before
it creates a bucket, so each create of KV_distribution_* and KV_gitea_* timed out and
the keeper never finished a fill pass (health failed). Read-only: the account's limits
and usage, never a stream's data.

Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5

mesh-tools commented

2026-11-08 22:07:13 +00:00

Delivery novox/mesh-delivery@66f31c8e97a6 — merged since 2026-11-08T22:07:35Z

Source — source.main moved to novox/mesh-delivery@3f96301177. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-11-08 22:07 (new) → proposed (announced): novox/mesh-delivery#179's head announced
2026-11-08 22:07 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-08 22:07 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-delivery@66f31c8e97a6` — **merged** since 2026-11-08T22:07:35Z **Source** — source.main moved to novox/mesh-delivery@3f96301177b1. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-11-08 22:07 (new) → proposed (announced): novox/mesh-delivery#179's head announced - 2026-11-08 22:07 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-08 22:07 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 3f96301177 into main

2026-11-08 22:07:15 +00:00

mesh-tools deleted branch fix/keeper-account-info

2026-11-08 22:07:15 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-delivery#179