Grants creates a one-filter consumer on the plain create subject it is granted (issue 1966, recovery) #181

2026-11-08T22:57:08Z

mesh-tools commented

2026-11-08 22:57:08 +00:00

Recovery fix (recovery-fixes-merge-and-tell; the operator: "you can deliver stuff yourself", 2026-11-08).

Symptom. Grants' pass lists three consumers it cannot create: ASKS.novox_mesh-delivery-indexer, ASKS.shanks_mesh-delivery-builder and FORGE.shanks_mesh-delivery-builder ("no answer in 10s: a create the bus refuses"). The bus refused e.g. $JS.API.CONSUMER.CREATE.ASKS.novox_mesh-delivery-indexer.mesh.stream.mesh-delivery-checker.event.verdict.

Cause. buscompose.ConsumerConfig put a single filter in FilterSubject. For that case nats.go (jetstream/consumer.go:315-319) creates on the filtered subject …CREATE.<stream>.<name>.<filter>. CreateConsumerGrants deliberately grants only the plain subject, because a wildcard in a filter would widen the grant.

Fix. Every filter goes in FilterSubjects, a single one too, so the client uses the plain subject the part is granted. consumerDiffers compares filter lists, not the config's shape, so consumers the bus already holds are unaffected. TestAOneFilterConsumerIsCreatedOnThePlainSubject fails without the fix.

Quick or thorough. Every consumer grants creates goes through this one function, so the quick fix is the thorough one.

Checked locally. go vet ./... and go test ./... in modules/mesh-grants.

Undo. Revert this merge.

https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5

Recovery fix (recovery-fixes-merge-and-tell; the operator: "you can deliver stuff yourself", 2026-11-08). **Symptom.** Grants' pass lists three consumers it cannot create: ASKS.novox_mesh-delivery-indexer, ASKS.shanks_mesh-delivery-builder and FORGE.shanks_mesh-delivery-builder ("no answer in 10s: a create the bus refuses"). The bus refused e.g. `$JS.API.CONSUMER.CREATE.ASKS.novox_mesh-delivery-indexer.mesh.stream.mesh-delivery-checker.event.verdict`. **Cause.** `buscompose.ConsumerConfig` put a single filter in `FilterSubject`. For that case nats.go (jetstream/consumer.go:315-319) creates on the filtered subject `…CREATE.<stream>.<name>.<filter>`. `CreateConsumerGrants` deliberately grants only the plain subject, because a wildcard in a filter would widen the grant. **Fix.** Every filter goes in `FilterSubjects`, a single one too, so the client uses the plain subject the part is granted. `consumerDiffers` compares filter lists, not the config's shape, so consumers the bus already holds are unaffected. `TestAOneFilterConsumerIsCreatedOnThePlainSubject` fails without the fix. **Quick or thorough.** Every consumer grants creates goes through this one function, so the quick fix is the thorough one. **Checked locally.** `go vet ./...` and `go test ./...` in modules/mesh-grants. **Undo.** Revert this merge. https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5

mesh-tools added 1 commit 2026-11-08 22:57:08 +00:00

Grants creates a one-filter consumer on the plain create subject it is granted

mesh/delivery merged: source.main moved to novox/mesh-delivery@fa8258af4e6d

Details

mesh/check checking 56018993e0d9 on fa8258af4e6d

56018993e0

With exactly one filter in FilterSubject, nats.go creates on $JS.API.CONSUMER.CREATE.<stream>.<name>.<filter>,
a subject the grants part is never granted (CreateConsumerGrants keeps filters out of grants), so the creates
of ASKS.novox_mesh-delivery-indexer, ASKS.shanks_mesh-delivery-builder and FORGE.shanks_mesh-delivery-builder
were refused and timed out (2026-11-08, issue 1966). Every filter now goes in FilterSubjects, which the
client creates on the plain subject.

Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5

mesh-tools commented

2026-11-08 22:57:11 +00:00

Delivery novox/mesh-delivery@56018993e0d9 — merged since 2026-11-08T22:57:15Z

Source — source.main moved to novox/mesh-delivery@fa8258af4e. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-11-08 22:57 (new) → proposed (announced): novox/mesh-delivery#181's head announced
2026-11-08 22:57 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-08 22:57 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-delivery@56018993e0d9` — **merged** since 2026-11-08T22:57:15Z **Source** — source.main moved to novox/mesh-delivery@fa8258af4e6d. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-11-08 22:57 (new) → proposed (announced): novox/mesh-delivery#181's head announced - 2026-11-08 22:57 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-08 22:57 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit fa8258af4e into main

2026-11-08 22:57:14 +00:00

mesh-tools deleted branch fix/grants-consumer-plain-create

2026-11-08 22:57:14 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-delivery#181