mesh-grants: create a declared module's missing buckets, logs and streams on the event; publish memberships past retired seat verbs (issues 1790, 1945)
#58
Merged
mesh-toolsmerged 2 commits from fix/1790-grants-create-buckets into main2026-10-26 08:17:23 +00:00
Issue 1790 (notes 8-10) and issue 1945 (notes 70, 71).
Creation (issue 1790): when a registered manifest declares a bucket, log or stream the bus lacks, the grants part creates it with the controller's own config (mesh-sdk BucketStreamConfig, ModuleStreamConfig), once, inside Compose (start, watched changes, a tool's ask, a move of the loaded user list): no timer. An existing stream is never touched (NATS refuses a differing CREATE; 'already in use' is held). A refused create is said and tried at the next event. Tool grants_assert asks the same by hand for one module; event asserted. Everything else stays shadow.
Memberships (issue 1945): the shadow-difference guard accepts losing a verb only of a seat the seat catalogue defines with verbs and no longer lists (mark-ready on seat mesh-delivery, retired by mesh-sdk d506f21, ADR 0421), so the 5 memberships held since 2026-10-26 01:24 publish; any other loss is still refused. All held memberships are said and listed by grants_membership.
mesh-sdk pin moved to the composer change of this group.
Review notes left for later: a refused create waits up to 10 s per item in a pass (cmd/mesh-grants/bus.go:20); no test row for dropping a current catalogue verb; keep mesh-grants' mesh-sdk pin at or ahead of other modules'.
Tests: TestGrants subtests (create once, never touch a held stream; refused create said and retried; held memberships listed; retired-verb rows). go test -race -count=5 ./... and go vet -tags integration ./... pass. Rules bent: no mesh-controller.try (operator, 2026-10-25).
Issue: 1790
Issue: 1945
Reviewed-by: review-create-buckets@shanks at 12f16bbebd
Issue 1790 (notes 8-10) and issue 1945 (notes 70, 71).
1. Creation (issue 1790): when a registered manifest declares a bucket, log or stream the bus lacks, the grants part creates it with the controller's own config (mesh-sdk BucketStreamConfig, ModuleStreamConfig), once, inside Compose (start, watched changes, a tool's ask, a move of the loaded user list): no timer. An existing stream is never touched (NATS refuses a differing CREATE; 'already in use' is held). A refused create is said and tried at the next event. Tool `grants_assert` asks the same by hand for one module; event `asserted`. Everything else stays shadow.
2. Memberships (issue 1945): the shadow-difference guard accepts losing a verb only of a seat the seat catalogue defines with verbs and no longer lists (mark-ready on seat mesh-delivery, retired by mesh-sdk d506f21, ADR 0421), so the 5 memberships held since 2026-10-26 01:24 publish; any other loss is still refused. All held memberships are said and listed by `grants_membership`.
3. mesh-sdk pin moved to the composer change of this group.
Review notes left for later: a refused create waits up to 10 s per item in a pass (cmd/mesh-grants/bus.go:20); no test row for dropping a current catalogue verb; keep mesh-grants' mesh-sdk pin at or ahead of other modules'.
Tests: TestGrants subtests (create once, never touch a held stream; refused create said and retried; held memberships listed; retired-verb rows). `go test -race -count=5 ./...` and `go vet -tags integration ./...` pass. Rules bent: no mesh-controller.try (operator, 2026-10-25).
Issue: 1790
Issue: 1945
Reviewed-by: review-create-buckets@shanks at 12f16bbebd4007d7392bddc5bb79e25921e81f6c
The guard that holds back a membership losing anything held back five since 01:24: the frozen
controller's memberships still serve the delivery seat's mark-ready, which mesh-sdk d506f21
retired on purpose (ADR 0421), so every membership composed with today's seat catalogue looked
like a loss. A seat verb the catalogue defines no longer is now dropped from the comparison and
named in the pass (retired); any other loss, a module's own seat's verbs included, is still
refused. The log named only the first held membership: it now says each one, with what it would
lose, whenever the set changes, and grants_membership with neither node nor module lists them.
Issue: 1945
A module's new state reached the bus only when the controller started (issue 1790, met three
times: puts, queues, mesh-vault's bus-accounts). The operator allowed one more grant in the
controller's composer on 2026-10-26 08:54, creation only: the part's process now creates each
bucket, log or stream a placed module's manifest declares and the bus lacks, with the same
configuration the controller asserts (mesh-sdk BucketStreamConfig, Log.Config,
ModuleStreamConfig), on the event that brought the manifest, never on a timer. It says asserted
and logs one line per module; a stream the bus holds is never updated or deleted, its difference
only said; a create refused is said and tried at the next event; one created at this manifest
and gone since is made again only by hand. grants_assert asks the process to do the same for one
module now. The user list, the grants and any change to a held stream stay in shadow. mesh-sdk
moves to fix/1790-grants-create-buckets, whose composer grants this, so the shadow list is
composed as the controller's.
Issue: 1790
Deliverynovox/mesh-delivery@12f16bbebd40 — merged since 2026-10-26T08:17:24Z
Source — source.main moved to novox/mesh-delivery@86db64904b. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.
2026-10-26 08:16 (new) → proposed (announced): novox/mesh-delivery#58's head announced
2026-10-26 08:16 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-26 08:17 ready → merged (merged): on the trunk its modules follow: merged there
The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.
<!-- mesh-delivery:view -->
**Delivery** `novox/mesh-delivery@12f16bbebd40` — **merged** since 2026-10-26T08:17:24Z
**Source** — source.main moved to novox/mesh-delivery@86db64904b2a. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves.
**Group** `fix/1790-grants-create-buckets`: novox/mesh-controller@6927b02d4d58, novox/mesh-delivery@12f16bbebd40, novox/mesh-sdk@136fa8b2a896
**Transitions**
- 2026-10-26 08:16 (new) → proposed (announced): novox/mesh-delivery#58's head announced
- 2026-10-26 08:16 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
- 2026-10-26 08:17 ready → merged (merged): on the trunk its modules follow: merged there
The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Issue 1790 (notes 8-10) and issue 1945 (notes 70, 71).
grants_assertasks the same by hand for one module; eventasserted. Everything else stays shadow.grants_membership.Review notes left for later: a refused create waits up to 10 s per item in a pass (cmd/mesh-grants/bus.go:20); no test row for dropping a current catalogue verb; keep mesh-grants' mesh-sdk pin at or ahead of other modules'.
Tests: TestGrants subtests (create once, never touch a held stream; refused create said and retried; held memberships listed; retired-verb rows).
go test -race -count=5 ./...andgo vet -tags integration ./...pass. Rules bent: no mesh-controller.try (operator, 2026-10-25).Issue: 1790
Issue: 1945
Reviewed-by: review-create-buckets@shanks at
12f16bbebdDelivery
novox/mesh-delivery@12f16bbebd40— merged since 2026-10-26T08:17:24ZSource — source.main moved to novox/mesh-delivery@86db64904b. Whether it reached the machines is
mesh-delivery-view's, derived fromsource.main, the wants and the haves.Group
fix/1790-grants-create-buckets: novox/mesh-controller@6927b02d4d, novox/mesh-delivery@12f16bbebd, novox/mesh-sdk@136fa8b2a8Transitions
The commit's note under
refs/notes/mesh-plankeeps every transition of this change up to its merge:git log --notes=mesh-plan.