mesh-grants: take-over and hand-back by the operator's Telegram Approve, the sealed list, and every grant the loaded list holds (issue 1945) #67

Merged

mesh-tools merged 11 commits from feat/1945-user-list-switch into main 2026-10-26 12:21:51 +00:00

Conversation 3 Commits 11 Files Changed 18

+1876 -190

11 Commits

Author	SHA1	Message	Date
jschoubben	5c76c9d3ac	mesh-grants: a list in force with no users kept is checked against the users the bus loaded, so the first list after take-over keeps every user (review of the switch, issue 1945)	2026-10-26 12:54:55 +01:00
jschoubben	f55f150896	mesh-grants: after take-over the list in force is not replaced by one composed past a failed read or one dropping its users for want of a hash; the switch's effect says when the bus node does not watch the key (review of the switch, issue 1945). Pins mesh-sdk c2a410bb.	2026-10-26 12:31:31 +01:00
jschoubben	29cfb8c177	Pin mesh-sdk at the group's head 83ee7769 (issue 1945)	2026-10-26 12:06:58 +01:00
jschoubben	a092ee9ff9	mesh-grants writes the user list sealed to the bus node and names it in user-list.sealed; the switch turns that key; take-over state says switched only once the bus node loaded it (ADR 0547 clauses 7, 8; issue 1945) ... The bus node can only take over a list that exists: each pass composes the accounts block with the vault's hashes, seals it to the key the bus node says in its have, puts it in the part's own object bucket by digest and writes the key with digest, revision, user count, users left out and which list to follow. take-over is refused, naming why, while no list is sealed to the bus node's current key or the loaded list does not grant the bus node its read. Review of fix/1945-takeover-blockers: no responders on the router's record is an error, not 'no record'; an answer whose record cannot be reached is not closed; an ask that failed to publish is taken back at the router; an error acting on an answer is logged. Pins mesh-sdk 175a5567.	2026-10-26 11:59:41 +01:00
jschoubben	4b23db28b3	mesh-grants: an open take-over ask is always closed (router record, expiry, failed publish, any outcome), the switch is said recorded not switched, the refusal condition is cleared, the excuse is limited to the claiming machines' subscriptions (issue 1945)	2026-10-26 11:43:39 +01:00
jschoubben	b0b1cf4f01	mesh-grants: a retired verb and a multiply claimed mesh seat's added subjects are named, not counted, in the comparison (issue 1945)	2026-10-26 11:34:52 +01:00
jschoubben	9a569bfb8d	mesh-grants: derive that a bundle loads from build.artifacts, as the indexer's manifest has no derived bundles, so route-proxy's helper is carried (issue 1945)	2026-10-26 11:33:28 +01:00
jschoubben	75d0eb32be	mesh-grants: take-over and hand-back are asked of the operator on their channel and run on their yes after the refusals; take-over no longer always refused; grants_take_over_state (issue 1945)	2026-10-26 11:26:37 +01:00
jschoubben	ce72b67cef	mesh-grants: hear the condition events through the controller's durable consumer and acknowledge them; the provided mesh-wireguard manifest always wins (issue 1945)	2026-10-26 11:20:42 +01:00
jschoubben	2a94d16834	mesh-grants: ask the controller's root-free verb and wake on its condition events, so a verified sender is composed (issue 1945) ... The part composed every membership with no root-free input, so telegram's verified-sender was dropped and the membership held as a shadow difference. It now asks mesh-controller.root-free for the machines a composition needs, per pass, failing closed and said once, and wakes on root-not-free condition-raised and condition-cleared.	2026-10-26 11:11:43 +01:00
jschoubben	da7baa5e39	mesh-grants: take mesh-wireguard's manifest from mesh-sdk, where the mesh provides it, so its node-tools grants are composed (issue 1945)	2026-10-26 11:11:43 +01:00