Leave the engine's acts out of its declared state for now, so the bus's user list is composed again (issue 774) #178

2026-10-30T11:49:25Z

mesh-tools commented

2026-10-30 11:49:25 +00:00

Recovery (recovery mode: reviewed + local unit tests, merged by hand). Blocking fault in design 47's release delivery (issue 774).

mesh-grants.grants_user_list refuses every pass: "a second writer would be granted: ace.node-tools may publish $KV.mesh-host_acts.>, whose writer is the node-engine". Source (found after mesh-catalog #563, which aimed at the nats tools' removes and did not end it): the running grants part reads mesh-host's trunk manifest; mesh-host has no account of its own (NoAccount), so sdk users.go runnerServes has every node's tool runner carry it, and nats.go grants a carried module's states to the runtime. writers.go lets only the node account write mesh-host_acts, so the whole list fails. The frozen list (revision 102043) keeps every new permission of the release off the bus: the new vault on novox is refused, novox composes nothing, the controller issues no credentials.

Fix: module.json drops the state acts (keeps health, which no writers row guards); the manifest test follows.

Cost, said: the grants part no longer creates mesh-host_acts. If it does not exist, the node seat's acting verbs (hand-over and access asks, setuid search, the engine's own asks) refuse loudly with "the node-engine's state mesh-host_acts cannot be bound", as they already do today because the frozen list created nothing. The engine's own grant to its keys stays (sdk engineGrants). This change gives mesh-host a new build, delivered to all four machines.

Quick vs thorough: quick (drop the declaration). Thorough after the release: mesh-sdk never carries the engine module in a tool runner (it is its own node account) and CheckWriters refuses one account instead of the whole list; then acts comes back in the manifest.

Tests: go test ./... and go vet ./... pass.

Reviewed-by: rev-host@shanks at ec191247a0

Recovery (recovery mode: reviewed + local unit tests, merged by hand). Blocking fault in design 47's release delivery (issue 774). mesh-grants.grants_user_list refuses every pass: "a second writer would be granted: ace.node-tools may publish $KV.mesh-host_acts.>, whose writer is the node-engine". Source (found after mesh-catalog #563, which aimed at the nats tools' removes and did not end it): the running grants part reads mesh-host's trunk manifest; mesh-host has no account of its own (NoAccount), so sdk users.go runnerServes has every node's tool runner carry it, and nats.go grants a carried module's states to the runtime. writers.go lets only the node account write mesh-host_acts, so the whole list fails. The frozen list (revision 102043) keeps every new permission of the release off the bus: the new vault on novox is refused, novox composes nothing, the controller issues no credentials. Fix: module.json drops the state `acts` (keeps `health`, which no writers row guards); the manifest test follows. Cost, said: the grants part no longer creates mesh-host_acts. If it does not exist, the node seat's acting verbs (hand-over and access asks, setuid search, the engine's own asks) refuse loudly with "the node-engine's state mesh-host_acts cannot be bound", as they already do today because the frozen list created nothing. The engine's own grant to its keys stays (sdk engineGrants). This change gives mesh-host a new build, delivered to all four machines. Quick vs thorough: quick (drop the declaration). Thorough after the release: mesh-sdk never carries the engine module in a tool runner (it is its own node account) and CheckWriters refuses one account instead of the whole list; then `acts` comes back in the manifest. Tests: `go test ./...` and `go vet ./...` pass. Reviewed-by: rev-host@shanks at ec191247a06dfbb2bb9b533c49e7e4275d29f312

mesh-tools added 1 commit 2026-10-30 11:49:25 +00:00

Leave the engine's acts out of its declared state for now, so no node's tool runner carries a grant to the engine's own keys and the grants part composes the bus's user list again (issue 774)

mesh/check checking ec191247a06d on 737bce9c9448

mesh/delivery merged: source.main moved to novox/mesh-host@737bce9c9448

Details

ec191247a0

mesh-tools commented

2026-10-30 11:49:27 +00:00

Delivery novox/mesh-host@ec191247a06d — merged since 2026-10-30T11:51:58Z

Source — source.main moved to novox/mesh-host@737bce9c94. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-10-30 11:49 (new) → proposed (announced): novox/mesh-host#178's head announced
2026-10-30 11:49 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-10-30 11:51 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-host@ec191247a06d` — **merged** since 2026-10-30T11:51:58Z **Source** — source.main moved to novox/mesh-host@737bce9c9448. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-10-30 11:49 (new) → proposed (announced): novox/mesh-host#178's head announced - 2026-10-30 11:49 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-10-30 11:51 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

jschoubben merged commit 737bce9c94 into main

2026-10-30 11:51:57 +00:00

jschoubben deleted branch fix/774-engine-acts-not-carried

2026-10-30 11:51:57 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#178