The node-engine trusts the vault alone, loads the grants part's user list alone and applies only its own compositions (issue 1126) #196

2026-11-02T09:44:18Z

mesh-tools commented

2026-11-02 09:44:18 +00:00

Issue 1126 (design 47): the controller ended by its unassignment (2026-11-02 10:09); its lease is never handed, so the node-engine's gates on it are removed:

Trust: each node-engine trusts the vault's key alone; an ask the controller signs is refused. Checked before the push: every node (ace, g14, novox, shanks) already trusts the vault's key (mesh-delivery-view.node_trusts).
The bus's users: the bus node writes the grants part's user list alone; an unreadable or deleted grants key keeps the loaded list; with none ever heard nothing is written. No fallback to a controller list nobody writes. (The user-list file's location is still read from the composition of the bus node, location only; issue 1126's removal step gives it another source.)
Compositions: a node applies only what it composes itself from placement; a candidate deleting the node's own placement is refused.

Tested locally (GOWORK=off, TMPDIR short): gofmt, go vet, go vet -tags integration, the untagged suite (1263 unit, unchanged), and the integration tests of internal/userlist and internal/link, including the node-composes-its-own test, pass. Three integration tests of the removed controller-composition path were deleted (integration 7 -> 4); what still exists stays covered.

Reviewed-by: review-g1@shanks at 38d666f223
Pushed-by: lead-47@shanks

https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Issue 1126 (design 47): the controller ended by its unassignment (2026-11-02 10:09); its lease is never handed, so the node-engine's gates on it are removed: - **Trust:** each node-engine trusts the vault's key alone; an ask the controller signs is refused. Checked before the push: every node (ace, g14, novox, shanks) already trusts the vault's key (`mesh-delivery-view.node_trusts`). - **The bus's users:** the bus node writes the grants part's user list alone; an unreadable or deleted grants key keeps the loaded list; with none ever heard nothing is written. No fallback to a controller list nobody writes. (The user-list file's location is still read from the composition of the bus node, location only; issue 1126's removal step gives it another source.) - **Compositions:** a node applies only what it composes itself from placement; a candidate deleting the node's own placement is refused. **Tested locally** (GOWORK=off, TMPDIR short): gofmt, `go vet`, `go vet -tags integration`, the untagged suite (1263 unit, unchanged), and the integration tests of internal/userlist and internal/link, including the node-composes-its-own test, pass. Three integration tests of the removed controller-composition path were deleted (integration 7 -> 4); what still exists stays covered. Reviewed-by: review-g1@shanks at 38d666f223902d4cd421a85a592f4d1dae2943e3 Pushed-by: lead-47@shanks https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools added 2 commits 2026-11-02 09:44:18 +00:00

Trust the vault's key alone and write the grants part's user list alone 5cfc4ff4a7

The controller ended by its unassignment and its lease is never handed, so
the engine's lease gate kept trusting the controller's key and the bus node
kept the controller's list as a fallback nobody writes (issue 1126, A6).
The engine now trusts no controller signature, its hand-over line names the
node seat's hand-over, and the user-list follower writes only the grants
part's list: a key unreadable or deleted keeps the list loaded, and with no
key heard nothing is written. Compositions in the node's bucket name the
file's place alone. The guard no longer asks for the controller's user.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

Apply only the node's own compositions, never the controller's

mesh/delivery merged: source.main moved to novox/mesh-host@84737f4cb26d

Details

mesh/check being carried to 38d666f22390 on 84737f4cb26d | from 14a12cc7b6f9

38d666f223

The controller ended by its unassignment, so a node that falls back to the
compositions in its bucket follows what nobody writes (issue 1126, A7). The
node agent now always runs its own composer: without a placement key it
composes nothing and keeps what runs, a placement it cannot watch stops the
agent and is said, and a candidate taking its placement away is refused
instead of answered as a return to the controller. The start-time placement
read, the end-when-placed watchers and the returning answer go, with their
tests and the three integration tests of the controller-composed path.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

mesh-tools commented

2026-11-02 09:44:21 +00:00

Delivery novox/mesh-host@38d666f22390 — merged since 2026-11-02T09:51:18Z

Source — source.main moved to novox/mesh-host@84737f4cb2. Whether it reached the machines is mesh-delivery-view's, derived from source.main, the wants and the haves.

Transitions

2026-11-02 09:44 (new) → proposed (announced): novox/mesh-host#196's head announced
2026-11-02 09:44 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false)
2026-11-02 09:51 ready → merged (merged): on the trunk its modules follow: merged there

The commit's note under refs/notes/mesh-plan keeps every transition of this change up to its merge: git log --notes=mesh-plan.

**Delivery** `novox/mesh-host@38d666f22390` — **merged** since 2026-11-02T09:51:18Z **Source** — source.main moved to novox/mesh-host@84737f4cb26d. Whether it reached the machines is `mesh-delivery-view`'s, derived from `source.main`, the wants and the haves. **Transitions** - 2026-11-02 09:44 (new) → proposed (announced): novox/mesh-host#196's head announced - 2026-11-02 09:44 proposed → ready (accepted): a verdict names this commit and the trunk's head as its trunk commit, the gate passed or warned, and the repository's own check did not fail; or the check gates no merge (check-gates-merge false) - 2026-11-02 09:51 ready → merged (merged): on the trunk its modules follow: merged there The commit's note under `refs/notes/mesh-plan` keeps every transition of this change up to its merge: `git log --notes=mesh-plan`.

mesh-tools merged commit 84737f4cb2 into main

2026-11-02 09:51:16 +00:00

mesh-tools deleted branch fix/1126-gates-host

2026-11-02 09:51:16 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#196