Node agent: compose its own modules from their builds and providers' served keys under its own grant (issue 1126, group fix/1126-node-creds) #153

Merged

mesh-tools merged 6 commits from fix/1126-node-creds into main 2026-10-27 20:32:37 +00:00

Conversation 2 Commits 6 Files Changed 8

+456 -92

6 Commits

Author	SHA1	Message	Date
jschoubben	6a4718b712	Hold in a unit table which haves count a module as run inside the node's own composition, so a failed have naming nothing is caught without H8's timing (issue 1126, review round 2)	2026-10-27 21:29:51 +01:00
jschoubben	d5adf9b72b	Drop two debugging lines from the build read and H8, and say why the refused read's wait stays above the history bound (issue 1126, review round 1)	2026-10-27 21:21:19 +01:00
jschoubben	7365890298	Prove in H8 that a node reads a placed module's build and a provider's served key through its own session, refused without the grant, and take a failed have naming nothing as no module run inside the node's own; pin mesh-sdk 7a8e9f9 (issue 1126, review round 1) ... H8 found it: a module the node could not compose yet got a failed have naming no fingerprint, which counted as run inside the node's own composition, so the next composition took it from its manifest past its build.	2026-10-27 21:18:45 +01:00
jschoubben	0862f97972	Pin mesh-sdk 538ffba, the group's head (issue 1126)	2026-10-27 21:04:02 +01:00
jschoubben	45439fd742	Compose each module from its build and read what providers elsewhere serve, pinning mesh-sdk cebc651, so a self-composing node hands its moved modules and settles mailu's domain (issue 1126) ... The node read a behind module's source manifest digest and composed every module from the indexer's raw manifest; frombus now takes the build itself (Scope.KeptAt, a fingerprint). The reader gives frombus the builder's key, a templates archive fetched as every archive is (apply.Fetch) once per digest and checked against it, and another node's served keys one by one, as the node's grant allows them.	2026-10-27 21:01:16 +01:00
jschoubben	0184e2a5b8	Watch the have bucket only where the node's grant allows, so a node composing itself is not refused by the bus (issue 1126) ... The fold's watch of every have key ('>') was refused (permissions violation on CONSUMER.CREATE KV_node-engine_have), and every self-composing agent stopped after the seed. The composer now watches '*.node' (records) and '<node>.>' (its own haves), as buscompose grants a node; the shadow watches '<node>.>' too. The selfcompose tests check every watch and get against PermissionsFor(KindNode), and the agent's integration tests run the agent as the node under that grant.	2026-10-27 09:27:54 +01:00