model-usage bed: prove the usage store end to end (ADR 0054)

A VM bed: a postgres provider and the model-usage consumer on one node, the substrate on the other. A usage event injected into the mesh is upserted into model-usage's provisioned store, asserted at both grains, latest-per-key, and in the clear. Also, in build-module-runtime.sh, add migrate/index.ts and pg.d.ts to the compiled entrypoint set so a module may carry a run-once entry and an ambient type declaration (model-usage uses the latter for the pg driver). The bed surfaced and drove several fixes elsewhere: a short module slug for the S3-key identity bound (ADR 0049), host-network containers getting the mesh's names (mesh-control), and injecting the event from a publisher rather than the pure-consumer store (its account has no publish right by design). Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
2026-09-07 04:07:41 +02:00
parent 8313e78325
commit 9cc3c1ac2a
3 changed files with 461 additions and 3 deletions
@@ -0,0 +1,54 @@
+# The usage context store, proved end to end (novox/hq ADR 0054). A postgres PROVIDER and the
+# model-usage CONSUMER ride one node; the substrate (store, broker, control) owns the other. As in
+# two-node-db, the app-postgres provider and the mesh's own substrate store both want host port 5432,
+# so they cannot share a machine — the substrate lives on `anchor` and NOTHING else, and `laptop`
+# runs postgres plus model-usage. Provider and consumer are co-located on laptop, so only enrolment
+# crosses to anchor, over the underlay both machines already share.
+#
+# The property the bed proves: a usage event emitted into the mesh is upserted into model-usage's
+# provisioned postgres store, at BOTH grains (licence and session, differing only in `consumer`),
+# LATEST-per-key, and IN THE CLEAR — an ordinary select returns the numeric value and its raw payload.
+#
+#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
+#   Build BOTH runtime images into the local daemon first (the scenario stocks and serves them by
+#   digest, which is where the host pulls them from):
+#     scripts/build-module-runtime.sh postgres      /tmp/postgres.tar
+#     scripts/build-module-runtime.sh model-usage   /tmp/model-usage.tar
+scenario: model-usage-bed
+
+segments:
+  hosting:
+    kind: public
+    cidr: [192.0.2.0/24]
+
+machines:
+  # The substrate ONLY: store, broker, control — three containers.
+  anchor:
+    at: { segment: hosting, address: [192.0.2.10] }
+    inbound: allow
+    memory: 4GiB
+    cpus: 4
+  # The postgres PROVIDER (server + broker-bound runtime) and the model-usage CONSUMER (its run-once
+  # migrate and its long-lived event runtime). The 5432-vs-substrate conflict is gone because the
+  # substrate store is on the OTHER node. The runtime images plus postgres:17-alpine are pulled from
+  # the scenario's own registry by digest; forty gigabytes holds them with room to spare.
+  laptop:
+    at: { segment: hosting, address: [192.0.2.20] }
+    inbound: allow
+    memory: 4GiB
+    cpus: 4
+    disk: 40GiB
+
+images:
+  # The first-node substrate: store, broker, control. postgres:17-alpine doubles as postgres's own
+  # service image.
+  - postgres:17-alpine
+  - cloudamqp/lavinmq:latest
+  - mesh-control:development
+  # The per-module runtimes, built by scripts/build-module-runtime.sh and stocked here. Each carries
+  # its module's code — postgres its provisioner, model-usage its consumer, tools and run-once migrate.
+  - mesh-runtime-postgres:development
+  - mesh-runtime-model-usage:development
+
+place:
+  all: [host, runtime]