From 161fba56aea31c9edcfba3a4fe4b111c4018ddea Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Thu, 29 Oct 2026 22:42:21 +0100
Subject: [PATCH] Hold the provisioner's records to one writer in the
 credential table: only mesh-provisioner writes provisions and plans, readers
 only read, and it writes none of the grants part's states (issue 1954 L6-P5,
 ADR 0570 clauses 1, 8)

---
 go/buscompose/buscompose_test.go | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/go/buscompose/buscompose_test.go b/go/buscompose/buscompose_test.go
index dc82f65..97bb99a 100644
--- a/go/buscompose/buscompose_test.go
+++ b/go/buscompose/buscompose_test.go
@@ -603,6 +603,12 @@ func healthChecks(t *testing.T) {
 		{Module: "mesh-healers", State: []Bucket{bucket("mesh-healers", "findings"), bucket("mesh-healers", "attempts"), bucket("mesh-healers", "would")}},
 		{Module: WatchmanModule, State: []Bucket{bucket(WatchmanModule, "findings")}},
 		{Module: "mesh-hand-acts", State: []Bucket{bucket("mesh-hand-acts", "warrants")}, Logs: []Log{{Module: "mesh-hand-acts", Name: "acts"}}},
+		// ADR 0570 clauses 1, 8 (issue 1954 L6-P5): mesh-provisioner keeps provisions and plans; the vault and a provider
+		// read them.
+		{Module: "mesh-provisioner", State: []Bucket{bucket("mesh-provisioner", "provisions"), bucket("mesh-provisioner", "plans"),
+			bucket("mesh-provisioner", "registry")}},
+		{Module: "mesh-vault", Reads: []string{"mesh-provisioner.provisions", "mesh-provisioner.plans"}},
+		{Module: "postgres", Reads: []string{"mesh-provisioner.provisions", "mesh-provisioner.plans"}},
 		{Module: "telegram", Holds: []Seat{{Name: "telegram-sender", Accepts: []string{"send"}}},
 			Processes: []ProcessPrincipal{{Process: "w", Queues: []QueueOwner{{Process: "w", Stream: "M_WORK"}, {Process: "w", Stream: "KV_x"}}}}},
 		{Module: "nats", SnapshotsTheBus: true, Processes: []ProcessPrincipal{{Process: "nats-tools",
@@ -613,8 +619,11 @@ func healthChecks(t *testing.T) {
 		t.Fatal(err)
 	}
 	may := map[string][]string{
-		"a.mesh-conditions": {"$KV.mesh-conditions_conditions.machine.g14.silent"},
-		"a.mesh-hand-acts":  {"$KV.mesh-hand-acts_warrants.mesh-config.ask-1", "mesh.log.mesh-hand-acts.acts.act-1"},
+		"a.mesh-conditions":  {"$KV.mesh-conditions_conditions.machine.g14.silent"},
+		"a.mesh-provisioner": {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak"},
+		"a.mesh-vault": {"$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.a.keycloak.postgres-database",
+			"$JS.API.DIRECT.GET.KV_mesh-provisioner_plans.$KV.mesh-provisioner_plans.a.keycloak"},
+		"a.mesh-hand-acts": {"$KV.mesh-hand-acts_warrants.mesh-config.ask-1", "mesh.log.mesh-hand-acts.acts.act-1"},
 		WatchmanModule: {"$JS.API.CONSUMER.CREATE.DEAD_LETTER_NOTICES." + WatchmanModule, "$JS.API.CONSUMER.MSG.NEXT.DEAD_LETTER_NOTICES." + WatchmanModule,
 			"$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller", "$JS.API.STREAM.MSG.GET.DEAD_LETTERS"},
 		WatchmanModule + " sources": {"$JS.API.STREAM.MSG.GET.EVENTS", "$JS.API.STREAM.INFO.SEAT_TELEGRAM_SENDER",
@@ -626,6 +635,11 @@ func healthChecks(t *testing.T) {
 		// The keeper writes no findings and no attempts; no observer writes the keeper's buckets (clause 2).
 		"a.mesh-conditions": {"$KV.mesh-self-check_findings.x", "$KV.mesh-healers_attempts.x", "$KV.mesh-controller_conditions.x"},
 		"a.mesh-self-check": {"$KV.mesh-conditions_conditions.x", "$KV.mesh-conditions_takeover.switch"},
+		// Only mesh-provisioner writes provisions and plans, and it writes none of the grants part's states (ADR 0570
+		// clauses 1, 8).
+		"a.mesh-provisioner": {"$KV.mesh-grants_accounts.a.m", "$KV.mesh-grants_user-list.sealed"},
+		"a.mesh-vault":       {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak"},
+		"a.postgres":         {"$KV.mesh-provisioner_provisions.a.keycloak.postgres-database", "$KV.mesh-provisioner_plans.a.keycloak"},
 		// Nor mesh-hand-acts' log and warrants, which it alone writes (ADR 0565 clause 10).
 		"a.mesh-healers": {"$KV.mesh-conditions_conditions.x", "$KV.mesh-conditions_takeover.switch",
 			"$KV.mesh-hand-acts_warrants.x", "mesh.log.mesh-hand-acts.acts.x"},