The bus node follows the grants part's sealed user list, and only the grants part reads the vault's hashes (ADR 0547 clauses 7, 9; issue 1945)

The grants part writes its list as an object of its own bucket, sealed to the bus node's key, and names it in
user-list.sealed; the node-engine of the node holding mesh-broker is granted that one key and an object by name, the
grants part its bucket (the controller's copy carries the same grants, byte for byte, golden regenerated there).
A state may name its readers (announce, NamedReaders): mesh-vault.bus-accounts is read by mesh-grants alone.

go/announce/announce.go

@@ -46,6 +46,9 @@ func Key(module string) (string, error) {
 type State struct {
 	Name     string `json:"name"`
 	Readable bool   `json:"readable,omitempty"`
+	// Readers, when named, are the only modules that may read the state (novox/hq ADR 0547 clause 9, issue 1945): a
+	// state readable by some and not all, such as the vault's bus account hashes. Naming readers makes it readable.
+	Readers []string `json:"readers,omitempty"`
 }
 
 // States is an announcement: the module, the machine whose instance said it, and every state the module keeps, sorted
@@ -67,11 +70,31 @@ func (s States) Keeps(state string) bool {
 	return false
 }
 
+// ReadableBy says whether the module announced the state readable by reader: readable, and reader among the readers
+// when it names any.
+func (s States) ReadableBy(state, reader string) bool {
+	for _, k := range s.States {
+		if k.Name != state {
+			continue
+		}
+		if len(k.Readers) > 0 {
+			for _, r := range k.Readers {
+				if r == reader {
+					return true
+				}
+			}
+			return false
+		}
+		return k.Readable
+	}
+	return false
+}
+
 // Readable says whether the module announced the state readable by others.
 func (s States) Readable(state string) bool {
 	for _, k := range s.States {
 		if k.Name == state {
-			return k.Readable
+			return k.Readable || len(k.Readers) > 0
 		}
 	}
 	return false
@@ -93,6 +116,11 @@ func (s *States) check() error {
 			return fmt.Errorf("announce: %s announces the state %q twice", s.Module, k.Name)
 		}
 		seen[k.Name] = true
+		for _, r := range k.Readers {
+			if !name.MatchString(r) {
+				return fmt.Errorf("announce: %s names %q as a reader of %s, and a reader is a module: lower-case letters, digits and hyphens", s.Module, r, k.Name)
+			}
+		}
 	}
 	return nil
 }

go/announce/announce_test.go

@@ -9,7 +9,8 @@ import (
 // own event subject, in a versioned value the controller keeps by module.
 func TestAnAnnouncementRoundTripsSortedAndSaysWhatIsReadable(t *testing.T) {
 	data, err := Encode(States{Module: "mesh-controller", Node: "novox", States: []State{
-		{Name: "plans-building", Readable: true}, {Name: "assignments", Readable: true}, {Name: "own"}}})
+		{Name: "plans-building", Readable: true}, {Name: "assignments", Readable: true}, {Name: "own"},
+		{Name: "hashes", Readers: []string{"mesh-grants"}}}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -24,12 +25,17 @@ func TestAnAnnouncementRoundTripsSortedAndSaysWhatIsReadable(t *testing.T) {
 	for _, s := range back.States {
 		names = append(names, s.Name)
 	}
-	if strings.Join(names, ",") != "assignments,own,plans-building" {
+	if strings.Join(names, ",") != "assignments,hashes,own,plans-building" {
 		t.Fatalf("the states are not sorted: %v", names)
 	}
 	if !back.Readable("plans-building") || back.Readable("own") || back.Readable("absent") {
 		t.Fatal("Readable does not say what was announced readable")
 	}
+	// Named readers (ADR 0547 clause 9): the state is readable, by them alone.
+	if !back.Readable("hashes") || !back.ReadableBy("hashes", "mesh-grants") || back.ReadableBy("hashes", "spy") ||
+		!back.ReadableBy("plans-building", "spy") || back.ReadableBy("own", "spy") {
+		t.Fatal("ReadableBy does not say who was named")
+	}
 	if !back.Keeps("own") || back.Keeps("absent") {
 		t.Fatal("Keeps does not say what was announced")
 	}
@@ -57,6 +63,7 @@ func TestAnAnnouncementRefusesWhatNoBucketCouldBe(t *testing.T) {
 		{States{Module: "a", States: []State{{Name: "x_y"}}}, `"x_y"`},
 		{States{Module: "a", States: []State{{Name: ""}}}, `""`},
 		{States{Module: "a", States: []State{{Name: "x"}, {Name: "x", Readable: true}}}, "twice"},
+		{States{Module: "a", States: []State{{Name: "x", Readers: []string{"b.c"}}}}, `"b.c"`},
 	} {
 		if _, err := Encode(c.s); err == nil || !strings.Contains(err.Error(), c.says) {
 			t.Errorf("%+v: %v, wanted a refusal saying %s", c.s, err, c.says)