Move the node's health report layout into the sdk and let each node write only its own key while the watchman reads them, so the six machine alerts leave the controller (issue 774)

2026-10-29 22:58:05 +01:00
parent 58a83249c8
commit 94d0de5c19
5 changed files with 184 additions and 2 deletions
@@ -58,6 +58,12 @@ func engineGrants(p Principal) (pub, sub []string) {
 	if safeSubject.MatchString(p.Node) {
 		pub = append(pub, readGrants(provisions.ProvisionsBucket, p.Node+".>")...)
 	}
+	// And its node's own health report, its key `<node>` alone (issue 774, the operator's alert table): what the watchman
+	// reads for the machine's alerts.
+	if safeSubject.MatchString(p.Node) {
+		pub = append(pub, append([]string{"$KV." + delivery.NodeHealthBucket + "." + p.Node},
+			readGrants(delivery.NodeHealthBucket, p.Node)...)...)
+	}
 	// And its node's declared packages, its own key alone (ADR 0565 clause 6).
 	if safeSubject.MatchString(p.Node) {
 		pub = append(pub, EnginePackagesGrants(p.Node)...)