11 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	c28c645ca4	Name the node-engine's data items state, so mesh-host writes and disk-load reads one shape (ADR 0577) ... The contract (state name, key form, value) is in delivery; buscompose grants the engine its own node's keys of mesh-host_data and each node's disk-load a read of its own node's keys alone, the same way the engine's other states are granted. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL	2026-11-01 00:05:38 +01:00
jschoubben	d352fe51b4	Let the bus module's tools delete the stream ASSIGNMENTS at the lease write, the only stream a bus account may delete (issue 774, research 072 row 33)	2026-10-31 09:12:31 +01:00
jschoubben	94d0de5c19	Move the node's health report layout into the sdk and let each node write only its own key while the watchman reads them, so the six machine alerts leave the controller (issue 774)	2026-10-29 22:58:05 +01:00
jschoubben	20cac82ab7	Give the control records their layouts, a person's policy and its one derivation, and the engine's own packages key, so the assigner, the indexer and the nodes keep them without the controller (issue 1953 L5-S2, S3, S4)	2026-10-29 22:14:01 +01:00
jschoubben	69fcb6c1c1	Fit the watchman's grant to what L4 does: hear its watchdogs' words and read a source's age and message, never deliver again or drop, so it holds no more than its job (issue 1952 S5)	2026-10-29 21:44:53 +01:00
jschoubben	2a04bf0ac5	Let the watchman read and delete a given-up message only on the streams dead letters come from, each by name and never a bucket's, so keeping dead letters cannot read every bucket (issue 1952 S5)	2026-10-29 21:43:15 +01:00
jschoubben	5a47192b57	Grant the health holders what ADR 0564 gives them and nothing more: named reads of the lease and the controller's conditions and hand acts, the watchman's own dead-letter consumer, and the bus tools' removal account (issue 1952 S5)	2026-10-29 21:40:49 +01:00
jschoubben	2323ba19db	The node-engine's declared state acts: created by the grants part as a placed module's, its manifest placed on every node, and written by each node's engine under its own keys alone (issue 774, ADR 0563 §2, §3)	2026-10-28 21:54:04 +01:00
jschoubben	175a5567b8	The bus node follows the grants part's sealed user list, and only the grants part reads the vault's hashes (ADR 0547 clauses 7, 9; issue 1945) ... The grants part writes its list as an object of its own bucket, sealed to the bus node's key, and names it in user-list.sealed; the node-engine of the node holding mesh-broker is granted that one key and an object by name, the grants part its bucket (the controller's copy carries the same grants, byte for byte, golden regenerated there). A state may name its readers (announce, NamedReaders): mesh-vault.bus-accounts is read by mesh-grants alone.	2026-10-26 11:53:11 +01:00
jschoubben	8f6ee2fd18	Let the grants part create the streams manifests declare, so a new module state no longer waits for a controller start ... The copied bus composer grants mesh-grants' principal $JS.API.STREAM.CREATE.<stream> and $JS.API.STREAM.INFO.<stream> for each bucket (KV_<module>_<state>), log (LOG_<module>_<log>) and module stream a placed module's manifest declares, each by its own name: NATS wildcards are whole tokens, so nothing narrower than an exact name exists and nothing wider is granted. The writers table lets the grants part create, never update or delete. The operator allowed this one grant on 2026-10-26 08:54, beside the memberships grant of 22:31 (ADR 0547 clause 1 and 5). The expected lists were written again by the controller's own internal/broker with the same change (mesh-control fix/1790-grants-create-buckets); a fixture now places mesh-grants beside the builder's state, log and stream. Issue: 1790	2026-10-26 09:01:32 +01:00
jschoubben	b5f8604d03	Copy the controller's bus composer into mesh-sdk as buscompose, held byte for byte to the controller's lists (issue 1377, ADR 0547 §5) ... The grants part composes the bus's user list with the composer the controller uses (ADR 0547 §5), copied rather than moved: the controller is not changed and keeps its own until it loses the lease. Left out: the bus client, the broker's address from the environment and the client's two methods; the lease's two subjects are copied in. One table test holds the copy to four meshes' lists and the server golden, written by the controller's own internal/broker from the same fixtures (testdata/controller-user-lists.json).	2026-10-25 21:54:58 +01:00