From df929b48b5cb23b31f1f473f663fb5b1a45cc3fb Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Tue, 3 Nov 2026 15:29:47 +0100
Subject: [PATCH] Leave the own secret ledgers out of node-tools' manifest
 until the vault holds it on every machine, reading a missing file as no
 ledger credentials; grant the test's ledger account as the grants part does
 (issue 1966 T6)

---
 node-tools/internal/runtime/ledger_credentials.go   |  4 +++-
 .../internal/runtime/ledger_credentials_test.go     | 13 +++++++------
 node-tools/module.json                              |  3 +--
 3 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/node-tools/internal/runtime/ledger_credentials.go b/node-tools/internal/runtime/ledger_credentials.go
index 3abca81..5b26218 100644
--- a/node-tools/internal/runtime/ledger_credentials.go
+++ b/node-tools/internal/runtime/ledger_credentials.go
@@ -19,7 +19,9 @@ import (
 // that module's own ledger connection**; everything else stays on the runner's own.
 
 // LedgersFile is where the runner reads its own secret `ledgers`: MESH_LEDGERS_FILE when set, else beside its broker
-// credential, both in its directory mesh-state (node-tools' manifest: `${dir:mesh-state}/ledgers`).
+// credential, both in its directory mesh-state (`${dir:mesh-state}/ledgers`). Its manifest declares the secret only once
+// the vault holds it on every machine (B3 of issue 1966): until then a file not there means no ledger credentials, and
+// every ledger write is refused naming the missing one.
 const LedgersFile = "MESH_LEDGERS_FILE"
 
 // LedgersFileOf is the path of the secret `ledgers` for a runtime whose broker credential is at broker.
diff --git a/node-tools/internal/runtime/ledger_credentials_test.go b/node-tools/internal/runtime/ledger_credentials_test.go
index 783cddb..c96afd5 100644
--- a/node-tools/internal/runtime/ledger_credentials_test.go
+++ b/node-tools/internal/runtime/ledger_credentials_test.go
@@ -29,8 +29,11 @@ func TestALedgerIsWrittenOnlyOnItsModulesLedgerConnection(t *testing.T) {
 	users := []*server.User{
 		{Username: "node-tools", Password: "pw", Permissions: &server.Permissions{
 			Publish: &server.SubjectPermission{Allow: []string{">"}, Deny: ledgerSubjects}}},
+		// As the grants part composes a ledger account (mesh-grants buscompose ledgerPermissions): publish on its
+		// module's ledger histories and snapshots, subscribe its own inbox, nothing else.
 		{Username: "ledger.anchor.m", Password: "pw", Permissions: &server.Permissions{
-			Publish: &server.SubjectPermission{Allow: append([]string{"$JS.API.>", "_INBOX.>"}, ledgerSubjects...)}}},
+			Publish:   &server.SubjectPermission{Allow: ledgerSubjects},
+			Subscribe: &server.SubjectPermission{Allow: []string{"_INBOX.ledger.anchor.m.>"}}}},
 		{Username: "admin", Password: "pw"},
 	}
 	s, err := server.NewServer(&server.Options{Host: "127.0.0.1", Port: server.RANDOM_PORT, JetStream: true, StoreDir: t.TempDir(),
@@ -92,10 +95,8 @@ func TestALedgerIsWrittenOnlyOnItsModulesLedgerConnection(t *testing.T) {
 		return nil
 	})
 
+	// Not there yet, as on a machine whose vault has not made it: no ledger credentials, and the runner serves on.
 	file := filepath.Join(t.TempDir(), "ledgers")
-	if err := os.WriteFile(file, []byte(`{}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
 	creds := FollowLedgerCredentials(file, bus.Dial, t.Logf)
 	t.Cleanup(creds.Stop)
 	all := &consumers{conn: conn, logf: t.Logf, of: map[string]*moduleEvents{}}
@@ -106,8 +107,8 @@ func TestALedgerIsWrittenOnlyOnItsModulesLedgerConnection(t *testing.T) {
 		return err
 	}
 
-	// Missing: refused, naming it.
-	if err := apply("decision/1"); err == nil || !strings.Contains(err.Error(), "m's ledger credential is missing from the tool runner's own secret ledgers") {
+	// Missing: refused, naming it and why.
+	if err := apply("decision/1"); err == nil || !strings.Contains(err.Error(), "m's ledger credential is missing from the tool runner's own secret ledgers (the file "+file+" is not there yet)") {
 		t.Fatalf("an apply with no credential: %v", err)
 	}
 	// Written: taken without a restart, on m's connection (the runner's own account is denied m's ledger subjects, so an
diff --git a/node-tools/module.json b/node-tools/module.json
index e456563..e6cb6db 100644
--- a/node-tools/module.json
+++ b/node-tools/module.json
@@ -28,8 +28,7 @@
     }
   },
   "own-secrets": {
-    "broker": "${dir:mesh-state}/broker",
-    "ledgers": "${dir:mesh-state}/ledgers"
+    "broker": "${dir:mesh-state}/broker"
   },
   "listens": [
     {