Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00
parent ee1b15d7f0
commit 0260ae92f6
646 changed files with 37611 additions and 1861 deletions
@@ -0,0 +1,142 @@
+package main
+
+// The forge's read credential in the agent's home (novox/hq ADR 0365 §4, issue 737).
+//
+// The forge's module mints each node's agent a token of its own account, `agent-<node>`, scoped to read
+// repositories alone, and the vault keeps it for this module on this machine alone (provision `gitea-read`, issue
+// 749). What arrives in this module's state is git's credential-store lines for it, one per origin the forge is
+// reached at. This module places them in the agent's home, a file of mode 0600 written as the agent's account (ADR
+// 0266: no other module writes there), and points every session's git at it through the managed settings'
+// environment: the file's path, never its content. So an agent clones and fetches what its account may read, and no
+// token is printed, typed on a command line or put in an environment a process listing shows.
+//
+// Git's own `store` helper reads the file; on a token the forge rejects it erases that line, and on a password a
+// person typed elsewhere it adds one. Both are undone at the next look (every few seconds): the file holds what the
+// forge issued, and nothing else. A value that is not credential lines — one the mesh made while the forge had not
+// been asked yet — is not placed, and what was placed before is taken back.
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io/fs"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// ForgeProvision is the provision whose credential this is, and the file this module's manifest has it delivered to.
+const (
+	ForgeProvision = "gitea-read"
+	forgeSecret    = "gitea-read.secret"
+)
+
+func (p Paths) forgeSecret() string { return filepath.Join(p.State, forgeSecret) }
+
+// forgeCredentials is where the agent's git reads the credential: under the agent's home, in a directory of the
+// mesh's own.
+func (p Paths) forgeCredentials() string {
+	return filepath.Join(p.Home, ".config", "mesh", "forge.credentials")
+}
+
+// ForgeCredentialLines are the credential lines held, checked: each an http(s) origin with an account and a token,
+// and nothing else. Anything else is refused, said without the value.
+func ForgeCredentialLines(raw string) (string, error) {
+	var lines []string
+	for _, line := range strings.Split(raw, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		u, err := url.Parse(line)
+		if err != nil || (u.Scheme != "https" && u.Scheme != "http") || u.Host == "" || u.User == nil ||
+			u.User.Username() == "" || u.Path != "" || u.RawQuery != "" || u.Fragment != "" {
+			return "", errors.New("what the mesh holds for the forge's read credential is not git credential lines " +
+				"(the forge has not issued it yet, or something else was given)")
+		}
+		if pw, ok := u.User.Password(); !ok || pw == "" {
+			return "", errors.New("a forge credential line names no token")
+		}
+		lines = append(lines, line)
+	}
+	if len(lines) == 0 {
+		return "", errors.New("the forge's read credential is empty")
+	}
+	return strings.Join(lines, "\n") + "\n", nil
+}
+
+// ForgeCredentialHeld says whether this machine holds a forge read credential to place.
+func ForgeCredentialHeld(p Paths) bool {
+	raw, err := os.ReadFile(p.forgeSecret())
+	if err != nil {
+		return false
+	}
+	_, err = ForgeCredentialLines(string(raw))
+	return err == nil
+}
+
+// PlaceForgeCredential puts the forge's read credential in the agent's home as it is held — written, rewritten when
+// it differs, taken back when none is held — and says what it did, or "" when nothing changed. Never the value.
+func PlaceForgeCredential(p Paths) (string, error) {
+	path := p.forgeCredentials()
+	raw, err := os.ReadFile(p.forgeSecret())
+	var lines string
+	var why error
+	switch {
+	case errors.Is(err, fs.ErrNotExist):
+		why = errors.New("this machine holds no forge read credential")
+	case err != nil:
+		return "", fmt.Errorf("the forge's read credential cannot be read: %w", err)
+	default:
+		lines, why = ForgeCredentialLines(string(raw))
+	}
+	if why != nil {
+		if _, err := fsys.Stat(path); errors.Is(err, fs.ErrNotExist) {
+			return "", nil
+		}
+		if err := fsys.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			return "", fmt.Errorf("the forge credential at %s could not be taken back: %w", path, err)
+		}
+		return fmt.Sprintf("forge credential: taken back from %s: %v", path, why), nil
+	}
+	if held, err := fsys.ReadFile(path); err == nil && bytes.Equal(held, []byte(lines)) {
+		if info, err := fsys.Stat(path); err == nil && info.Mode().Perm() == 0o600 {
+			return "", nil
+		}
+	}
+	if err := fsys.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return "", fmt.Errorf("the directory for the forge credential could not be made: %w", err)
+	}
+	tmp := path + ".mesh-tmp"
+	if err := fsys.WriteFile(tmp, []byte(lines), 0o600); err != nil {
+		return "", fmt.Errorf("the forge credential could not be written: %w", err)
+	}
+	if err := fsys.Chmod(tmp, 0o600); err != nil {
+		_ = fsys.Remove(tmp)
+		return "", fmt.Errorf("the forge credential could not be made 0600: %w", err)
+	}
+	if err := fsys.Rename(tmp, path); err != nil {
+		_ = fsys.Remove(tmp)
+		return "", fmt.Errorf("the forge credential could not be put in place: %w", err)
+	}
+	return fmt.Sprintf("forge credential: placed at %s for %d origin(s)", path, strings.Count(lines, "\n")), nil
+}
+
+// forgeEnv is what every session's environment carries for git to read the credential: the file's path in git's
+// configuration from the environment, never the credential. Laid over the operator's `env`, the mesh's keys winning.
+func forgeEnv(managed map[string]any, credentials string) {
+	if credentials == "" {
+		return
+	}
+	env := map[string]any{}
+	if held, ok := managed["env"].(map[string]any); ok {
+		for k, v := range held {
+			env[k] = v
+		}
+	}
+	env["GIT_CONFIG_COUNT"] = "1"
+	env["GIT_CONFIG_KEY_0"] = "credential.helper"
+	env["GIT_CONFIG_VALUE_0"] = "store --file=" + shellQuote(credentials)
+	managed["env"] = env
+}
@@ -0,0 +1,262 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/cgi"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const agentToken = "0123456789abcdef0123456789abcdef01234567"
+
+// privateForge is a forge serving one private repository over git's smart http, to agent-anchor with its token
+// alone, as the forge does for an account a team lets read it.
+func privateForge(t *testing.T) (origin, bare string) {
+	t.Helper()
+	backend := filepath.Join(gitExecPath(t), "git-http-backend")
+	if _, err := os.Stat(backend); err != nil {
+		t.Skipf("git-http-backend is not installed: %v", err)
+	}
+	root := t.TempDir()
+	bare = filepath.Join(root, "private.git")
+	work := t.TempDir()
+	runGit(t, work, nil, "git", "init", "-q", "-b", "main", ".")
+	commit(t, work, "one")
+	runGit(t, root, nil, "git", "clone", "-q", "--bare", work, bare)
+	cgiHandler := &cgi.Handler{Path: backend, Env: []string{"GIT_PROJECT_ROOT=" + root, "GIT_HTTP_EXPORT_ALL=1"}}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user, pass, ok := r.BasicAuth()
+		if !ok || user != "agent-anchor" || pass != agentToken {
+			w.Header().Set("WWW-Authenticate", `Basic realm="Gitea"`)
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		if r.Method == http.MethodPost && strings.HasSuffix(r.URL.Path, "git-receive-pack") {
+			http.Error(w, "read only", http.StatusForbidden)
+			return
+		}
+		cgiHandler.ServeHTTP(w, r)
+	}))
+	t.Cleanup(srv.Close)
+	return srv.URL, bare
+}
+
+func gitExecPath(t *testing.T) string {
+	t.Helper()
+	out, err := exec.Command("git", "--exec-path").Output()
+	if err != nil {
+		t.Skipf("git is not installed: %v", err)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func runGit(t *testing.T, dir string, env []string, name string, args ...string) string {
+	t.Helper()
+	out, err := runErr(dir, env, name, args...)
+	if err != nil {
+		t.Fatalf("%s %v: %v\n%s", name, args, err, out)
+	}
+	return out
+}
+
+func runErr(dir string, env []string, name string, args ...string) (string, error) {
+	cmd := exec.Command(name, args...)
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@t", "GIT_COMMITTER_NAME=t",
+		"GIT_COMMITTER_EMAIL=t@t", "GIT_TERMINAL_PROMPT=0", "GIT_ASKPASS=", "SSH_ASKPASS=")
+	cmd.Env = append(cmd.Env, env...)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+func commit(t *testing.T, dir, text string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, "file"), []byte(text+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	runGit(t, dir, nil, "git", "add", "file")
+	runGit(t, dir, nil, "git", "commit", "-q", "-m", text)
+}
+
+// sessionEnv is the environment a session starts with: the managed settings' `env`, in a home with no git
+// configuration of its own.
+func sessionEnv(t *testing.T, home, managedSettings string) []string {
+	t.Helper()
+	var settings struct {
+		Env map[string]string `json:"env"`
+	}
+	if err := json.Unmarshal([]byte(managedSettings), &settings); err != nil {
+		t.Fatal(err)
+	}
+	env := []string{"HOME=" + home, "XDG_CONFIG_HOME=" + filepath.Join(home, ".config"), "GIT_CONFIG_NOSYSTEM=1"}
+	for k, v := range settings.Env {
+		env = append(env, k+"="+v)
+	}
+	return env
+}
+
+func forgePaths(t *testing.T) Paths {
+	t.Helper()
+	return Paths{State: t.TempDir(), Home: t.TempDir(), Node: "anchor"}
+}
+
+func managedFor(p Paths) string {
+	facts := Facts{Node: p.Node, Console: "http://console"}
+	if ForgeCredentialHeld(p) {
+		facts.ForgeCredentials = p.forgeCredentials()
+	}
+	return Render(facts, Settings{}, nil, "", nil, Config{})["managed-settings.json"]
+}
+
+// Issue 737's done-when, as far as a machine of its own proves it: an agent session clones a private repository and
+// fetches it again, and no credential appears in a log, a command line or the session.
+func TestAnAgentClonesAPrivateRepositoryAndFetchesItAgainWithTheCredentialPlaced(t *testing.T) {
+	origin, bare := privateForge(t)
+	p := forgePaths(t)
+	repo := origin + "/private.git"
+
+	// Before the forge issued anything, the session's git has no credential: the clone is refused, as today.
+	before := sessionEnv(t, p.Home, managedFor(p))
+	if out, err := runErr(t.TempDir(), before, "git", "clone", "-q", repo, "x"); err == nil {
+		t.Fatalf("a private repository was cloned with no credential:\n%s", out)
+	}
+
+	// The vault hands this module what the forge issued for this machine's agent.
+	lines := strings.Replace(origin, "http://", "http://agent-anchor:"+agentToken+"@", 1) + "\n" +
+		"https://agent-anchor:" + agentToken + "@git.example.test\n"
+	if err := os.WriteFile(p.forgeSecret(), []byte(lines), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	said, err := PlaceForgeCredential(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(p.forgeCredentials())
+	if err != nil || info.Mode().Perm() != 0o600 {
+		t.Fatalf("the credential file: %v %v, want mode 0600", info, err)
+	}
+	if again, err := PlaceForgeCredential(p); err != nil || again != "" {
+		t.Fatalf("placed again with nothing changed: %q %v", again, err)
+	}
+	managed := managedFor(p)
+	env := sessionEnv(t, p.Home, managed)
+
+	work := t.TempDir()
+	cloneOut := runGit(t, work, env, "git", "clone", repo, "clone")
+	clone := filepath.Join(work, "clone")
+	if got := runGit(t, clone, env, "git", "log", "--format=%s"); strings.TrimSpace(got) != "one" {
+		t.Fatalf("cloned %q", got)
+	}
+
+	// The forge's repository moves on; the agent fetches it again.
+	other := t.TempDir()
+	runGit(t, other, nil, "git", "clone", "-q", bare, "w")
+	commit(t, filepath.Join(other, "w"), "two")
+	runGit(t, filepath.Join(other, "w"), nil, "git", "push", "-q", "origin", "main")
+	fetchOut := runGit(t, clone, env, "git", "fetch", "origin")
+	if got := runGit(t, clone, env, "git", "log", "--format=%s", "origin/main"); !strings.HasPrefix(got, "two") {
+		t.Fatalf("fetched %q", got)
+	}
+
+	// A push is the forge's to refuse (ADR 0365 §5): the token reads, and nothing writes with it.
+	commit(t, clone, "three")
+	if out, err := runErr(clone, env, "git", "push", "origin", "main"); err == nil {
+		t.Fatalf("a push with the agent's credential went through:\n%s", out)
+	}
+
+	// No credential in what the session saw, its command lines, its environment or the module's words.
+	remote := runGit(t, clone, env, "git", "remote", "get-url", "origin")
+	for what, text := range map[string]string{"the clone's output": cloneOut, "the fetch's output": fetchOut,
+		"the remote's url": remote, "the managed settings": managed, "the session's environment": strings.Join(env, "\n"),
+		"what the module said": said, "the clone's configuration": readOrEmpty(filepath.Join(clone, ".git", "config"))} {
+		if strings.Contains(text, agentToken) {
+			t.Errorf("the token appears in %s", what)
+		}
+	}
+}
+
+func readOrEmpty(path string) string {
+	raw, _ := os.ReadFile(path)
+	return string(raw)
+}
+
+func TestWhatGitChangedInTheFileIsPutBackAndAValueNotIssuedIsNeverPlaced(t *testing.T) {
+	p := forgePaths(t)
+	// A value the mesh made while the forge had not been asked: not credential lines, never placed.
+	if err := os.WriteFile(p.forgeSecret(), []byte("Zm9yZ2VkLWJ5LXRoZS1tZXNo\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if said, err := PlaceForgeCredential(p); err != nil || said != "" {
+		t.Fatalf("%q %v", said, err)
+	}
+	if _, err := os.Stat(p.forgeCredentials()); err == nil {
+		t.Fatal("a value the forge did not issue was placed")
+	}
+	if ForgeCredentialHeld(p) || strings.Contains(managedFor(p), "GIT_CONFIG") {
+		t.Fatal("the sessions' git is pointed at a credential that is not held")
+	}
+
+	issued := "https://agent-anchor:" + agentToken + "@git.example.test\n"
+	if err := os.WriteFile(p.forgeSecret(), []byte(issued), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := PlaceForgeCredential(p); err != nil {
+		t.Fatal(err)
+	}
+	// git's store helper erased the line after a rejection, and a person's password for another host was stored.
+	if err := os.WriteFile(p.forgeCredentials(), []byte("https://me:mine@example.org\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if said, err := PlaceForgeCredential(p); err != nil || !strings.Contains(said, "placed") {
+		t.Fatalf("%q %v", said, err)
+	}
+	if got := readOrEmpty(p.forgeCredentials()); got != issued {
+		t.Fatalf("the file holds %q", strings.ReplaceAll(got, agentToken, "<token>"))
+	}
+	if info, _ := os.Stat(p.forgeCredentials()); info.Mode().Perm() != 0o600 {
+		t.Fatalf("mode %v", info.Mode().Perm())
+	}
+
+	// The credential withdrawn: taken back, and the sessions' git no longer pointed at it.
+	if err := os.Remove(p.forgeSecret()); err != nil {
+		t.Fatal(err)
+	}
+	if said, err := PlaceForgeCredential(p); err != nil || !strings.Contains(said, "taken back") || strings.Contains(said, agentToken) {
+		t.Fatalf("%q %v", said, err)
+	}
+	if _, err := os.Stat(p.forgeCredentials()); err == nil {
+		t.Fatal("a withdrawn credential stayed in the agent's home")
+	}
+}
+
+func TestTheSessionsGitIsPointedAtTheFileUnderTheOperatorsOwnEnvironment(t *testing.T) {
+	managed := map[string]any{"env": map[string]any{"FOO": "bar", "GIT_CONFIG_COUNT": "7"}}
+	forgeEnv(managed, "/home/agent/.config/mesh/forge.credentials")
+	env := managed["env"].(map[string]any)
+	if env["FOO"] != "bar" || env["GIT_CONFIG_COUNT"] != "1" || env["GIT_CONFIG_KEY_0"] != "credential.helper" ||
+		env["GIT_CONFIG_VALUE_0"] != "store --file='/home/agent/.config/mesh/forge.credentials'" {
+		t.Fatalf("%v", env)
+	}
+	none := map[string]any{}
+	forgeEnv(none, "")
+	if _, set := none["env"]; set {
+		t.Fatal("an environment was set with no credential held")
+	}
+}
+
+func TestForgeCredentialLinesAreReadStrictly(t *testing.T) {
+	for _, bad := range []string{"", "\n", "token", "https://git.example.test", "https://agent-anchor@git.example.test",
+		"https://agent-anchor:t@git.example.test/novox/hq.git", "ssh://agent-anchor:t@git.example.test",
+		"https://agent-anchor:t@git.example.test\nnot a line"} {
+		if _, err := ForgeCredentialLines(bad); err == nil {
+			t.Errorf("%q was taken", bad)
+		} else if strings.Contains(err.Error(), "t@git") {
+			t.Errorf("the refusal said the value: %v", err)
+		}
+	}
+}
@@ -585,7 +585,25 @@ func run(p Paths, view *ServerView, configView *ConfigView) {

 	report()
 	var last string
+	// The forge's read credential (forge.go, ADR 0365 §4): placed as held, and put back when git or a person changed
+	// it; the sessions' environment names it only while one is held.
+	forgeHeld := ForgeCredentialHeld(p)
+	placeForge := func() {
+		if line, err := PlaceForgeCredential(p); err != nil {
+			say("%v", err)
+		} else if line != "" {
+			say("%s", line)
+		}
+		if held := ForgeCredentialHeld(p); held != forgeHeld {
+			forgeHeld = held
+			if _, err := RenderNow(p, writeManaged); err != nil {
+				say("rendering after the forge's read credential changed: %v", err)
+			}
+		}
+	}
+	placeForge()
 	for range time.Tick(5 * time.Second) {
+		placeForge()
 		info, err := fsys.Stat(p.credentials())
 		now := "absent"
 		if err == nil {
@@ -216,6 +216,9 @@ func RenderNow(p Paths, write WriteManaged) ([]string, error) {
 	if !readJSON(p.Facts, &facts) || facts.Console == "" {
 		return nil, fmt.Errorf("the mesh has not rendered %s yet; nothing to write", p.Facts)
 	}
+	if ForgeCredentialHeld(p) {
+		facts.ForgeCredentials = p.forgeCredentials()
+	}
 	var settings Settings
 	readJSON(p.Settings, &settings)
 	var binding *Binding
@@ -34,6 +34,9 @@ const meshEntry = "mesh"
 type Facts struct {
 	Node    string `json:"node"`
 	Console string `json:"console"`
+	// ForgeCredentials is the forge's read credential placed in the agent's home, when this machine holds one
+	// (forge.go): its path, which every session's git is pointed at. Never rendered by the mesh.
+	ForgeCredentials string `json:"-"`
 }

 // Settings are the operator's, for the mesh or this node.
@@ -139,6 +142,7 @@ func RenderWithMesh(facts Facts, settings Settings, binding *Binding, helperPath
 		}
 		managed[key] = entries
 	}
+	forgeEnv(managed, facts.ForgeCredentials)
 	if binding != nil && binding.Kind == "api-key" {
 		managed["apiKeyHelper"] = helperPath
 	}
@@ -19,11 +19,12 @@ const agentAccountFile = "/etc/claude-code/agent-account"

 type manifestShell struct {
 	Resources []map[string]any `json:"resources"`
-	Shell     []struct {
-		For  string `json:"for"`
-		Slot string `json:"slot"`
-		Code string `json:"code"`
-	} `json:"shell"`
+	// The zsh code is an item of the collection shell:zsh:<slot> (novox/hq ADR 0349 clause 13), its text the
+	// template file beside the manifest.
+	Items []struct {
+		Collection string `json:"collection"`
+		Template   string `json:"template"`
+	} `json:"items"`
 }

 func readManifestShell(t *testing.T) manifestShell {
@@ -54,9 +55,13 @@ func resourceByID(t *testing.T, m manifestShell, id string) map[string]any {
 func zshCode(t *testing.T, m manifestShell) string {
 	t.Helper()
 	var code []string
-	for _, s := range m.Shell {
-		if s.For == "zsh" {
-			code = append(code, s.Code)
+	for _, it := range m.Items {
+		if strings.HasPrefix(it.Collection, "shell:zsh:") {
+			text, err := os.ReadFile(filepath.Join("..", "..", it.Template))
+			if err != nil {
+				t.Fatal(err)
+			}
+			code = append(code, string(text))
 		}
 	}
 	if len(code) != 1 {
@@ -71,8 +76,8 @@ func TestTheAccountAgentsRunAsIsWrittenForTheShell(t *testing.T) {
 	if r["type"] != "file" || r["path"] != agentAccountFile || r["mode"] != "0644" {
 		t.Fatalf("the account's file is %v", r)
 	}
-	if r["content"] != "${machine:agent-account}\n" {
-		t.Fatalf("the account's file holds %q", r["content"])
+	if text := templateText(t, r); text != "${machine:agent-account}\n" {
+		t.Fatalf("the account's file holds %q", text)
 	}
 	if _, has := r["owner"]; has {
 		t.Fatal("the account's file must be root's, as claude-agent is")
@@ -163,7 +168,7 @@ func TestClaudeAgentRunsTheRealClaudeUnderTheAlias(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	start, _ := resourceByID(t, readManifestShell(t), "start")["content"].(string)
+	start := templateText(t, resourceByID(t, readManifestShell(t), "start"))
 	if !strings.Contains(start, "exec claude \"$@\"") {
 		t.Fatalf("claude-agent no longer runs claude itself:\n%s", start)
 	}
@@ -0,0 +1,64 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// The module's directory, where its manifest and its files/ are.
+const moduleDir = "../.."
+
+// templateText is the text a file resource places on the machine: its template's, in the module's files/
+// (novox/hq ADR 0349 §2). A resource that names no template, or a template that is not there, fails the test.
+func templateText(t *testing.T, r map[string]any) string {
+	t.Helper()
+	name, _ := r["template"].(string)
+	if name == "" {
+		t.Fatalf("resource %v names no template", r["id"])
+	}
+	raw, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(name)))
+	if err != nil {
+		t.Fatalf("resource %v names %s: %v", r["id"], name, err)
+	}
+	return string(raw)
+}
+
+// No file resource carries its text inline: each names its template in files/, and the build packs files/
+// into the one archive the controller reads the templates back from (novox/hq ADR 0349 §2).
+func TestEveryFileTakesItsTextFromATemplate(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join(moduleDir, "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		Resources []map[string]any `json:"resources"`
+		Build     struct {
+			Artifacts []map[string]any `json:"artifacts"`
+		} `json:"build"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range m.Resources {
+		if _, inline := r["content"]; inline {
+			t.Errorf("resource %v keeps its text inline: keep it in files/ and name it as the template", r["id"])
+		}
+		if r["type"] == "file" {
+			templateText(t, r)
+		}
+	}
+	packs := 0
+	for _, a := range m.Build.Artifacts {
+		if a["kind"] == "archive" && a["from"] == "files" {
+			packs++
+			if a["name"] != "files" {
+				t.Errorf("the templates archive is named %v, not files", a["name"])
+			}
+		}
+	}
+	if packs != 1 {
+		t.Errorf("the build packs files/ into %d archives, not one", packs)
+	}
+}