F-catalog-B: distribution's front takes no bootstrap credential

The lead's ENG-5 ruling: on a fresh mesh the bootstrap pushes the holders' own images to the store on its
loopback with no credential, so the front's bootstrap token, its file, the bootstrap-push window and the
program's removal of the file go. Fewer secrets; nothing to refuse once a window closes.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/internal/holder/front.go

@@ -1,7 +1,6 @@
 package holder
 
 import (
-	"crypto/subtle"
 	"fmt"
 	"net/http"
 	"net/http/httputil"
@@ -15,7 +14,8 @@ import (
 // protocol's GET and HEAD) stay open to every node's container runtime; a write reaches the store only from
 // distribution's own process, which writes to the loopback directly and never through the front. While the direct-write
 // window is open, a build module's old build still pushes through the front as today, but never to a tag the seat holds
-// published.
+// published. No credential opens it: on a fresh mesh the bootstrap pushes the holders' own images to the store on its
+// loopback, never through the front (design 51 *On a fresh mesh*).
 type Front struct {
 	// Store is the registry container's loopback address.
 	Store *url.URL
@@ -23,9 +23,6 @@ type Front struct {
 	Window *atomic.Bool
 	// Published says whether name holds a tag published through the seat.
 	Published func(name, tag string) (bool, error)
-	// Bootstrap is the bootstrap's one-off credential for the holders' first images (design 51 *On a fresh mesh*):
-	// read on each write, never kept, so the file's removal (BootstrapFile) refuses the next write that carries it.
-	Bootstrap func() (token string, ok bool)
 	Logf      func(string, ...any)
 	proxy     *httputil.ReverseProxy
 }
@@ -40,14 +37,7 @@ func (f *Front) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		f.proxy.ServeHTTP(w, r)
 		return
 	}
-	bootstrap := false
-	if f.Bootstrap != nil {
-		if token, ok := f.Bootstrap(); ok && token != "" {
-			got, has := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
-			bootstrap = has && subtle.ConstantTimeCompare([]byte(got), []byte(token)) == 1
-		}
-	}
-	if !bootstrap && (f.Window == nil || !f.Window.Load()) {
+	if f.Window == nil || !f.Window.Load() {
 		refuse(w, http.StatusForbidden, "DENIED", "the store takes writes from distribution's own process alone: publish through the seat's publish")
 		return
 	}
@@ -62,21 +52,12 @@ func (f *Front) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
-	if bootstrap {
-		if f.Logf != nil {
-			f.Logf("a write %s %s from %s with the bootstrap's one-off credential", r.Method, r.URL.Path, r.RemoteAddr)
-		}
-	} else if f.Logf != nil {
+	if f.Logf != nil {
 		f.Logf("a direct write %s %s from %s, accepted while the direct-write window is open", r.Method, r.URL.Path, r.RemoteAddr)
 	}
 	f.proxy.ServeHTTP(w, r)
 }
 
-// BootstrapFile is where the node-engine's bootstrap gives distribution its one-off credential, in distribution's
-// state directory (0600, distribution's account): one line, the token. The tools bundle removes it when it answers its
-// first publish, so the holders serve publish and the credential is gone (RemoveBootstrap).
-const BootstrapFile = "/var/lib/mesh/registry/bootstrap-push"
-
 // manifestPut is a PUT of /v2/<name>/manifests/<tag>, a tag and not a digest.
 func manifestPut(r *http.Request) (name, tag string, ok bool) {
 	if r.Method != http.MethodPut {

modules/distribution/internal/holder/holder_test.go

@@ -469,9 +469,7 @@ func TestTheHolderOfTheTwoImageSeats(t *testing.T) {
 		defer store.Close()
 		u, _ := url.Parse(store.URL)
 		var open atomic.Bool
-		token, kept := "s3cret", true
-		f := &Front{Store: u, Window: &open, Published: func(name, tag string) (bool, error) { return name == "m/i" && tag == "0.1.3", nil },
-			Bootstrap: func() (string, bool) { return token, kept }}
+		f := &Front{Store: u, Window: &open, Published: func(name, tag string) (bool, error) { return name == "m/i" && tag == "0.1.3", nil }}
 		auth := ""
 		do := func(method, path string) int {
 			rec := httptest.NewRecorder()
@@ -500,24 +498,12 @@ func TestTheHolderOfTheTwoImageSeats(t *testing.T) {
 				t.Errorf("window open %v: %s %s = %d, want %d", c.open, c.method, c.path, got, c.want)
 			}
 		}
-		// The bootstrap's one-off credential writes with the window closed, never over a published tag, and not once
-		// its file is gone; a wrong token writes nothing.
+		// No credential opens the front (the lead's ENG-5 ruling): a write carrying a token, with the window closed, is
+		// refused as any other.
 		open.Store(false)
-		for _, c := range []struct {
-			auth string
-			kept bool
-			path string
-			want int
-		}{
-			{"s3cret", true, "/v2/gitea/program/manifests/0.1.0", http.StatusCreated},
-			{"s3cret", true, "/v2/m/i/manifests/0.1.3", http.StatusForbidden},
-			{"wrong", true, "/v2/gitea/program/manifests/0.1.0", http.StatusForbidden},
-			{"s3cret", false, "/v2/gitea/program/manifests/0.1.0", http.StatusForbidden},
-		} {
-			auth, kept = c.auth, c.kept
-			if got := do(http.MethodPut, c.path); got != c.want {
-				t.Errorf("bootstrap %q kept %v: PUT %s = %d, want %d", c.auth, c.kept, c.path, got, c.want)
-			}
+		auth = "s3cret"
+		if got := do(http.MethodPut, "/v2/gitea/program/manifests/0.1.0"); got != http.StatusForbidden {
+			t.Errorf("a write with a bearer token and the window closed = %d, want %d", got, http.StatusForbidden)
 		}
 	})
 	t.Run("mirror copies an outside image by its pinned digest, every platform, only the parts the store lacks", func(t *testing.T) {

modules/distribution/internal/holder/window.go

@@ -16,10 +16,6 @@ import (
 const (
 	OldNameWindow      = "old-name"
 	DirectWritesWindow = "direct-writes"
-	// BootstrapWindow is the bootstrap's one-off credential (BootstrapFile): open while the file is there. The tools
-	// bundle closes it at its first answered publish; the program, which runs as distribution's account and alone may
-	// remove the file in distribution's state directory, removes it on that close.
-	BootstrapWindow = "bootstrap-push"
 	// WindowFindingAfter is how long a node holds a window open before it is distribution's finding naming the node.
 	WindowFindingAfter = 7 * 24 * time.Hour
 	// The events a window's close says on distribution's own family distribution.events (7 days, 16 MiB, drop