F-catalog-B: distribution's front takes no bootstrap credential

The lead's ENG-5 ruling: on a fresh mesh the bootstrap pushes the holders' own images to the store on its
loopback with no credential, so the front's bootstrap token, its file, the bootstrap-push window and the
program's removal of the file go. Fewer secrets; nothing to refuse once a window closes.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/distribution/cmd/distribution-tools/main.go

@@ -80,27 +80,6 @@ func finding(kind, subject, words string, raised bool) {
 	}
 }
 
-// closeBootstrap asks the program to discard the bootstrap's one-off credential once a publish is answered (design 51
-// *On a fresh mesh*): the window bootstrap-push closed in the state windows, which the program follows and then removes
-// the file. The tools bundle runs in the tool runner's account, which cannot remove a file in distribution's state
-// directory. Once per process; the window's record says it to the next.
-var closeBootstrap func()
-
-func bootstrapCloser(windows kept[holder.Window]) func() {
-	return sync.OnceFunc(func() {
-		cur, _, err := windows.Get(holder.BootstrapWindow)
-		if err == nil && !cur.Closed.IsZero() {
-			return
-		}
-		w := holder.Window{Name: holder.BootstrapWindow, Closed: time.Now().UTC()}
-		if err := windows.Put(w); err != nil {
-			logf("the bootstrap's one-off credential could not be asked away: %v", err)
-			return
-		}
-		logf("the bootstrap's one-off credential is asked away: the holders serve publish")
-	})
-}
-
 // learned are the proved callers whose build this process recorded as publishing through the seats.
 var learned sync.Map
 
@@ -268,9 +247,6 @@ func tools(v *holder.Verbs, windows kept[holder.Window], callers func() (holder.
 					}
 					_, _ = v.DropIdle()
 					a, err := v.Publish(seat, stdio.CallerOf(args), publishOf(in))
-					if err == nil && closeBootstrap != nil {
-						closeBootstrap()
-					}
 					if err == nil {
 						learnPublishing(windows, stdio.CallerOf(args))
 					}
@@ -465,12 +441,7 @@ func tools(v *holder.Verbs, windows kept[holder.Window], callers func() (holder.
 						return nil, err
 					}
 				}
-				b, _, err := windows.Get(holder.BootstrapWindow)
-				if err != nil {
-					return nil, err
-				}
-				// The program removes the file when this window closes and writes it closed again with its removal's time.
-				return map[string]any{"window": cur, "bootstrap_credential_discarded": !b.Closed.IsZero(), "bootstrap": b}, nil
+				return map[string]any{"window": cur}, nil
 			}})
 	}
 	return out
@@ -484,7 +455,6 @@ func main() {
 	v := &holder.Verbs{Holder: h, Catalog: store, Holds: kept[holder.Hold]{state: "holds", key: holder.Hold.Key}, Mirrors: mirrors{}}
 	go followMirrors(v)
 	windows := kept[holder.Window]{state: "windows", key: func(w holder.Window) string { return w.Name }}
-	closeBootstrap = bootstrapCloser(windows)
 	if err := stdio.Serve("", tools(v, windows, holder.ConfiguredCallers)); err != nil {
 		logf("%v", err)
 		os.Exit(1)

modules/distribution/cmd/distribution/main.go

@@ -1,7 +1,7 @@
 // Command distribution is distribution's program (novox/hq design 51): it serves the artifact store's port in front of
 // the registry container, which listens on its node's loopback only. Reads (GET, HEAD) go through to every node's
 // container runtime; a write is refused but while the direct-write window is open, never over a tag the seat holds
-// published, or with the bootstrap's one-off credential (holder.Front). The windows are distribution's state windows:
+// published (holder.Front). The windows are distribution's state windows:
 // the program moves them (windows.go) and follows the direct-write window's record on each change; it holds no timer.
 package main
 
@@ -10,7 +10,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/fs"
 	"log"
 	"net/http"
 	"net/url"
@@ -58,7 +57,6 @@ func run(ctx context.Context, getenv func(string) string) error {
 	windows := process.OptionalBucket(ctx, js, "distribution_windows", "the direct-write window is read as open until the program starts again", logger.Printf)
 	if windows != nil {
 		go follow(ctx, windows, &open, logger)
-		go followBootstrap(ctx, windows, logger)
 		calls, err := process.Connect(cred)
 		if err != nil {
 			return err
@@ -72,13 +70,6 @@ func run(ctx context.Context, getenv func(string) string) error {
 		Published: func(name, tag string) (bool, error) {
 			d, err := oci.Digest(name, tag)
 			return d != "", err
-		},
-		Bootstrap: func() (string, bool) {
-			b, err := os.ReadFile(holder.BootstrapFile)
-			if err != nil {
-				return "", false
-			}
-			return strings.TrimSpace(string(b)), true
 		}}
 	srv := &http.Server{Addr: or(getenv("MESH_REGISTRY_LISTEN"), ":5000"), Handler: front, ReadHeaderTimeout: 30 * time.Second}
 	errs := make(chan error, 1)
@@ -119,42 +110,6 @@ func follow(ctx context.Context, kv jetstream.KeyValue, open *atomic.Bool, logge
 	}
 }
 
-// followBootstrap removes the bootstrap's one-off credential (holder.BootstrapFile) when the tools bundle closes the
-// window bootstrap-push at its first answered publish (design 51 *On a fresh mesh*): the program runs as distribution's
-// account, which owns the file. A file already gone is no fault; one that cannot be removed is said each time the
-// window is written.
-func followBootstrap(ctx context.Context, kv jetstream.KeyValue, logger *log.Logger) {
-	w, err := kv.Watch(ctx, holder.BootstrapWindow)
-	if err != nil {
-		logger.Printf("the bootstrap's credential window cannot be watched (%v): its file stays until the program starts again", err)
-		return
-	}
-	for e := range w.Updates() {
-		if e == nil || e.Operation() != jetstream.KeyValuePut {
-			continue
-		}
-		var win holder.Window
-		if json.Unmarshal(e.Value(), &win) != nil || win.Closed.IsZero() {
-			continue
-		}
-		if why := removeBootstrap(holder.BootstrapFile); why != "" {
-			logger.Printf("%s", why)
-		}
-	}
-}
-
-// removeBootstrap removes the credential's file; it answers what went wrong, or "" when the file is gone.
-func removeBootstrap(path string) string {
-	switch err := os.Remove(path); {
-	case err == nil:
-		return "the bootstrap's one-off credential is discarded: the holders serve publish"
-	case errors.Is(err, fs.ErrNotExist):
-		return ""
-	default:
-		return fmt.Sprintf("the bootstrap's one-off credential could not be discarded, so it is still accepted: %v", err)
-	}
-}
-
 func or(v, d string) string {
 	if strings.TrimSpace(v) == "" {
 		return d

modules/distribution/cmd/distribution/main_test.go

@@ -1,35 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// The program, which runs as distribution's account, removes the bootstrap's one-off credential when its window
-// closes (design 51 *On a fresh mesh*; a3-publish-contract): removed once, a file already gone is no fault, and one
-// that cannot be removed is said, since the front still accepts it.
-func TestTheProgramDiscardsTheBootstrapCredential(t *testing.T) {
-	dir := t.TempDir()
-	file := filepath.Join(dir, "bootstrap-push")
-	if err := os.WriteFile(file, []byte("token\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if why := removeBootstrap(file); !strings.Contains(why, "discarded") {
-		t.Fatalf("first removal = %q, want it said discarded", why)
-	}
-	if _, err := os.Stat(file); !os.IsNotExist(err) {
-		t.Fatalf("the file is still there: %v", err)
-	}
-	if why := removeBootstrap(file); why != "" {
-		t.Fatalf("a file already gone = %q, want nothing said", why)
-	}
-	stuck := filepath.Join(dir, "stuck")
-	if err := os.MkdirAll(filepath.Join(stuck, "child"), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	if why := removeBootstrap(stuck); !strings.Contains(why, "still accepted") {
-		t.Fatalf("an unremovable file = %q, want it said still accepted", why)
-	}
-}