mesh-mail: declare the sender's own secret broker-send, so the controller can issue its account (review round 1 finding 1; issue 1172)

modules/mesh-mail/cmd/mesh-mail/manifest_test.go

@@ -85,7 +85,7 @@ func TestTheManifestSaysWhatTheCodeDoes(t *testing.T) {
 		t.Fatalf("the slug %q overflows an S3 access key", m.Slug)
 	}
 	fam := m.OwnSecrets[SecretFamily+"*"]
-	if fam["issued-by"] != "outside" || fam["path"] != "${dir:state}/"+SecretFamily+"*.secret" || len(m.OwnSecrets) != 1 {
+	if fam["issued-by"] != "outside" || fam["path"] != "${dir:state}/"+SecretFamily+"*.secret" || len(m.OwnSecrets) != 2 {
 		t.Fatalf("own secrets %v", m.OwnSecrets)
 	}
 	var names []string
@@ -232,6 +232,14 @@ func TestItsManifestDeclaresTheSenderProcess(t *testing.T) {
 		t.Fatalf("mail-credential-*'s owner: %v; want mesh-mail-send", fam["owner"])
 	}
 
+	// The sender's own bus account is delivered as the own secret broker-<process id>, never the module's
+	// own `broker` (novox/hq ADR 0436 §2): without it, the controller's mayIssue refuses to issue the
+	// module at all, naming the process and the secret (review round 1, finding 1).
+	broker := m.OwnSecrets["broker-send"]
+	if broker["path"] != "${dir:state}/broker-send.secret" || broker["owner"] != "mesh-mail-send" {
+		t.Fatalf("broker-send: %v; want path ${dir:state}/broker-send.secret, owner mesh-mail-send", broker)
+	}
+
 	var sendsStream *struct {
 		Name          string   `json:"name"`
 		Events        []string `json:"events"`

modules/mesh-mail/module.json

@@ -50,6 +50,10 @@
       "issued-by": "outside",
       "prompt": "the password of the mail account {member}",
       "owner": "mesh-mail-send"
+    },
+    "broker-send": {
+      "path": "${dir:state}/broker-send.secret",
+      "owner": "mesh-mail-send"
     }
   },
   "config": {