From 828b5b1d38c4dcafa315b368649123d95f678dbe Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 5 Nov 2026 18:37:28 +0100 Subject: [PATCH] No client names a holder: each reader keeps its own constant, held to its manifest (ADR 0625 section 4, issue 1966) Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i --- .../clients/meshmoduleassignerclient/reads.go | 20 +------------------ .../meshmoduleassignerclient/reads_test.go | 9 --------- .../clients/meshprovisionerclient/client.go | 8 +++++--- .../meshprovisionerclient/client_test.go | 9 ++++++--- 4 files changed, 12 insertions(+), 34 deletions(-) diff --git a/placement/go/clients/meshmoduleassignerclient/reads.go b/placement/go/clients/meshmoduleassignerclient/reads.go index 99fa9fd..f892d87 100644 --- a/placement/go/clients/meshmoduleassignerclient/reads.go +++ b/placement/go/clients/meshmoduleassignerclient/reads.go @@ -1,24 +1,6 @@ package meshmoduleassignerclient -import ( - "sort" - - seat "git.novox.be/novox/mesh-contracts/placement/go/seats/meshmoduleassigner" -) - -// The holder of the seat and the names a reader of its states declares in its `reads` (`.`) and binds -// to (`_`): named here once, by the seat's state, so no reader builds them from a module's name -// (ADR 0634 §4; the lead's ruling of 2026-11-05). -const ( - // Module is the module that holds the seat mesh-module-assigner. - Module = "mesh-delivery-assigner" - // PlacementRead and SeatHoldersRead are the states `placement` and `seat-holders`, as a manifest's `reads` names them. - PlacementRead = Module + "." + seat.StatePlacement - SeatHoldersRead = Module + "." + seat.StateSeatHolders - // PlacementBucket and SeatHoldersBucket are the states' buckets. - PlacementBucket = Module + "_" + seat.StatePlacement - SeatHoldersBucket = Module + "_" + seat.StateSeatHolders -) +import "sort" // MachineNames is every machine the seat places modules on, sorted, from its state `placement` as a reader holds its // keys: each with a node key `.node` or, in the form before, `placement.`. Module keys and keys of the diff --git a/placement/go/clients/meshmoduleassignerclient/reads_test.go b/placement/go/clients/meshmoduleassignerclient/reads_test.go index 40223bd..f531b6d 100644 --- a/placement/go/clients/meshmoduleassignerclient/reads_test.go +++ b/placement/go/clients/meshmoduleassignerclient/reads_test.go @@ -5,15 +5,6 @@ import ( "testing" ) -func TestTheStatesAreNamedBySeatAndState(t *testing.T) { - for got, want := range map[string]string{PlacementRead: "mesh-delivery-assigner.placement", SeatHoldersRead: "mesh-delivery-assigner.seat-holders", - PlacementBucket: "mesh-delivery-assigner_placement", SeatHoldersBucket: "mesh-delivery-assigner_seat-holders"} { - if got != want { - t.Errorf("got %q, want %q", got, want) - } - } -} - func TestMachineNamesAreTheNodesAKeyNames(t *testing.T) { keys := map[string][]byte{"g14.node": nil, "g14.app": nil, "ace.node": nil, "placement.novox": nil, "want.x.y": nil, "bad": nil} if got, want := MachineNames(keys), []string{"ace", "g14", "novox"}; !reflect.DeepEqual(got, want) { diff --git a/provisioning/go/clients/meshprovisionerclient/client.go b/provisioning/go/clients/meshprovisionerclient/client.go index 32a0ed6..2074ef1 100644 --- a/provisioning/go/clients/meshprovisionerclient/client.go +++ b/provisioning/go/clients/meshprovisionerclient/client.go @@ -126,15 +126,17 @@ func VaultName(form string, p Provision) string { return "" } -// VaultModule is the provider of every provision's credential (novox/hq ADR 0570 clauses 1, 6). -const VaultModule = "mesh-vault" +// SecretProvision is the provision the seat mesh-vault delivers: the vault's own offer, and the one provision with no +// credential beside it (novox/hq ADR 0570 clauses 1, 6). The client names the provision, never the module that holds +// the seat (novox/hq ADR 0625 §4). +const SecretProvision = "secret" // CredentialKey is the key of a provision's credential, itself a provision whose provider is the vault (clause 6; the // key form the lead settled on 2026-10-29): `..secret-[.]` for a value of the // consumer's own (pair, issued, given), and `..secret-` for the provider's one // shared value. False for a form with no vault value, and for a provision the vault itself provides. func CredentialKey(form string, consumer, provider End, provision, local string) (string, bool) { - if provider.Module == VaultModule { + if provision == SecretProvision { return "", false // the vault's own offer is the value: it has no credential beside it (the lead, 2026-10-29) } name := catalogue.CredentialProvisionPrefix + provision diff --git a/provisioning/go/clients/meshprovisionerclient/client_test.go b/provisioning/go/clients/meshprovisionerclient/client_test.go index 8461091..bb2bdaa 100644 --- a/provisioning/go/clients/meshprovisionerclient/client_test.go +++ b/provisioning/go/clients/meshprovisionerclient/client_test.go @@ -111,9 +111,12 @@ func TestAProvisionIsAReferenceUnderItsConsumersKey(t *testing.T) { } } // The vault's own offer is the value: no secret-secret beside it. - vaultEntry := catalogue.PlanProvision{Provision: "secret", Provider: "novox", ProviderModule: VaultModule, CredentialForm: FormPair} - if got := DependsOn(keycloak, vaultEntry, nil); len(got) != 0 { - t.Errorf("the vault's secret depends on %v", got) + // It is the seat's provision that has none, whatever module holds the seat (ADR 0625 §4). + for _, holder := range []string{"mesh-vault", "another-holder"} { + vaultEntry := catalogue.PlanProvision{Provision: SecretProvision, Provider: "novox", ProviderModule: holder, CredentialForm: FormPair} + if got := DependsOn(keycloak, vaultEntry, nil); len(got) != 0 { + t.Errorf("the secret provided by %s depends on %v", holder, got) + } } if ProvisionsBucket != "mesh-provisioner_provisions" || PlansRead != "mesh-provisioner.plans" { t.Errorf("the states are %s and %s", ProvisionsBucket, PlansRead)