The private network writes nothing into the runtime's file (hq issue 190)

daemon.json and docker.service belong to the docker module, which holds node-container-runtime
and now states the registry itself through ${seat:mesh-artifact-store:reach} (hq ADR 0222). The
overlay stops generating registry-trust and registry-trust-reload. A generated resource is now
held to the collision check every module is, so a second writer cannot come back through
computed code; resolution never saw what a generator declares.

internal/catalogue/computed_test.go

@@ -159,7 +159,8 @@ func TestTwoWaysToBeOnAPrivateNetworkRefuseAndNameBoth(t *testing.T) {
 	}
 }
 
-// reloading answers the runtime's trust as the networking module does (novox/hq ADR 0102): a file
+// reloading answers the runtime's trust as the networking module once did (novox/hq ADR 0102; it no
+// longer does, ADR 0222 — and beside the runtime's module it is refused, generated_collision_test): a file
 // written into, and the runtime reloaded on it.
 type reloading struct{}
 

internal/catalogue/declaration.go

@@ -431,6 +431,11 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		return nil, err
 	}
 
+	generated, err := r.generatedHere(with)
+	if err != nil {
+		return nil, err
+	}
+
 	var out []map[string]any
 	for _, m := range r.Modules {
 		if with.Adopted && m.Filtering != nil {
@@ -697,23 +702,14 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			first = append(first, file)
 		}
 		if m.Computed != "" {
-			generator, known := with.Generators[m.Computed]
-			if !known {
-				return nil, fmt.Errorf(
-					"%s says its resources are computed by %q, and this control plane has no %q",
-					m.Module, m.Computed, m.Computed)
-			}
-			generated, part, err := generator.Resources(r.Node)
-			if err != nil {
-				return nil, err
-			}
+			mine, part := generated[m.Module]
 			if !part {
 				// Assigned, and not yet part of what this generates. Nothing to put on the
 				// machine, which is different from an error: a node given the network module
 				// before it has an address is in exactly that state, briefly.
 				continue
 			}
-			resources = generated
+			resources = mine
 		}
 
 		// Now, and not before: a module whose resources are computed replaces them wholesale, and
@@ -2353,3 +2349,49 @@ func accountsFirst(resources []map[string]any) (accounts, rest []map[string]any)
 	}
 	return accounts, rest
 }
+
+// generatedHere is what each computed module's generator answers for this machine, by module —
+// absent for a module whose machine is not yet part of what it generates — held to the rule every
+// module is held to: no two modules on a machine declare one path, unit, name or package (novox/hq
+// issue 190, step 5; ADR 0222).
+//
+// Resolution checks the catalogue's manifests, and a computed module's manifest has none of the
+// resources it will declare — they exist only once its generator has answered for this machine,
+// here — so a generated resource writing into another module's file was never seen. That is how
+// the private network came to declare the container runtime's daemon file and service beside the
+// runtime's own module. Asked once, so what is checked is exactly what is declared.
+func (r Resolution) generatedHere(with Rendering) (map[string][]map[string]any, error) {
+	generated := map[string][]map[string]any{}
+	placed := make([]Manifest, 0, len(r.Modules))
+	for _, m := range r.Modules {
+		if m.Computed == "" {
+			placed = append(placed, m)
+			continue
+		}
+		generator, known := with.Generators[m.Computed]
+		if !known {
+			return nil, fmt.Errorf(
+				"%s says its resources are computed by %q, and this control plane has no %q",
+				m.Module, m.Computed, m.Computed)
+		}
+		resources, part, err := generator.Resources(r.Node)
+		if err != nil {
+			return nil, err
+		}
+		computed := m
+		computed.Resources = nil
+		if part {
+			generated[m.Module] = resources
+			computed.Resources = resources
+		}
+		placed = append(placed, computed)
+	}
+	if len(generated) == 0 {
+		return generated, nil // nothing resolution has not already judged
+	}
+	if problems := checkResources(placed); len(problems) > 0 {
+		return nil, fmt.Errorf("what the mesh computes for this machine collides with a module's own: %s",
+			strings.Join(problems, "; "))
+	}
+	return generated, nil
+}

internal/catalogue/generated_collision_test.go

@@ -0,0 +1,84 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// novox/hq issue 190, step 5 (ADR 0222): what the mesh computes for a module is held to the rule
+// every module is — no two modules on a machine declare one path, unit, name or package. The
+// private network once declared the container runtime's file and service beside the runtime's own
+// module, and nothing refused it, because the collision check only ever saw catalogue manifests.
+
+func runtimesOwn() Manifest {
+	return Manifest{Module: "docker", Resources: []map[string]any{
+		{"id": "daemon", "type": "file", "path": "/etc/docker/daemon.json", "into": "json",
+			"content": `{"live-restore": true}`},
+		{"id": "runtime", "type": "service", "unit": "docker.service", "state": "running",
+			"reload-on": []any{"daemon"}},
+	}}
+}
+
+func TestAGeneratedResourceCollidingWithAModulesIsRefused(t *testing.T) {
+	r := Resolution{Node: "workstation", Modules: []Manifest{
+		{Module: "mesh-network", Computed: "mesh-network", Provides: Offers("private-network")},
+		runtimesOwn(),
+	}}
+	_, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": reloading{}}})
+	if err == nil {
+		t.Fatal("a generated resource declaring the runtime's file beside the runtime's module was accepted")
+	}
+	for _, want := range []string{"mesh-network", "docker", "/etc/docker/daemon.json", "docker.service"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not name %s: %v", want, err)
+		}
+	}
+}
+
+func TestAGeneratedResourceBesideAModulesOwnIsComposed(t *testing.T) {
+	r := Resolution{Node: "workstation", Modules: []Manifest{
+		{Module: "mesh-network", Computed: "mesh-network", Provides: Offers("private-network")},
+		runtimesOwn(),
+	}}
+	gen := &fake{on: map[string]bool{"workstation": true}}
+	out, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": gen}})
+	if err != nil {
+		t.Fatalf("disjoint resources were refused: %v", err)
+	}
+	if fileNamed(out, "docker.daemon") == nil {
+		t.Fatalf("the runtime's own file is missing: %v", out)
+	}
+	// And a machine not on the network yet generates nothing, which collides with nothing.
+	if _, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": &fake{}}}); err != nil {
+		t.Fatalf("a machine off the network was refused: %v", err)
+	}
+}
+
+// The catalogue's container runtime module states the mesh's registry itself (ADR 0222).
+func TestTheRuntimesModuleTrustsTheMeshsRegistry(t *testing.T) {
+	docker := catalogueManifest(t, "docker")
+	r := Resolution{Node: "workstation", Modules: []Manifest{docker}}
+	out, err := r.Declaration(Rendering{
+		SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	daemon := fileNamed(out, "docker.daemon")
+	if daemon == nil || daemon["into"] != "json" {
+		t.Fatalf("the runtime's file is not written into: %v", daemon)
+	}
+	content, _ := daemon["content"].(string)
+	if !strings.Contains(content, `"insecure-registries": ["anchor.internal:5100"]`) ||
+		!strings.Contains(content, `"live-restore": true`) {
+		t.Fatalf("the runtime's file says %q", content)
+	}
+
+	out, err = r.Declaration(Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if content, _ := fileNamed(out, "docker.daemon")["content"].(string); strings.Contains(content, "insecure-registries") {
+		t.Fatalf("with no store on the network, the runtime is told %q", content)
+	}
+}