An assignment places a module's directories and its accesses (hq 153)

A definition names no host path (ADR 0112); an adopted machine keeps its
data where the predecessor put it. Two settings, validated like endpoints:

  places:   {<directory id>: <path> | {path, owner}}
  accesses: {<access id>: <path>}

An access may now be declared by id (`{"id": "series", "mode": "read-write"}`)
and named in mounts, env and content as ${access:<id>}; the assignment
says where it is on this node, and an access nobody placed is refused by
name. A definition still carrying a path keeps it as the default the
assignment replaces. A placed directory takes the assignment's owner
where it says one. Resolved in composition, so the host receives paths
and owners exactly as before.

internal/catalogue/manifest.go

@@ -91,8 +91,13 @@ const (
 // If the path is absent when a machine applies, the host refuses clearly rather than creating it:
 // the mesh does not own it, so conjuring it would be a lie the host then acts on.
 type Access struct {
-	// Path is the absolute path on the machine, as the operator provides it.
-	Path string `json:"path"`
+	// ID is the name the module gives this access, which the assignment places
+	// (`accesses: {<id>: <path>}`, novox/hq ADR 0112, issue 153) and the module's mounts name as
+	// ${access:<id>}. The shape a definition should use: it names no path of any machine.
+	ID string `json:"id,omitempty"`
+	// Path is the absolute path on the machine. A definition carrying one names an installation;
+	// tolerated as the default the assignment may replace, for accesses declared before ids.
+	Path string `json:"path,omitempty"`
 	// Mode is "read" or "read-write". Absent narrows to read.
 	Mode string `json:"mode,omitempty"`
 }
@@ -1525,7 +1530,16 @@ func ParseManifest(raw []byte) (Manifest, error) {
 		}
 	}
 	for _, a := range m.Accesses {
-		if !strings.HasPrefix(a.Path, "/") {
+		if a.ID == "" && a.Path == "" {
+			problems = append(problems, fmt.Sprintf(
+				"%s declares an access with neither an id nor a path — an id, which the assignment places",
+				m.Module))
+		}
+		if a.ID != "" && !accessRef.MatchString("${access:"+a.ID+"}") {
+			problems = append(problems, fmt.Sprintf(
+				"%s accesses %q; an access id is lowercase letters, digits and dashes", m.Module, a.ID))
+		}
+		if a.Path != "" && !strings.HasPrefix(a.Path, "/") {
 			problems = append(problems, fmt.Sprintf(
 				"%s accesses %q, which is not an absolute path", m.Module, a.Path))
 		}
@@ -1557,6 +1571,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	// the time it sees the mount it is being asked to create the directory, which it can do.
 	problems = append(problems, m.undeclaredMounts()...)
 	problems = append(problems, m.unknownDirRefs()...)
+	problems = append(problems, m.unknownAccessRefs()...)
 
 	for i, r := range m.Resources {
 		id, _ := r["id"].(string)