catalogue: compose a route's name from a label and its node's domain, and resolve it in-mesh

A public route used to carry its whole hostname as a literal in the module
manifest, so running the same catalogue against a different domain meant
overriding that literal on every routed module, per node. The mesh was, in
effect, holding a map of names to services: the one thing it should never hold,
because the subdomain is the operator's choice and the domain is the node's.

Compose instead. A route contribution carries a `label` (the subdomain); a node
carries its `public_domain` as node-level configuration; the mesh joins
`<label>.<public-domain>` and grants exactly that, interpreting neither half.
Held as a node property beside the node's other node-level facts (endpoint,
site, overlay address), not in a module's settings — the ADR calls it
node-level, and the settings table is keyed per module.

Additive, so an unmigrated catalogue keeps working: a contribution that still
carries a full `name` and no `label` passes through unchanged, and the catalogue
can migrate module by module. A labelled contribution on a node with no public
domain composes nothing, reading downstream as a route that named no host.

And propagate: each granted route name is published into internal resolution
mesh-wide, mapped to the node that serves it, alongside the `<node>.internal`
names every container already gets. So a container — and an internal ACME
validator, which cannot complete a challenge for a name it cannot reach —
resolves a routed name to the proxy that serves it. Name-agnostic throughout:
the mesh propagates whatever names it was told to serve and knows nothing about
what they mean.

novox/hq 02-DECISIONS/0056

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

internal/catalogue/routing_test.go

@@ -0,0 +1,152 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// novox/hq ADR 0056 — public routing is name-agnostic.
+//
+// A route contribution carries a label (the subdomain the operator chose); the node carries its
+// public domain; the mesh composes <label>.<public-domain> and interprets neither half. The
+// checks here are the ADR's own: the same catalogue resolves against two domains by changing one
+// node setting and nothing else, and a legacy full-name contribution passes through untouched so
+// the catalogue can migrate module by module.
+
+// labelled is a module that asks to be published under a subdomain rather than a full hostname.
+func labelled(module, label string, port int) Manifest {
+	return Manifest{Module: module, Version: "1",
+		Contributes: map[string]map[string]any{
+			"reverse-proxy": {"label": label, "port": port},
+		}}
+}
+
+// withDomain is a workstation that composes its routed names under one public domain.
+func withDomain(domain string) Node {
+	n := workstation()
+	n.PublicDomain = domain
+	return n
+}
+
+func TestALabelComposesWithTheNodesPublicDomain(t *testing.T) {
+	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, withDomain("example.tld"), World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if len(given) != 1 {
+		t.Fatalf("the proxy was told about %d of 1: %v", len(given), given)
+	}
+	if given[0].Values["name"] != "git.example.tld" {
+		t.Fatalf("the label did not compose with the domain: %v", given[0].Values)
+	}
+	// The port the module gave is still there — composing the name must not drop what the proxy
+	// needs to reach the workload.
+	if given[0].Values["port"] != float64(8080) {
+		t.Fatalf("composing the name dropped the port: %v", given[0].Values)
+	}
+}
+
+func TestOneNodeSettingMovesTheCatalogueBetweenDomains(t *testing.T) {
+	// The ADR's name-agnostic check: the same catalogue resolves against two different public
+	// domains by changing one node setting and nothing else.
+	one, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, withDomain("example.tld"), World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	two, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, withDomain("other.example"), World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	first := received(t, mustDeclare(t, one))[0].Values
+	second := received(t, mustDeclare(t, two))[0].Values
+
+	if first["name"] != "git.example.tld" || second["name"] != "git.other.example" {
+		t.Fatalf("the name did not track the domain: %v then %v", first["name"], second["name"])
+	}
+	// And nothing else moved: same label, same port. The domain is the one fact that changed.
+	if first["label"] != second["label"] || first["label"] != "git" {
+		t.Fatalf("the label changed with the domain: %v then %v", first["label"], second["label"])
+	}
+	if first["port"] != second["port"] {
+		t.Fatalf("the port changed with the domain: %v then %v", first["port"], second["port"])
+	}
+}
+
+func TestALegacyFullNameContributionPassesThroughUnchanged(t *testing.T) {
+	// Backward compatibility: a contribution that still carries a full `name` and no `label` is
+	// granted that name as-is, even on a node that has a public domain. This is what lets the
+	// catalogue migrate one module at a time while the running mesh keeps working.
+	legacy := Manifest{Module: "board", Version: "1",
+		Contributes: map[string]map[string]any{
+			"reverse-proxy": {"name": "git.pinned.example", "port": 8080},
+		}}
+	got, err := Resolve(shelf(proxy(), legacy), []string{"board"}, withDomain("example.tld"), World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if given[0].Values["name"] != "git.pinned.example" {
+		t.Fatalf("a full name was rewritten: %v", given[0].Values)
+	}
+	if _, grewLabel := given[0].Values["label"]; grewLabel {
+		t.Fatalf("a legacy contribution grew a label: %v", given[0].Values)
+	}
+}
+
+func TestALabelWithNoPublicDomainComposesNothing(t *testing.T) {
+	// A routed module on a node with no public domain has nothing to join its label to. It composes
+	// no name — which reads downstream exactly as a route that named no host, the same as before
+	// this existed — rather than an fabricated `git.` with a dangling dot.
+	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, workstation(), World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if _, named := given[0].Values["name"]; named {
+		t.Fatalf("a name was composed with no domain to compose it from: %v", given[0].Values)
+	}
+	if given[0].Values["label"] != "git" {
+		t.Fatalf("the label was lost: %v", given[0].Values)
+	}
+}
+
+func TestARoutedNameResolvesToTheServingNode(t *testing.T) {
+	// novox/hq ADR 0056 propagate: a granted route name is published into internal resolution,
+	// mapped to the node that serves it, alongside the `<node>.internal` names — so every
+	// container, and an in-mesh ACME validator, resolves a routed name to the proxy that serves it.
+	// The names map is what withMeshNames writes into every container as `--add-host`; a route name
+	// mapped to the serving node's address rides the same mechanism.
+	got := containersOf(t, Resolution{Node: "anchor", Modules: []Manifest{{
+		Module: "app",
+		Resources: []map[string]any{{"id": "web", "type": "container", "name": "web",
+			"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)}},
+	}}}, Rendering{Names: map[string]string{
+		"anchor.internal": "10.42.0.1",
+		"git.example.tld": "10.42.0.1",
+	}})
+	if len(got) != 1 {
+		t.Fatalf("expected one container, got %d", len(got))
+	}
+	given := namesOf(got[0])
+	var sawNode, sawRoute bool
+	for _, h := range given {
+		if h == "anchor.internal:10.42.0.1" {
+			sawNode = true
+		}
+		if h == "git.example.tld:10.42.0.1" {
+			sawRoute = true
+		}
+	}
+	if !sawNode {
+		t.Fatalf("the container lost the mesh's node names: %v", given)
+	}
+	if !sawRoute {
+		t.Fatalf("the routed name was not published to the serving node: %v", given)
+	}
+}