Seal core credentials by the controller while the vault does not hold them, so the bus is never left out of a declaration (issue 908, ADR 0396)

cmd/mesh-controller/core_box.go

@@ -9,6 +9,7 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 
@@ -31,10 +32,13 @@ import (
 // vault's generation and the machine's key are the same: a declaration that changed with every answer would never be
 // current. Every question but a send reads the kept box and asks nothing.
 //
-// **When the vault does not answer, the controller never falls back to its own seal.** A credential with a kept box
-// keeps it — the machine keeps the file it has — and one with none leaves its module out of the declaration (the
-// machine keeps what it holds of it, and a module not there yet is not placed). Either way the send raises a
-// condition naming the vault and the machine, cleared by the first send the vault answers whole.
+// **Until the vault holds a machine's core credentials, the controller seals them itself** (novox/hq ADR 0396, issue
+// 908; it replaces the ADR 0349 §16 rule that the controller never does). When the vault does not answer, a credential
+// with a kept box keeps it — the machine keeps the file it has — and one with none has its module composed as for an
+// engine below the contract: with the controller's own sealed value, never left out (a core module left out took the
+// bus's port from the packet filter and cut the remote machines off). Either way the send raises a condition naming
+// the vault and the machine, cleared by the first send the vault answers whole. Only a machine with no sealing key, or
+// one whose key cannot be read, leaves its module out.
 
 // engineOpensVaultBox says whether a machine's node-engine opens the vault's box, by its own newest statement.
 func engineOpensVaultBox(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
@@ -64,6 +68,9 @@ type coreBoxes struct {
 	notPlaced map[string]string
 	// keep is each box newly answered, to keep.
 	keep []inventory.CoreBox
+	// byController is each core module the vault did not answer for and no box was kept for, which is composed with
+	// the controller's own seal until the vault holds it (ADR 0396).
+	byController []string
 	// held is each credential the vault did not answer for whose kept box is carried again; silent is why the vault
 	// did not answer, per credential.
 	held, silent []string
@@ -110,8 +117,8 @@ func sealingKeyPEM(raw string) (string, error) {
 }
 
 // coreBoxesOf decides each core credential of a machine: on a send, the vault's answer (the kept box while its
-// generation and key are the same), the kept box where the vault did not answer, or the module left out where nothing
-// was kept; on any other question, the kept box, or a stand-in the next send asks for. Pure: what to keep and what to
+// generation and key are the same), the kept box where the vault did not answer, or the module left to the controller's
+// own seal where nothing was kept; on any other question, the kept box, or a stand-in the next send asks for. Pure: what to keep and what to
 // say is answered, not done.
 func coreBoxesOf(node, sealingKey string, core map[string][]string, kept map[string]map[string]inventory.CoreBox,
 	choosing Choosing, ask coreAsk) coreBoxes {
@@ -156,9 +163,7 @@ func coreBoxesOf(node, sealingKey string, core map[string][]string, kept map[str
 					out.held = append(out.held, module+"/"+name)
 					continue
 				}
-				out.notPlaced[module] = fmt.Sprintf("the vault did not give %s's credential %s for %s (%v), and the "+
-					"controller never seals it itself (novox/hq ADR 0349 §16): not placed until the vault answers",
-					module, name, node, err)
+				out.byController = append(out.byController, module)
 				break
 			}
 			if valid && k.Generation == got.Generation {
@@ -170,7 +175,7 @@ func coreBoxesOf(node, sealingKey string, core map[string][]string, kept map[str
 			out.keep = append(out.keep, inventory.CoreBox{Module: module, Name: name, Generation: got.Generation,
 				SealedTo: sealingKey, Box: box})
 		}
-		if _, left := out.notPlaced[module]; !left {
+		if _, left := out.notPlaced[module]; !left && !slices.Contains(out.byController, module) {
 			out.sealed[module] = boxes
 		}
 	}
@@ -262,6 +267,9 @@ func vaultSilentObservation(node string, b coreBoxes) conditions.Observation {
 		sort.Strings(left)
 		said = append(said, "not placed: "+strings.Join(left, ", "))
 	}
+	if len(b.byController) > 0 {
+		said = append(said, "sealed by the controller until the vault holds it: "+strings.Join(b.byController, ", "))
+	}
 	if len(b.held) > 0 {
 		said = append(said, "kept as last sent: "+strings.Join(b.held, ", "))
 	}