Give every module an identity and ask once to keep a shared folder (hq ADR 0325, issue 575)

A module's containers that declare identity run as an identity the controller allocates once, mesh-wide,
from 50000-59999; each access names its users and whether its folder is taken; an access wait is excused
for a folder the mesh may not keep yet, and the operator is asked once per folder and machine, the folder
taken only on the warrant. All of it is sent only to an engine at contract 5. A placement for an access a
newer build brings is judged against that build (issue 575). mesh-host pinned to the ADR 0325 branch head.

internal/inventory/catalogue.go

@@ -958,7 +958,28 @@ func (i *Inventory) judgeSettings(ctx context.Context, nodeName, module string,
 	}
 	layers = append(layers, catalogue.Layer{From: from, Values: values})
 	if err := catalogue.JudgeSettings(m, layers, adopted); err != nil {
-		return fmt.Errorf("refused: %s on %s cannot compose with the layer %q — %w", module, where, from, err)
+		// **A placement for an access the module's newer build brings** (novox/hq issue 575): judged against the
+		// manifest of the module's newest build on the branch it follows, where the registered one does not declare
+		// the access yet — so an access can be placed before or with the delivery that adds it. It must still compose
+		// with the registered manifest, which passes the placement by until the build registers.
+		var undeclared *catalogue.UndeclaredAccessError
+		if !errors.As(err, &undeclared) {
+			return fmt.Errorf("refused: %s on %s cannot compose with the layer %q — %w", module, where, from, err)
+		}
+		ahead, has, aerr := i.NewestManifestOnBranch(ctx, module)
+		if aerr != nil {
+			return aerr
+		}
+		if !has || catalogue.JudgeSettings(ahead, layers, adopted) != nil || catalogue.ComposesWith(m, layers, adopted) != nil {
+			return fmt.Errorf("refused: %s on %s cannot compose with the layer %q — %w; nor does the newest build of "+
+				"%s on the branch it follows declare it", module, where, from, err, module)
+		}
+		m = ahead
+	}
+	// A module that runs as its own identity owns its directories by it: no setting names their owner (novox/hq ADR
+	// 0325 §1, §3). A module that does not yet keeps its placed owner, warned of where it is set.
+	if err := catalogue.PlacesOwnerProblem(m, layers); err != nil {
+		return fmt.Errorf("refused: %w", err)
 	}
 	// And a key that reaches nothing, refused here where somebody can still fix the spelling:
 	// stored, it would be a setting somebody believes they made.
@@ -969,6 +990,29 @@ func (i *Inventory) judgeSettings(ctx context.Context, nodeName, module string,
 	return nil
 }
 
+// NewestManifestOnBranch is the manifest of a module's newest successful build on the branch its record follows
+// (novox/hq issue 575): what the delivery under way brings, before it registers — or the registered one's own, when
+// nothing newer was built. False when no build of the module with a manifest is kept.
+func (i *Inventory) NewestManifestOnBranch(ctx context.Context, module string) (catalogue.Manifest, bool, error) {
+	var raw []byte
+	err := i.store.Pool().QueryRow(ctx,
+		`select b.manifest from build b join module m on m.name = b.module
+		  where b.module = $1 and b.failed = '' and b.manifest is not null and b.manifest::text <> 'null'
+		    and (coalesce(m.ref, '') = '' or b.ref = '' or b.ref = m.ref)
+		  order by b.at desc limit 1`, module).Scan(&raw)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return catalogue.Manifest{}, false, nil
+	}
+	if err != nil {
+		return catalogue.Manifest{}, false, err
+	}
+	m, err := catalogue.ParseManifest(raw)
+	if err != nil {
+		return catalogue.Manifest{}, false, nil // a build the mesh cannot read judges nothing
+	}
+	return m, true, nil
+}
+
 // givenIn is the machine ports a node-level settings layer gives a module, software port →
 // machine port (novox/hq ADR 0100). Nothing when the layer gives none; what is not a port is left
 // for composition to refuse in its own words.

internal/inventory/health.go

@@ -38,13 +38,17 @@ type ResourceHealth struct {
 	Waits []Wait `json:"waits,omitempty"`
 }
 
-// Wait is one thing a waiting resource waits for the operator to give: exactly one of Secret and Setting
-// (novox/hq ADR 0283), as link.Wait carries it.
+// Wait is one thing a waiting resource waits for the operator to give: exactly one of Secret, Setting and Access
+// (novox/hq ADR 0283, ADR 0325 §7), as link.Wait carries it.
 type Wait struct {
 	Part    string `json:"part"`
 	Secret  string `json:"secret,omitempty"`
 	Setting string `json:"setting,omitempty"`
-	What    string `json:"what"`
+	// Access is an access of the module by its own id for it, from the engine's access-waits, and Disk that it
+	// waits for the disk that holds its folder rather than for the operator's word (novox/hq ADR 0325 §7, §9).
+	Access string `json:"access,omitempty"`
+	Disk   bool   `json:"disk,omitempty"`
+	What   string `json:"what"`
 }
 
 // NodeHealth is a machine's newest statement, as kept.

internal/inventory/identities.go

@@ -0,0 +1,120 @@
+package inventory
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// Module identities and taken folders (novox/hq ADR 0325 §3, §8, §11; migration 0096).
+
+// AllocateIdentity is module's identity, allocated now when it has none: one number from the range of its own,
+// mesh-wide, kept for ever. Two controllers allocating at once agree: the second's insert finds the first's row.
+func (i *Inventory) AllocateIdentity(ctx context.Context, module string) (catalogue.ModuleIdentity, error) {
+	if strings.TrimSpace(module) == "" {
+		return catalogue.ModuleIdentity{}, errors.New("an identity is allocated for a module, and none was named")
+	}
+	if id, had, err := i.IdentityOf(ctx, module); err != nil || had {
+		return id, err
+	}
+	// The number is drawn only when the row is new; a draw lost to a concurrent insert is a gap in the range, never
+	// a number given twice.
+	_, err := i.store.Pool().Exec(ctx,
+		`insert into module_identity (module, uid, gid)
+		 select $1, n, n from (select nextval('module_identity_number')::integer as n) drawn
+		 on conflict (module) do nothing`, module)
+	if err != nil {
+		return catalogue.ModuleIdentity{}, fmt.Errorf("%s could not be given an identity: %w", module, err)
+	}
+	id, had, err := i.IdentityOf(ctx, module)
+	if err == nil && !had {
+		err = fmt.Errorf("%s was given an identity and it cannot be read back", module)
+	}
+	return id, err
+}
+
+// IdentityOf is module's identity, and false when it was never allocated one.
+func (i *Inventory) IdentityOf(ctx context.Context, module string) (catalogue.ModuleIdentity, bool, error) {
+	id := catalogue.ModuleIdentity{Module: module}
+	err := i.store.Pool().QueryRow(ctx, `select uid, gid from module_identity where module = $1`, module).
+		Scan(&id.UID, &id.GID)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return catalogue.ModuleIdentity{}, false, nil
+	}
+	if err != nil {
+		return catalogue.ModuleIdentity{}, false, err
+	}
+	return id, true, nil
+}
+
+// Identities is every module's identity, by module.
+func (i *Inventory) Identities(ctx context.Context) (map[string]catalogue.ModuleIdentity, error) {
+	rows, err := i.store.Pool().Query(ctx, `select module, uid, gid from module_identity`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]catalogue.ModuleIdentity{}
+	for rows.Next() {
+		var id catalogue.ModuleIdentity
+		if err := rows.Scan(&id.Module, &id.UID, &id.GID); err != nil {
+			return nil, err
+		}
+		out[id.Module] = id
+	}
+	return out, rows.Err()
+}
+
+// TakenFolder is one folder the operator let the mesh keep on a machine (ADR 0325 §8).
+type TakenFolder struct {
+	Path    string
+	By      string
+	Ask     string
+	Warrant string
+	Said    string
+}
+
+// KeptFolders is every folder taken on a machine, by its clean path.
+func (i *Inventory) KeptFolders(ctx context.Context, nodeName string) (map[string]TakenFolder, error) {
+	rows, err := i.store.Pool().Query(ctx,
+		`select k.path, k.taken_by, k.ask, k.warrant, k.said from kept_folder k join node n on n.id = k.node
+		  where n.name = $1`, nodeName)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]TakenFolder{}
+	for rows.Next() {
+		var t TakenFolder
+		if err := rows.Scan(&t.Path, &t.By, &t.Ask, &t.Warrant, &t.Said); err != nil {
+			return nil, err
+		}
+		out[t.Path] = t
+	}
+	return out, rows.Err()
+}
+
+// RecordTaken keeps that a folder was taken on a machine, under the operator's warrant. A take is recorded once:
+// a second for the same folder keeps the first.
+func (i *Inventory) RecordTaken(ctx context.Context, nodeName string, t TakenFolder) error {
+	switch {
+	case !strings.HasPrefix(t.Path, "/"):
+		return fmt.Errorf("a taken folder is an absolute path, not %q", t.Path)
+	case strings.TrimSpace(t.Warrant) == "" || strings.TrimSpace(t.Ask) == "":
+		return errors.New("a folder is taken only on the operator's warrant, and this names none")
+	}
+	node, err := i.NodeByName(ctx, nodeName)
+	if err != nil {
+		return err
+	}
+	_, err = i.store.Pool().Exec(ctx,
+		`insert into kept_folder (node, path, taken_by, ask, warrant, said) values ($1, $2, $3, $4, $5, $6)
+		 on conflict (node, path) do nothing`, node.ID, filepath.Clean(t.Path), t.By, t.Ask, t.Warrant, t.Said)
+	return err
+}

internal/inventory/identities_test.go

@@ -0,0 +1,158 @@
+package inventory
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// novox/hq ADR 0325 §3, §11: a module gets one allocation, the same whoever asks and however often, from the range
+// of its own; no allocation is 0 or a root group's; a number once given is never given again.
+func TestAModuleIsGivenOneIdentityOnceAndNeverRoot(t *testing.T) {
+	inv := fresh(t)
+	ctx := t.Context()
+	radarr, err := inv.AllocateIdentity(ctx, "radarr")
+	if err != nil {
+		t.Fatal(err)
+	}
+	again, err := inv.AllocateIdentity(ctx, "radarr")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if radarr != again {
+		t.Fatalf("radarr was given %+v, then %+v: one allocation per module", radarr, again)
+	}
+	plex, err := inv.AllocateIdentity(ctx, "plex")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range []catalogue.ModuleIdentity{radarr, plex} {
+		if id.UID == 0 || id.GID == 0 || !catalogue.AllocatableID(id.UID) || !catalogue.AllocatableID(id.GID) ||
+			id.UID != id.GID {
+			t.Errorf("%s was given %d:%d: within %d–%d, never 0, uid and gid one number", id.Module, id.UID, id.GID,
+				catalogue.IdentityLow, catalogue.IdentityHigh)
+		}
+	}
+	if radarr.UID == plex.UID {
+		t.Fatalf("radarr and plex share %d", plex.UID)
+	}
+
+	// Read back as composition reads it, from another connection's view: the same numbers (stable across restarts
+	// and machines, since every machine's composition reads this one row).
+	all, err := inv.Identities(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if all["radarr"].UID != radarr.UID || all["plex"].UID != plex.UID {
+		t.Fatalf("the identities read back are %+v", all)
+	}
+
+	// A module forgotten keeps its row, and the next module is given a new number: never one given before.
+	if _, err := inv.store.Pool().Exec(ctx, `delete from module_identity where module = 'plex'`); err != nil {
+		t.Fatal(err)
+	}
+	sonarr, err := inv.AllocateIdentity(ctx, "sonarr")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sonarr.UID == plex.UID || sonarr.UID == radarr.UID {
+		t.Fatalf("sonarr was given %d, a number given before", sonarr.UID)
+	}
+
+	// The store itself refuses a number outside the range, root's above all: no write by hand makes one root.
+	for _, n := range []int{0, 10, 1000, 49999, 60000} {
+		if _, err := inv.store.Pool().Exec(ctx,
+			`insert into module_identity (module, uid, gid) values ($1, $2, $2)`, "byhand", n); err == nil {
+			t.Errorf("the store took %d as an identity", n)
+		}
+	}
+}
+
+// novox/hq ADR 0325 §8: a folder taken is recorded once per machine, under a warrant, and read back by its path.
+func TestAFolderIsTakenOnceUnderAWarrant(t *testing.T) {
+	inv := fresh(t)
+	ctx := t.Context()
+	if _, err := inv.AddNode(ctx, "ace"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordTaken(ctx, "ace", TakenFolder{Path: "/storage/media/movies/", By: "the operator"}); err == nil {
+		t.Fatal("a folder was recorded taken with no warrant")
+	}
+	first := TakenFolder{Path: "/storage/media/movies/", By: "the operator", Ask: "c01", Warrant: "c01", Said: "started"}
+	if err := inv.RecordTaken(ctx, "ace", first); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordTaken(ctx, "ace", TakenFolder{Path: "/storage/media/movies", By: "someone else", Ask: "c02",
+		Warrant: "c02"}); err != nil {
+		t.Fatal(err)
+	}
+	kept, err := inv.KeptFolders(ctx, "ace")
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, has := kept["/storage/media/movies"]
+	if !has || got.Ask != "c01" || got.By != "the operator" {
+		t.Fatalf("the taken folder reads %+v (%v): the first take, by its clean path", got, has)
+	}
+}
+
+// novox/hq issue 575: a module registered without the access movies, whose newest build on its branch declares it —
+// the build the delivery under way brings — takes a proposal placing movies: judged against that build, not refused.
+// Without such a build it is refused, as before.
+func TestAPlacementIsJudgedAgainstTheBuildThatBringsTheAccess(t *testing.T) {
+	inv := fresh(t)
+	ctx := t.Context()
+	if _, err := inv.AddNode(ctx, "ace"); err != nil {
+		t.Fatal(err)
+	}
+	registered := catalogue.Manifest{Module: "media-importer", Version: "1",
+		Accesses: []catalogue.Access{{ID: "downloads", Path: "/services/media/downloads", Mode: catalogue.AccessReadWrite}},
+		Resources: []map[string]any{{"id": "server", "type": "container", "name": "importer", "image": "x",
+			"volumes": []any{"${access:downloads}:/downloads"}}}}
+	if err := inv.RegisterModule(ctx, registered, Source{Repository: "https://forge.invalid/media.git",
+		Ref: "main", BuiltFrom: "c0ffee33"}); err != nil {
+		t.Fatal(err)
+	}
+	placing := map[string]any{catalogue.AccessesSetting: map[string]any{"movies": "/storage/media/movies"}}
+
+	err := inv.JudgeSettings(ctx, "ace", "media-importer", placing)
+	if err == nil || !strings.Contains(err.Error(), `places the access "movies", which it does not declare`) {
+		t.Fatalf("a placement no build declares: %v", err)
+	}
+
+	// main's manifest — the build of #34 — declares movies.
+	ahead := registered
+	ahead.Accesses = append([]catalogue.Access{}, registered.Accesses...)
+	ahead.Accesses = append(ahead.Accesses, catalogue.Access{ID: "movies", Path: "/services/media/movies",
+		Mode: catalogue.AccessReadWrite})
+	raw, err := json.Marshal(ahead)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b := aBuild("b34", "media-importer", "")
+	b.Ref, b.Manifest = "main", raw
+	if err := inv.RecordBuild(ctx, b); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.JudgeSettings(ctx, "ace", "media-importer", placing); err != nil {
+		t.Fatalf("the proposal placing movies, which main's build declares, was refused: %v", err)
+	}
+	if err := inv.SetSettings(ctx, "ace", "media-importer", placing); err != nil {
+		t.Fatalf("the layer placing movies was not stored: %v", err)
+	}
+	// Stored ahead, it does not cost the registered module its place: composition passes it by.
+	layers, err := inv.SettingsFor(ctx, "ace", "media-importer")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := catalogue.ComposesWith(registered, layers, false); err != nil {
+		t.Fatalf("the registered module no longer composes with the layer stored ahead: %v", err)
+	}
+	// A typo is still a typo: an access neither build declares is refused.
+	typo := map[string]any{catalogue.AccessesSetting: map[string]any{"moveis": "/storage/media/movies"}}
+	if err := inv.JudgeSettings(ctx, "ace", "media-importer", typo); err == nil {
+		t.Fatal("a placement no build declares was taken")
+	}
+}

internal/inventory/migrations/0096-a-module-is-given-an-identity-and-a-folder-is-taken.sql

@@ -0,0 +1,40 @@
+-- Every module is given an identity of its own, and the mesh takes a shared folder once, on the operator's word
+-- (novox/hq ADR 0325 §3, §8, §11).
+--
+-- **One number per module, mesh-wide, allocated once and never again.** The node-engine makes the account
+-- mesh-<module> on each machine the module is assigned to, with these numbers, so a container that declares
+-- `identity` runs as the same uid and gid everywhere and a folder's entries mean the same on every machine. The
+-- numbers come from a sequence of their own, 50000–59999 (catalogue.IdentityLow and IdentityHigh): above the
+-- numbers distributions give people, below the 60000s Debian keeps for its daemons, and nowhere near root's 0 or a
+-- root group's (0, 4, 10). The checks refuse a row outside the range, so no write, by hand or by a later bug, can make
+-- an identity root (§11). uid and gid are one number. A sequence never hands a number back, and a row is kept after
+-- its module is forgotten, so a number once given is never given to another module: a file left owned by a removed
+-- module's identity is never inherited by a new one.
+create sequence module_identity_number as integer minvalue 50000 maxvalue 59999 start 50000 no cycle;
+
+create table module_identity (
+    module    text        primary key,
+    uid       integer     not null unique check (uid between 50000 and 59999),
+    gid       integer     not null unique check (gid between 50000 and 59999),
+    allocated timestamptz not null default now(),
+    check (uid = gid)
+);
+
+-- **A folder taken, per machine** (§8). The first time a placed folder that already holds data is to be kept, the
+-- operator is asked once for that folder on that machine; on the warrant the node-engine adds the entries to
+-- everything there, and the folder is taken: kept from then on without asking, a module that gains the access
+-- added with no wait. The row is the record of that act — who approved it, under which warrant — and what tells a
+-- later module's access that it joins a taken folder (`taken` on the access). The path is the folder as placed,
+-- clean and absolute.
+create table kept_folder (
+    node     uuid        not null references node (id) on delete cascade,
+    path     text        not null check (path like '/%'),
+    taken_at timestamptz not null default now(),
+    -- Who approved it, as the hand-act log says it, and the ask and warrant it was taken under.
+    taken_by text        not null,
+    ask      text        not null,
+    warrant  text        not null,
+    -- What the node-engine answered when it started the take.
+    said     text        not null default '',
+    primary key (node, path)
+);