Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)

A local service could only be declared public, which says the internet. local-network is a source and a reach: the private network and the private networks the machine reported on a link facing outside, judged here, shown by plan and node, and said in the rule set when there are none.

cmd/mesh-controller/plan.go

@@ -442,6 +442,12 @@ func declarationWith(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return sendable{}, err
 	}
+	// Which ports the filter admits from the local network, and from which networks, for plan to say
+	// (novox/hq ADR 0340 §8). The same rules the composition rendered, never sent.
+	rules, err := plan.Rules(with)
+	if err != nil {
+		return sendable{}, err
+	}
 	// And what was taken on it, said in every declaration it is sent from this one place.
 	adoption, err := adoptionOf(ctx, open.inventory, record, plan, composed)
 	if err != nil {
@@ -451,7 +457,8 @@ func declarationWith(ctx context.Context, open *stores, node string,
 		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
 		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
 		unbound: with.Unbound, foreseen: composed.Foreseen, unplaced: composed.Unplaced,
-		modules: namedModules(plan, composed.LeftOut)}
+		modules:      namedModules(plan, composed.LeftOut),
+		localNetwork: catalogue.LocalNetworkPorts(rules, with.LocalNetworks)}
 	// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
 	// 0221). Read only on the send path: a question about what would be sent records nothing.
 	if choosing == Allocating {
@@ -960,6 +967,12 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
+	// And which of the networks it is attached to count as its local network (novox/hq ADR 0340):
+	// private ranges only, on a link facing outside it. Reported by the machine, never set.
+	local, err := localNetworksOf(ctx, inv, node)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
 	// Where this machine reaches each mesh seat's holder, for ${seat:<seat>:reach} (novox/hq ADR
 	// 0222): the artifact store as this network reaches it, which the container runtime is told to
 	// trust (ADR 0082). The same address composed into every reference the mesh built.
@@ -984,7 +997,8 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		Machines: machines, Zones: zones, Holders: replicas,
 		Suffix: overlay.Suffix(), MeshRange: meshRange, TunnelInterface: overlay.Interface, Accounts: accounts, Foundation: foundation,
 		Kept: kept, Adopted: record.Adopted, OutwardLinks: outwardLinks,
-		Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
+		LocalNetworks: catalogue.CountedLocalNetworks(local),
+		Given:         given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
 		BusUsers: busUsers, Withheld: withheld, Unbound: unbound,
 	}, record, nil
 }
@@ -1417,6 +1431,11 @@ func planCommand(ctx context.Context, args []string) error {
 			fmt.Printf("  %-20s settings from %s\n", module, layer.From)
 		}
 	}
+	// What each port reached from the local network resolved to on this machine (novox/hq ADR 0340 §8),
+	// or that it resolved to none.
+	for _, p := range declared.localNetwork {
+		fmt.Println("  " + p.Said())
+	}
 	fmt.Printf("\n%d resource(s)\n", len(resources))
 
 	if *show {