Stop composing ADR 0312's group grant, so deliveries to the media machine pass again

Since #256 delivered, the node-engine judges every read-write access by the path's group alone and
states six media modules unhealthy on ace, though they write their folders as the owner; every
delivery there fails its gate (hq issue 567). ADR 0325 replaces ADR 0312; until it is built, the
controller sends no grant, as before #256.

This reverts commit 3cfc121670.

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -464,35 +464,6 @@ type Access struct {
 	Path string `json:"path"`
 	// Mode is how this module reaches the path: read or read-write. Absent narrows to read.
 	Mode string `json:"mode,omitempty"`
-
-	// Grant is who the path's own group is granted to, for a read-write access (novox/hq ADR 0312 §1): the
-	// identities the module's code runs as. The controller says who; the node-engine reads which group owns
-	// the path when it applies, because only the machine knows, and never changes the path (§2). Absent is a
-	// controller older than the grant, or an access that grants nothing — and a read access always is one (§3).
-	Grant *AccessGrant `json:"grant,omitempty"`
-}
-
-// AccessGrant is the identities a read-write access grants its path's group to (novox/hq ADR 0312 §1).
-type AccessGrant struct {
-	// Containers are the module's containers that mount the path, by id: each is created with the group as a
-	// supplementary group of its process, and recreated when the group moves (§6).
-	Containers []string `json:"containers,omitempty"`
-	// Account is the account that runs the module's tools: put in the group as an account group, as ADR 0252
-	// §1 puts one, and taken out again as §3 takes back (§5). Empty for a module whose code runs nowhere as
-	// an account.
-	Account string `json:"account,omitempty"`
-}
-
-// UnmarshalJSON reads a grant as strictly as a resource is read: a field the engine does not know is a
-// thing the controller believes it asked for, and is refused rather than ignored.
-func (g *AccessGrant) UnmarshalJSON(raw []byte) error {
-	type plain AccessGrant
-	var p plain
-	if err := strictDecode(raw, &p); err != nil {
-		return fmt.Errorf("a grant: %w", err)
-	}
-	*g = AccessGrant(p)
-	return nil
 }
 
 func (a *Access) Identity() string { return a.ID }
@@ -511,24 +482,6 @@ func (a *Access) validate(where string, _ bool) []string {
 		problems = append(problems, fmt.Sprintf(
 			"%s: an access is %q or %q, not %q", where, AccessRead, AccessReadWrite, a.Mode))
 	}
-	if a.Grant != nil && a.Mode != AccessReadWrite {
-		// A read access reads as any account may, and gains no group (novox/hq ADR 0312 §3).
-		problems = append(problems, where+": a read access grants nothing, and this one names a grant; "+
-			"only a read-write access grants its path's group (novox/hq ADR 0312 §3)")
-	}
-	if a.Grant != nil {
-		for _, id := range a.Grant.Containers {
-			if id == "" {
-				problems = append(problems, where+": a grant names a container with no id")
-			}
-		}
-		if a.Grant.Account != "" && !accountName.MatchString(a.Grant.Account) {
-			// Handed to id, usermod and gpasswd as an argument: a name starting with a dash would be read as an
-			// option by each of them.
-			problems = append(problems, fmt.Sprintf("%s: a grant's account is an account's name — letters, digits, "+
-				"dots, underscores and dashes, not starting with a dash — and %q is not one", where, a.Grant.Account))
-		}
-	}
 	return problems
 }
 
@@ -1715,7 +1668,6 @@ func parse(raw []byte, allowActions bool) (*Declaration, error) {
 		d.Resources = append(d.Resources, resource)
 	}
 	problems = append(problems, checkWhileStopped(d.Resources)...)
-	problems = append(problems, checkGrants(d.Resources)...)
 	problems = append(problems, checkAdoption(env.Adoption, d.Resources, allowActions)...)
 	problems = append(problems, checkReplaces(d.Resources)...)
 	if env.Adoption == nil {
@@ -1780,36 +1732,6 @@ func checkWhileStopped(resources []Resource) []string {
 	return problems
 }
 
-// accountName is what a grant's account may be: the portable account name the user tools take, optionally ending
-// in `$`, never starting with a dash.
-var accountName = regexp.MustCompile(`^[A-Za-z0-9_.][A-Za-z0-9_.-]*\$?$`)
-
-// checkGrants judges each access's grant against the whole declaration (novox/hq ADR 0312): a container it
-// names is a container of this declaration, as a maintenance window's are. A grant to a container the machine
-// is not told about would be a group given to nothing, said as granted.
-func checkGrants(resources []Resource) []string {
-	containers := map[string]bool{}
-	for _, r := range resources {
-		if r.Kind() == TypeContainer {
-			containers[r.Identity()] = true
-		}
-	}
-	var problems []string
-	for _, r := range resources {
-		a, ok := r.(*Access)
-		if !ok || a.Grant == nil {
-			continue
-		}
-		for _, id := range a.Grant.Containers {
-			if id != "" && !containers[id] {
-				problems = append(problems, fmt.Sprintf("resource %q: its grant names %q, and this declaration "+
-					"has no container by that id", a.ID, id))
-			}
-		}
-	}
-	return problems
-}
-
 func strictDecode(raw []byte, into any) error {
 	// DisallowUnknownFields is the whole point rather than strictness for its own sake: a
 	// field the host does not know is a thing the control plane believes it asked for.