Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

A source repository's name is not its identity, and a trunk anyone may push
to makes the trunk rule mean nothing (the review of 2026-10-09). Through any
verb a module now registers only from a repository on the mesh's forge whose
trunk refuses direct pushes, requires a status and lets no administrator
merge past one, asked of the forge's own tools; and only from the repository
by the forge's id, recorded at registration (migration 0084), so one deleted
and made again under the name is refused. The serving controller marks its
environment, so nothing it runs or starts reads as the terminal, and a
terminal request covers only the repository and path it asked.

cmd/mesh-controller/build_source_test.go

@@ -1,9 +1,15 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
+	"hash/fnv"
+	"os"
+	"os/exec"
+	"slices"
 	"strings"
+	"sync"
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/inventory"
@@ -28,10 +34,10 @@ func onTrunk(id, repository, seat, path string, manifest map[string]any) link.Bu
 }
 
 // keptAsked keeps a build request as the asker would: through a verb, or at the terminal.
-func keptAsked(t *testing.T, inv *inventory.Inventory, id, repository string, atTerminal bool) {
+func keptAsked(t *testing.T, inv *inventory.Inventory, id, repository, path string, atTerminal bool) {
 	t.Helper()
 	if err := inv.RecordBuildRequest(t.Context(), inventory.BuildRequest{ID: id, Repository: repository, Seat: "git",
-		For: "build", AtTerminal: atTerminal}); err != nil {
+		Path: path, For: "build", AtTerminal: atTerminal}); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -45,7 +51,7 @@ func theCatalogue(t *testing.T) *stores {
 		onTrunk("build-sudo", "novox/mesh-catalog", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "1"}),
 		onTrunk("build-host", "novox/mesh-host", "git", "", map[string]any{"module": "mesh-host", "version": "1"}),
 	} {
-		keptAsked(t, open.inventory, b.ID, b.Source.Repository, true)
+		keptAsked(t, open.inventory, b.ID, b.Source.Repository, b.Path, true)
 		if _, _, err := takeIn(ctx, open.inventory, b); err != nil {
 			t.Fatal(err)
 		}
@@ -65,7 +71,7 @@ func TestABuildFromAnAgentsRepositoryIsNotRegisteredAsAModuleTheMeshHolds(t *tes
 	} {
 		t.Run(c.name, func(t *testing.T) {
 			id := "build-" + strings.ReplaceAll(c.repository, "/", "-")
-			keptAsked(t, open.inventory, id, c.repository, false) // through the build verb
+			keptAsked(t, open.inventory, id, c.repository, c.path, false) // through the build verb
 			evil := onTrunk(id, c.repository, "git", c.path, map[string]any{"module": c.module, "version": "evil"})
 			_, _, err := takeIn(ctx, open.inventory, evil)
 			if !errors.Is(err, errNotItsSource) {
@@ -88,7 +94,7 @@ func TestABuildFromAnAgentsRepositoryIsNotRegisteredAsAModuleTheMeshHolds(t *tes
 func TestANewModuleFromARepositoryTheCatalogueDoesNotBuildFromIsNotRegistered(t *testing.T) {
 	open := theCatalogue(t)
 	ctx := t.Context()
-	keptAsked(t, open.inventory, "build-new", "agent/tools", false)
+	keptAsked(t, open.inventory, "build-new", "agent/tools", "", false)
 	_, _, err := takeIn(ctx, open.inventory, onTrunk("build-new", "agent/tools", "git", "",
 		map[string]any{"module": "agent-tools", "version": "1"}))
 	if !errors.Is(err, errNotItsSource) {
@@ -109,7 +115,7 @@ func TestANewModuleFromARepositoryTheCatalogueDoesNotBuildFromIsNotRegistered(t
 func TestAtTheTerminalAnotherRepositoryIsRegistered(t *testing.T) {
 	open := theCatalogue(t)
 	ctx := t.Context()
-	keptAsked(t, open.inventory, "build-moved", "novox/sudo", true)
+	keptAsked(t, open.inventory, "build-moved", "novox/sudo", "", true)
 	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-moved", "novox/sudo", "git", "",
 		map[string]any{"module": "sudo", "version": "2"})); err != nil {
 		t.Fatalf("a move the operator asked for at the terminal was refused: %v", err)
@@ -117,7 +123,10 @@ func TestAtTheTerminalAnotherRepositoryIsRegistered(t *testing.T) {
 	if src, _ := open.inventory.SourceOf(ctx, "sudo"); src.Repository != "novox/sudo" {
 		t.Fatalf("sudo is built from %q", src.Repository)
 	}
-	keptAsked(t, open.inventory, "build-external", "someone/app", true)
+	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-external",
+		Repository: "http://forge.internal:20000/someone/app.git", For: "build", AtTerminal: true}); err != nil {
+		t.Fatal(err)
+	}
 	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-external", "someone/app", "", "",
 		map[string]any{"module": "app", "version": "1"})); err != nil {
 		t.Fatalf("a new module the operator asked for at the terminal was refused: %v", err)
@@ -195,7 +204,7 @@ func TestARollbackNeverPutsBackABuildFromAnotherRepository(t *testing.T) {
 	fork := onTrunk("build-1791500000000000000", "agent/mesh-catalog", "git", "modules/sudo",
 		map[string]any{"module": "sudo", "version": "evil"})
 	fork.Commit = "c0ffee0123456789" // the commit sudo was registered at
-	keptAsked(t, inv, fork.ID, "agent/mesh-catalog", false)
+	keptAsked(t, inv, fork.ID, "agent/mesh-catalog", "modules/sudo", false)
 	if _, _, err := takeIn(ctx, inv, fork); !errors.Is(err, errNotItsSource) {
 		t.Fatalf("the fork's build was taken in: %v", err)
 	}
@@ -220,3 +229,117 @@ func TestARollbackNeverPutsBackABuildFromAnotherRepository(t *testing.T) {
 		t.Fatalf("a rollback puts back %q (found %v), want the registered build-sudo", previous.ID, found)
 	}
 }
+
+// theForge is what the forge says in a test, by owner/name: a repository not named here is protected as a
+// trunk must be, with an id of its own.
+var theForge sync.Map
+
+func init() {
+	askTheForge = func(_ context.Context, owner, repo, _ string) (forgeFacts, error) {
+		if said, ok := theForge.Load(owner + "/" + repo); ok {
+			switch f := said.(type) {
+			case error:
+				return forgeFacts{}, f
+			case forgeFacts:
+				return f, nil
+			}
+		}
+		h := fnv.New32a()
+		_, _ = h.Write([]byte(owner + "/" + repo))
+		return forgeFacts{ID: int64(h.Sum32()), Guarded: true}, nil
+	}
+}
+
+// A module's trunk the forge does not protect — direct pushes, no required status — or a forge that cannot say,
+// registers nothing through a verb: the trunk rule means nothing on a branch anyone pushes to.
+func TestATrunkTheForgeDoesNotProtectRegistersNothing(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	theForge.Store("novox/unguarded", forgeFacts{ID: 7, Why: "the rule main lets a person push to main directly"})
+	t.Cleanup(func() { theForge.Delete("novox/unguarded") })
+	first := onTrunk("build-unguarded-1", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "1"})
+	keptAsked(t, open.inventory, first.ID, "novox/unguarded", "", true)
+	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
+		t.Fatalf("at the terminal: %v", err)
+	}
+	again := onTrunk("build-unguarded-2", "novox/unguarded", "git", "", map[string]any{"module": "unguarded", "version": "2"})
+	if _, _, err := takeIn(ctx, open.inventory, again); !errors.Is(err, errNotItsSource) ||
+		!strings.Contains(err.Error(), "push to main directly") {
+		t.Fatalf("a rebuild from an unprotected trunk was taken in: %v", err)
+	}
+	theForge.Store("novox/unguarded", errors.New("nothing serves gitea.gitea_api"))
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-unguarded-3", "novox/unguarded", "git", "",
+		map[string]any{"module": "unguarded", "version": "3"})); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("a forge that could not say was read as a protected trunk: %v", err)
+	}
+	if shelf, _ := open.inventory.Catalogue(ctx); shelf["unguarded"].Version != "1" {
+		t.Fatalf("unguarded is %q", shelf["unguarded"].Version)
+	}
+}
+
+// A repository deleted and made again under the module's repository's name is another repository: the forge's
+// id, recorded at registration, tells them apart.
+func TestARepositoryMadeAgainUnderItsNameIsNotTheModulesSource(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	theForge.Store("novox/remade", forgeFacts{ID: 100, Guarded: true})
+	t.Cleanup(func() { theForge.Delete("novox/remade") })
+	first := onTrunk("build-remade-1", "novox/remade", "git", "", map[string]any{"module": "remade", "version": "1"})
+	keptAsked(t, open.inventory, first.ID, "novox/remade", "", true)
+	if _, _, err := takeIn(ctx, open.inventory, first); err != nil {
+		t.Fatal(err)
+	}
+	if id, _ := open.inventory.SourceIdentity(ctx, "remade"); id != 100 {
+		t.Fatalf("the forge's id was not recorded: %d", id)
+	}
+	theForge.Store("novox/remade", forgeFacts{ID: 101, Guarded: true}) // deleted, and made again by an agent
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-2", "novox/remade", "git", "",
+		map[string]any{"module": "remade", "version": "evil"})); !errors.Is(err, errNotItsSource) ||
+		!strings.Contains(err.Error(), "made again") {
+		t.Fatalf("a repository made again under the name was taken in: %v", err)
+	}
+	// And a new module from it, beside the one registered from the first, the same.
+	if _, _, err := takeIn(ctx, open.inventory, onTrunk("build-remade-3", "novox/remade", "git", "modules/other",
+		map[string]any{"module": "other", "version": "1"})); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("a new module from a repository made again was taken in: %v", err)
+	}
+}
+
+// The terminal's mark is the operator's for the repository and path they asked: an outcome of another, under that
+// build's id, is not theirs.
+func TestATerminalRequestCoversOnlyWhatItAsked(t *testing.T) {
+	open := theCatalogue(t)
+	ctx := t.Context()
+	if err := open.inventory.RecordBuildRequest(ctx, inventory.BuildRequest{ID: "build-asked", Repository: "novox/app",
+		Seat: "git", Path: "modules/app", For: "build", AtTerminal: true}); err != nil {
+		t.Fatal(err)
+	}
+	other := onTrunk("build-asked", "agent/sudo", "git", "modules/app", map[string]any{"module": "sudo", "version": "evil"})
+	if _, _, err := takeIn(ctx, open.inventory, other); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("an outcome of another repository under a terminal request's id was taken in: %v", err)
+	}
+	elsewhere := onTrunk("build-asked", "novox/app", "git", "modules/sudo", map[string]any{"module": "sudo", "version": "evil"})
+	if _, _, err := takeIn(ctx, open.inventory, elsewhere); !errors.Is(err, errNotItsSource) {
+		t.Fatalf("an outcome of another path under a terminal request's id was taken in: %v", err)
+	}
+}
+
+// The serving controller, and everything it starts, is never the terminal: a build asked in it reads as asked
+// through the mesh even when no verb and no caller is named.
+func TestTheServingControllerIsNeverTheTerminal(t *testing.T) {
+	t.Setenv(verbVar, "")
+	t.Setenv(link.CallerVar, "")
+	t.Setenv(servedVar, "")
+	if !startedAtTheTerminal() {
+		t.Fatal("a process started by hand is not the terminal")
+	}
+	markServed()
+	if startedAtTheTerminal() {
+		t.Fatal("the serving controller reads as the terminal")
+	}
+	child := exec.Command(os.Args[0], "-test.run=^$")
+	child.Env = os.Environ()
+	if !slices.Contains(child.Env, servedVar+"=1") {
+		t.Fatal("what the serving controller starts does not carry its mark")
+	}
+}