Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions,
hands bus accounts to the vault and judges the new manifest words, on the
feature's SDK and node-engine validator (feature 57, config and provisioning).

cmd/mesh-controller/modules.go

@@ -446,6 +446,10 @@ func settingsCommand(ctx context.Context, args []string) error {
 		if len(positionals) == 2 {
 			values = positionals[1]
 		}
+		// Once its config values are mesh-config's, they are proposed there (issue 664).
+		if forwarded, err := forwardPropose(ctx, inv, positionals[0], *node, values, *clear); forwarded || err != nil {
+			return err
+		}
 		return proposeCommand(ctx, positionals[0], *node, values, *clear, *replace)
 	case "proposals":
 		if len(positionals) > 1 || *node != "" || *clear || *replace || *history {
@@ -466,6 +470,15 @@ func settingsCommand(ctx context.Context, args []string) error {
 		where = *node
 	}
 
+	// Once the move of config has run, a module in the config form is read and set through mesh-config (issue 664).
+	if (args[0] == "set" && len(positionals) == 2) || ((args[0] == "show" && !*history) || args[0] == "clear") &&
+		len(positionals) == 1 {
+		if forwarded, err := forwardSettings(ctx, inv, args[0], positionals[0], *node, positionals, *replace); forwarded ||
+			err != nil {
+			return err
+		}
+	}
+
 	switch args[0] {
 	case "set":
 		if len(positionals) != 2 {
@@ -949,7 +962,55 @@ func issueOnTheNewBus(ctx context.Context, inv *inventory.Inventory, m catalogue
 	if err != nil {
 		return err
 	}
-	return issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password)
+	if err := issueWith(ctx, inv, m, node, busAddress, known, reachable, user, password); err != nil {
+		return err
+	}
+	if !runsTheProvisionerClient(m) {
+		return nil
+	}
+	return issueProvisionerClient(ctx, inv, m, node, known, reachable)
+}
+
+// runsTheProvisionerClient says a module runs its machine's provisioner client, which reaches the bus on an
+// account of its own (novox/hq ADR 0349 clause 11, design 57 P3): it claims the seat and declares the own secret
+// that account is delivered in. The same test the bus's user list makes (inventory's declaredFor).
+func runsTheProvisionerClient(m catalogue.Manifest) bool {
+	_, reads := m.OwnSecrets[broker.ProvisionerSecret]
+	return reads && m.ClaimsSeat(broker.NodeProvisionerSeat)
+}
+
+// issueProvisionerClient gives a machine's provisioner client its account: minted under the client's own name,
+// never the module's or the tool runner's, and sealed to the machine as the module's own secret
+// broker.ProvisionerSecret, which the client's service reads (novox/hq ADR 0349 clause 11, design 57 P3). No
+// claims and no consumer: the client holds no seat on this account and is delivered nothing but its answers.
+func issueProvisionerClient(ctx context.Context, inv *inventory.Inventory, m catalogue.Manifest, node string,
+	known broker.Broker, reachable string) error {
+	user := broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: m.Module}.Username()
+	password, err := inv.MintBusPassword(ctx, inventory.BusUser{
+		Username: user, Kind: inventory.BusProvisioner, Node: node, Module: m.Module,
+	})
+	if err != nil {
+		return err
+	}
+	held, err := json.Marshal(struct {
+		URL         string `json:"url"`
+		Fingerprint string `json:"fingerprint,omitempty"`
+		Node        string `json:"node"`
+		User        string `json:"user"`
+		Password    string `json:"password"`
+	}{URL: "nats://" + reachable, Fingerprint: known.Fingerprint, Node: node, User: user, Password: password})
+	if err != nil {
+		return err
+	}
+	if err := inv.AcceptSecretForModule(ctx, node, m.Module, broker.ProvisionerSecret, string(held)); err != nil {
+		return err
+	}
+	if err := handIssuedToVault(ctx, inv, m, node, broker.ProvisionerSecret, string(held)); err != nil {
+		return err
+	}
+	fmt.Printf("bus user %s minted for %s's provisioner client, scoped to %s's keys, its reports and the vault\n",
+		user, m.Module, node)
+	return nil
 }
 
 // busKindOf is what a module's bus user is recorded as: the node's tool runtime where the module is
@@ -994,6 +1055,9 @@ func issueWith(ctx context.Context, inv *inventory.Inventory, m catalogue.Manife
 	if err := inv.AcceptSecretForModule(ctx, node, m.Module, "broker", string(held)); err != nil {
 		return err
 	}
+	if err := handIssuedToVault(ctx, inv, m, node, "broker", string(held)); err != nil {
+		return err
+	}
 
 	// And how it hears what it consumes. Derived from its declaration, and only when it declared
 	// something: a module that consumes nothing needs no consumer, and creating one would be a