Declare openings and a refusal-only guard on an adopted node in place of the filter (hq ADR 0100)

internal/catalogue/manifest.go

@@ -346,6 +346,14 @@ type Manifest struct {
 	// that could only see its own ports would write a rule set that closed everything else.
 	Filtering *Filtering `json:"filtering,omitempty"`
 
+	// Guards are ports of this module's the mesh refuses on an adopted node except from the
+	// private network and from the machine itself (novox/hq ADR 0100) — the store's port and the
+	// broker's management port. The ports the software uses; the mesh guards where the machine
+	// publishes them. On an adopted node the found firewall stays in force and the mesh loads no
+	// filter of its own, so this is what keeps them unreachable from outside whatever that
+	// firewall does. Ignored on a converged node, whose derived filter already closes them.
+	Guards []int `json:"guards,omitempty"`
+
 	// Facts are things only the mesh knows, written where this module asks for them.
 	//
 	// **The graph is the control plane's; how a machine uses it is the module's.** The mesh knows
@@ -950,6 +958,12 @@ func ParseManifest(raw []byte) (Manifest, error) {
 				"%s listens on %d over %q, which is tcp or udp", m.Module, l.Port, p))
 		}
 	}
+	for _, port := range m.Guards {
+		if port < 1 || port > 65535 {
+			problems = append(problems, fmt.Sprintf(
+				"%s guards port %d, which is not a port", m.Module, port))
+		}
+	}
 	if c := m.Certificate; c != nil {
 		if !strings.HasPrefix(c.Into, "/") {
 			problems = append(problems, fmt.Sprintf(