A token is an account on the bus, and genesis can place the list

novox/hq 04-ISSUES/146. The composed user list names an enrolment user for
every machine with a live token and nothing minted a credential for it, so the
composer left it out as a user with no password — and every enrolment since the
mesh moved to this bus was refused before the mesh heard of it. The comment
above the issuing code already said the account is created before the token is
handed over; now it is. Recorded rather than minted, because the token's secret
is the password.

And 'broker accounts', which composes the same list the declaration carries and
writes it to standard output. For genesis, where no declaration can reach the
machine running the bus because that machine is not yet a node. It says what it
composed; whoever is raising the machine places it. A control plane that wrote
the file itself would have to learn where the bus keeps its configuration and
how to make it reload, which is the module's knowledge.

cmd/mesh-controller/buscertificate.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
@@ -12,7 +13,10 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
+
+	"github.com/novox/mesh-controller/internal/broker"
 )
 
 // The bus's own certificate, made by the mesh rather than borrowed from an image.
@@ -169,3 +173,86 @@ func writeBusCertificate(crt, key string) error {
 		busCertificateNames, template.NotAfter.Format(time.RFC3339), crt, key)
 	return nil
 }
+
+// busAccounts writes the mesh's composed user list to a file.
+//
+// **For genesis, where no declaration can deliver it** (novox/hq 04-ISSUES/146). Everywhere else
+// the list reaches the machine running the bus as a resource of the module that holds it — which
+// requires that machine to be an enrolled node, and at genesis it is not: the first node cannot
+// enrol because the account it would enrol with cannot be composed onto a bus it has no declaration
+// for. The installer breaks that circle by placing the file itself, once, and the module takes the
+// file over from its first push.
+//
+// The same composition, not a second one: this asks the store for the same records and renders them
+// with the same composer the declaration uses. A genesis that hand-wrote an account would be a
+// second statement of who may say what, able to disagree with the first.
+//
+// **It writes to standard output unless told a file**, and that is the point: the control plane
+// composes and says what it composed, and whoever is raising the machine puts it where that
+// machine's bus reads it. A control plane that wrote into the bus's own directory would have to
+// know where that is and how to make the server re-read it — which is the module's knowledge, and
+// the module is what takes this over on the first push.
+//
+//	broker accounts > /var/lib/mesh-bus-conf/accounts.conf
+func busAccounts(ctx context.Context, args []string) error {
+	into := ""
+	for i := 0; i < len(args); i++ {
+		switch args[i] {
+		case "--into":
+			if i+1 >= len(args) {
+				return errors.New("--into needs a file")
+			}
+			into = args[i+1]
+			i++
+		default:
+			return fmt.Errorf("broker accounts --into <file>: %q", args[i])
+		}
+	}
+
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+
+	records, err := open.inventory.BusRecords(ctx)
+	if err != nil {
+		return err
+	}
+	users, err := broker.Users(records)
+	if err != nil {
+		return err
+	}
+	kept, err := open.inventory.BusUsers(ctx)
+	if err != nil {
+		return err
+	}
+	hashes := make(map[string]string, len(kept))
+	for name, u := range kept {
+		hashes[name] = u.PasswordHash
+	}
+	filled, missing := broker.WithPasswords(users, hashes)
+	if len(missing) > 0 {
+		// To standard error, always: the composed file may be going to standard output, and a
+		// remark in the middle of it is a configuration the server refuses to parse.
+		fmt.Fprintf(os.Stderr, "leaving out %d user(s) the mesh has minted no credential for: %s\n",
+			len(missing), strings.Join(missing, ", "))
+	}
+	if len(filled) == 0 {
+		return errors.New("not one user has a credential, so this list would refuse every " +
+			"connection in the mesh")
+	}
+	accounts, err := broker.ComposeAccounts(filled)
+	if err != nil {
+		return err
+	}
+	if into == "" {
+		fmt.Print(accounts)
+		return nil
+	}
+	if err := os.WriteFile(into, []byte(accounts), 0o600); err != nil {
+		return err
+	}
+	fmt.Printf("wrote %d user(s) to %s\n", len(filled), into)
+	return nil
+}

cmd/mesh-controller/main.go

@@ -88,7 +88,7 @@ func run() error {
 	case "identity":
 		return identityCommand(ctx, args[1:])
 	case "broker":
-		return brokerCommand(args[1:])
+		return brokerCommand(ctx, args[1:])
 	case "serve":
 		return serve(ctx)
 	case "upgrade":

cmd/mesh-controller/nodes.go

@@ -363,12 +363,15 @@ func identityCommand(ctx context.Context, args []string) error {
 	return nil
 }
 
-func brokerCommand(args []string) error {
+func brokerCommand(ctx context.Context, args []string) error {
 	if len(args) > 0 && args[0] == "certificate" {
 		return busCertificate(args[1:])
 	}
+	if len(args) > 0 && args[0] == "accounts" {
+		return busAccounts(ctx, args[1:])
+	}
 	if len(args) == 0 || args[0] != "show" {
-		return errors.New("broker show | broker certificate [--check] --into <directory>")
+		return errors.New("broker show | broker certificate [--check] --into <directory> | broker accounts --into <file>")
 	}
 	known, err := broker.FromEnvironment()
 	if errors.Is(err, broker.ErrNotConfigured) {