A tools bundle is given its words, composed per machine; what they name is the account's to read (hq ADR 0192)

build.artifacts[].env on a bundle: words and values written with ${dir:…} and ${port:…} only,
refused when a value carries any other reference (a secret's content, a binding) or names a word
the runtime sets for itself, and on any artifact that is not a bundle. Resolved per machine like a
container's environment and handed to the runtime as MESH_TOOL_ENV, module by module, in the unit
so a change restarts it. Every file and directory of the module a word names, or that holds one, is
owned by the account the runtime runs as where it says no owner, since a tool reads as that account.

internal/catalogue/runtime.go

@@ -1,6 +1,7 @@
 package catalogue
 
 import (
+	"encoding/json"
 	"fmt"
 	"sort"
 	"strings"
@@ -82,6 +83,11 @@ const (
 	RuntimeBrokerFile      = "MESH_BROKER_FILE"
 	RuntimeOperatorAccount = "MESH_OPERATOR_ACCOUNT"
 	RuntimeOperatorHome    = "MESH_OPERATOR_HOME"
+	// RuntimeToolEnv is every served module's composed environment, as JSON (novox/hq ADR 0192):
+	// {"<module>": {"<word>": "<value>"}}. The runtime takes it at start, removes it from its own
+	// environment and hands each module's words to that module's bundles alone. In the unit, so a
+	// change to any module's words changes the process and restarts it.
+	RuntimeToolEnv = "MESH_TOOL_ENV"
 )
 
 // interpreterFor is how a bundle in a language is run: the program the host's unit starts, with the
@@ -146,10 +152,18 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 	// would be told to load files that were never delivered.
 	var served []string
 	var restartOn []string
+	given := map[string]map[string]string{}
 	for _, m := range r.Modules {
 		if with.Adopted && m.Filtering != nil {
 			continue
 		}
+		words, err := bundleWords(m, with)
+		if err != nil {
+			return nil, err
+		}
+		if len(words) > 0 {
+			given[m.Module] = words
+		}
 		for _, b := range m.Bundles {
 			if len(b.Loads) == 0 {
 				continue
@@ -168,6 +182,14 @@ func (r Resolution) runtimeProcess(with Rendering) (map[string]any, error) {
 		RuntimeToolModules: strings.Join(served, ","),
 		RuntimeBrokerFile:  credential.Path,
 	}
+	if len(given) > 0 {
+		// Marshalled from maps, whose keys encoding/json sorts: the same words, the same unit.
+		body, err := json.Marshal(given)
+		if err != nil {
+			return nil, err
+		}
+		env[RuntimeToolEnv] = string(body)
+	}
 	process := map[string]any{
 		"id": RuntimeModule + "." + RuntimeProcessID(), "type": "process", "name": RuntimeModule,
 		"source": bundle.Source, "digest": bundle.Digest,
@@ -249,3 +271,71 @@ func ToolContainerOnTheRuntime(m Manifest, against []string) string {
 			"now (novox/hq ADR 0175, to-be 38); declare the tools as a bundle and drop the container",
 		m.Module, RuntimeImageModule, RuntimeImageArtifact, RuntimeModule)
 }
+
+// bundleWords is what one module's tools bundles are given on this machine (novox/hq ADR 0192):
+// each loaded bundle's env, its ${dir:…} resolved to where this machine places the module's
+// directories and its ${port:…} to the port this machine gave it — the same resolution a
+// container's environment gets. Two bundles of one module naming one word differently is refused:
+// the runtime hands a module's words to all its bundles.
+func bundleWords(m Manifest, with Rendering) (map[string]string, error) {
+	var out map[string]string
+	dirs := dirsFor(m, with)
+	for _, b := range m.Bundles {
+		if len(b.Loads) == 0 || len(b.Env) == 0 {
+			continue
+		}
+		for _, word := range sortedKeys(b.Env) {
+			value, err := dirFill(b.Env[word], dirs, m.Module)
+			if err != nil {
+				return nil, err
+			}
+			if value, err = portsFilledInto(value, m.Module+"'s bundle "+b.Name+" ("+word+")", m.Module, m.Listens, with); err != nil {
+				return nil, err
+			}
+			if out == nil {
+				out = map[string]string{}
+			}
+			if was, had := out[word]; had && was != value {
+				return nil, fmt.Errorf("%s's bundles give %s two values (%q, %q); a module's words are "+
+					"handed to all its bundles, so they agree (novox/hq ADR 0192)", m.Module, word, was, value)
+			}
+			out[word] = value
+		}
+	}
+	return out, nil
+}
+
+// givenTo makes what a bundle's words name readable by the account the runtime runs as (novox/hq
+// ADR 0192): every file and directory of the module whose path a word names, or that holds one,
+// is owned by the account — a tool reads its configuration and its secret as the account, and a
+// root-owned 0600 file or a 0700 directory is one it cannot. Only where it says no owner already:
+// a module that named one knew why. Nothing on a machine with no account, where the runtime is root.
+func givenTo(out []map[string]any, owner map[string]string, words map[string]map[string]string, account string) {
+	if account == "" || len(words) == 0 {
+		return
+	}
+	for _, resource := range out {
+		module := owner[fmt.Sprint(resource["id"])]
+		mine := words[module]
+		if len(mine) == 0 {
+			continue
+		}
+		kind := fmt.Sprint(resource["type"])
+		if kind != "file" && kind != "directory" {
+			continue
+		}
+		path, _ := resource["path"].(string)
+		if path == "" {
+			continue
+		}
+		if _, said := resource["owner"]; said {
+			continue
+		}
+		for _, value := range mine {
+			if value == path || strings.HasPrefix(value, strings.TrimRight(path, "/")+"/") {
+				resource["owner"] = account
+				break
+			}
+		}
+	}
+}