Hear a restricted stream only from a module's own account, never the tool runner's (issue 727)

The tool runner's bus account carried the heard grants, consumer and bind word of every module it runs, and every agent session on that machine reaches the bus as that account, so any session could pull a granted module's consumer on MAIL. Per ADR 0376 §1 the controller now composes a restricted stream's consumer, grants and bind word only for a module that declares runs-as; registration refuses a consumes of a restricted stream without runs-as (§2), and a grant that composes nothing is said in doctor (D-heard) and in the controller's log on every raise and send.

internal/broker/modstreams.go

@@ -98,6 +98,62 @@ type Heard struct {
 	Stream  string
 	Emitter string
 	Filters []string
+	// Restricted says the stream is restricted by its provider's trusted config value (ADR 0363 §4): then it
+	// is heard only by a module on an account of its own (ADR 0376 §1, ComposedHears).
+	Restricted bool
+}
+
+// ComposedHears is what of a module's hearing the controller composes (novox/hq ADR 0376 §1): every stream it
+// hears, but a restricted one only for a module that runs in a runtime of its own on a bus account of its own
+// (`runs-as`, ADR 0259). **The tool runner never hears a restricted stream**: a module it carries reaches the bus
+// through the tool runner's account, which every agent session on that machine reaches the bus as too, so a
+// consumer, its grants or its bind word composed there would hand the stream to any session. A module that
+// declares no `runs-as` and keeps its own container credential gets none either: only `runs-as` is an account
+// the mesh keeps from agents.
+func ComposedHears(d Declared) []Heard {
+	if d.RunsAs != "" {
+		return d.Hears
+	}
+	var out []Heard
+	for _, h := range d.Hears {
+		if !h.Restricted {
+			out = append(out, h)
+		}
+	}
+	return out
+}
+
+// Withheld is a restricted stream a grant gives a module that the controller composes nothing for, because the
+// module has no account of its own (novox/hq ADR 0376 §2): said in `doctor` and in the controller's log, never
+// silent.
+type Withheld struct {
+	Node, Module, Stream, Emitter string
+}
+
+// Said is a withheld hearing in the operator's words: the module, the stream and the remedy.
+func (w Withheld) Said() string {
+	return fmt.Sprintf("%s on %s is granted part of %s's restricted stream %s, and hears none of it: it is carried "+
+		"by the machine's tool runner, whose bus account every agent session there shares, so nothing is composed "+
+		"for it. Declare runs-as in %s's manifest, so it runs as an account of its own (novox/hq ADR 0376)",
+		w.Module, w.Node, w.Emitter, w.Stream, w.Module)
+}
+
+// WithheldOf is every granted hearing of a restricted stream composed for nothing, by machine and module.
+func WithheldOf(r Records) []Withheld {
+	var out []Withheld
+	for _, node := range sortedCopy(r.Nodes) {
+		for _, d := range r.Assigned[node] {
+			if d.RunsAs != "" {
+				continue
+			}
+			for _, h := range d.Hears {
+				if h.Restricted && len(h.Filters) > 0 {
+					out = append(out, Withheld{Node: node, Module: d.Module, Stream: h.Stream, Emitter: h.Emitter})
+				}
+			}
+		}
+	}
+	return out
 }
 
 // heardConsumer is the durable consumer a module hears a module's stream through: named as its consumer
@@ -177,7 +233,8 @@ func streamsIssuedFor(d Declared) []StreamIssued {
 // HeardIssuedFor is every module stream an assignment hears, as its membership names it.
 func HeardIssuedFor(node string, d Declared) []HeardIssued {
 	var out []HeardIssued
-	for _, h := range d.Hears {
+	// A restricted stream's bind word only for a module of its own account (novox/hq ADR 0376 §1).
+	for _, h := range ComposedHears(d) {
 		if len(h.Filters) == 0 {
 			continue
 		}