Take the watchman's grant on the build seats back: a waiting ask has no pulse, a taken one is read from the steps (issue 1908)

internal/broker/buildbacklog.go

@@ -2,29 +2,15 @@ package broker
 
 import "git.novox.be/novox/mesh-sdk/go/delivery"
 
-// The two modules that read the build seats' queues, each by name (novox/hq ADR 0525 §2, issue 1887 A8): the watchman hears
-// the asks put on the seats (a plain subscription, no consumer made) to mirror each waiting ask as a pulse, and the view
-// reads the shared workers' counts and the oldest waiting ask to show the backlog. Neither may publish an ask: only the
-// builder and the checker ask, by their seat use. Nothing here is a wildcard over a stream or a worker.
+// The view alone reads the build seats' queues (novox/hq ADR 0525 §2, issue 1887 A8a): the shared workers' counts and the
+// oldest waiting ask, to show the backlog. It may not publish an ask: only the builder and the checker ask, by their seat use.
+// The watchman is granted nothing here: a waiting ask has no pulse, a taken one is read from the build module's steps (issue
+// 1908). Nothing is a wildcard over a stream or a worker.
 const (
 	// ViewModule is the module of the delivery view (mesh-delivery-view).
 	ViewModule = "mesh-delivery-view"
 )
 
-// BuildSeatAsksHeard are the subjects the watchman subscribes to: `mesh.seat.node-build-<language>.accept.<kind>` of every
-// build seat and kind (delivery.AskSubject), each by name.
-func BuildSeatAsksHeard() []string {
-	var out []string
-	for _, lang := range delivery.AskLanguages {
-		for _, kind := range delivery.AskKinds {
-			if s, err := delivery.AskSubject(lang, kind); err == nil {
-				out = append(out, s)
-			}
-		}
-	}
-	return out
-}
-
 // BuildBacklogReads are the API subjects the view requests: the information of each build seat's stream and of each of its
 // shared workers (delivery.AskStream, delivery.AskWorker), and the message of the stream by sequence. Reads only: no
 // message is pulled, none acknowledged, none published.

internal/broker/buildbacklog_test.go

@@ -23,34 +23,13 @@ func composedFor(t *testing.T, module string) (pub, sub []string) {
 	return perms.Publish, perms.Subscribe
 }
 
-func TestTheWatchmanHearsTheBuildSeatsAsksByName(t *testing.T) { // 1887/A8b
-	_, sub := composedFor(t, WatchmanModule)
-	for _, lang := range []string{"go", "node", "image"} {
-		for _, kind := range []string{"delivery", "check", "recheck"} {
-			if s := "mesh.seat.node-build-" + lang + ".accept." + kind; !hasSubject(sub, s) {
-				t.Errorf("the watchman cannot subscribe %s", s)
-			}
+func TestTheWatchmanIsGrantedNothingOnTheBuildSeats(t *testing.T) { // 1908: a waiting ask has no pulse
+	pub, sub := composedFor(t, WatchmanModule)
+	for _, s := range append(append([]string{}, pub...), sub...) {
+		if strings.Contains(s, "node-build") || strings.Contains(s, "NODE_BUILD") {
+			t.Errorf("the watchman is granted %s on a build seat", s)
 		}
 	}
-	for _, s := range sub {
-		if strings.Contains(s, "node-build") && (strings.HasSuffix(s, ">") || strings.HasSuffix(s, "*")) {
-			t.Errorf("a wildcard over the build seats: %s", s)
-		}
-	}
-	pub, _ := composedFor(t, WatchmanModule)
-	for _, s := range pub {
-		if strings.Contains(s, "node-build") || strings.Contains(s, "SEAT_NODE_BUILD") {
-			t.Errorf("the watchman may publish on %s", s)
-		}
-	}
-	perms, _ := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: WatchmanModule})
-	if MayPublish(perms, "mesh.seat.node-build-go.accept.check") {
-		t.Error("the watchman may publish an ask")
-	}
-	// no other module hears them
-	if _, other := composedFor(t, "shop"); containsAny(other, "node-build") {
-		t.Errorf("another module hears the build seats: %v", other)
-	}
 }
 
 func containsAny(list []string, sub string) bool {

internal/broker/nats.go

@@ -855,8 +855,6 @@ func PermissionsFor(p Principal) (Permissions, error) {
 		if p.Module == WatchmanModule {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
-			// And the asks put on the build seats, to mirror each waiting one as a pulse (issue 1887 A8b).
-			sub = append(sub, BuildSeatAsksHeard()...)
 		}
 		// The view alone reads the build seats' workers for the backlog of asks (issue 1887 A8a).
 		if p.Module == ViewModule {

internal/broker/testdata/composed.conf

@@ -44,7 +44,7 @@ accounts {
       } }
       { user: "one.mesh-delivery-watchman", password: "$2a$11$wwwwwwwwwwwwwwwwwwwwww", permissions: {
         publish: { allow: ["$JS.ACK.EVENTS.one_mesh-delivery-watchman.>", "$JS.API.CONSUMER.INFO.EVENTS.one_mesh-delivery-watchman", "$JS.API.CONSUMER.MSG.NEXT.EVENTS.one_mesh-delivery-watchman", "$JS.API.DIRECT.GET.ASSIGNMENTS.mesh.assignment.one.mesh-delivery-watchman", "mesh.bus.connz"] }
-        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.mesh-delivery-watchman", "$SRV.INFO.mesh-delivery-watchman.>", "$SRV.PING", "$SRV.PING.mesh-delivery-watchman", "$SRV.PING.mesh-delivery-watchman.>", "$SRV.STATS", "$SRV.STATS.mesh-delivery-watchman", "$SRV.STATS.mesh-delivery-watchman.>", "_INBOX.one.mesh-delivery-watchman.>", "mesh.assignment.one.mesh-delivery-watchman", "mesh.bus.connect", "mesh.bus.disconnect", "mesh.mod.mesh-delivery-watchman.call.>", "mesh.mod.mesh-delivery-watchman.tool.>", "mesh.seat.node-build-go.accept.check", "mesh.seat.node-build-go.accept.delivery", "mesh.seat.node-build-go.accept.recheck", "mesh.seat.node-build-image.accept.check", "mesh.seat.node-build-image.accept.delivery", "mesh.seat.node-build-image.accept.recheck", "mesh.seat.node-build-node.accept.check", "mesh.seat.node-build-node.accept.delivery", "mesh.seat.node-build-node.accept.recheck"] }
+        subscribe: { allow: ["$SRV.INFO", "$SRV.INFO.mesh-delivery-watchman", "$SRV.INFO.mesh-delivery-watchman.>", "$SRV.PING", "$SRV.PING.mesh-delivery-watchman", "$SRV.PING.mesh-delivery-watchman.>", "$SRV.STATS", "$SRV.STATS.mesh-delivery-watchman", "$SRV.STATS.mesh-delivery-watchman.>", "_INBOX.one.mesh-delivery-watchman.>", "mesh.assignment.one.mesh-delivery-watchman", "mesh.bus.connect", "mesh.bus.disconnect", "mesh.mod.mesh-delivery-watchman.call.>", "mesh.mod.mesh-delivery-watchman.tool.>"] }
         allow_responses: { max: 1, ttl: "1m" }
       } }
       { user: "one.nats", password: "$2a$11$bbbbbbbbbbbbbbbbbbbbbb", permissions: {