From da7baa5e3909a096b0ae2b2b9e4e70a733e21cf2 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 26 Oct 2026 11:11:43 +0100
Subject: [PATCH] mesh-grants: take mesh-wireguard's manifest from mesh-sdk,
 where the mesh provides it, so its node-tools grants are composed (issue
 1945)

---
 modules/mesh-grants/grants_test.go            |  6 +++++
 modules/mesh-grants/internal/grants/inputs.go | 22 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/modules/mesh-grants/grants_test.go b/modules/mesh-grants/grants_test.go
index 03acd28..6617cc1 100644
--- a/modules/mesh-grants/grants_test.go
+++ b/modules/mesh-grants/grants_test.go
@@ -424,7 +424,13 @@ func TestGrants(t *testing.T) {
 		b.manifestOf("mod-p", pManifest)
 		b.manifestOf("mod-z", zManifest)
 		b.assign("b", "mod-p")
+		// mesh-wireguard is provided by the mesh, not read from a repository: no manifest in the indexer, none refused,
+		// no gap, and its manifest is the one mesh-sdk provides (issue 1945).
+		b.assign("b", "mesh-wireguard")
 		in := grants.ReadInputs(b, &grants.Manifests{})
+		if _, ok := in.Manifests["mesh-wireguard"]; !ok || gapNamed(in.Gaps, "manifest of mesh-wireguard") || !strings.HasPrefix(in.Digests["mesh-wireguard"], "provided:") {
+			t.Errorf("mesh-wireguard's manifest is not taken from mesh-sdk: gaps %v", in.Gaps)
+		}
 		if len(in.Refused) != 1 || in.Refused[0].Input != "manifest of mod-z" || !gapNamed(in.Gaps, "manifest of mod-z") {
 			t.Errorf("refused = %v: only mod-z's, and named in the gaps", in.Refused)
 		}
diff --git a/modules/mesh-grants/internal/grants/inputs.go b/modules/mesh-grants/internal/grants/inputs.go
index a281b81..3a46aab 100644
--- a/modules/mesh-grants/internal/grants/inputs.go
+++ b/modules/mesh-grants/internal/grants/inputs.go
@@ -8,6 +8,7 @@
 package grants
 
 import (
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"slices"
@@ -18,6 +19,7 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 )
 
 // The states of other parts the grants part reads, as its manifest's reads name them (`<module>.<state>`).
@@ -289,6 +291,26 @@ func ReadInputs(r Reader, cache *Manifests) Inputs {
 		in.Manifests[module] = m
 		in.Digests[module] = v.Manifest
 	}
+	// A module the mesh provides itself has no repository the indexer reads: its manifest comes with mesh-sdk, as the
+	// controller's composer takes it (issue 1945, the private network on every machine).
+	for _, module := range modules {
+		if _, ok := in.Manifests[module]; ok || module != overlay.Name {
+			continue
+		}
+		raw, err := json.Marshal(overlay.Manifest())
+		var m catalogue.Manifest
+		if err == nil {
+			m, err = catalogue.ParseManifestForInputs(raw)
+		}
+		if err != nil {
+			g := Gap{Input: "manifest of " + module, Why: "the manifest mesh-sdk provides is refused by its own reader: " + err.Error()}
+			in.Refused = append(in.Refused, g)
+			in.Gaps = append(in.Gaps, g)
+			continue
+		}
+		in.Manifests[module] = m
+		in.Digests[module] = fmt.Sprintf("provided:sha256:%x", sha256.Sum256(raw))
+	}
 	for _, module := range modules {
 		if _, ok := in.Manifests[module]; !ok && !gapNamed(in.Gaps, "manifest of "+module) {
 			in.Gaps = append(in.Gaps, Gap{Input: "manifest of " + module,