Count mesh-sdk's kept RuntimeModule as the tool runner while node-tools' trunk manifest leaves tool-runner out

The running indexer refuses the tool-runner word, so node-tools' trunk manifest takes it out again (mesh-tools
fix/l3-words-after-judge); trunk's judge then refuses node-tools twice (its waits, its runtime bundle) and mesh-grants
would compose its node users as plain modules. One helper, sdk/toolrunner.Is, counts a manifest as the tool runner
when it says tool-runner or its module is the SDK's deprecated catalogue.RuntimeModule; the judge's waits and
undelivered-bundle rules and mesh-grants' declared records ask it. It goes once tool-runner is back on node-tools'
trunk manifest (issue 774, issue 1585 note 42).

Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn

modules/mesh-grants/go.mod

@@ -20,3 +20,7 @@ require (
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 )
+
+require git.novox.be/novox/mesh-delivery/sdk v0.0.0-00010101000000-000000000000
+
+replace git.novox.be/novox/mesh-delivery/sdk => ../../sdk

modules/mesh-grants/grants_test.go

@@ -2842,27 +2842,38 @@ func TestGrants(t *testing.T) {
 		// ADR 0601 §4: a tool runner whose manifest does not say so yet (an older build's) keeps its user as the list in force
 		// holds it, known by what it runs (it says the runner is alive), and the held condition says so; never composed as a
 		// plain module.
-		const runner = `{"module":"node-tools","version":"1","tool-runner":true,"own-secrets":{"broker":"/var/lib/nt/broker"}}`
-		b.manifestOf("node-tools", runner)
-		b.assign("a", "node-tools")
-		b.put(grants.ReadAccounts, "a.node-tools", map[string]any{"user": "a.node-tools", "hash": "$2a$10$first", "generation": 1, "fingerprint": "sha256:1"})
+		const runner = `{"module":"agent-runtime","version":"1","tool-runner":true,"own-secrets":{"broker":"/var/lib/nt/broker"}}`
+		b.manifestOf("agent-runtime", runner)
+		b.assign("a", "agent-runtime")
+		b.put(grants.ReadAccounts, "a.agent-runtime", map[string]any{"user": "a.agent-runtime", "hash": "$2a$10$first", "generation": 1, "fingerprint": "sha256:1"})
 		p.Compose()
 		inForce, _, _ = p.Sealed()
-		ran, _, ok, _ := b.ownGet(grants.StateUserList, grants.SealedUserKey(inForce.Digest, "a.node-tools"))
+		ran, _, ok, _ := b.ownGet(grants.StateUserList, grants.SealedUserKey(inForce.Digest, "a.agent-runtime"))
 		if !ok || !strings.Contains(string(ran), "mesh.control.a.tools-alive") {
 			t.Fatalf("the list in force holds no tool runner on a: %s", ran)
 		}
-		b.manifestOf("node-tools", strings.Replace(runner, `"tool-runner":true,`, "", 1))
+		b.manifestOf("agent-runtime", strings.Replace(runner, `"tool-runner":true,`, "", 1))
 		b.put(grants.ReadAccounts, "a.mod-x", map[string]any{"user": "a.mod-x", "hash": "$2a$10$gen10", "generation": 10, "fingerprint": "sha256:10"})
 		p.Compose()
 		now, _, _ := p.Sealed()
-		kept, _, ok, _ := b.ownGet(grants.StateUserList, grants.SealedUserKey(now.Digest, "a.node-tools"))
+		kept, _, ok, _ := b.ownGet(grants.StateUserList, grants.SealedUserKey(now.Digest, "a.agent-runtime"))
 		if !ok || string(kept) != string(ran) {
 			t.Errorf("the tool runner of a was composed without what it runs: %s, was %s", kept, ran)
 		}
-		if last := said[len(said)-1]; last.State != asks.StateRaised || !strings.Contains(last.Summary, "a.node-tools (stays in the list") {
+		if last := said[len(said)-1]; last.State != asks.StateRaised || !strings.Contains(last.Summary, "a.agent-runtime (stays in the list") {
 			t.Errorf("the kept tool runner was not said: %+v", last)
 		}
+		// While node-tools' trunk manifest leaves `tool-runner` out for the running indexer, mesh-sdk's deprecated
+		// catalogue.RuntimeModule is the tool runner without saying so (issue 774, issue 1585 note 42): composed as one.
+		b.manifestOf(catalogue.RuntimeModule, strings.Replace(strings.Replace(runner, `"tool-runner":true,`, "", 1), "agent-runtime", catalogue.RuntimeModule, 1))
+		b.assign("c", catalogue.RuntimeModule)
+		b.put(grants.ReadAccounts, "c."+catalogue.RuntimeModule, map[string]any{"user": "c." + catalogue.RuntimeModule, "hash": "$2a$10$c", "generation": 1, "fingerprint": "sha256:c"})
+		p.Compose()
+		now, _, _ = p.Sealed()
+		if composed, _, ok, _ := b.ownGet(grants.StateUserList, grants.SealedUserKey(now.Digest, "c."+catalogue.RuntimeModule)); !ok ||
+			!strings.Contains(string(composed), "mesh.control.c.tools-alive") {
+			t.Errorf("the kept runtime module on c was not composed as the tool runner: %s", composed)
+		}
 	})
 }
 

modules/mesh-grants/internal/grants/records.go

@@ -6,6 +6,7 @@ import (
 	"slices"
 	"strings"
 
+	"git.novox.be/novox/mesh-delivery/sdk/toolrunner"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"mesh-grants/internal/buscompose"
@@ -132,7 +133,7 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		fromModules = append(fromModules, c)
 	}
 	d := buscompose.Declared{
-		Module: m.Module, ToolRunner: catalogue.IsToolRunner(m), Emits: m.EmitsAll(), Consumes: fromModules, Watches: watches, Serves: m.Tools,
+		Module: m.Module, ToolRunner: toolrunner.Is(m), Emits: m.EmitsAll(), Consumes: fromModules, Watches: watches, Serves: m.Tools,
 		Invokes: m.Invokes, Waits: waitsOf(m, seats), State: bucketsOf(m), Reads: m.Reads, Logs: logsOf(m),
 		Streams: streamsOf(m), Queues: queueOwnersOf(m), Processes: processesOf(m), Checks: catalogue.HealthChecks(m),
 		RunsAs: m.RunsAs, Issued: issuedTools(m),