Watch the have bucket only where the node's grant allows, so a node composing itself is not refused by the bus (issue 1126)

The fold's watch of every have key ('>') was refused (permissions violation on
CONSUMER.CREATE KV_node-engine_have), and every self-composing agent stopped
after the seed. The composer now watches '*.node' (records) and '<node>.>' (its
own haves), as buscompose grants a node; the shadow watches '<node>.>' too. The
selfcompose tests check every watch and get against PermissionsFor(KindNode),
and the agent's integration tests run the agent as the node under that grant.

cmd/mesh-host/nodeagent_integration_test.go

@@ -14,6 +14,7 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/nats-io/nats-server/v2/server"
 	"github.com/nats-io/nats.go"
@@ -29,9 +30,14 @@ import (
 const itNode = "it1"
 
 type itBed struct {
-	t        *testing.T
-	conn     *nats.Conn
-	js       nats.JetStreamContext
+	t    *testing.T
+	conn *nats.Conn
+	js   nats.JetStreamContext
+	// nodeConn and nodeJS are the node's own, under its real grant (buscompose.PermissionsFor, KindNode): the agent runs
+	// on them, so a watch or a read the grant does not allow fails here as it fails on the bus (issue 1126, 2026-10-27
+	// 09:21: a watch of every have key stopped every node agent). conn is the test's, unrestricted, for setting up.
+	nodeConn *nats.Conn
+	nodeJS   nats.JetStreamContext
 	wants    nats.KeyValue
 	composed nats.KeyValue
 	haves    nats.KeyValue
@@ -44,9 +50,22 @@ type itBed struct {
 	mu       sync.Mutex
 }
 
-func aServer(t *testing.T) *nats.Conn {
+// aServer is an embedded bus with JetStream and two users: the test's, unrestricted, and the node's, granted exactly what
+// buscompose.PermissionsFor gives a node (KindNode); it answers a connection of each.
+func aServer(t *testing.T) (admin, node *nats.Conn) {
 	t.Helper()
-	srv, err := server.NewServer(&server.Options{Port: -1, JetStream: true, StoreDir: t.TempDir(), NoLog: true, NoSigs: true})
+	perms, err := buscompose.PermissionsFor(buscompose.Principal{Kind: buscompose.KindNode, Node: itNode})
+	if err != nil {
+		t.Fatal(err)
+	}
+	granted := &server.Permissions{Publish: &server.SubjectPermission{Allow: perms.Publish, Deny: perms.PublishDeny},
+		Subscribe: &server.SubjectPermission{Allow: perms.Subscribe}}
+	if perms.AllowResponses {
+		granted.Response = &server.ResponsePermission{MaxMsgs: 1, Expires: buscompose.ResponseTTL}
+	}
+	nodeUser := buscompose.Principal{Kind: buscompose.KindNode, Node: itNode}.Username()
+	srv, err := server.NewServer(&server.Options{Port: -1, JetStream: true, StoreDir: t.TempDir(), NoLog: true, NoSigs: true,
+		Users: []*server.User{{Username: "test", Password: "test"}, {Username: nodeUser, Password: "node", Permissions: granted}}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -55,12 +74,15 @@ func aServer(t *testing.T) *nats.Conn {
 		t.Fatal("the embedded server did not start")
 	}
 	t.Cleanup(srv.Shutdown)
-	conn, err := nats.Connect(srv.ClientURL())
-	if err != nil {
+	if admin, err = nats.Connect(srv.ClientURL(), nats.UserInfo("test", "test")); err != nil {
 		t.Fatal(err)
 	}
-	t.Cleanup(conn.Close)
-	return conn
+	t.Cleanup(admin.Close)
+	if node, err = nats.Connect(srv.ClientURL(), nats.UserInfo(nodeUser, "node"), nats.CustomInboxPrefix("_INBOX."+nodeUser)); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(node.Close)
+	return admin, node
 }
 
 func newItBed(t *testing.T) *itBed {
@@ -75,11 +97,15 @@ func newItBed(t *testing.T) *itBed {
 	builtFor = "arch"
 	t.Cleanup(func() { builtFor = was })
 
-	b := &itBed{t: t, conn: aServer(t), dir: t.TempDir()}
+	b := &itBed{t: t, dir: t.TempDir()}
+	b.conn, b.nodeConn = aServer(t)
 	var err error
 	if b.js, err = b.conn.JetStream(); err != nil {
 		t.Fatal(err)
 	}
+	if b.nodeJS, err = b.nodeConn.JetStream(); err != nil {
+		t.Fatal(err)
+	}
 	composedBucket, _ := delivery.ComposedBucketFor(itNode)
 	for _, c := range []struct {
 		name    string
@@ -114,7 +140,7 @@ func (b *itBed) start(trustOperator bool) (stop func()) {
 	}
 	b.session = &link.Session{Membership: link.Membership{Node: itNode}, Timeout: 2 * time.Second,
 		Say: b.say, Keys: func() link.RecordKeys { return link.RecordKeys{} }}
-	b.session.Attach(context.Background(), link.OverNATS{Conn: b.conn, JS: b.js, Node: itNode})
+	b.session.Attach(context.Background(), link.OverNATS{Conn: b.nodeConn, JS: b.nodeJS, Node: itNode})
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan struct{})
 	go func() {