The node composes its own modules once the catalogue places it: one composer per node drains a mark set by any input's change, the agent applies what it composed when it differs, and a record move waits for a yes (issue 1126, ADR 0547 §2, §3)

internal/agent/agent.go

@@ -23,6 +23,7 @@ import (
 	"sync"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -49,9 +50,13 @@ type Have struct {
 	Module   string
 	FP       string
 	Composed string
-	// Phase is "running", "failed", "held" or "removed"; empty reads as running.
+	// Phase is "running", "failed", "held", "waiting-yes" or "removed"; empty reads as running.
 	Phase  string
 	Detail string
+	// Judgement and Waits are, in phase waiting-yes, the judgement of the move and the digest of the composition that
+	// waits for a person's yes (ADR 0547 §3).
+	Judgement string
+	Waits     string
 }
 
 // Haves is the node's have bucket as the agent uses it.
@@ -120,6 +125,14 @@ type Env struct {
 	// transient failure only on RetryTransient or a change of either key.
 	Backoff func(try int) time.Duration
 	Say     func(string)
+	// SelfComposed says the compositions are the node's own (novox/hq ADR 0547 §2, issue 1126): Composed hands what the
+	// node composed itself, unsigned, and a want names the build alone. The composition composed for the want's build is
+	// the one applied, when it differs from what runs.
+	SelfComposed bool
+	// Policy is a module's upgrade policy as its manifest derives it (catalogue.DerivedUpgrade); with SelfComposed, a
+	// move of a module of policy record that recreates a container or moves its data waits for a person's yes in its
+	// want (ADR 0547 §3). Nil judges no move.
+	Policy func(module string) string
 }
 
 // transientFor is how many transient retries say the phase applying before the have says failed: past them the bus has
@@ -366,7 +379,14 @@ func (a *Agent) takeComposition(u Update) string {
 	}
 	now := compNow{Raw: u.Value, Rev: u.Revision}
 	c, err := delivery.DecodeComposed(u.Value)
-	if err == nil {
+	if err == nil && a.env.SelfComposed {
+		// The node composed it itself: nothing crossed the bus, so nothing is signed (ADR 0547 §2).
+		now.C = c
+		now.Dig, err = delivery.ComposedDigestOf(c)
+		if err != nil {
+			now.C = delivery.Composed{}
+		}
+	} else if err == nil {
 		var trusted []ed25519.PublicKey
 		if a.env.Trusted != nil {
 			trusted = a.env.Trusted()
@@ -636,7 +656,16 @@ func (a *Agent) settleOne(ctx context.Context, module string) {
 	a.mu.Lock()
 	comp, have := a.compositionFor(module, w.Want.FP)
 	a.mu.Unlock()
-	if (!have || comp.Err != nil || comp.Dig != w.Want.Composed) && w.Want.Composed != "" {
+	if a.env.SelfComposed {
+		if !have || comp.Err != nil {
+			return // waits for the node's own composition of the want's build
+		}
+		// The composition the node composed for the want's build is the one it applies (ADR 0547 §2).
+		w.Want.Composed = comp.Dig
+		if a.waitsForYes(ctx, module, w, comp) {
+			return
+		}
+	} else if (!have || comp.Err != nil || comp.Dig != w.Want.Composed) && w.Want.Composed != "" {
 		// The composition the want names may be an older revision of the key, replaced by a newer one at the same
 		// fingerprint (a want held there keeps its digest): taken from the revisions the bucket keeps (ADR 0539 clause 1).
 		if old, found := a.revisionNamed(ctx, module, w.Want.FP, w.Want.Composed); found {
@@ -925,3 +954,57 @@ func short(s string) string {
 	}
 	return s
 }
+
+// waitsForYes judges a move the node composed for a module of policy record (ADR 0547 §3, ADR 0377 §3): one that
+// recreates a container or moves the module's data, or that cannot be judged, is not applied while the want names no yes
+// for this composition; the have says phase waiting-yes with the judgement, and the assigner asks a person. A composition
+// equal to what runs is no move. True when the module waits.
+func (a *Agent) waitsForYes(ctx context.Context, module string, w wantNow, comp compNow) bool {
+	if module == NodeModule || a.env.Policy == nil || a.env.Policy(module) != catalogue.PolicyRecord || w.Want.Yes == comp.Dig {
+		return false
+	}
+	a.mu.Lock()
+	r, ran := a.running[module]
+	if ran && r.Composed == comp.Dig && r.Phase != delivery.PhaseRemoved {
+		a.mu.Unlock()
+		return false
+	}
+	from, known := a.runningComposition(module)
+	prior := ran || a.prior[module]
+	a.mu.Unlock()
+	var j delivery.Judged
+	switch {
+	case known:
+		j = delivery.JudgeMove(&from, comp.C)
+	case prior:
+		j = delivery.Judged{Judgement: delivery.JudgedCannot, Words: "what " + module + " runs on this node cannot be read"}
+	default:
+		j = delivery.JudgeMove(nil, comp.C)
+	}
+	switch j.Judgement {
+	case delivery.JudgedRecreates, delivery.JudgedMovesData, delivery.JudgedCannot:
+	default:
+		return false
+	}
+	a.mu.Lock()
+	a.sayOnce("yes:"+module+":"+comp.Dig, fmt.Sprintf("%s at %s waits for a person's yes: %s", module, w.Want.FP, j.Words))
+	prev := a.running[module]
+	a.mu.Unlock()
+	a.env.Haves.Write(ctx, Have{Module: module, FP: prev.FP, Composed: prev.Composed, Phase: string(delivery.PhaseWaitingYes),
+		Detail: j.Words, Judgement: string(j.Judgement), Waits: comp.Dig})
+	return true
+}
+
+// runningComposition is what the module runs now: the composition last applied, else its resources in the declaration
+// the node kept from before the switch. Called with a.mu held.
+func (a *Agent) runningComposition(module string) (delivery.Composed, bool) {
+	if c, ok := a.applied[module]; ok && c.Err == nil {
+		return c.C, true
+	}
+	if a.env.Kept != nil {
+		if rs, ok := a.env.Kept()[module]; ok {
+			return delivery.Composed{Node: a.env.Node, Module: module, Resources: rs}, true
+		}
+	}
+	return delivery.Composed{}, false
+}

internal/agent/agent_test.go

@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -952,3 +953,78 @@ func TestAModuleRunningFromTheKeptDeclarationKeepsItsFilledPaths(t *testing.T) {
 		t.Fatalf("what runs from the kept declaration: %+v", got)
 	}
 }
+
+// Issue 1126 (ADR 0547 §2, §3): with the node's own compositions, unsigned, and wants naming the build alone, the
+// composition composed for the want's build is applied, and only when it differs from what runs; for a module of
+// policy record a move that recreates a container waits in phase waiting-yes with its judgement until the want names
+// the yes for that composition, and is then applied.
+func TestTheNodesOwnCompositionIsAppliedWhenItDiffersAndARecordMoveWaitsForAYes(t *testing.T) {
+	b := newBed(t)
+	b.env.SelfComposed, b.env.Trusted = true, nil
+	b.env.Policy = func(m string) string {
+		if m == "db" {
+			return catalogue.PolicyRecord
+		}
+		return catalogue.PolicyRoll
+	}
+	stop := b.run()
+	defer stop()
+	unsigned := func(module, fp string, rs ...json.RawMessage) (string, []byte, string) {
+		c := delivery.Composed{Node: node, Module: module, FP: fp, Resources: rs}
+		key, _ := delivery.ComposedKey(node, module, fp)
+		raw, err := delivery.EncodeComposed(c)
+		if err != nil {
+			t.Fatal(err)
+		}
+		dig, _ := delivery.ComposedDigestOf(c)
+		return key, raw, dig
+	}
+	want := func(module, fp, yes string) {
+		key, _ := delivery.WantKey(node, module)
+		raw, err := delivery.EncodeWant(delivery.Want{FP: fp, Yes: yes})
+		if err != nil {
+			t.Fatal(err)
+		}
+		b.wants.put(key, raw)
+	}
+
+	fp := fpOf("a")
+	ck, craw, dig := unsigned("web", fp, file("web", "x", "1"))
+	b.comps.put(ck, craw)
+	want("web", fp, "")
+	eventually(t, "the node's own composition was not applied", func() bool { return len(b.appliedList()) == 1 })
+	eventually(t, "the have does not name the composed digest", func() bool { return b.haves.last("web").Composed == dig })
+	// The same composition handed again is no move.
+	b.comps.put(ck, craw)
+	time.Sleep(50 * time.Millisecond)
+	// A revision at the same build (a config value changed) is applied.
+	_, craw2, dig2 := unsigned("web", fp, file("web", "x", "2"))
+	b.comps.put(ck, craw2)
+	eventually(t, "the revision was not applied", func() bool { return len(b.appliedList()) == 2 && b.haves.last("web").Composed == dig2 })
+
+	// A record module: its first composition is no move; a new image recreates its container and waits for a yes.
+	container := func(image string) json.RawMessage {
+		raw, _ := json.Marshal(map[string]any{"id": "db.server", "type": "container", "module": "db", "name": "db", "image": image})
+		return raw
+	}
+	dk, draw, _ := unsigned("db", fp, container("db@sha256:"+strings.Repeat("1", 64)))
+	b.comps.put(dk, draw)
+	want("db", fp, "")
+	eventually(t, "the record module's first composition was not applied", func() bool { return len(b.appliedList()) == 3 })
+	fpB := fpOf("b")
+	dk2, draw2, ddig2 := unsigned("db", fpB, container("db@sha256:"+strings.Repeat("2", 64)))
+	b.comps.put(dk2, draw2)
+	want("db", fpB, "")
+	eventually(t, "the move did not wait for a yes", func() bool {
+		h := b.haves.last("db")
+		return h.Phase == string(delivery.PhaseWaitingYes) && h.Judgement == string(delivery.JudgedRecreates) && h.Waits == ddig2
+	})
+	if got := b.appliedList(); len(got) != 3 {
+		t.Fatalf("a move waiting for a yes was applied: %v", got)
+	}
+	want("db", fpB, ddig2)
+	eventually(t, "the yes did not apply the move", func() bool {
+		h := b.haves.last("db")
+		return len(b.appliedList()) == 4 && h.Phase == string(delivery.PhaseRunning) && h.FP == fpB
+	})
+}