Keep libraries under groups of their own, and give modules users in them (hq ADR 0328, issue 567)

ADR 0328 supersedes ADR 0325: shared data is a library with one home, kept usable by
its group rather than by ACL entries. The engine now makes each library's group and
each module's user in its libraries' groups; keeps a library's root and requested
sub-paths in its group with group write and setgid on its home, making missing
sub-paths as the root is; waits for the operator's word before touching a root that
holds data, and on the take act walks it by descriptor (no link, same filesystem,
bounded and resumed, files with other names left); holds the containers of a library
whose disk or mount is not there; and puts the tool runner's account in the group.
The ACL keeping, mask repair and watch are gone; an access is again as before ADR 0325.

cmd/mesh-host/main.go

@@ -241,8 +241,8 @@ func run(ctx context.Context, command string, opts options) error {
 	// found (novox/hq issue 339).
 	handedOverFrom(opts.state)
 	foundState.Store(opts.state)
-	// And what it knows of the shared folders it keeps is beside its state (novox/hq ADR 0325 §5).
-	apply.KeptFolders = store.NewKeptFile(opts.state)
+	// And what it knows of the libraries it keeps is beside its state (novox/hq ADR 0328 §6).
+	apply.Libraries = store.NewLibraryFile(opts.state)
 	// And the guard asks the running container runtimes where they keep their data (novox/hq issue 339).
 	apply.AskRuntimes = apply.ExecRunner
 	switch command {
@@ -1123,7 +1123,7 @@ func runLink(ctx context.Context, opts options) error {
 	// this process's, a `reconcile` run by hand, the installer's — reads it (novox/hq issue 224).
 	sched.RecordWindowsIn(apply.WindowsIn(filepath.Dir(opts.state)))
 	go sched.Run(ctx)
-	// The watch on every kept folder and the walks under them, beside the applies (novox/hq ADR 0325 §6, §8).
+	// The take act's walks that stopped at their bound go on beside the applies (novox/hq ADR 0328 §7).
 	startKeeping(ctx, func(line string) { say(line) })
 
 	// The one liveness judge on this machine (novox/hq ADR 0240), made before anything applies: every
@@ -1236,7 +1236,7 @@ func runLink(ctx context.Context, opts options) error {
 		// A read-only judgement of the directories this node is declared, asked by the controller (novox/hq
 		// issue 358): which the walk that follows no link another account could make would refuse.
 		JudgeDirectories: judgeDirectoriesFrom(opts.state),
-		// The take act on an access's folder, on the operator's warrant (novox/hq ADR 0325 §8).
+		// The take act on a library, on the operator's warrant (novox/hq ADR 0328 §7).
 		AccessAct: accessActFrom(opts.state, opts.timeout),
 		Say:       say,
 		Timeout:   opts.timeout,
@@ -1602,8 +1602,7 @@ const (
 // judgeWhatRuns looks at every long-running resource every liveness.LookEvery and says the statement on
 // the bus when a state changed, again every minute while one is not healthy, and every five minutes
 // anyway. A statement the bus did not take is said at the next look. It reads; it never acts (ADR 0240
-// rule 6) — but for the sweep of a kept folder, which ADR 0325 §10 has every look make: it puts back an entry or a
-// mask an app narrowed, and nothing else.
+// rule 6) — but for going on with a take act stopped at its bound (ADR 0328 §7), which runs beside it.
 func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, say link.Announce) {
 	ticker := time.NewTicker(liveness.LookEvery)
 	defer ticker.Stop()
@@ -1642,8 +1641,8 @@ func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, sa
 				}
 			}
 		}
-		// Every access, judged on every look, its kept folder swept (novox/hq ADR 0325 §10); and a walk stopped
-		// at its bound goes on.
+		// Every library, judged on every look (novox/hq ADR 0328 §8, §9); and a take act stopped at its bound
+		// goes on, beside.
 		accessSt, accessesChanged := accesses.look(time.Now())
 		keeping.poke(ctx)
 		owed = owed || accessesChanged
@@ -1700,10 +1699,10 @@ func judgeWhatRuns(ctx context.Context, j *liveness.Judge, queue *link.Queue, sa
 
 // healthAsReported is a statement as the report and the event carry it.
 func healthAsReported(st liveness.Statement, ns *network.Statement) *link.Health {
-	// IdentityContract: this engine reads a resource's declared `health` and judges it (ADR 0240 Phase B), judges a
-	// user's declared `root` (novox/hq ADR 0266), and reads a declaration's identities, a container's identity and
-	// an access's users (novox/hq ADR 0325), which is what tells the controller it may be sent any of those fields.
-	h := &link.Health{Contract: link.IdentityContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}}
+	// LibraryContract: this engine reads a resource's declared `health` and judges it (ADR 0240 Phase B), judges a
+	// user's declared `root` (novox/hq ADR 0266), and reads a declaration's identities, groups and libraries
+	// (novox/hq ADR 0328), which is what tells the controller it may be sent any of those fields.
+	h := &link.Health{Contract: link.LibraryContract, At: st.At.UTC(), Resources: []link.ResourceHealth{}}
 	for _, r := range st.Resources {
 		h.Resources = append(h.Resources, link.ResourceHealth{Module: r.Module, Resource: r.ID, Kind: r.Kind,
 			Target: r.Target, State: r.State, Reason: r.Reason, Since: r.Since.UTC(), Streak: r.Streak,
@@ -2084,9 +2083,9 @@ func applyAndKeepHeld(ctx context.Context, opts options, raw []byte, signed *sto
 	// What runs here for a module, and how each is (novox/hq ADR 0240): judged from what was just
 	// applied, so every resource this apply started says `starting` and the gate waits for it.
 	if j := judging; j != nil {
-		// A container that waits for an accessed folder not there was not created: the access says why, and
-		// liveness judges it neither alive nor dead (novox/hq ADR 0325 §9).
-		j.Set(liveness.LongRunning(declared, withWaiting(held, apply.WaitingOnAccess(declared))))
+		// A container that waits for a library whose disk or mount is not there was not created: the library says
+		// why, and liveness judges it neither alive nor dead (novox/hq ADR 0328 §9).
+		j.Set(liveness.LongRunning(declared, withWaiting(held, apply.WaitingOnLibrary(declared))))
 		st, _ := j.Look(ctx)
 		netJudge.declare(declaredResolvConf(declared))
 		var netSt *network.Statement
@@ -2109,7 +2108,7 @@ func applyAndKeepHeld(ctx context.Context, opts options, raw []byte, signed *sto
 			accountSt = &as
 		}
 		accesses.set(declared, held)
-		// What the apply changed in who uses a kept folder is walked under it now, beside (ADR 0325 §8).
+		// A take act stopped at its bound goes on, beside (ADR 0328 §7).
 		keeping.poke(ctx)
 		accessSt, _ := accesses.look(time.Now())
 		report.Health = withAccesses(withFoundDirectories(withAccounts(withUnits(healthAsReported(st, netSt), unitSt),