The node's composer asks the vault's own for its modules' secrets sealed to its key, and keeps a value first had while its generation stands; two agent tests folded to hold the count (issue 1126, ADR 0550 §5)

internal/selfcompose/selfcompose.go

@@ -19,6 +19,7 @@ import (
 	"sync"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
 	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 
@@ -38,6 +39,9 @@ type Env struct {
 	Get  func(ctx context.Context, bucket, key string) ([]byte, error)
 	Mesh frombus.Mesh
 	Say  func(string)
+	// Own asks the vault's `own` in this node's engine's name: its modules' own secrets sealed to its key (ADR 0550 §5).
+	// Nil asks nothing, and a module with an own secret does not compose.
+	Own func(ctx context.Context) (json.RawMessage, error)
 }
 
 // Composer composes the node and is the agent's watcher of its compositions (agent.Env.Composed).
@@ -52,9 +56,12 @@ type Composer struct {
 	values     map[string]map[string]any // by module, this node's
 	manifests  map[string][]byte         // by digest, read once
 	handed     map[string]string         // composed key to the digest handed
-	said       string
-	caught     bool
-	rev        uint64
+	// sealedOwn is each own secret's sealed value as first handed, by module/name and generation: a value sealed again
+	// is other bytes, so the one first had is kept while the generation stands, and the composition stays the same.
+	sealedOwn map[string]ownSealed
+	said      string
+	caught    bool
+	rev       uint64
 }
 
 // New is a composer for one node.
@@ -64,7 +71,14 @@ func New(env Env) *Composer {
 	}
 	return &Composer{env: env, wants: map[string]delivery.Want{}, placements: map[string]delivery.Placement{},
 		records: map[string]delivery.NodeRecord{}, modules: map[string]delivery.Module{}, values: map[string]map[string]any{},
-		manifests: map[string][]byte{}, handed: map[string]string{}}
+		manifests: map[string][]byte{}, handed: map[string]string{}, sealedOwn: map[string]ownSealed{}}
+}
+
+// ownSealed is one own secret's sealed value at a generation and the key it is sealed to.
+type ownSealed struct {
+	generation int
+	key        string
+	sealed     string
 }
 
 // input is one watched bucket and how its updates are taken.
@@ -492,3 +506,44 @@ func (r reader) Values(_ context.Context, node, module string) (map[string]any,
 	}
 	return out, nil
 }
+
+func (r reader) OwnSecrets(ctx context.Context, node string) ([]compose.OwnSecretRow, error) {
+	if node != r.c.env.Node || r.c.env.Own == nil {
+		return nil, nil
+	}
+	raw, err := r.c.env.Own(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("the vault's own: %w", err)
+	}
+	var a struct {
+		Node string `json:"node"`
+		Key  string `json:"key"`
+		Own  []struct {
+			Module     string          `json:"module"`
+			Name       string          `json:"name"`
+			Origin     string          `json:"origin"`
+			Generation int             `json:"generation"`
+			Sealed     json.RawMessage `json:"sealed"`
+		} `json:"own"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil {
+		return nil, fmt.Errorf("the vault's own answer is not one: %w", err)
+	}
+	if a.Node != node {
+		return nil, fmt.Errorf("the vault answered %q's own secrets to %s", a.Node, node)
+	}
+	r.c.mu.Lock()
+	defer r.c.mu.Unlock()
+	out := make([]compose.OwnSecretRow, 0, len(a.Own))
+	for _, o := range a.Own {
+		id := o.Module + "/" + o.Name
+		kept, ok := r.c.sealedOwn[id]
+		if !ok || kept.generation != o.Generation || kept.key != a.Key {
+			kept = ownSealed{generation: o.Generation, key: a.Key, sealed: string(o.Sealed)}
+			r.c.sealedOwn[id] = kept
+		}
+		out = append(out, compose.OwnSecretRow{Node: node, Module: o.Module, Name: o.Name, Origin: o.Origin,
+			SealedTo: a.Key, Sealed: kept.sealed})
+	}
+	return out, nil
+}