Raise genesis on the bus the mesh runs on, from one bundle (hq issue 146, ADR 0331)

The installer could not raise a first node: the old bundle's control plane had no
MESH_BUS_NATS and crash-looped, and the NATS bundle was refused because rootsecrets
only knew the previous broker's guest:guest@ template.

One bundle now, the NATS one. rootsecrets makes the controller's bus account and puts
it in both placeholders (the address and the bcrypt hash in the carried user list),
kept with its hash so a re-run writes the same bundle. Preflight refuses a template
naming no bus connection it knows, naming the placeholder, instead of waiting out the
verify step. The broker step adopts the bus as the nats module and refuses, by name,
a catalogue without it or a server that is not the foundation's container.

examples/bundle_test.go

@@ -7,6 +7,7 @@ package examples
 
 import (
 	"os"
+	"path/filepath"
 	"sort"
 	"strings"
 	"testing"
@@ -48,7 +49,7 @@ func TestTheBundleCarriesTheFoundationAndTheControlPlaneAndNothingElse(t *testin
 	}
 	sort.Strings(images)
 
-	want := []string{"lavinmq", "mesh-controller", "postgres"}
+	want := []string{"mesh-controller", "nats", "postgres"}
 	if strings.Join(images, ",") != strings.Join(want, ",") {
 		t.Fatalf("the bundle carries %v; expected exactly %v.\n\n"+
 			"Adding one is a change to what every first node becomes, and to ADR 0006's "+
@@ -67,3 +68,32 @@ func TestTheControlPlaneIsCarriedToo(t *testing.T) {
 	t.Fatal("nothing in the bundle starts the control plane, so the machine would raise a " +
 		"foundation and stop")
 }
+
+// One genesis bundle, on the bus the mesh runs on (novox/hq ADR 0331 §2). Two bundles let every bed
+// and README name the one that could not raise a mesh, for weeks (issue 146).
+func TestThereIsOneGenesisBundle(t *testing.T) {
+	bundles, err := filepath.Glob("*.lock")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(bundles) != 1 || bundles[0] != "foundation-first-node.lock" {
+		t.Fatalf("examples/ holds %v; it holds one genesis bundle, foundation-first-node.lock", bundles)
+	}
+}
+
+// The control plane the bundle raises is given the bus, with the account the installer fills and
+// the certificate it pins (ADR 0331 §4); without it, it crash-loops for ever (issue 146).
+func TestTheControlPlaneIsGivenTheBus(t *testing.T) {
+	for _, r := range bundle(t).Resources {
+		c, ok := r.(*declaration.Container)
+		if !ok || !strings.Contains(c.Image, "mesh-controller") {
+			continue
+		}
+		if !strings.HasPrefix(c.Env["MESH_BUS_NATS"], "nats://controller:bootstrap@") || c.Env["MESH_BROKER_CERTIFICATE"] == "" {
+			t.Fatalf("the control plane is given the bus %q and the certificate %q",
+				c.Env["MESH_BUS_NATS"], c.Env["MESH_BROKER_CERTIFICATE"])
+		}
+		return
+	}
+	t.Fatal("nothing in the bundle starts the control plane")
+}