Say the heartbeat's interval, export the host's validator, grant the genesis controller Phase 1 (hq to-be 45)

The controller's watchdog of a machine's heartbeat (S1) is bound to three
of its intervals, and a bound the controller guessed would not move when
the interval does: the heartbeat now carries interval_seconds.

Its self-check (D1) must judge every composed declaration as the host
does, and a second validator written from the host's rules would drift
from them: the host's own parsing is exported, unchanged, as
github.com/novox/mesh-host/validate.

The installer's first user list grants what the controller now composes
for itself: its condition buckets, the condition and doctor-heartbeat
events, the bus's two consumer advisories and $SRV.INFO — or the first
controller would be refused them until the broker's machine is pushed.

validate/validate.go

@@ -0,0 +1,38 @@
+// Package validate is the node-engine's own judgement of a declaration, for whoever must know before
+// a declaration is sent whether a machine would take it (novox/hq to-be 45 §4, D1; §9, the merge gate).
+//
+// **One validator.** The controller composed declarations the host then refused whole — a manifest
+// the catalogue check passed (novox/hq issue 236), a consumer's identity too long for the machine's
+// names (issue 263) — because the only validator was the one the host runs as it applies. A second,
+// written in the controller from the host's rules, would drift from them the first time either
+// changed. So the host's own parsing is exported here, unchanged: what the controller's self-check and
+// the merge gate run is what every machine runs.
+//
+// It judges a declaration as it arrives over the link: actions are refused, as the host refuses them
+// from the link (novox/hq ADR 0005). Nothing here touches a machine.
+package validate
+
+import (
+	"errors"
+
+	"github.com/novox/mesh-host/internal/declaration"
+)
+
+// Declaration is every problem the node-engine would refuse a declaration for, each in its own words;
+// nil when it would take it. The body is the declaration as the controller composes it — the bytes a
+// signature is made over — not the signed envelope.
+func Declaration(raw []byte) []string {
+	_, err := declaration.Parse(raw)
+	if err == nil {
+		return nil
+	}
+	var refused *declaration.RefusalError
+	if errors.As(err, &refused) {
+		return refused.Problems
+	}
+	return []string{err.Error()}
+}
+
+// Version is the declaration vocabulary this validator speaks: a declaration of another version is
+// refused whole by Declaration, as by the host.
+const Version = declaration.Version

validate/validate_test.go

@@ -0,0 +1,31 @@
+package validate
+
+import (
+	"strings"
+	"testing"
+)
+
+// **The validator a controller imports is the host's**: a declaration the host takes passes, and one
+// it refuses is refused with the host's own words, every problem at once.
+func TestTheValidatorIsTheHosts(t *testing.T) {
+	good := `{"declaration": 1, "resources": [{"id": "d", "type": "directory", "path": "/var/lib/x", "mode": "0755"}]}`
+	if problems := Declaration([]byte(good)); problems != nil {
+		t.Fatalf("a declaration the host takes was refused: %v", problems)
+	}
+	for _, bad := range []string{
+		`{"declaration": 1, "resources": []}`,
+		`{"declaration": 99, "resources": [{"id": "d", "type": "directory", "path": "/x"}]}`,
+		`{"declaration": 1, "resources": [{"id": "d", "type": "nothing-the-host-knows"}]}`,
+		`not json`,
+	} {
+		problems := Declaration([]byte(bad))
+		if len(problems) == 0 {
+			t.Errorf("a declaration the host refuses was passed: %s", bad)
+		}
+		for _, p := range problems {
+			if strings.TrimSpace(p) == "" {
+				t.Errorf("a problem said nothing, for %s", bad)
+			}
+		}
+	}
+}