Seal the build agent the forge genesis raised, in place of the builder's npm-password (hq issue 121, ADR 0336)

The build agent declares neither the retired builder's npm-password own-secret
nor a serves setting, so the packages step handed its credential to nothing
and genesis's sdk step had no way to publish. The packages step now seals the
genesis-package-registry own-secret to build-agent: the forge on this node's
loopback, the port given for the package registry, its npm path, and the
mesh-builder account with its password. setFoundationSettings no longer gives
the builder a serves.port.

internal/bootstrap/phase_packages.go

@@ -2,6 +2,7 @@ package bootstrap
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"os"
@@ -49,8 +50,8 @@ const (
 	packagesTeam = "packages"
 	// giteaAdminUser is the admin the bootstrap creates and the provisioner later authenticates as.
 	giteaAdminUser = "mesh-admin"
-	// builderGiteaUser is the gitea account the builder publishes and pulls with at genesis. It is
-	// the `as` the builder's static package binding names.
+	// builderGiteaUser is the gitea account the build agent publishes and pulls with at genesis: the
+	// `as` of the genesis document (novox/hq ADR 0336 §3). Retiring it is issue 602.
 	builderGiteaUser = "mesh-builder"
 	// giteaDBRole/giteaDBName is gitea's own database in the foundation store.
 	giteaDBRole = "mesh_gitea"
@@ -133,8 +134,8 @@ func RaisePackageRegistry(ctx context.Context, o Options, d Deps, control contro
 		return err
 	}
 
-	say("  delivering the builder its registry credential")
-	if err := deliverBuilderNpm(ctx, o, control, builderPassword, say); err != nil {
+	say("  sealing the build agent the genesis document for the forge it raised")
+	if err := deliverGenesisRegistry(ctx, o, control, genesisRegistry(ports, builderPassword), say); err != nil {
 		return err
 	}
 
@@ -362,27 +363,69 @@ func packagePasswords() (db, admin, builder string, err error) {
 	return db, admin, builder, nil
 }
 
-// deliverBuilderNpm seals the builder's registry password to this node as its `npm-password`
-// own-secret, the same way the control plane's store connections are delivered — carry the value in,
-// `secret accept`, and the next push writes it sealed where the builder reads it.
-func deliverBuilderNpm(ctx context.Context, o Options, control controlPlane, password string,
+// BuildAgentModule is the module genesis seals the genesis document to: the build agent, which holds
+// the node seat `node-build-agent` (novox/hq ADR 0190).
+const BuildAgentModule = "build-agent"
+
+// GenesisRegistrySecret is the build agent's own-secret the genesis document is sealed as (novox/hq
+// ADR 0336 §3). The build-agent manifest declares it, issued outside the mesh: only this installer
+// gives one, on genesis's node.
+const GenesisRegistrySecret = "genesis-package-registry"
+
+// GenesisRegistry is the genesis document (novox/hq ADR 0336 §3): the forge this step raised, the port
+// this node gave the package registry, its npm path, and the account this step made with its password.
+// mesh-controller's cmd/mesh-builder reads it under the same field names while the build agent's
+// npm-package-registry requirement is unbound, and prefers the binding once the gitea module is
+// assigned and it binds.
+type GenesisRegistry struct {
+	Scheme   string `json:"scheme"`
+	At       string `json:"at"`
+	Port     int    `json:"port"`
+	NpmPath  string `json:"npm-path"`
+	As       string `json:"as"`
+	Password string `json:"password"`
+}
+
+// genesisRegistry is the document for the forge raised here: on the machine's own loopback, where it
+// answers on the host network and where its ROOT_URL says it is (raiseGiteaServer), on the port this
+// node gave the package registry.
+func genesisRegistry(ports FoundationPorts, password string) GenesisRegistry {
+	return GenesisRegistry{Scheme: "http", At: "127.0.0.1", Port: ports.Packages,
+		NpmPath: "/api/packages/" + packagesOrg + "/npm/", As: builderGiteaUser, Password: password}
+}
+
+// deliverGenesisRegistry seals the genesis document to the build agent on this node as its
+// `genesis-package-registry` own-secret (novox/hq ADR 0336 §3), the same way the control plane's store
+// connections are delivered — carry the value in, `secret accept`, and the next push writes it sealed
+// where the build agent reads it.
+//
+// **The build agent's one way to the forge until the registry binds.** Its npm-package-registry
+// requirement is optional (ADR 0336 §1), and nothing provides it until the gitea module is assigned
+// after the base, so the sdk step (15) publishes and the base step (16) resolves with the account in
+// this document. It replaces the retired builder's `npm-password` own-secret and the `serves.port`
+// setting its carried binding took, neither of which the build agent declares.
+func deliverGenesisRegistry(ctx context.Context, o Options, control controlPlane, doc GenesisRegistry,
 	say func(string)) error {
-	at := "/accepting-npm-password"
-	if err := control.carryingSecret(ctx, "mesh-accepting-npm-password", []byte(password), at); err != nil {
+	raw, err := json.Marshal(doc)
+	if err != nil {
 		return err
 	}
-	if _, err := control.tell(ctx, "secret", "accept", o.Node, BuilderModule, "npm-password", "--from", at); err != nil {
+	at := "/accepting-" + GenesisRegistrySecret
+	if err := control.carryingSecret(ctx, "mesh-accepting-"+GenesisRegistrySecret, raw, at); err != nil {
 		return err
 	}
-	// Push so the sealed secret reaches the builder, which restarts on it and comes back credentialed.
+	if _, err := control.tell(ctx, "secret", "accept", o.Node, BuildAgentModule, GenesisRegistrySecret, "--from", at); err != nil {
+		return err
+	}
+	// Push so the sealed document reaches the build agent, which reads it at its next build.
 	if _, err := control.tell(ctx, "push", o.Node); err != nil {
 		return err
 	}
 	return nil
 }
 
-// PublishTheSDK dispatches a build of the SDK to the builder. The builder has its registry
-// credential by now, so the build's `npm publish` authenticates; the artifact is a `package`, built
+// PublishTheSDK dispatches a build of the SDK to the build agent. The agent has the genesis document by
+// now (novox/hq ADR 0336 §7), so the build's `npm publish` authenticates; the artifact is a `package`, built
 // on a public base, so this needs no toolchain — which is the whole point of doing it before the base.
 func PublishTheSDK(ctx context.Context, o Options, control controlPlane, say func(string)) error {
 	if o.SDKSource.Repository == "" {