Hand a module exactly when the vault's own answer judged it handed, so the node never composes a secret the vault leaves to the provisioner (issue 774)

internal/selfcompose/selfcompose_test.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"reflect"
 	"slices"
 	"strconv"
 	"strings"
@@ -163,7 +164,7 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 		asks++
 		sealedAt[fmt.Sprintf(`{"ask":%d}`, asks)] = generation + 1
 		return json.RawMessage(fmt.Sprintf(`{"node":"n1","key":"sk","own":[{"module":"keeper","name":"password","origin":"made",`+
-			`"generation":%d,"sealed":{"ask":%d}}]}`, generation+1, asks)), nil
+			`"generation":%d,"sealed":{"ask":%d}}],"handed":{"keeper":false}}`, generation+1, asks)), nil
 	}
 	secretChanged := make(chan []byte, 1)
 	env.Hear = func(subject string) (<-chan []byte, func(), error) {
@@ -767,6 +768,16 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	if rotated.Key != keeperKey {
 		t.Fatalf("a new generation handed %s, want keeper again", rotated.Key)
 	}
+	// Issue 774: what the vault judged handed in its own answer is what the node's composition hands, for n1 alone.
+	b.mu.Lock()
+	asked := asks
+	b.mu.Unlock()
+	if h := (reader{c: c}).Handed(ctx, "n1"); asked == 0 || !reflect.DeepEqual(h, map[string]bool{"keeper": false}) {
+		t.Errorf("the vault's handed verdicts as the composition reads them, after %d asks: %v", asked, h)
+	}
+	if h := (reader{c: c}).Handed(ctx, "n2"); h != nil {
+		t.Errorf("another node's verdicts: %v", h)
+	}
 
 	// Review of L2 (round 2): rotated, then the node-engine restarts. The agent has applied nothing yet, so the box the
 	// node runs comes from keeper's have (Held); the vault seals the value again, other bytes, and the box the have holds