The node-engine owns the composition it alone runs (H1, H2)

ADR 0593 §1 and §7: compose, its bus reader and runtime reader, takein,
validate, the overlay generator, the composer's run and mesh-compose, and
the judgement of a move leave mesh-sdk for the node-engine's internal
packages, so no other module composes and a change to them rebuilds only
the node-engine. The shapes others read (the composer's request and
verdict, the overlay's names, compositions and answers) stay in mesh-sdk.
The node's grant is now a golden file of what the grants part composes,
since the composer of the bus's user list leaves mesh-sdk too.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

cmd/mesh-compose/testdata/mesh-catalog/modules/umami/module.json.captured

@@ -0,0 +1,142 @@
+{
+  "module": "umami",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "postgres-database",
+    "route",
+    "secret"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "umami"
+    },
+    "route": {
+      "label": "umami",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret",
+    "secret": {
+      "app-secret": "${dir:state}/app.secret",
+      "admin": "${dir:state}/admin.secret"
+    }
+  },
+  "provides": [
+    {
+      "name": "analytics",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "analytics": {}
+  },
+  "receives": {
+    "analytics": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "analytics": "${dir:grants}"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 3000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "one port serves two surfaces — the dashboard and the collection endpoint that the browsers of every tracked site POST to. Both are reached through the proxy, by name, so the port is how the proxy reaches this module and nothing else (novox/hq ADR 0045). It said \"anywhere\" and gave the reason that the collection endpoint must be public, which is true of the name and not of the port: opened, the machine-side port served the dashboard over plain HTTP to the internet, bypassing every rule the proxy applies by path"
+    }
+  ],
+  "data": {
+    "consumers": {
+      "analytics": {
+        "class": "valuable",
+        "in": "postgres-database",
+        "why": "a site's page views are recorded nowhere else"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "template": "files/server.env"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "umami"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "health": {
+        "kind": "http",
+        "endpoint": "web",
+        "path": "/api/share/mesh-health",
+        "status": 404,
+        "body": "\"code\":\"not-found\"",
+        "timeout": "10s",
+        "needs": "postgres-database"
+      },
+      "name": "umami",
+      "image": "ghcr.io/umami-software/umami@sha256:85909afc45bdcda1917394594a087421fdbb05610fded0fa9f6fb861abb2f367",
+      "network": "umami",
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "ports": [
+        "3000"
+      ],
+      "secrets-in-environment": "a Next.js/Prisma application: DATABASE_URL and APP_SECRET are read from the environment only; not convertible"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_UMAMI_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_PROVISION_UMAMI_URL": "http://127.0.0.1:${port:3000}"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}