mesh-host enrol redeems through the seat mesh-enrolment and refuses an answer the token's key did not sign

The engine dials as enrol.<node> on the pinned certificate, calls redeem with the public halves of its keys and a proof over
them (the SDK's RedeemProof, which binds the node and the keys and never the token's secret), asks again while the holder
says to, and verifies the vault's answer against the key its token carries before it keeps anything: an answer signed by
another key, naming another signer or node, or altered is refused and nothing is kept. A signed one is kept (membership,
login, keys), then the node dials as the login it was given, reads its key of node-logins, and calls confirm; nothing is
applied until its placement names a module. When the bus does not serve the seat to the token (the controller still holds its
lease) the controller's enrolment subject is used as before. The token's shape is mesh-sdk's now: identity keeps its names as
aliases. Tests: one added, paid by merging three identity token tests into one (net two fewer).

(issue 774, 774/S64)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

cmd/mesh-host/enrol_seat.go

@@ -0,0 +1,89 @@
+package main
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"github.com/novox/mesh-host/internal/identity"
+	"github.com/novox/mesh-host/internal/link"
+)
+
+// enrolThroughSeat joins this machine through the seat mesh-enrolment (novox/hq ADR 0587 §6, issue 774): it redeems the token
+// with the keys it made, verifies the vault's signed answer against the key the token carries before it keeps anything, keeps
+// its membership and its login, dials as the login node-logins names and confirms. handled is false when the bus does not serve
+// the seat to this token (the controller still holds its lease, so its enrolment subject is the way in): nothing was sent or
+// kept then, and the caller enrols as before.
+func enrolThroughSeat(ctx context.Context, opts options, token identity.Token, node string, mine identity.Identity,
+	sealing identity.SealingKey, serving identity.ServingKey, reported map[string]any, found *link.Tunnel, identityPath string) (handled bool, err error) {
+
+	req := delivery.Redeem{Node: node, PublicKey: base64.StdEncoding.EncodeToString(mine.Public), OverlayKey: mine.Overlay.Public,
+		SealingKey: sealing.Public, ServingKey: serving.Public, Profile: reported}
+	if found != nil {
+		if req.Tunnel, err = json.Marshal(found); err != nil {
+			return true, err
+		}
+	}
+	req.Proof = base64.StdEncoding.EncodeToString(mine.Sign(delivery.RedeemProof(node, req.PublicKey, req.OverlayKey, req.SealingKey, req.ServingKey)))
+	to := link.Approach{Address: token.Broker, Fingerprint: token.Fingerprint, Transport: link.OnNATS}
+	membership := link.Membership{Node: node, Broker: token.Broker, Fingerprint: token.Fingerprint, Transport: link.OnNATS}
+	j := link.Joining{Node: node, Signer: token.SignerKey(),
+		Redeem: func(ctx context.Context) (delivery.RedeemAnswer, error) {
+			return link.Redeem(ctx, to, node, token.Secret, req, opts.timeout)
+		},
+		Open: func(a delivery.RedeemAnswer) (string, error) {
+			value, err := sealing.Open(a.Account)
+			return string(value), err
+		},
+		Keep: func(a delivery.RedeemAnswer, password string) error {
+			// The mesh's name for this node wins over what the machine called itself, as on the controller's path.
+			mine.Node = a.Node
+			mine.Membership = identity.Membership{Broker: token.Broker, Fingerprint: token.Fingerprint, Signer: token.Signer,
+				Password: password, Transport: link.OnNATS}
+			if err := writeLogins(loginsFile(opts.state), link.LoginsState{Current: a.Login, Values: map[string]string{a.Login: password}}); err != nil {
+				return fmt.Errorf("cannot keep the login %s: %w", a.Login, err)
+			}
+			if err := identity.Save(identityPath, mine); err != nil {
+				return err
+			}
+			if !mine.Membership.Joined() {
+				return errors.New("the answer did not say how to reach the mesh again, so the identity could not be used after a restart")
+			}
+			return keepJoinedKeys(opts, mine, sealing, serving)
+		},
+		Dial: func(ctx context.Context, login, password string) (link.Confirming, error) {
+			return link.DialConfirming(ctx, membership, login, password, opts.timeout)
+		},
+	}
+	answer, err := j.Run(ctx)
+	switch {
+	case errors.Is(err, link.ErrNoSeat):
+		return false, nil
+	case err != nil:
+		return true, err
+	}
+	fmt.Printf("\nenrolled as %s through the seat mesh-enrolment, dialled as %s and confirmed\n", answer.Node, answer.Login)
+	fmt.Printf("  identity   %s\n", identityPath)
+	fmt.Println("  nothing is applied until the placement of this node names a module")
+	return true, nil
+}
+
+// keepJoinedKeys writes the private halves of the keys this machine made, after its identity: an identity naming a key that is
+// not there looks joined and cannot come up, so the identity is written first and a failure here is said plainly.
+func keepJoinedKeys(opts options, mine identity.Identity, sealing identity.SealingKey, serving identity.ServingKey) error {
+	if err := os.WriteFile(identity.OverlayKeyPath(opts.state), []byte(mine.Overlay.Private+"\n"), 0o600); err != nil {
+		return fmt.Errorf("cannot write this node's overlay key: %w", err)
+	}
+	if err := os.WriteFile(identity.SealingKeyPath(opts.state), []byte(sealing.Private+"\n"), 0o600); err != nil {
+		return fmt.Errorf("cannot write this node's sealing key: %w", err)
+	}
+	if err := identity.WriteServingKey(identity.ServingKeyPath(opts.state), serving); err != nil {
+		return fmt.Errorf("cannot write this node's serving key: %w", err)
+	}
+	return nil
+}

cmd/mesh-host/main.go

@@ -822,6 +822,11 @@ func enrol(ctx context.Context, opts options) error {
 	// the bus's name, so every enrolment ended at "this token is for the \"\" bus"
 	// (novox/hq 04-ISSUES/146). Nothing caught it because nothing had enrolled since the bus
 	// changed.
+	// Through the seat mesh-enrolment when the bus serves it to this token (novox/hq ADR 0587 §6): the controller's enrolment
+	// subject below stays for as long as the controller holds its lease.
+	if handled, err := enrolThroughSeat(ctx, opts, token, *name, mine, sealing, serving, reported, found, identityPath); handled || err != nil {
+		return err
+	}
 	reply, err := link.Enrol(ctx,
 		link.Approach{Address: token.Broker, Fingerprint: token.Fingerprint, Transport: link.OnNATS},
 		*name, token.Secret,