novox/mesh-host
18
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

Node shadow: reuse a running seal only at its own slot, lay values as the controller does, answer the newest candidate first and say how it goes (issue 1126, C1 C2, T1 T2 T3)

Browse Source 
A box is reused by slot (resource, field) after the composition, from what runs or the
have's slots; a have written before slots is reused within its module alone. Config
values are laid by mesh-sdk's one rule (never a default). The shadow answers the
newest candidate first and hands each answer as it lands, says when an answer starts,
every minute what it waits on, and when it ends, and fits an answer to the node's key.
Needs mesh-sdk fix/1126-seed-same (16b8d8a1).
This commit is contained in:
jschoubben
2026-10-28 09:41:29 +01:00
parent 7271cf151b
commit a7cd0a7807
9 changed files with 355 additions and 202 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/selfcompose/selfcompose_test.go
+132 -25
View File
@@ -306,8 +306,28 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
t.Error("Transient misjudges a bus that does not answer, or a refusal")
}
// Issue 1126, C2: a config value is laid as the controller lays it (catalogue.LaidValue), from the mesh's, the node's
// or the module's own and never from a default or an unset one, both of this node's and of what another node serves:
// a default laid blanked Element's links on ace.
for _, row := range []struct {
source string
laid bool
}{{"mesh", true}, {"node", true}, {"module", true}, {"default", false}, {"unset", false}, {"", false}} {
probe := New(env)
value := []byte(`{"value":["x"],"source":"` + row.source + `"}`)
probe.takeValue(agent.Update{Key: "n1.lemurs.links", Value: value})
_, laid := probe.values["lemurs"]["links"]
b.mu.Lock()
b.kv[ResolvedBucket+"/n2.lemurs.links"] = value
b.mu.Unlock()
served, err := reader{c: probe}.Served(ctx, "n2", "lemurs", []string{"links"})
if laid != row.laid || err != nil || (served["links"] != nil) != row.laid {
t.Errorf("a value from %q: laid %v, served %v (%v), want laid %v", row.source, laid, served, err, row.laid)
}
}
// A config value of another module, and a value changing nothing composed, hand nothing.
b.put(t, ResolvedBucket, "n1.other.k", []byte(`{"value":1}`))
b.put(t, ResolvedBucket, "n1.other.k", []byte(`{"value":1,"source":"node"}`))
quiet(t, out)
// A want removed takes its composition back.
@@ -367,7 +387,7 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
t.Fatalf("keeper's composition does not carry the sealed value: %s", handed)
}
before := handed
b.put(t, ResolvedBucket, "n1.other.k", []byte(`{"value":2}`))
b.put(t, ResolvedBucket, "n1.other.k", []byte(`{"value":2,"source":"node"}`))
quiet(t, out)
b.mu.Lock()
generation++
@@ -383,32 +403,47 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
// node runs comes from keeper's have (Held); the vault seals the value again, other bytes, and the box the have holds
// is kept, since it opens to the same value: the composition does not move. The box from before the rotation opens
// to the old value, so the vault's is taken.
boxOf := func(raw string) string {
// Issue 1126, C1: a box is kept only at the slot that holds it (the same field of the same resource of the same
// module). A box another module holds (a provider's grant of the value its consumer holds as a secret, on one node)
// or another resource of keeper holds is never taken, though it opens to the same value; a have written before slots
// (a list) is reused within its own module alone.
boxOf := func(raw string) (string, string) {
c, err := delivery.DecodeComposed([]byte(raw))
if err != nil {
t.Fatal(err)
}
sealed := agent.SealedIn(c)
sealed := delivery.SealsIn(c)
if len(sealed) != 1 {
t.Fatalf("keeper's composition carries %v", sealed)
}
return sealed[0]
for slot, box := range sealed {
return slot, box
}
return "", ""
}
// And the node's own key (review of L2, round 3, finding 1): a core box its own composition carries is held there, and
// kept after a restart as a module's is, so the node's own composition does not move either.
slot, rotatedBox := boxOf(string(rotated.Value))
_, beforeBox := boxOf(before)
for _, row := range []struct {
name, held, in string
name, in, held string
slots delivery.Seals
kept bool
}{{"the have holds the rotated value", boxOf(string(rotated.Value)), "keeper", true},
{"the have holds the value before the rotation", boxOf(before), "keeper", false},
{"the node's own key holds the rotated value", boxOf(string(rotated.Value)), agent.NodeModule, true}} {
}{
{"the have holds the rotated value at its slot", "keeper", rotatedBox, delivery.Seals{slot: rotatedBox}, true},
{"the have holds the value before the rotation", "keeper", beforeBox, delivery.Seals{slot: beforeBox}, false},
{"a have written before slots holds the rotated value", "keeper", rotatedBox, nil, true},
{"another module holds the same value", "lemurs", rotatedBox, delivery.Seals{"lemurs.grant-x#sealed": rotatedBox}, false},
{"another resource of keeper holds the same value", "keeper", rotatedBox, delivery.Seals{"keeper.other#sealed": rotatedBox}, false},
} {
restarted := env
restarted.Running = func() []delivery.Composed { return nil }
restarted.Held = func(module string) []string {
if module == row.in {
return []string{row.held}
restarted.Held = func(module string) (delivery.Seals, []string) {
if module != row.in {
return nil, nil
}
return nil
if row.slots == nil {
return nil, []string{row.held}
}
return row.slots, nil
}
restarted.Unseal = func(box string) ([]byte, error) {
b.mu.Lock()
@@ -419,14 +454,56 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
return nil, fmt.Errorf("not sealed to n1: %s", box)
}
again := New(restarted)
again.wants = map[string]delivery.Want{"keeper": {FP: fp, Self: true}, agent.NodeModule: {}}
rows, err := reader{c: again}.OwnSecrets(ctx, "n1")
if err != nil || len(rows) != 1 {
t.Fatalf("%s: own secrets %+v, %v", row.name, rows, err)
c.mu.Lock()
for k, v := range c.wants {
again.wants[k] = v
}
if kept := rows[0].Sealed == row.held; kept != row.kept {
t.Errorf("%s: composed with %s (held %s), kept %v, want %v", row.name, rows[0].Sealed, row.held, kept, row.kept)
for k, v := range c.placements {
again.placements[k] = v
}
for k, v := range c.records {
again.records[k] = v
}
for k, v := range c.modules {
again.modules[k] = v
}
c.mu.Unlock()
var composed string
for _, u := range again.compose(ctx) {
if u.Key == keeperKey {
composed = string(u.Value)
}
}
if composed == "" {
t.Fatalf("%s: keeper was not composed", row.name)
}
if _, box := boxOf(composed); (box == row.held) != row.kept {
t.Errorf("%s: composed with %s (held %s), kept %v", row.name, box, row.held, row.kept)
}
}
// And the node's own key (review of L2, round 3, finding 1): a core box its own composition carries is held there, and
// kept after a restart as a module's is, so the node's own composition does not move either.
ownComp := delivery.Composed{Node: "n1", Resources: []json.RawMessage{json.RawMessage(`{"id":"core-box","sealed":"{\"ask\":999}"}`)}}
b.mu.Lock()
sealedAt[`{"ask":999}`] = generation + 1
b.mu.Unlock()
coreEnv := env
coreEnv.Unseal = func(box string) ([]byte, error) {
b.mu.Lock()
defer b.mu.Unlock()
if g, ok := sealedAt[box]; ok {
return []byte(fmt.Sprintf("password-%d", g)), nil
}
return nil, fmt.Errorf("not sealed to n1: %s", box)
}
coreEnv.Held = func(module string) (delivery.Seals, []string) {
if module == agent.NodeModule {
return delivery.Seals{"core-box#sealed": rotatedBox}, nil
}
return nil, nil
}
if got := delivery.SealsIn(New(coreEnv).keepRunning(ownComp, nil))["core-box#sealed"]; got != rotatedBox {
t.Errorf("the node's own core box after a restart is %s, want the one its key holds %s", got, rotatedBox)
}
// The pair credentials asked (ADR 0550 §5): the keys go to the vault's own with their role, a consumer's comes back as
@@ -460,10 +537,15 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
if err != nil || len(creds) != 1 || len(issued) != 1 {
t.Fatalf("credentials %+v issued %+v, %v", creds, issued, err)
}
if creds[0].State != compose.CredentialHeld || creds[0].Provider != "n2" || creds[0].Sealed != `{"run":1}` ||
if creds[0].State != compose.CredentialHeld || creds[0].Provider != "n2" || creds[0].Sealed != `{"c":1}` ||
issued[0].Consumer != "n3" || issued[0].ForProvider != `{"p":1}` {
t.Errorf("credentials %+v issued %+v", creds, issued)
}
// What runs at the credential's slot is kept, after the composition (keepRunning, issue 1126, C1).
webComp := delivery.Composed{Node: "n1", Module: "web", Resources: []json.RawMessage{json.RawMessage(`{"id":"web.secret-pg","sealed":"{\"c\":1}"}`)}}
if got := delivery.SealsIn(pc.keepRunning(webComp, pairEnv.Running()))["web.secret-pg#sealed"]; got != `{"run":1}` {
t.Errorf("web's credential composed as %s, want the box that runs", got)
}
// A node that cannot compose tells the agent once, and once again when it composes (the agent's haves say it).
pc.refused("a stand-in for web's password")
pc.refused("a stand-in for web's password")
@@ -718,6 +800,11 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
Pull: delivery.Head{Repository: delivery.CatalogueRepository, Number: 1, Head: "h-same"}, Placement: &trunk})
sameKey, _ := delivery.PlacementCandidateKey("same", "n1")
nb.put(delivery.PlacementCandidatesBucket, sameKey, sameRaw, 3)
// Issue 1126, T3: an older group (a closed pull request's candidate, rev 2) is answered after the newest.
oldRaw, _ := delivery.EncodePlacementCandidate(delivery.PlacementCandidate{Group: "older",
Pull: delivery.Head{Repository: delivery.CatalogueRepository, Number: 2, Head: "h-old"}, Placement: &trunk})
oldKey, _ := delivery.PlacementCandidateKey("older", "n1")
nb.put(delivery.PlacementCandidatesBucket, oldKey, oldRaw, 2)
for _, bucket := range []string{delivery.PlacementCandidatesBucket, delivery.PlacementBucket, delivery.HaveBucket, delivery.ModulesBucket, ResolvedBucket} {
nb.send(bucket, agent.Update{Caught: true})
}
@@ -742,11 +829,31 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
if g := a["same"]; g.Verdict != delivery.CandidateSame || !strings.Contains(g.Note, "this answer took over") {
t.Errorf("the shadow, once ready, answered %+v", g)
}
// The newest first, handed at once: the older group still holds the answer it had.
if g := a["older"]; g.Verdict != delivery.CandidateRefused {
t.Errorf("the older group was answered before the newest was handed: %+v", g)
}
if g := (<-nanswered)["older"]; g.Verdict != delivery.CandidateSame {
t.Errorf("the older group, answered next: %+v", g)
}
// Issue 1126, T2: an answer says when it starts and when it ends (and, every minute between, what it waits on).
nmu.Lock()
if !strings.Contains(strings.Join(nsaid, "\n"), "the answer to same took") {
t.Errorf("a slow answer was not said: %q", nsaid)
said := strings.Join(nsaid, "\n")
for _, line := range []string{"the answer to same took", "answering placement candidate same (revision 3)",
"answered placement candidate same in", "answering placement candidate older (revision 2)"} {
if !strings.Contains(said, line) {
t.Errorf("%q was not said: %q", line, nsaid)
}
}
if strings.Index(said, "answering placement candidate same") > strings.Index(said, "answering placement candidate older") {
t.Errorf("the older group was answered first: %q", nsaid)
}
nmu.Unlock()
done := nsh.c.waiting("the vault's own secrets")
if got := nsh.c.waitingOn(); got != "the vault's own secrets" {
t.Errorf("a running answer would say it waits on %q", got)
}
done()
case <-time.After(10 * time.Second):
t.Fatal("the shadow, once ready, answered nothing")
}
@@ -830,7 +937,7 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
buildKey, _ := delivery.BuilderBuildKey("lemurs", fp)
b.mu.Lock()
b.kv[delivery.BuilderBuildsBucket+"/"+buildKey] = built
b.kv[ResolvedBucket+"/n2.mailer.domain"] = []byte(`{"value":"example.org"}`)
b.kv[ResolvedBucket+"/n2.mailer.domain"] = []byte(`{"value":"example.org","source":"module"}`)
b.reads = nil
b.mu.Unlock()
fetched := 0