What runs is the agent's compositions plus the kept declaration's rest: health, filling, take act, directories and the others held out of an apply read it; a restart trusts the node-engine's own haves; the bed tests run off Arch (review round 1)

2026-10-24 18:13:40 +02:00
parent 67db003813
commit be5f31ce66
9 changed files with 298 additions and 59 deletions
@@ -85,9 +85,10 @@ type Env struct {
 	Remove func(ctx context.Context, module string, others []delivery.Composed) Result
 	// Backup backs a module up before a new composition of it is applied; nil backs up nothing.
 	Backup func(ctx context.Context, module string) Backup
-	// Kept is the resources the node last applied for a module from the declaration it kept before the switch (ADR 0539
-	// §9), as JSON, and whether it held the module. Nil when the node kept none.
-	Kept func(module string) ([]json.RawMessage, bool)
+	// Kept is the resources the node last applied, by module, from the declaration it kept before the switch (ADR 0539
+	// §9), as JSON; the node's own are under NodeModule. Nil when the node kept none. A module the agent does not hold yet
+	// still runs from it.
+	Kept func() map[string][]json.RawMessage
 	// Trusted is the public keys a composition may be signed by: the controller's and the operator's (ADR 0539 §3). A
 	// composition unsigned, signed by another key, or changed after it was signed is refused and nothing of it is
 	// applied. Nil trusts no key, so nothing is applied.
@@ -348,7 +349,8 @@ func (a *Agent) compositionFor(module, fp string) (compNow, bool) {
 	return c, ok
 }

-// others are the compositions the node's other modules run now, so what they hold is not taken.
+// others are what the node's other modules run now, so what they hold is not taken: the compositions the agent runs and,
+// for every module the agent does not hold yet, the resources the kept declaration has for it (ADR 0429 §4).
 func (a *Agent) others(except string) []delivery.Composed {
 	var out []delivery.Composed
 	mods := make([]string, 0, len(a.running))
@@ -367,9 +369,44 @@ func (a *Agent) others(except string) []delivery.Composed {
 			out = append(out, c.C)
 		}
 	}
+	if a.env.Kept != nil {
+		kept := a.env.Kept()
+		names := make([]string, 0, len(kept))
+		for m := range kept {
+			if _, held := a.running[m]; !held && m != except {
+				names = append(names, m)
+			}
+		}
+		sort.Strings(names)
+		for _, m := range names {
+			c := delivery.Composed{Node: a.env.Node, Module: m, Resources: kept[m]}
+			if m == NodeModule {
+				c.Module = ""
+			}
+			out = append(out, c)
+		}
+	}
 	return out
 }

+// Everything is what the node runs: the compositions the agent runs, and the kept declaration's resources for each module
+// the agent does not hold yet. What the node judges its health by, and what the filling, the take act and the judgement
+// of directories read, is built from it.
+func (a *Agent) Everything() []delivery.Composed {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.others("\x00")
+}
+
+// HoldsNode says whether the agent runs the node's own composition, so the node's parts are its and not the kept
+// declaration's.
+func (a *Agent) HoldsNode() bool {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	h, ok := a.running[NodeModule]
+	return ok && h.Phase != delivery.PhaseRemoved
+}
+
 func (a *Agent) settleOne(ctx context.Context, module string) {
 	a.mu.Lock()
 	w := a.wants[module]
@@ -434,19 +471,24 @@ func (a *Agent) baseline(ctx context.Context, module string, w wantNow, comp com
 			a.mu.Lock()
 			a.prior[module] = true
 			a.mu.Unlock()
-			if h.FP == w.Want.FP && h.Composed == w.Want.Composed &&
-				(h.Phase == "" || h.Phase == string(delivery.PhaseRunning)) {
-				a.mu.Lock()
-				a.running[module] = delivery.Have{FP: h.FP, Composed: h.Composed, Phase: delivery.PhaseRunning}
-				a.mu.Unlock()
-				return true
+			if h.Composed != "" {
+				// This node-engine wrote it: what it says is what runs, and the kept declaration says nothing more. A
+				// failed apply or a different composition is applied again.
+				if h.FP == w.Want.FP && h.Composed == w.Want.Composed &&
+					(h.Phase == "" || h.Phase == string(delivery.PhaseRunning)) {
+					a.mu.Lock()
+					a.running[module] = delivery.Have{FP: h.FP, Composed: h.Composed, Phase: delivery.PhaseRunning}
+					a.mu.Unlock()
+					return true
+				}
+				return false
 			}
 		}
 	}
 	if a.env.Kept == nil {
 		return false
 	}
-	kept, ok := a.env.Kept(module)
+	kept, ok := a.env.Kept()[module]
 	if ok {
 		a.mu.Lock()
 		a.prior[module] = true
@@ -110,15 +110,17 @@ type bed struct {
 	failWith string
 	backup   func(module string) Backup
 	kept     map[string][]json.RawMessage
+	others   [][]delivery.Composed
 	env      Env
 }

 func newBed(t *testing.T) *bed {
 	b := &bed{t: t, wants: newFeed(), comps: newFeed(), haves: &haves{}}
 	b.env = Env{Node: node, Wants: b.wants, Composed: b.comps, Haves: b.haves,
-		Apply: func(_ context.Context, c delivery.Composed, _ []delivery.Composed) Result {
+		Apply: func(_ context.Context, c delivery.Composed, others []delivery.Composed) Result {
 			b.mu.Lock()
 			defer b.mu.Unlock()
+			b.others = append(b.others, others)
 			name := c.Module
 			if name == "" {
 				name = NodeModule
@@ -144,10 +146,7 @@ func newBed(t *testing.T) *bed {
 			}
 			return Backup{Done: true}
 		},
-		Kept: func(m string) ([]json.RawMessage, bool) {
-			r, ok := b.kept[m]
-			return r, ok
-		},
+		Kept: func() map[string][]json.RawMessage { return b.kept },
 		Trusted: func() []ed25519.PublicKey { return []ed25519.PublicKey{controllerPub, operatorPub} },
 		Say:     func(s string) { t.Log(s) },
 	}
@@ -556,3 +555,88 @@ func TestWithNoTrustedKeyNothingIsApplied(t *testing.T) {
 		t.Fatalf("applied with no trusted key: %v", got)
 	}
 }
+
+// What a module's apply must not take is every other module that runs, those the agent holds and those still running from
+// the kept declaration (ADR 0429 §4): the resources of the kept declaration reach Apply as the others.
+func TestApplyingOneModuleHoldsOutTheModulesStillRunningFromTheKeptDeclaration(t *testing.T) {
+	b := newBed(t)
+	b.kept = map[string][]json.RawMessage{"db": {file("db", "x", "1")}, NodeModule: {file("node", "n", "n")}}
+	stop := b.run()
+	defer stop()
+	fp := fpOf("a")
+	ck, craw, dig := composition(t, "web", fp, false, file("web", "x", "1"))
+	b.comps.put(ck, craw)
+	wk, wraw := wantFor(t, "web", fp, dig, "")
+	b.wants.put(wk, wraw)
+	eventually(t, "not applied", func() bool { return len(b.appliedList()) == 1 })
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	var names []string
+	for _, c := range b.others[0] {
+		names = append(names, c.Module)
+	}
+	if len(names) != 2 || !strings.Contains(strings.Join(names, ","), "db") {
+		t.Fatalf("the others of web were %v: db and the node's own run from the kept declaration", names)
+	}
+}
+
+// Everything is what runs: the agent's compositions and the kept resources of each module it does not hold.
+func TestEverythingIsWhatTheAgentRunsAndWhatIsKeptForTheRest(t *testing.T) {
+	b := newBed(t)
+	b.kept = map[string][]json.RawMessage{"db": {file("db", "x", "1")}, "web": {file("web", "x", "old")}}
+	a := New(b.env)
+	if got := a.Everything(); len(got) != 2 {
+		t.Fatalf("before the agent holds anything: %d compositions, want the 2 kept", len(got))
+	}
+	a.running["web"] = delivery.Have{FP: fpOf("a"), Composed: "sha256:" + strings.Repeat("1", 64), Phase: delivery.PhaseRunning}
+	ck, craw, dig := composition(t, "web", fpOf("a"), false, file("web", "x", "new"))
+	a.running["web"] = delivery.Have{FP: fpOf("a"), Composed: dig, Phase: delivery.PhaseRunning}
+	a.takeComposition(Update{Key: ck, Value: craw, Revision: 1})
+	got := a.Everything()
+	if len(got) != 2 {
+		t.Fatalf("%d compositions", len(got))
+	}
+	for _, c := range got {
+		if c.Module == "web" && !strings.Contains(string(c.Resources[0]), "new") {
+			t.Fatal("web is the kept declaration's, not the composition the agent runs")
+		}
+	}
+	if a.HoldsNode() {
+		t.Fatal("the agent holds no node composition")
+	}
+}
+
+// A failed apply is applied again after a restart even when the kept declaration holds the composition: once this
+// node-engine wrote its haves, they are what it knows (the kept declaration is only for the first start after the switch).
+func TestAFailedApplyIsAppliedAgainAfterARestartWhateverIsKept(t *testing.T) {
+	b := newBed(t)
+	fp := fpOf("a")
+	ck, craw, dig := composition(t, "web", fp, false, file("web", "x", "1"))
+	wk, wraw := wantFor(t, "web", fp, dig, "")
+	b.comps.before(ck, craw)
+	b.wants.before(wk, wraw)
+	b.kept = map[string][]json.RawMessage{"web": {file("web", "x", "1")}}
+	b.haves.stored = map[string]Have{"web": {Module: "web", FP: fp, Composed: dig, Phase: string(delivery.PhaseFailed)}}
+	stop := b.run()
+	defer stop()
+	eventually(t, "a failed apply was marked running from the kept declaration", func() bool { return len(b.appliedList()) == 1 })
+}
+
+// A have written before the switch carries no composition: then the kept declaration says what runs.
+func TestAHaveWithNoCompositionDefersToTheKeptDeclaration(t *testing.T) {
+	b := newBed(t)
+	fp := fpOf("a")
+	ck, craw, dig := composition(t, "web", fp, false, file("web", "x", "1"))
+	wk, wraw := wantFor(t, "web", fp, dig, "")
+	b.comps.before(ck, craw)
+	b.wants.before(wk, wraw)
+	b.kept = map[string][]json.RawMessage{"web": {file("web", "x", "1")}}
+	b.haves.stored = map[string]Have{"web": {Module: "web", Phase: "running"}}
+	stop := b.run()
+	defer stop()
+	eventually(t, "the have was not written", func() bool { return b.haves.last("web").Composed == dig })
+	time.Sleep(50 * time.Millisecond)
+	if got := b.appliedList(); len(got) != 0 {
+		t.Fatalf("applied %v", got)
+	}
+}