The node-engine finds the tool runner by what its manifest says (tool-runner), never by its name, pinned at mesh-sdk a973bfa (issue 774, the operator 2026-11-03)

2026-11-03 13:28:44 +01:00
parent 12c80d7c2e
commit db7cd273f0
13 changed files with 105 additions and 95 deletions
@@ -31,12 +31,12 @@ func aToolsModule(t *testing.T, name string, entrypoints ...string) mcat.Manifes
 // loaded, and its broker secret to receive the node's credential in.
 func theRuntime(t *testing.T) mcat.Manifest {
 	t.Helper()
-	m := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
-		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+	m := mcat.Manifest{Module: "node-tools", Version: "1", ToolRunner: true,
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + "node-tools" + "/broker"}},
 		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "typescript",
 			Entrypoints: []string{"src/main.js"}}}}}
 	resolved, err := m.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
-		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+		Reference: mcat.ArtifactStoreScheme + "node-tools" + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -45,7 +45,7 @@ func theRuntime(t *testing.T) mcat.Manifest {

 func TestEveryToolsBundleIsDeliveredWhereTheRuntimeRuns(t *testing.T) {
 	store := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
+		Needed: map[string]map[string]string{"node-tools": {"broker": "sealed-credential"}}}
 	nftables := aToolsModule(t, "nftables", "tools/index.js")
 	zsh := aToolsModule(t, "zsh", "tools/index.js", "tools/more.js")

@@ -70,7 +70,7 @@ func TestEveryToolsBundleIsDeliveredWhereTheRuntimeRuns(t *testing.T) {
 			t.Errorf("zsh's tools bundle was not delivered: %v", ids(out))
 		}
 		// The runtime's own bundle is run, not loaded: its process delivers it, not an archive.
-		if fileNamed(out, mcat.RuntimeModule+"."+BundleID("runtime")) != nil {
+		if fileNamed(out, "node-tools"+"."+BundleID("runtime")) != nil {
 			t.Error("the runtime's own bundle was delivered as an archive beside its process")
 		}
 	})
@@ -86,6 +86,18 @@ func TestEveryToolsBundleIsDeliveredWhereTheRuntimeRuns(t *testing.T) {
 				t.Errorf("%s was delivered to a machine running no runtime to load it", id)
 			}
 		}
+		// The tool runner is what says it is one, never a name (issue 774): node-tools saying nothing is no runner.
+		silent := theRuntime(t)
+		silent.ToolRunner = false
+		out, err = Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{nftables, zsh, silent}}, store)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, id := range ids(out) {
+			if strings.Contains(id, BundleID("")) || strings.HasSuffix(id, "."+RuntimeProcessID()) {
+				t.Errorf("%s was composed for a module that does not say it is the tool runner", id)
+			}
+		}
 	})
 }

@@ -101,7 +113,7 @@ func ids(out []map[string]any) []string {
 // where its credential is, and who the operator is — restarted when any of that changes.
 func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
 	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
+		Needed: map[string]map[string]string{"node-tools": {"broker": "sealed-credential"}}}
 	nftables := aToolsModule(t, "nftables", "tools/index.js")
 	// A bundle carrying a daemon beside its tools says which files the runtime loads.
 	showcase := mcat.Manifest{Module: "showcase", Version: "1", Tools: []string{"greet"},
@@ -118,12 +130,12 @@ func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	process := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+	process := fileNamed(out, "node-tools"+"."+RuntimeProcessID())
 	if process == nil {
 		t.Fatalf("no runtime process was composed: %v", ids(out))
 	}
-	if process["type"] != "process" || process["name"] != mcat.RuntimeModule || process["digest"] != bundleDigest ||
-		process["source"] != "http://anchor.internal:5101/v2/"+mcat.RuntimeModule+"/runtime/blobs/"+bundleDigest {
+	if process["type"] != "process" || process["name"] != "node-tools" || process["digest"] != bundleDigest ||
+		process["source"] != "http://anchor.internal:5101/v2/"+"node-tools"+"/runtime/blobs/"+bundleDigest {
 		t.Errorf("the runtime's process is %v", process)
 	}
 	if fmt.Sprint(process["run"]) != "[node src/main.js]" {
@@ -134,7 +146,7 @@ func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
 		"showcase="+mcat.BundleRoot+"/showcase/code/tools/index.js" {
 		t.Errorf("the runtime is told to serve %q: every loaded file, by module, and nothing a bundle runs", env[mcat.RuntimeToolModules])
 	}
-	if env[mcat.RuntimeBrokerFile] != "/var/lib/mesh/"+mcat.RuntimeModule+"/broker" {
+	if env[mcat.RuntimeBrokerFile] != "/var/lib/mesh/"+"node-tools"+"/broker" {
 		t.Errorf("the runtime reads its credential at %q, not where the module's own secret is placed", env[mcat.RuntimeBrokerFile])
 	}
 	if env[mcat.RuntimeOperatorAccount] != "ops" || env[mcat.RuntimeOperatorHome] != "/home/ops" || process["user"] != "ops" {
@@ -142,18 +154,18 @@ func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
 	}
 	// The credential the process reads belongs to the account it runs as, or it could not read it
 	// (to-be 38 WP3); other modules' secrets are left as their manifests say.
-	if credential := fileNamed(out, mcat.RuntimeModule+"."+mcat.NeedID("broker")); credential == nil || credential["owner"] != "ops" {
+	if credential := fileNamed(out, "node-tools"+"."+mcat.NeedID("broker")); credential == nil || credential["owner"] != "ops" {
 		t.Errorf("the runtime's credential is not the account's to read: %v", credential)
 	}
 	restarts := fmt.Sprint(process["restart-on"])
-	for _, want := range []string{"nftables." + BundleID("tools"), "showcase." + BundleID("code"), mcat.RuntimeModule + "." + mcat.NeedID("broker")} {
+	for _, want := range []string{"nftables." + BundleID("tools"), "showcase." + BundleID("code"), "node-tools" + "." + mcat.NeedID("broker")} {
 		if !strings.Contains(restarts, want) {
 			t.Errorf("the runtime is not restarted when %s changes: %s", want, restarts)
 		}
 	}
 	// After every bundle and the credential, so both exist before it starts.
 	names := ids(out)
-	if names[len(names)-1] != mcat.RuntimeModule+"."+RuntimeProcessID() {
+	if names[len(names)-1] != "node-tools"+"."+RuntimeProcessID() {
 		t.Errorf("the runtime's process is not last: %v", names)
 	}

@@ -162,7 +174,7 @@ func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		process := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+		process := fileNamed(out, "node-tools"+"."+RuntimeProcessID())
 		env := process["env"].(map[string]string)
 		if _, set := env[mcat.RuntimeOperatorAccount]; set {
 			t.Error("an operator account was named on a machine that has none")
@@ -170,13 +182,13 @@ func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
 		if _, set := process["user"]; set {
 			t.Error("a user was set on a machine with no account")
 		}
-		if credential := fileNamed(out, mcat.RuntimeModule+"."+mcat.NeedID("broker")); credential == nil || credential["owner"] != nil {
+		if credential := fileNamed(out, "node-tools"+"."+mcat.NeedID("broker")); credential == nil || credential["owner"] != nil {
 			t.Errorf("the runtime's credential was given an owner on a machine with no account: %v", credential)
 		}
 	})

 	t.Run("a runtime module built wrong is refused by name", func(t *testing.T) {
-		two := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1", OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/b"}},
+		two := mcat.Manifest{Module: "node-tools", Version: "1", ToolRunner: true, OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/b"}},
 			Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "typescript",
 				Entrypoints: []string{"a.js", "b.js"}}}}}
 		resolved, err := two.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
@@ -195,7 +207,7 @@ func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
 // build from before launchers — so the move needs no flag day.
 func TestTheRuntimeStartsTheLauncherWhereTheBuildWroteOne(t *testing.T) {
 	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
+		Needed: map[string]map[string]string{"node-tools": {"broker": "sealed-credential"}}}
 	launched := mcat.Manifest{Module: "dash", Version: "1", Tools: []string{"status"},
 		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "tools", Kind: mcat.ArtifactBundle, Language: "typescript",
 			Entrypoints: []string{"tools/index.js"}}}}}
@@ -210,7 +222,7 @@ func TestTheRuntimeStartsTheLauncherWhereTheBuildWroteOne(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	env := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())["env"].(map[string]string)
+	env := fileNamed(out, "node-tools"+"."+RuntimeProcessID())["env"].(map[string]string)
 	want := "dash=" + mcat.BundleRoot + "/dash/tools/tools/index.serve.mjs,nftables=" + mcat.BundleRoot + "/nftables/tools/tools/index.js"
 	if env[mcat.RuntimeToolModules] != want {
 		t.Errorf("the runtime is told %q, want %q", env[mcat.RuntimeToolModules], want)
@@ -220,13 +232,13 @@ func TestTheRuntimeStartsTheLauncherWhereTheBuildWroteOne(t *testing.T) {
 // novox/hq ADR 0193: a runtime compiled to a binary runs itself from its own unpacked bundle.
 func TestARuntimeCompiledToABinaryRunsItself(t *testing.T) {
 	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
-	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
-		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Needed: map[string]map[string]string{"node-tools": {"broker": "sealed-credential"}}}
+	goRuntime := mcat.Manifest{Module: "node-tools", Version: "1", ToolRunner: true,
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + "node-tools" + "/broker"}},
 		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
 			System: "arch", From: "cmd/node-tools"}}}}
 	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
-		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+		Reference: mcat.ArtifactStoreScheme + "node-tools" + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -234,7 +246,7 @@ func TestARuntimeCompiledToABinaryRunsItself(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	process := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+	process := fileNamed(out, "node-tools"+"."+RuntimeProcessID())
 	if fmt.Sprint(process["run"]) != "[./node-tools]" {
 		t.Errorf("a Go runtime is run as %v, want its own binary", process["run"])
 	}
@@ -249,13 +261,13 @@ func TestARuntimeCompiledToABinaryRunsItself(t *testing.T) {
 // which runs as the operator's account and is given none of its words.
 func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
 	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
-	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
-		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Needed: map[string]map[string]string{"node-tools": {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
+	goRuntime := mcat.Manifest{Module: "node-tools", Version: "1", ToolRunner: true,
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + "node-tools" + "/broker"}},
 		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
 			System: "arch", From: "cmd/node-tools"}}}}
 	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
-		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+		Reference: mcat.ArtifactStoreScheme + "node-tools" + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -267,7 +279,7 @@ func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	machine := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+	machine := fileNamed(out, "node-tools"+"."+RuntimeProcessID())
 	if served := machine["env"].(map[string]string)[mcat.RuntimeToolModules]; strings.Contains(served, "telegram") || !strings.Contains(served, "nftables") {
 		t.Errorf("the machine's runtime serves %q", served)
 	}
@@ -342,13 +354,13 @@ func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
 // as the account agents run as there — either would hand what it holds back to the accounts it is kept from.
 func TestAModuleOfItsOwnAccountIsRefusedTheOperatorsAndTheAgentsAccount(t *testing.T) {
 	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
-	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
-		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Needed: map[string]map[string]string{"node-tools": {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
+	goRuntime := mcat.Manifest{Module: "node-tools", Version: "1", ToolRunner: true,
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + "node-tools" + "/broker"}},
 		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
 			System: "arch", From: "cmd/node-tools"}}}}
 	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
-		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+		Reference: mcat.ArtifactStoreScheme + "node-tools" + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -368,16 +380,16 @@ func TestAModuleOfItsOwnAccountIsRefusedTheOperatorsAndTheAgentsAccount(t *testi
 // files it holds for its consumers, and what its words name — belongs to that account, never the operator's.
 func TestWhatAModuleOfItsOwnAccountReadsIsItsAccounts(t *testing.T) {
 	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "vault": {"broker": "own"}},
+		Needed: map[string]map[string]string{"node-tools": {"broker": "sealed-credential"}, "vault": {"broker": "own"}},
 		Kept:   &mcat.KeptExport{Export: 1, OperatorKey: "k"},
 		Grants: []mcat.Grant{{Provision: "secret", Consumer: "anchor", From: "telegram", Sealed: "sealed-to-anchor",
 			Values: map[string]any{"name": "telegram"}}}}
-	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
-		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+	goRuntime := mcat.Manifest{Module: "node-tools", Version: "1", ToolRunner: true,
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + "node-tools" + "/broker"}},
 		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
 			System: "arch", From: "cmd/node-tools"}}}}
 	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
-		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+		Reference: mcat.ArtifactStoreScheme + "node-tools" + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
 	if err != nil {
 		t.Fatal(err)
 	}