Write down what a run has to be pointed at

Reconstructed from the source twice now, which is 04-ISSUES/005 in its
own README: a test whose artifact was not pointed at skips rather than
fails, so an unset variable is a green run that proved nothing. The
first attempt today reported "skipped 24" and left a receipt claiming
zero of everything — working exactly as designed, and indistinguishable
at a glance from a suite that had nothing to do.

Also records the two things that cost time either side of it: `check`
says which variables are missing before a long run rather than skipping
quietly, and a heredoc into `newgrp` runs the suite as a child of a
shell that immediately exits, so it needs `setsid nohup … &` or it dies
with the shell that launched it.

test/integration/mesh.test.ts

@@ -1658,3 +1658,78 @@ test("a third-party workload is adopted, with the credential it already had", {
   assert.doesNotMatch(reached, /unreachable/,
     "a container could not reach the other by name, so the module's network did nothing");
 });
+
+// The real modules, resolved together on one machine.
+//
+// **What this proves without pulling a gigabyte of images**: that five manifests written from the
+// running system resolve as a graph — keycloak's requirement met by postgres's provision,
+// capabilities checked, nothing claiming the same singular thing — and that the declaration the
+// control plane composes is one the host accepts. `plan --json` exists for exactly this: it is
+// the only way to know that what the control plane emits is what the host takes.
+//
+// Running them needs their images stocked and two provisioners built, which is a separate and
+// larger job. This is the half that can be known now, and it is the half where a design fault
+// would live.
+test("the real modules resolve together, and compose a declaration a host accepts", {
+  skip, timeout: 300_000,
+}, async () => {
+  const modules = ["postgres", "keycloak", "gitea", "minio", "mailu"];
+  for (const name of modules) {
+    const raw = readFileSync(
+      `${process.env["MESH_LAB_MODULES"]}/${name}.json`, "utf8");
+    await must("anchor", `printf %s ${quote(raw)} > /${name}.json`);
+    await must("anchor", `docker cp /${name}.json mesh-control:/${name}.json`);
+    await mesh(`module add /${name}.json`);
+  }
+
+  // Assigned one at a time, because assignment resolves the whole set and says so immediately.
+  // A refusal here is the graph rejecting something, which is the point of asking.
+  for (const name of modules) {
+    await mesh(`assign anchor ${name}`);
+  }
+
+  const plan = await mesh("plan anchor --json", 120_000);
+  const declaration = JSON.parse(plan.slice(plan.indexOf("{")));
+  const byId = new Map<string, any>(
+    (declaration.resources as any[]).map((r) => [r.id, r]));
+  const ids = [...byId.keys()];
+
+  // Every module's own network, which only exists because more than one container needs to reach
+  // another by name.
+  for (const id of ["postgres.net", "keycloak.net", "minio.net", "mailu.net"]) {
+    assert.ok(byId.has(id), `${id} is missing; ${ids.length} resources: ${ids.join(", ")}`);
+    assert.equal(byId.get(id).type, "network");
+  }
+
+  // The cross-module edge: keycloak asked for a database and was told where it is and given a
+  // credential. Neither file is anything keycloak's manifest could have written.
+  const bound = [...byId.values()].find((r) =>
+    r.type === "file" && r.path === "/var/lib/keycloak/database.json");
+  assert.ok(bound, `keycloak was never told where its database is: ${ids.join(", ")}`);
+  assert.match(JSON.stringify(bound), /postgres/,
+    "keycloak's binding does not name what answered its requirement");
+
+  const credential = [...byId.values()].find((r) =>
+    r.type === "file" && r.path === "/var/lib/keycloak/database.env");
+  assert.ok(credential, "keycloak was given no credential for its database");
+  assert.ok(credential.sealed, "keycloak's credential is not sealed, so the mesh can read it");
+  assert.ok(!credential.content, "a credential arrived as content rather than sealed");
+
+  // And the provider was told who asked, which is what its provisioner reconciles against.
+  const grants = [...byId.values()].find((r) =>
+    r.type === "file" && String(r.path).startsWith("/var/lib/postgres/grants"));
+  assert.ok(grants, "postgres was never told which modules were granted a database");
+  assert.match(JSON.stringify(grants), /keycloak|gitea/,
+    "the grants file names neither module that asked for a database");
+
+  // Secrets reach containers as files, never as environment in the declaration.
+  const containers = [...byId.values()].filter((r) => r.type === "container");
+  assert.ok(containers.length >= 12,
+    `only ${containers.length} containers; mailu alone is nine`);
+  for (const c of containers) {
+    for (const [key, value] of Object.entries(c.env ?? {})) {
+      assert.doesNotMatch(String(value), /^[A-Za-z0-9+/]{24,}={0,2}$/,
+        `${c.name} carries something secret-shaped in env.${key}, which the broker would see`);
+    }
+  }
+});