Two mechanism beds install the catalogue's redis with the vault beside it

A module's name is its tool namespace and its broker scope, so a fixture running
the module's runtime cannot carry another name (novox/hq ADR 0093). The grant and
backend-network beds now read the catalogue's redis and install mesh-vault, which
provides the secret it requires; the redis-node scenario stocks the vault's runtime.
The remaining declared copies say why they stand (novox/hq 04-ISSUES/074).

test/integration/provider-on-backend-network.test.ts

@@ -20,7 +20,7 @@ import { loadScenario } from "../../src/declaration/parse.ts";
 import { raise } from "../../src/lifecycle/raise.ts";
 import { destroy, exec } from "../../src/lifecycle/operate.ts";
 import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
-import { labIsUsable, destroyAll, foundationBundle, onTheMachine } from "./harness.ts";
+import { labIsUsable, destroyAll, foundationBundle, onTheMachine, catalogueModule, catalogueIsPresent } from "./harness.ts";
 import type { HeldImage } from "../../src/pinning.ts";
 
 const capability = await labIsUsable();
@@ -33,7 +33,7 @@ const skip = !capability.usable
     ? "MESH_LAB_HOST_BINARY is not set to a built mesh-host"
     : !bundle || !existsSync(bundle)
       ? "MESH_LAB_BUNDLE is not set to a foundation bundle (mesh-host examples/)"
-      : false;
+      : catalogueIsPresent();
 
 const SCENARIO = "redis-node";
 const MACHINE = "anchor";
@@ -136,54 +136,15 @@ after(async () => {
 test("redis's runtime, on the backend's private network, binds the broker and provisions with the mesh's credential", {
   skip, timeout: 900_000,
 }, async () => {
-  // Exactly the committed redis shape: a private `redis` network, the server on it with a published
-  // port, and the runtime on it too — reaching redis by name and the broker by NAT.
-  const manifest = JSON.stringify({
-    module: "redis",
-    version: "1",
-    provides: [{ name: "redis-cache", scope: "mesh" }],
-    serves: { "redis-cache": {} },
-    emits: ["module.redis.cache.provisioned", "module.redis.cache.deprovisioned"],
-    consumes: ["module.redis.cache.provisioned", "module.redis.cache.deprovisioned"],
-    receives: { "redis-cache": "/var/lib/redis-module/grants/mesh.json" },
-    grants: { "redis-cache": "/var/lib/redis-module/grants" },
-    "own-secrets": { default: "/var/lib/redis-module/default.secret", broker: "/var/lib/mesh/redis/broker" },
-    resources: [
-      { id: "mesh-state", type: "directory", path: "/var/lib/mesh/redis", mode: "0700" },
-      { id: "state", type: "directory", path: "/var/lib/redis-module", mode: "0700" },
-      { id: "grants-dir", type: "directory", path: "/var/lib/redis-module/grants", mode: "0700" },
-      { id: "data", type: "directory", path: "/services/redis/data", mode: "0700", owner: "999:999" },
-      {
-        id: "server-conf", type: "file", path: "/var/lib/redis-module/redis.conf", mode: "0644",
-        content: "requirepass ${secret:default}\nappendonly no\ndir /data\n",
-      },
-      { id: "net", type: "network", name: "redis" },
-      {
-        id: "server", type: "container", name: "redis", image: pinned("redis"), network: "redis",
-        ports: ["6379"],
-        volumes: [
-          "/services/redis/data:/data",
-          "/var/lib/redis-module/redis.conf:/etc/redis/redis.conf:ro",
-        ],
-        args: ["/etc/redis/redis.conf"],
-      },
-      {
-        id: "runtime", type: "container", name: "mesh-redis", image: pinned("mesh-runtime-redis"),
-        network: "redis",
-        volumes: [
-          "/var/lib/mesh/redis/broker:/run/secrets/broker:ro",
-          "/var/lib/redis-module/grants:/var/lib/redis-module/grants:ro",
-          "/var/lib/redis-module/default.secret:/run/secrets/default:ro",
-        ],
-        env: {
-          MESH_BROKER_FILE: "/run/secrets/broker",
-          MESH_RECEIVES: "/var/lib/redis-module/grants/mesh.json",
-          MESH_PROVISION_REDIS: "redis:6379",
-          MESH_PROVISION_PASSWORD_FILE: "/run/secrets/default",
-        },
-      },
-    ],
-  });
+  // The catalogue's redis (novox/hq 04-ISSUES/074): a private `redis` network, the server on it
+  // with a published port, and the runtime on it too — reaching redis by name and the broker by
+  // NAT. Its own password is a `secret` the vault provides, so the vault is installed beside it.
+  const vaultManifest = catalogueModule("mesh-vault", held);
+  await must(`printf %s ${quote(vaultManifest)} > /tmp/mesh-vault.json && docker cp /tmp/mesh-vault.json mesh-controller:/mesh-vault.json`);
+  await mesh("module add /mesh-vault.json");
+  await mesh(`module issue mesh-vault --node ${MACHINE}`);
+  await mesh(`assign ${MACHINE} mesh-vault`);
+  const manifest = catalogueModule("redis", held);
   await must(`printf %s ${quote(manifest)} > /tmp/redis.json && docker cp /tmp/redis.json mesh-controller:/redis.json`);
   await mesh("module add /redis.json");
   await mesh(`module issue redis --node ${MACHINE}`);