From 3690e17cf40bbee2a5ebc69a8cd6759ada663045 Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 14 Sep 2026 22:08:52 +0200 Subject: [PATCH] Ask the catalogue as the only thing that is allowed to MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Invoking a tool from inside the module's own container is refused: its account is scoped to what it emits and consumes, and a tool call needs a reply queue. Filed as novox/hq issue 049 — the account is right, the request is reasonable, and nothing can make it. Until that is decided the caller is the substrate's bootstrap admin over the broker's loopback, reached by joining its network namespace the way genesis reaches a substrate container. Recorded in the step as the workaround it is, rather than left looking like how a mesh is meant to be asked a question. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx --- test/integration/one-node-mesh.test.ts | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/test/integration/one-node-mesh.test.ts b/test/integration/one-node-mesh.test.ts index 5b73a83..7785589 100644 --- a/test/integration/one-node-mesh.test.ts +++ b/test/integration/one-node-mesh.test.ts @@ -660,9 +660,25 @@ before(async () => { said.push(` plan every image pinned, no placeholders`); // And the catalogue, ASKED rather than observed. These five questions are what it exists for. + // **Asked as an operator would have to, which turns out to be nobody.** + // + // The obvious move — run the invoke inside the catalogue's own container — is refused by the + // broker: `User 'anchor-mesh-catalog' doesn't have permissions to queue 'amq.gen-…'`. A + // module's account is scoped to what it declares it emits and consumes, and calling a tool + // needs a temporary reply queue, which that scope does not cover. So a module can SERVE tools + // and cannot CALL them, and nothing issues an account to anyone who wants to ask (novox/hq + // issue 049). + // + // Until that is decided, the caller is the substrate's own admin account over the broker's + // loopback — the bootstrap case `mesh-tools` documents, reached the way genesis reaches a + // substrate container, by joining its network namespace. + const image = (await on(CONTROL, + `docker inspect -f '{{.Config.Image}}' mesh-catalog`)).out.trim(); const ask = async (tool: string, args = "{}") => - must(CONTROL, `docker exec mesh-catalog node /app/dist/main.js invoke mesh-catalog ` + - `${tool} ${quote(args)}`, + must(CONTROL, + `docker run --rm --network container:mesh-broker ` + + `-e MESH_BROKER_URL=amqp://guest:guest@127.0.0.1:5672/ ` + + `${image} invoke mesh-catalog ${tool} ${quote(args)}`, 120_000); const held = await ask("catalog_modules");