From 122f640963f8994756d7668e8f5d56ac76c4f42f Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Thu, 5 Nov 2026 17:27:53 +0100
Subject: [PATCH] mesh-wireguard: the two provisions say their credential form
 (none), as the manifest validator requires of every offer (V1; issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 modules/mesh-wireguard/go/overlay/overlay.go  |  7 ++++++-
 .../mesh-wireguard/go/overlay/seat_test.go    | 20 +++++++++++++++++++
 modules/mesh-wireguard/module.json            | 14 +++++++++++--
 3 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/modules/mesh-wireguard/go/overlay/overlay.go b/modules/mesh-wireguard/go/overlay/overlay.go
index b114410..a5b6657 100644
--- a/modules/mesh-wireguard/go/overlay/overlay.go
+++ b/modules/mesh-wireguard/go/overlay/overlay.go
@@ -65,7 +65,12 @@ func Manifest() map[string]any {
 		"module":   Name,
 		"version":  "1",
 		"computed": Name,
-		"provides": []string{Requirement, Addressing},
+		// A provision says its credential's form (the manifest validator, DLV credential forms): the network and the
+		// addresses are used with no login of a consumer's own.
+		"provides": []map[string]any{
+			{"name": Requirement, "credential": map[string]any{"form": "none"}},
+			{"name": Addressing, "credential": map[string]any{"form": "none"}},
+		},
 		"claims":   []map[string]any{{"name": TheNetwork, "scope": "node"}},
 	}
 }
diff --git a/modules/mesh-wireguard/go/overlay/seat_test.go b/modules/mesh-wireguard/go/overlay/seat_test.go
index b13d6db..ce2811c 100644
--- a/modules/mesh-wireguard/go/overlay/seat_test.go
+++ b/modules/mesh-wireguard/go/overlay/seat_test.go
@@ -54,3 +54,23 @@ func TestThePrivateNetworksClaimIsASeatTheMeshDefinesAndModuleJSONSaysTheSame(t
 		t.Errorf("module.json beside its build is %v, Manifest() is %v", onDisk, composed)
 	}
 }
+
+// Each provision the module offers says its credential's form, as the manifest validator requires of every offer.
+func TestEveryProvisionTheModuleOffersSaysItsCredentialForm(t *testing.T) {
+	raw, err := json.Marshal(Manifest())
+	if err != nil {
+		t.Fatal(err)
+	}
+	m, err := catalogue.Decode(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(m.Provides) != 2 {
+		t.Fatalf("the module provides %+v: the network and the addresses", m.Provides)
+	}
+	for _, o := range m.Provides {
+		if o.Credential == nil || o.Credential.Form != "none" {
+			t.Errorf("%s offers credential %+v: the form is none", o.Name, o.Credential)
+		}
+	}
+}
diff --git a/modules/mesh-wireguard/module.json b/modules/mesh-wireguard/module.json
index ab7d425..6cce421 100644
--- a/modules/mesh-wireguard/module.json
+++ b/modules/mesh-wireguard/module.json
@@ -3,8 +3,18 @@
   "version": "1",
   "computed": "mesh-wireguard",
   "provides": [
-    "private-network",
-    "mesh-addressing"
+    {
+      "name": "private-network",
+      "credential": {
+        "form": "none"
+      }
+    },
+    {
+      "name": "mesh-addressing",
+      "credential": {
+        "form": "none"
+      }
+    }
   ],
   "claims": [
     {