Move the route proxy into its module and run it from the trust image, on mesh-sdk's public membership (issues 1633, 1634, 1635)

A bundle is built only from its module's directory (ADR 0480 clause 4), so the proxy leaves
examples/ and the controller's internal/broker; the broker keeps no second copy of what the
proxy shares with mesh-sdk. The image and its Dockerfile go, and a test holds that only
build-agent declares one (clause 11).

modules/route-proxy/cmd/route-provider/provider_test.go

@@ -77,7 +77,8 @@ func TestAConsumerOfARouteIsToldItsNamesFromItsPlanEntry(t *testing.T) {
 // route-proxy's own files and resources stay as they were (issue 792): the module answers its route through the
 // helper but is not marked moved, so its acme.env, its broker secret and its containers are composed as today and
 // the public ingress does not change. Everything of the manifest but its build, what it provides and the state it
-// keeps is pinned by this digest; changing the ingress means changing it here, on purpose.
+// keeps is pinned by this digest; changing the ingress means changing it here, on purpose. Re-pinned in R4d (novox/hq
+// ADR 0480): the program is an archive mounted into the trust image, the container and its files are otherwise as before.
 func TestRouteProxyIsNotMovedAndKeepsItsOwnFiles(t *testing.T) {
 	raw, err := os.ReadFile("../../module.json")
 	if err != nil {
@@ -102,7 +103,7 @@ func TestRouteProxyIsNotMovedAndKeepsItsOwnFiles(t *testing.T) {
 		t.Fatal(err)
 	}
 	sum := sha256.Sum256(pinned)
-	if got := hex.EncodeToString(sum[:]); got != "57a39de0943d8b33b9db6cb998ce97f8793602cca6cdfa5849c1c392390454a3" {
+	if got := hex.EncodeToString(sum[:]); got != "85cb955e5a4b2d8826f50aa76433064a576e8b15b71537032eb93c7388c0ee28" {
 		t.Fatalf("route-proxy's own manifest changed: digest %s", got)
 	}
 	// The two acme templates are pinned the same way (issue 849): they are what the proxy's certificates are asked

modules/route-proxy/cmd/route-proxy/bus.go

@@ -4,14 +4,14 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
-	"os"
 	"strings"
 	"sync/atomic"
 	"time"
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/broker"
+	"git.novox.be/novox/mesh-sdk/go/membership"
+	"git.novox.be/novox/mesh-sdk/go/process"
 )
 
 // What the mesh issued this proxy, read on the bus (novox/hq ADR 0160, ADR 0167).
@@ -21,16 +21,6 @@ import (
 // network, which is who may be served an internal name. Read once at connect and followed, so a
 // route added or a machine joining reaches a running proxy without a restart.
 
-// credential is the bus account the mesh delivered as this module's own secret named broker.
-type credential struct {
-	URL         string `json:"url"`
-	Fingerprint string `json:"fingerprint"`
-	Node        string `json:"node"`
-	Module      string `json:"module"`
-	User        string `json:"user"`
-	Password    string `json:"password"`
-}
-
 // followMembership connects with the credential in path and applies every membership the mesh
 // issues this proxy. It retries the first connection for as long as it takes: a proxy that started
 // before the bus keeps serving the file, and takes the bus when it answers.
@@ -46,60 +36,23 @@ func followMembership(path string, held *table, fromBus *atomic.Bool) {
 }
 
 func followOnce(path string, held *table, fromBus *atomic.Bool) error {
-	raw, err := os.ReadFile(path)
+	account, err := process.ReadAccount(path)
 	if err != nil {
 		return err
 	}
-	var cred credential
-	if err := json.Unmarshal(raw, &cred); err != nil {
-		return fmt.Errorf("the broker credential is not one: %w", err)
-	}
-	if cred.Node == "" || cred.Module == "" {
-		return fmt.Errorf("the broker credential names no node or module, so it has no membership")
-	}
-
-	opts := []nats.Option{
-		nats.Name(cred.Node + "." + cred.Module),
-		nats.UserInfo(cred.User, cred.Password),
-		// Its own inbox, and nothing wider: every principal is granted `_INBOX.<its user>.>` alone.
-		nats.CustomInboxPrefix("_INBOX." + cred.User),
-		// The bus being restarted is an upgrade, not a reason to stop following.
-		nats.MaxReconnects(-1),
-	}
-	if strings.TrimSpace(cred.Fingerprint) != "" {
-		opts = append(opts, nats.Secure(broker.PinnedToFingerprint(cred.Fingerprint)))
-	}
-	conn, err := nats.Connect(cred.URL, opts...)
+	conn, err := process.Connect(account, nats.Name(account.Node+"."+account.Module))
 	if err != nil {
-		return fmt.Errorf("connecting to the bus at %s: %w", broker.BareAddress(cred.URL), err)
+		return fmt.Errorf("connecting to the bus at %s: %w", membership.BareAddress(account.URL), err)
 	}
-
-	subject := broker.MembershipSubject(cred.Node, cred.Module)
-	apply := func(body []byte) {
-		var issued broker.Membership
-		if err := json.Unmarshal(body, &issued); err != nil {
-			log.Printf("a membership arrived that is not one: %v", err)
-			return
-		}
+	subject := membership.Subject(account.Node, account.Module)
+	err = conn.FollowMembership(func(issued membership.Membership) {
 		if took := applyMembership(issued, held); took && !fromBus.Swap(true) {
 			log.Printf("routes now come from this proxy's membership on %s", subject)
 		}
-	}
-
-	// Followed first, read second: an issue landing between the two is applied, not missed.
-	if _, err := conn.Subscribe(subject, func(m *nats.Msg) { apply(m.Data) }); err != nil {
+	}, func(err error) { log.Print(err) })
+	if err != nil {
 		conn.Close()
-		return fmt.Errorf("cannot follow %s: %w", subject, err)
-	}
-	// The subject-addressed direct get: the one request this account may make of the stream.
-	got, err := conn.Request("$JS.API.DIRECT.GET."+broker.AssignmentsStream+"."+subject, nil, 5*time.Second)
-	switch {
-	case err != nil:
-		log.Printf("cannot read the membership issued on %s yet (%v); following it", subject, err)
-	case got.Header.Get("Status") != "" || len(got.Data) == 0:
-		log.Printf("no membership issued on %s yet; serving the file until one is", subject)
-	default:
-		apply(got.Data)
+		return err
 	}
 	return nil
 }
@@ -108,7 +61,7 @@ func followOnce(path string, held *table, fromBus *atomic.Bool) error {
 //
 // A membership with no routes in it is one from a controller older than ADR 0167, and the file stays
 // the source rather than every route being withdrawn because a field was absent.
-func applyMembership(issued broker.Membership, held *table) bool {
+func applyMembership(issued membership.Membership, held *table) bool {
 	raw, carries := issued.Receives["route"]
 	if !carries {
 		return false

modules/route-proxy/cmd/route-proxy/reach_test.go

@@ -12,7 +12,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/broker"
+	"git.novox.be/novox/mesh-sdk/go/membership"
 )
 
 // behind is a workload the proxy can send to, and a table routing one public name and one
@@ -169,7 +169,7 @@ func TestTheMeshIsReadAsAddressesAndRanges(t *testing.T) {
 // machines it names (novox/hq ADR 0167).
 func TestAMembershipIsServedAsIssued(t *testing.T) {
 	held := newTable()
-	took := applyMembership(broker.Membership{
+	took := applyMembership(membership.Membership{
 		Receives: map[string]json.RawMessage{"route": json.RawMessage(`[
 		  {"from":"admin","node":"anchor","at":"anchor.internal",
 		   "values":{"internal-name":"admin.anchor.internal","port":8080}}]`)},
@@ -191,13 +191,13 @@ func TestAMembershipIsServedAsIssued(t *testing.T) {
 func TestAMembershipWithoutRoutesLeavesTheFileServing(t *testing.T) {
 	held := behind(t, "10.10.0.7")
 	before := held.names()
-	if applyMembership(broker.Membership{Mesh: []string{"10.10.0.7"}}, held) {
+	if applyMembership(membership.Membership{Mesh: []string{"10.10.0.7"}}, held) {
 		t.Error("a membership without routes was taken as the source of routes")
 	}
 	if got := held.names(); strings.Join(got, ",") != strings.Join(before, ",") {
 		t.Errorf("a membership without routes changed what is served: %v, was %v", got, before)
 	}
-	if applyMembership(broker.Membership{
+	if applyMembership(membership.Membership{
 		Receives: map[string]json.RawMessage{"route": json.RawMessage(`[]`)},
 		Mesh:     []string{"not-an-address"},
 	}, held) {