From 2aab86c5cb695c4f73ec0a57302c8e993650b893 Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 22 Oct 2026 17:43:49 +0200 Subject: [PATCH] =?UTF-8?q?Delete=20the=20copied=20list=20of=20the=20contr?= =?UTF-8?q?oller's=20readable=20states=20and=20the=20reads=20check=20built?= =?UTF-8?q?=20on=20it=20(issue=201790,=20S12,=20ADR=200495=20=C2=A74-?= =?UTF-8?q?=C2=A75)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit catalogue.ControllerMirrors and StateReadsNothingDeclares go, and the catalogue pass no longer judges a read against the owner's manifest: an owner's announcement and its own announcement test hold what it keeps. --- go/catalogue/seats_declared.go | 7 ----- go/catalogue/state.go | 43 -------------------------- go/catalogue/state_test.go | 56 +++++----------------------------- 3 files changed, 8 insertions(+), 98 deletions(-) diff --git a/go/catalogue/seats_declared.go b/go/catalogue/seats_declared.go index 2a9ad3f..457f87e 100644 --- a/go/catalogue/seats_declared.go +++ b/go/catalogue/seats_declared.go @@ -423,13 +423,6 @@ func CatalogueProblems(shelf Shelf) []string { "operator's account, which every agent runs as (novox/hq ADR 0259)", module, why)) } } - // A read of a module's state that module does not keep (novox/hq ADR 0201) — said only where the - // owner is on the shelf, as a consumer may be installed before its emitter. - var manifests []Manifest - for _, module := range shelfOrder(shelf) { - manifests = append(manifests, shelf[module]) - } - problems = append(problems, StateReadsNothingDeclares(manifests)...) sort.Strings(problems) return problems } diff --git a/go/catalogue/state.go b/go/catalogue/state.go index 87e402f..9229d3d 100644 --- a/go/catalogue/state.go +++ b/go/catalogue/state.go @@ -126,46 +126,3 @@ func StateProblems(m Manifest) []string { } return problems } - -// ControllerMirrors are the controller's record mirrors a module may read, each `mesh-controller.` -// (novox/hq ADR 0289, design 54 §5, design 57 F3). **The controller keeps them, not its manifest's `state`**: -// they are asserted with the controller's own buckets, with options of their own, and written by the -// controller's account alone (the writers table); declared as a module's state, they would be asserted a -// second way and granted to the module's own principal as well. Named here so a read of one is a read of -// kept state. The bus's list is broker.ControllerMirrors; a test keeps the two agreeing. -// plans-building is the plans in their build phase, read by the checker to hold checks while a delivery builds (ADR 0483 -// clause 2, issue 1687). -var ControllerMirrors = []string{"assignments", "declared-config", "predefined", "builds", "rollouts", "checks-running", "plans-building"} - -// StateReadsNothingDeclares is every read across a catalogue whose owner is present and declares no -// such state. An absent owner says nothing — a module may be installed long before the one whose -// state it reads, as a consumer may before its emitter (design 32 §1). -func StateReadsNothingDeclares(manifests []Manifest) []string { - declared := map[string]map[string]bool{} - for _, m := range manifests { - own := map[string]bool{} - for _, s := range m.State { - own[s.Name] = true - } - declared[m.Module] = own - } - if own, present := declared[ControllerSeatName]; present { - for _, name := range ControllerMirrors { - own[name] = true - } - } - var problems []string - for _, m := range manifests { - for _, r := range m.Reads { - module, local, err := ReadState(r) - if err != nil { - continue - } - if own, present := declared[module]; present && !own[local] { - problems = append(problems, fmt.Sprintf( - "%s reads %q, and %s keeps no state called %q", m.Module, r, module, local)) - } - } - } - return problems -} diff --git a/go/catalogue/state_test.go b/go/catalogue/state_test.go index 475ea2e..a30ee17 100644 --- a/go/catalogue/state_test.go +++ b/go/catalogue/state_test.go @@ -52,69 +52,29 @@ func TestAStateNameIsLocalAndOneToken(t *testing.T) { } } -// A read whose owner is present must name a state that owner keeps; an absent owner says nothing, -// because a module may be installed before the one whose state it reads. -func TestAReadNamesStateItsOwnerKeeps(t *testing.T) { - owner := Manifest{Module: "licence-manager", State: []StateDeclaration{{Name: "bindings"}}} - good := Manifest{Module: "claude-code", Reads: []string{"licence-manager.bindings", "absent.anything"}} - bad := Manifest{Module: "other", Reads: []string{"licence-manager.tokens"}} - if p := StateReadsNothingDeclares([]Manifest{owner, good}); len(p) != 0 { - t.Fatalf("a read of declared state was refused: %v", p) - } - p := StateReadsNothingDeclares([]Manifest{owner, bad}) - if len(p) != 1 || !strings.Contains(p[0], `licence-manager keeps no state called "tokens"`) { - t.Fatalf("a read of state nobody keeps was not named: %v", p) - } -} - -// **The controller's record mirrors are kept state** (design 54 §5, design 57 F3): a module may read -// `mesh-controller.assignments` and `mesh-controller.declared-config` although the controller's manifest -// declares no `state`; a read of anything else of the controller's is still named. -func TestAReadOfTheControllersMirrorsIsAReadOfKeptState(t *testing.T) { - controller := Manifest{Module: ControllerSeatName} - reader := Manifest{Module: "mesh-config", Reads: []string{"mesh-controller.assignments", "mesh-controller.declared-config"}} - if p := StateReadsNothingDeclares([]Manifest{controller, reader}); len(p) != 0 { - t.Fatalf("a read of the controller's mirrors was refused: %v", p) - } - other := Manifest{Module: "other", Reads: []string{"mesh-controller.calls"}} - if p := StateReadsNothingDeclares([]Manifest{controller, other}); len(p) != 1 { - t.Fatalf("a read of the controller's own calls was not named: %v", p) - } -} - -// A module may read `mesh-controller.plans-building` (novox/hq ADR 0483 clause 2, issue 1687): the checker holds a check -// while a delivery builds, and the composed check refused its read as state the controller does not keep. -func TestAReadOfThePlansBuildingIsAReadOfKeptState(t *testing.T) { - controller := Manifest{Module: ControllerSeatName} - checker := Manifest{Module: "mesh-delivery-checker", Reads: []string{"mesh-controller.plans-building"}} - if p := StateReadsNothingDeclares([]Manifest{controller, checker}); len(p) != 0 { - t.Fatalf("a read of the controller's plans-building was refused: %v", p) - } -} - -// **Across the whole catalogue**: every state name is local, and every read whose owner is present -// names state that owner keeps. +// **Across the whole catalogue**: every state name is local and every read names a module's state. func TestEveryManifestsStateIsLocalAndEveryReadIsKept(t *testing.T) { manifests := theCatalogue(t) var problems []string for _, m := range manifests { problems = append(problems, StateProblems(m)...) } - problems = append(problems, StateReadsNothingDeclares(manifests)...) if len(problems) > 0 { t.Fatalf("the catalogue's state is not what ADR 0201 says:\n %s", strings.Join(problems, "\n ")) } } -// `module check` says it too: the cross-catalogue pass names a read nothing on the shelf keeps. -func TestTheCataloguePassNamesAReadItsOwnerDoesNotKeep(t *testing.T) { +// The catalogue pass no longer judges one module's reads against another's manifest (novox/hq ADR 0495 clauses 1 and 5, +// issue 1790): what an owner keeps is what it announces on the bus, and each module's own announcement test holds that. +func TestTheCataloguePassJudgesNoReadAgainstTheOwnersManifest(t *testing.T) { shelf := Shelf{ "licence-manager": {Module: "licence-manager", State: []StateDeclaration{{Name: "bindings"}}}, "claude-code": {Module: "claude-code", Reads: []string{"licence-manager.tokens"}}, } - problems := CatalogueProblems(shelf) - if len(problems) != 1 || !strings.Contains(problems[0], `keeps no state called "tokens"`) { - t.Fatalf("the catalogue pass said %v", problems) + for _, p := range CatalogueProblems(shelf) { + if strings.Contains(p, "keeps no state") { + t.Fatalf("the catalogue pass judged a read against the owner's manifest: %s", p) + } } }