A stub keeps its module's directories, so the places its own secrets and data name still resolve (issue 1126: novox refused nats's ${dir:mesh-state})

go/compose/composed.go

@@ -257,11 +257,18 @@ func NamesBuild(m catalogue.Manifest) bool {
 	return false
 }
 
-// Stub is m with nothing to build and no resource: what it provides, requires, serves and grants still shape the rest of
+// Stub is m with nothing to build and no resource but its directories: what it provides, requires, serves and grants
-// the composition, and nothing of its own is composed (issue 1126).
+// still shape the rest of the composition, the places its own secrets, data and grants name (${dir:…}) still resolve,
+// and nothing else of its own is composed (issue 1126: nats's ${dir:mesh-state} on novox).
 func Stub(m catalogue.Manifest) catalogue.Manifest {
 	m.Build = nil
-	m.Resources = nil
+	var dirs []map[string]any
+	for _, r := range m.Resources {
+		if r["type"] == "directory" {
+			dirs = append(dirs, r)
+		}
+	}
+	m.Resources = dirs
 	return m
 }
 

go/compose/frombus/answer_rows_test.go

@@ -21,7 +21,10 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 	ctx := context.Background()
 	image := "alpine@sha256:" + strings.Repeat("a", 64)
 	manifest := func(module string) []byte {
+		// Its data names its directory, as nats's names ${dir:mesh-state} (issue 1126: novox's own composition refused
+		// "nats says ${dir:mesh-state}, and nats declares no directory mesh-state" when its stub held no directory).
 		return []byte(`{"module":"` + module + `","version":"1","capabilities":["container-runtime"],` +
+			`"own-secrets":{"token":"${dir:state}/token"},` +
 			`"resources":[{"id":"state","type":"directory","path":"/var/lib/` + module + `","mode":"0700"},` +
 			`{"id":"server","type":"container","name":"` + module + `","artifact":"site"}],` +
 			`"build":{"artifacts":[{"name":"site","kind":"upstream","from":"` + image + `"}]}}`)
@@ -38,6 +41,9 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 			modules:   map[string]delivery.Module{"lemurs": {Manifest: delivery.ManifestDigest(lemurs)}},
 			manifests: map[string][]byte{delivery.ManifestDigest(lemurs): lemurs},
 			builds:    map[string]*delivery.BuilderBuild{}}
+		for _, m := range []string{"web", "api", "spiegel"} {
+			b.own = append(b.own, compose.OwnSecretRow{Node: "n1", Module: m, Name: "token", Origin: "made", SealedTo: "sk", Sealed: `"box"`})
+		}
 		for _, m := range []string{"web", "api", "spiegel"} {
 			raw := manifest(m)
 			b.manifests[delivery.ManifestDigest(raw)] = raw