The provider helper reads an ended or pending assignment as a removed key (issue 1098)

.gitignore

@@ -1,3 +1,2 @@
 node_modules/
 dist/
-vendor/

README.md

@@ -9,15 +9,6 @@ does not belong.* Per-module code (a service's API client, its tool implementati
 create-a-resource adapter) lives **in the module**, never here — that coupling is exactly what
 turned the old SDK into constant maintenance and made every edit rebuild every module.
 
-**A seat's code is not here** (novox/hq ADR 0625, ADR 0627). mesh-sdk is the runtime every module uses (the bus
-connection, the tools bundle's runtime, state and its helpers) and a seat-neutral part two or more seats' clients or
-holders share (sending a file in parts, `go/parts`). A seat defined whole has its generated contract, and its client
-where callers share logic over it, in mesh-contracts (`go/seats/<seat>`, `go/clients/<seat>client`); the seat list is
-mesh-contracts' `go/seats`, which `catalogue` alone imports. The value layouts of seats not yet defined whole stay
-here until their domain moves, and no new seat-specific type is added. `packages_list_test.go` holds all of it:
-mesh-sdk imports no contracts module but the seat set in `catalogue`, names none of the seats with a client outside
-`catalogue`, and holds none of the packages that moved (`asks`, `asker`, `publish`).
-
 ## What is in it
 
 Five small areas, each a thing a module's `tools/` or `provisioner/` imports:
@@ -115,20 +106,21 @@ runtime's (`node-tools/internal/launch`, mesh-tools).
 values and then every change. Through the runtime that launched the bundle, which refuses what the
 module did not declare. Current values, never history and never a secret (novox/hq ADR 0201).
 
-### `seats` and `channel` — publishing on a seat, the channel's benches (Go)
+### `seats` and `asks` — asking a person, answering on a channel (Go)
 A seat may name its caller or its kind (novox/hq ADR 0259): `stdio.SeatPublish` submits an accept or says
 an event under the module's own name or kind, `stdio.SeatTake` takes a held seat's work, `stdio.SeatProve`
 and `stdio.SeatAnswer` carry a proof (a code typed by a person, by request and reply, never kept),
 `stdio.SeatRecord` reads a record kept for the module, and `State(...).Create` and `.Update` write by
-compare-and-set. The runtime does each only as far as the module's membership lists. `go/channel` holds the
-shapes of the two benches a channel holds, `channel` and `intake` (the `Message` a channel takes, the `Choice`,
-`LinkAsked`, `Failed`, `Standing` and `Code` it says, with the subjects each travels on): those benches are not
-defined whole, so their layouts stay here (ADR 0625 §9).
-Asking a person is the `operator-channel` seat's, defined whole in mesh-contracts: its `Ask` and `Warrant` are its
-generated contract (`go/seats/operatorchannel`), and the checks an ask is held to, the warrant's (`For`, `Says`,
-`Performs`) and an asking module's client (`Ask`, `Cancel`, `Where`, `Listen`, `Take`, each warrant handed once,
-marked acted on by compare-and-set) are its client, `go/clients/operatorchannelclient` (ADR 0627 §1). A lost
-compare-and-set is `stdio.ErrChanged`, told by the runtime's error code.
+compare-and-set. The runtime does each only as far as the module's membership lists. `go/asks` is the
+contract on top: the `Ask` an asker publishes and the checks it is held to (its `Whole` is what a channel that proves
+who answers shows in place of its `Explanation`, and its `Details` what the Details answer shows, hq issue 383), the `Warrant` it acts on
+(`For`, `Says`), and the `Message`, `Choice`, `LinkAsked` and `Code` a channel takes and says, with the
+subjects each travels on.
+`go/asker` is an asking module's client (ADR 0259 §10): `Ask` keeps an ask in the module's own state and then
+publishes it under the module's name; `Cancel`; `Where` reads its state from the router's record; `Listen` and
+`Take` hand the module each warrant once — marked acted on by compare-and-set before the module acts, and only
+for an ask it made, an option it offered, at that option's level, before it expired. A lost compare-and-set is
+`stdio.ErrChanged`, told by the runtime's error code.
 `State(...).Increment(key, attempts)` is a counter on top of the two (for numbers handed out once, such as an
 issue's): it reads the key, writes one more at the revision read, and on a lost write reads and tries again, at
 most `attempts` times; past that it is `stdio.ErrChanged` and nothing was counted.

c/.gitignore

@@ -0,0 +1 @@
+example

c/Makefile

@@ -0,0 +1,8 @@
+CFLAGS ?= -O2 -Wall -Wextra
+JANSSON := $(shell pkg-config --cflags --libs jansson)
+
+example: example.c mesh_sdk.c mesh_sdk.h
+	$(CC) $(CFLAGS) -o $@ example.c mesh_sdk.c $(JANSSON)
+
+clean:
+	rm -f example

c/README.md

@@ -0,0 +1,9 @@
+# mesh-sdk for C
+
+The skeleton (novox/hq ADR 0188): `mesh_serve(name, tools, count)` speaks MCP over stdio to the
+node's tool runtime. A `mesh_tool` is a name, a description, an argument schema and a function
+returning JSON. A tool named `<seat>.<verb>` is the seat's implementation. JSON is jansson's, the
+one dependency.
+
+What it holds, under ADR 0039's test: the stdio loop and the tool type. Nothing else — no bus, no
+client, nothing of any module's. `make` and pipe a `tools/list` request into `./example`.

c/example.c

@@ -0,0 +1,27 @@
+/* A tools bundle in C: one tool of its own and one seat verb, served over stdio. */
+#include "mesh_sdk.h"
+#include <stdio.h>
+
+static json_t *greet(json_t *args, char **error) {
+    (void)error;
+    const char *who = json_string_value(json_object_get(args, "who"));
+    char greeting[128];
+    snprintf(greeting, sizeof greeting, "hello %s", who ? who : "world");
+    return json_pack("{s:s,s:s}", "greeting", greeting, "language", "c");
+}
+
+static json_t *on(json_t *args, char **error) {
+    (void)args; (void)error;
+    return json_pack("{s:b,s:s}", "on", 1, "language", "c");
+}
+
+int main(void) {
+    json_t *who = json_pack("{s:{s:s,s:s}}", "who", "type", "string", "description", "whom");
+    const mesh_tool tools[] = {
+        {"greet", "say hello", who, greet},
+        {"node-lamp.on", "the seat's verb", NULL, on},
+    };
+    int rc = mesh_serve("c-example", tools, 2);
+    json_decref(who);
+    return rc;
+}

c/mesh_sdk.c

@@ -0,0 +1,83 @@
+#include "mesh_sdk.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+static void say(json_t *m) {
+    json_object_set_new(m, "jsonrpc", json_string("2.0"));
+    char *text = json_dumps(m, JSON_COMPACT);
+    fprintf(stdout, "%s\n", text);
+    fflush(stdout);
+    free(text);
+    json_decref(m);
+}
+
+static json_t *as_schema(json_t *given) {
+    if (!given || !json_is_object(given) || json_object_size(given) == 0)
+        return json_pack("{s:s,s:{}}", "type", "object", "properties");
+    if (json_object_get(given, "type") || json_object_get(given, "properties"))
+        return json_incref(given);
+    return json_pack("{s:s,s:O}", "type", "object", "properties", given);
+}
+
+int mesh_serve(const char *name, const mesh_tool *tools, size_t count) {
+    char *line = NULL;
+    size_t cap = 0;
+    ssize_t got;
+    while ((got = getline(&line, &cap, stdin)) >= 0) {
+        json_error_t err;
+        json_t *req = json_loads(line, 0, &err);
+        if (!req) continue;
+        json_t *id = json_object_get(req, "id");
+        const char *method = json_string_value(json_object_get(req, "method"));
+        json_t *params = json_object_get(req, "params");
+        if (!method) { json_decref(req); continue; }
+        if (strcmp(method, "initialize") == 0) {
+            say(json_pack("{s:O,s:{s:s,s:{s:{}},s:{s:s,s:s}}}", "id", id ? id : json_null(), "result",
+                "protocolVersion", MESH_SDK_PROTOCOL, "capabilities", "tools",
+                "serverInfo", "name", name, "version", "1"));
+        } else if (strcmp(method, "notifications/initialized") == 0) {
+        } else if (strcmp(method, "ping") == 0) {
+            if (id) say(json_pack("{s:O,s:{}}", "id", id, "result"));
+        } else if (strcmp(method, "tools/list") == 0) {
+            json_t *listed = json_array();
+            for (size_t i = 0; i < count; i++)
+                json_array_append_new(listed, json_pack("{s:s,s:s,s:o}", "name", tools[i].name,
+                    "description", tools[i].description, "inputSchema", as_schema(tools[i].input)));
+            say(json_pack("{s:O,s:{s:o}}", "id", id ? id : json_null(), "result", "tools", listed));
+        } else if (strcmp(method, "tools/call") == 0) {
+            const char *wanted = params ? json_string_value(json_object_get(params, "name")) : NULL;
+            const mesh_tool *tool = NULL;
+            for (size_t i = 0; wanted && i < count; i++)
+                if (strcmp(tools[i].name, wanted) == 0) tool = &tools[i];
+            if (!tool) {
+                char message[256];
+                snprintf(message, sizeof message, "%s has no tool %s", name, wanted ? wanted : "");
+                say(json_pack("{s:O,s:{s:i,s:s}}", "id", id ? id : json_null(), "error", "code", -32602, "message", message));
+            } else {
+                json_t *args = params ? json_object_get(params, "arguments") : NULL;
+                json_t *empty = args ? NULL : json_object();
+                char *error = NULL;
+                json_t *result = tool->run(args ? args : empty, &error);
+                if (empty) json_decref(empty);
+                if (result) {
+                    char *text = json_dumps(result, JSON_COMPACT);
+                    say(json_pack("{s:O,s:{s:[{s:s,s:s}]}}", "id", id ? id : json_null(), "result", "content", "type", "text", "text", text));
+                    free(text);
+                    json_decref(result);
+                } else {
+                    say(json_pack("{s:O,s:{s:[{s:s,s:s}],s:b}}", "id", id ? id : json_null(), "result", "content",
+                        "type", "text", "text", error ? error : "the tool failed", "isError", 1));
+                    free(error);
+                }
+            }
+        } else if (id) {
+            char message[256];
+            snprintf(message, sizeof message, "no %s", method);
+            say(json_pack("{s:O,s:{s:i,s:s}}", "id", id, "error", "code", -32601, "message", message));
+        }
+        json_decref(req);
+    }
+    free(line);
+    return ferror(stdin) ? -1 : 0;
+}

c/mesh_sdk.h

@@ -0,0 +1,29 @@
+/* The Novox Mesh SDK for C — the skeleton (novox/hq ADR 0188).
+ *
+ * A tools bundle is a process the node's runtime launches and speaks MCP over stdio to:
+ * `initialize`, `tools/list` once, `tools/call` per call, newline-framed JSON-RPC on stdin and
+ * stdout. This is the loop, so a bundle writes its tools and nothing else. A tool named
+ * `<seat>.<verb>` is the module's implementation of that seat's verb; any other name is the
+ * module's own. JSON is jansson's.
+ *
+ * No transport here: the bus, the subjects and the memberships are the runtime's (ADR 0039, 0175).
+ * stdout is the protocol; log to stderr. */
+#ifndef MESH_SDK_H
+#define MESH_SDK_H
+#include <jansson.h>
+
+#define MESH_SDK_PROTOCOL "2025-03-26"
+
+/* One tool. `run` returns a new JSON value (the answer) or NULL with *error set to a message the
+ * caller frees. `input` is the schema of the arguments, or NULL for a tool that takes nothing. */
+typedef struct {
+    const char *name;
+    const char *description;
+    json_t *input;
+    json_t *(*run)(json_t *args, char **error);
+} mesh_tool;
+
+/* Serve these tools on stdin/stdout until stdin closes. Returns 0, or -1 on an I/O fault. */
+int mesh_serve(const char *name, const mesh_tool *tools, size_t count);
+
+#endif

go/README.md

@@ -16,6 +16,4 @@ at the same version as the TypeScript package.
 
 What it holds, under ADR 0039's test: the stdio loop and the tool type, and `cli`, the local protocol
 `mesh-cli` speaks to the node-engine on its machine (novox/hq ADR 0272): the socket's path and one request and one
-answer; and `seal`, the mesh's sealed box (novox/hq ADR 0206: X25519, HKDF-SHA256, AES-256-GCM, `{v, eph, iv, tag, ct}`), byte for byte the box the licence manager made before it lived here. Nothing else — no bus, no client, nothing of any module's.
-
-From release 4a of design 47 (novox/hq ADR 0453 clause 3, ADR 0446 clause 4) it also holds the composition of a machine's declaration, over a plain input and with nothing behind it: `declaration` and `validate`, the node-engine's parser and its validator, copied from mesh-host; `catalogue`, the manifests, their resolution and rendering, and `overlay`, the private network's generator, copied from mesh-controller; `compose`, the controller's planFor, renderingFor and declarationWith as functions of an `Input` (the composition never allocates, makes, keeps or writes: what a send would do it names as foreseen or returns); `sdkversion`, which mesh-sdk version a program was built with; and, in `delivery`, the layouts of the keys the builder, the checker and the indexer write (the source fingerprint's new form, the builds, the verdicts and kept verdicts, the manifests by digest). None of them holds a bus, a store or a vault client, which `go list -deps` of `compose` shows.
+answer; and `seal`, the mesh's sealed box (novox/hq ADR 0206: X25519, HKDF-SHA256, AES-256-GCM, `{v, eph, iv, tag, ct}`), byte for byte the box the licence manager made before it lived here and the TypeScript `@novox/mesh-sdk/seal` makes. Nothing else — no bus, no client, nothing of any module's. `go build ./example` and pipe a `tools/list` request into it.

go/announce/announce.go

@@ -1,152 +0,0 @@
-// Package announce is how a module says on the bus which states it keeps and which of them others may read (novox/hq
-// ADR 0495 clauses 2 and 3; issue 1790): the subject it says it on, the value it says, and where the controller keeps
-// the last one said by each module. What a module announced is the truth of what it keeps; a reader is granted a read
-// from it, never from a list or from the owner's manifest.
-//
-// A module announces from its code (process.Conn.Keeps, stdio.Keeps, the TypeScript SDK's keeps), never from its
-// manifest, which only the core reads (clause 1). A module that keeps no state on the bus announces nothing.
-package announce
-
-import (
-	"encoding/json"
-	"fmt"
-	"regexp"
-	"sort"
-)
-
-// Version is the version of the value this package writes.
-const Version = 1
-
-// Event is the event type of an announcement, under the module's own namespace.
-const Event = "states"
-
-// Subject is where module announces what it keeps: its own event subject, mesh.mod.<module>.event.states, which its
-// account may already publish to and the events stream keeps.
-func Subject(module string) string { return "mesh.mod." + module + ".event." + Event }
-
-// SubjectAll is every module's announcement.
-const SubjectAll = "mesh.mod.*.event." + Event
-
-var name = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*$`)
-
-// Key is module's key where the last announcement of each module is kept: the module itself, which must be one plain name, since a module's name is part of
-// its buckets' names (the indexer's judge, novox/hq ADR 0578 §1).
-func Key(module string) (string, error) {
-	if !name.MatchString(module) {
-		return "", fmt.Errorf("announce: %q is not a module that keeps state: lower-case letters, digits and hyphens", module)
-	}
-	return module, nil
-}
-
-// State is one state a module keeps, by its local name, and whether others may read it. Others never write it: a
-// state another module writes is the owner's own code's business.
-type State struct {
-	Name     string `json:"name"`
-	Readable bool   `json:"readable,omitempty"`
-	// Readers, when named, are the only modules that may read the state (novox/hq ADR 0547 clause 9, issue 1945): a
-	// state readable by some and not all, such as the vault's bus account hashes. Only ReadableBy grants them; Readable,
-	// which a composer that knows no readers asks, stays false for it, so such a composer grants nobody.
-	Readers []string `json:"readers,omitempty"`
-}
-
-// States is an announcement: the module, the machine whose instance said it, and every state the module keeps, sorted
-// by name. An empty list says the module keeps nothing.
-type States struct {
-	V      int     `json:"v"`
-	Module string  `json:"module"`
-	Node   string  `json:"node,omitempty"`
-	States []State `json:"states"`
-}
-
-// Keeps says whether the module announced keeping the state.
-func (s States) Keeps(state string) bool {
-	for _, k := range s.States {
-		if k.Name == state {
-			return true
-		}
-	}
-	return false
-}
-
-// ReadableBy says whether the module announced the state readable by reader: readable, and reader among the readers
-// when it names any.
-func (s States) ReadableBy(state, reader string) bool {
-	for _, k := range s.States {
-		if k.Name != state {
-			continue
-		}
-		if len(k.Readers) > 0 {
-			for _, r := range k.Readers {
-				if r == reader {
-					return true
-				}
-			}
-			return false
-		}
-		return k.Readable
-	}
-	return false
-}
-
-// Readable says whether the module announced the state readable by others.
-func (s States) Readable(state string) bool {
-	for _, k := range s.States {
-		if k.Name == state {
-			return k.Readable
-		}
-	}
-	return false
-}
-
-func (s *States) check() error {
-	if s.Module == "" {
-		return fmt.Errorf("announce: an announcement names no module")
-	}
-	if _, err := Key(s.Module); err != nil {
-		return err
-	}
-	seen := map[string]bool{}
-	for _, k := range s.States {
-		if !name.MatchString(k.Name) {
-			return fmt.Errorf("announce: %s announces the state %q, and a state is named locally: lower-case letters, digits and hyphens", s.Module, k.Name)
-		}
-		if seen[k.Name] {
-			return fmt.Errorf("announce: %s announces the state %q twice", s.Module, k.Name)
-		}
-		seen[k.Name] = true
-		for _, r := range k.Readers {
-			if !name.MatchString(r) {
-				return fmt.Errorf("announce: %s names %q as a reader of %s, and a reader is a module: lower-case letters, digits and hyphens", s.Module, r, k.Name)
-			}
-		}
-	}
-	return nil
-}
-
-// Encode is s as JSON at Version, its states sorted; it refuses a module or a state no bucket could be named by and a
-// state announced twice, naming it.
-func Encode(s States) ([]byte, error) {
-	if err := s.check(); err != nil {
-		return nil, err
-	}
-	s.V = Version
-	s.States = append([]State{}, s.States...)
-	sort.Slice(s.States, func(i, j int) bool { return s.States[i].Name < s.States[j].Name })
-	return json.Marshal(s)
-}
-
-// Decode reads an announcement; it refuses another version and what Encode refuses.
-func Decode(data []byte) (States, error) {
-	var s States
-	if err := json.Unmarshal(data, &s); err != nil {
-		return States{}, fmt.Errorf("announce: the announcement is not JSON: %w", err)
-	}
-	if s.V != Version {
-		return States{}, fmt.Errorf("announce: the announcement is version %d, and this reads version %d", s.V, Version)
-	}
-	if err := s.check(); err != nil {
-		return States{}, err
-	}
-	sort.Slice(s.States, func(i, j int) bool { return s.States[i].Name < s.States[j].Name })
-	return s, nil
-}

go/announce/announce_test.go

@@ -1,75 +0,0 @@
-package announce
-
-import (
-	"strings"
-	"testing"
-)
-
-// A module says on the bus which states it keeps and which of them others may read (novox/hq ADR 0495 clause 2), on its
-// own event subject, in a versioned value the controller keeps by module.
-func TestAnAnnouncementRoundTripsSortedAndSaysWhatIsReadable(t *testing.T) {
-	data, err := Encode(States{Module: "mesh-controller", Node: "novox", States: []State{
-		{Name: "plans-building", Readable: true}, {Name: "assignments", Readable: true}, {Name: "own"},
-		{Name: "hashes", Readers: []string{"mesh-grants"}}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	back, err := Decode(data)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if back.V != Version || back.Module != "mesh-controller" || back.Node != "novox" {
-		t.Fatalf("decoded %+v", back)
-	}
-	var names []string
-	for _, s := range back.States {
-		names = append(names, s.Name)
-	}
-	if strings.Join(names, ",") != "assignments,hashes,own,plans-building" {
-		t.Fatalf("the states are not sorted: %v", names)
-	}
-	if !back.Readable("plans-building") || back.Readable("own") || back.Readable("absent") {
-		t.Fatal("Readable does not say what was announced readable")
-	}
-	// Named readers (ADR 0547 clause 9): readable by them alone, and not readable to a composer that knows no readers.
-	if back.Readable("hashes") || !back.ReadableBy("hashes", "mesh-grants") || back.ReadableBy("hashes", "spy") ||
-		!back.ReadableBy("plans-building", "spy") || back.ReadableBy("own", "spy") {
-		t.Fatal("ReadableBy does not say who was named")
-	}
-	if !back.Keeps("own") || back.Keeps("absent") {
-		t.Fatal("Keeps does not say what was announced")
-	}
-	if Subject("mesh-controller") != "mesh.mod.mesh-controller.event.states" || SubjectAll != "mesh.mod.*.event.states" {
-		t.Fatalf("the subjects are %q and %q", Subject("mesh-controller"), SubjectAll)
-	}
-	if k, err := Key("mesh-delivery-builder"); err != nil || k != "mesh-delivery-builder" {
-		t.Fatalf("Key = %q, %v", k, err)
-	}
-	if nothing, err := Encode(States{Module: "quiet"}); err != nil || !strings.Contains(string(nothing), `"states":[]`) {
-		t.Fatalf("a module keeping nothing: %s, %v", nothing, err)
-	}
-}
-
-func TestAnAnnouncementRefusesWhatNoBucketCouldBe(t *testing.T) {
-	for _, c := range []struct {
-		s    States
-		says string
-	}{
-		{States{Module: ""}, "no module"},
-		{States{Module: "a.b"}, `"a.b"`},
-		{States{Module: "a", States: []State{{Name: "x_y"}}}, `"x_y"`},
-		{States{Module: "a", States: []State{{Name: ""}}}, `""`},
-		{States{Module: "a", States: []State{{Name: "x"}, {Name: "x", Readable: true}}}, "twice"},
-		{States{Module: "a", States: []State{{Name: "x", Readers: []string{"b.c"}}}}, `"b.c"`},
-	} {
-		if _, err := Encode(c.s); err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%+v: %v, wanted a refusal saying %s", c.s, err, c.says)
-		}
-	}
-	if _, err := Decode([]byte(`{"v":2,"module":"a","states":[]}`)); err == nil {
-		t.Error("an unknown version was read")
-	}
-	if _, err := Key("a.b"); err == nil {
-		t.Error("a module with a dot became a key")
-	}
-}

go/announcetest/announcetest.go

@@ -1,91 +0,0 @@
-// Package announcetest is the test each module runs with its own checks to hold that it announces on the bus every
-// state it keeps (novox/hq ADR 0495 clause 5; issue 1790): it starts the module against a bus of the test's own and
-// compares what the module announced with what its code declares. With the bind guard of process.Conn.Keeps,
-// stdio.Keeps and the TypeScript keeps, which refuses a state the code did not announce, announcement and code agree.
-//
-// It replaces the merge gate's check of one module's reads against another's manifest (clause 5); a test using it
-// carries `//go:build integration`, since it starts a bus.
-package announcetest
-
-import (
-	"context"
-	"fmt"
-	"reflect"
-	"sort"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-
-	"git.novox.be/novox/mesh-sdk/go/announce"
-	"git.novox.be/novox/mesh-sdk/go/testbus"
-)
-
-// Wait is how long Check waits for the module's announcement once it started it.
-var Wait = 10 * time.Second
-
-// Check starts a bus of the test's own, with a stream taking module's events, calls start with its address (start
-// runs the module, or its part that connects, against it, and answers how to stop it), waits for the module's
-// announcement and fails the test unless it is module's and names exactly want (in any order), readable as want says.
-// It answers the announcement.
-func Check(t testing.TB, module string, want []announce.State, start func(url string) (stop func())) announce.States {
-	t.Helper()
-	url := testbus.URL(t)
-	nc, err := nats.Connect(url)
-	if err != nil {
-		t.Fatalf("announcetest: connecting to the test bus: %v", err)
-	}
-	defer nc.Close()
-	js, err := jetstream.New(nc)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), Wait)
-	defer cancel()
-	stream, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "ANNOUNCETEST", Subjects: []string{"mesh.mod." + module + ".event.>"}})
-	if err != nil {
-		t.Fatalf("announcetest: making the events stream: %v", err)
-	}
-	stop := start(url)
-	if stop != nil {
-		defer stop()
-	}
-	got, err := waitFor(ctx, stream, module)
-	if err != nil {
-		t.Fatalf("announcetest: %v", err)
-	}
-	if problem := differs(got, module, want); problem != "" {
-		t.Fatalf("announcetest: %s", problem)
-	}
-	return got
-}
-
-// waitFor reads the stream until module's announcement is in it.
-func waitFor(ctx context.Context, stream jetstream.Stream, module string) (announce.States, error) {
-	for {
-		msg, err := stream.GetLastMsgForSubject(ctx, announce.Subject(module))
-		if err == nil {
-			return announce.Decode(msg.Data)
-		}
-		select {
-		case <-ctx.Done():
-			return announce.States{}, fmt.Errorf("%s announced nothing on %s within %s", module, announce.Subject(module), Wait)
-		case <-time.After(50 * time.Millisecond):
-		}
-	}
-}
-
-// differs says how got is not module's announcement of want, or "".
-func differs(got announce.States, module string, want []announce.State) string {
-	if got.Module != module {
-		return fmt.Sprintf("the announcement names the module %q, not %q", got.Module, module)
-	}
-	w := append([]announce.State{}, want...)
-	sort.Slice(w, func(i, j int) bool { return w[i].Name < w[j].Name })
-	g := append([]announce.State{}, got.States...)
-	if !reflect.DeepEqual(g, w) && !(len(g) == 0 && len(w) == 0) {
-		return fmt.Sprintf("%s announced %v, and its code declares %v", module, g, w)
-	}
-	return ""
-}

go/announcetest/announcetest_integration_test.go

@@ -1,29 +0,0 @@
-//go:build integration
-
-package announcetest
-
-import (
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/announce"
-	"git.novox.be/novox/mesh-sdk/go/process"
-)
-
-// 1790/S11: a module started against the test bus announces through process.Conn.Keeps, and Check reads that
-// announcement back against what the code declares.
-func TestCheckReadsTheModulesAnnouncementOffARealBus(t *testing.T) {
-	declared := []announce.State{{Name: "accounts", Readable: true}, {Name: "drafts"}}
-	got := Check(t, "mesh-mail", declared, func(url string) func() {
-		conn, err := process.Connect(process.Account{URL: url, Module: "mesh-mail", Node: "novox", User: "u", Password: "p"})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if err := conn.Keeps(declared...); err != nil {
-			t.Fatal(err)
-		}
-		return conn.Close
-	})
-	if got.Node != "novox" {
-		t.Fatalf("announced from %q", got.Node)
-	}
-}

go/announcetest/announcetest_test.go

@@ -1,32 +0,0 @@
-package announcetest
-
-import (
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/announce"
-)
-
-// The comparison is exact up to order: a state missing, one extra, a readability that differs or another module's
-// announcement each fail, naming what differs.
-func TestAnAnnouncementDiffersFromTheCodeByNameAndReadability(t *testing.T) {
-	got := announce.States{Module: "m", States: []announce.State{{Name: "a", Readable: true}, {Name: "b"}}}
-	if p := differs(got, "m", []announce.State{{Name: "b"}, {Name: "a", Readable: true}}); p != "" {
-		t.Fatalf("an equal announcement differs: %s", p)
-	}
-	for _, want := range [][]announce.State{
-		{{Name: "a", Readable: true}},
-		{{Name: "a", Readable: true}, {Name: "b"}, {Name: "c"}},
-		{{Name: "a"}, {Name: "b"}},
-	} {
-		if p := differs(got, "m", want); p == "" || !strings.Contains(p, "declares") {
-			t.Errorf("want %v: %q", want, p)
-		}
-	}
-	if p := differs(got, "other", nil); !strings.Contains(p, `"other"`) {
-		t.Errorf("another module's announcement: %q", p)
-	}
-	if p := differs(announce.States{Module: "m"}, "m", nil); p != "" {
-		t.Errorf("a module keeping nothing: %q", p)
-	}
-}

go/asker/asker.go

@@ -0,0 +1,196 @@
+// Package asker is a module's client for asking a person (novox/hq ADR 0259 §10): it publishes an ask under
+// the module's own name, cancels it, reads its state from the router's record, and hands the module each
+// warrant once — only one for an ask it made, for an option it offered, at that option's level, before it
+// expired. The module then acts with its own grants.
+//
+// It keeps what it asked, and which warrants it acted on, in a state of the module's own (declared in its
+// manifest, by default `asked`): the ask is written before it is published, and a warrant is marked acted on
+// by compare-and-set before the module's handler runs, so a redelivery, or a second instance, acts once.
+package asker
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/asks"
+)
+
+// Client asks as one module.
+type Client struct {
+	// Module is the asking module's name: the one the bus grants its asks under.
+	Module string
+	// State is the module's own state the asks are kept in.
+	State Store
+	// Now is the clock; nil is time.Now.
+	Now func() time.Time
+	// Publish, Record and Subscribe reach the bus; nil is the stdio SDK's, through the module's runtime.
+	Publish   func(subject string, body any, id string) error
+	Record    func(key string) (*stdio.StateEntry, error)
+	Subscribe func(pattern string, handle func(stdio.Envelope) error) error
+}
+
+// Store is where the asks are kept: stdio.State(name) is one.
+type Store interface {
+	Get(key string) (*stdio.StateEntry, error)
+	Create(key string, value any) (uint64, error)
+	Update(key string, value any, revision uint64) (uint64, error)
+}
+
+// New is a client for the module the runtime serves, keeping its asks in the state named.
+func New(state string) *Client {
+	return &Client{Module: os.Getenv("MESH_MODULE"), State: stdio.State(state)}
+}
+
+func (c *Client) now() time.Time {
+	if c.Now != nil {
+		return c.Now()
+	}
+	return time.Now()
+}
+
+// Kept is one ask as the module keeps it.
+type Kept struct {
+	Ask    asks.Ask      `json:"ask"`
+	Asked  time.Time     `json:"asked"`
+	Acted  bool          `json:"acted,omitempty"`
+	Ended  asks.Outcome  `json:"ended,omitempty"`
+	Answer *asks.Warrant `json:"answer,omitempty"`
+}
+
+func key(id string) string { return "ask." + id }
+
+// Ask checks an ask, keeps it, and publishes it under the module's own name. An ask with an id already kept
+// is refused: a new question is a new id.
+func (c *Client) Ask(a asks.Ask) error {
+	if err := a.Check(c.now()); err != nil {
+		return err
+	}
+	if _, err := c.State.Create(key(a.ID), Kept{Ask: a, Asked: c.now()}); err != nil {
+		if errors.Is(err, stdio.ErrChanged) {
+			return fmt.Errorf("an ask %s was already made: a new question is a new id", a.ID)
+		}
+		return err
+	}
+	return c.publish(asks.AskSubject(c.Module), a, a.ID)
+}
+
+// Cancel takes an ask back: the router ends it and edits every copy.
+func (c *Client) Cancel(id string) error {
+	return c.publish(asks.CancelSubject(c.Module), map[string]string{"id": id}, "cancel."+id)
+}
+
+func (c *Client) publish(subject string, body any, id string) error {
+	if c.Publish != nil {
+		return c.Publish(subject, body, id)
+	}
+	return stdio.SeatPublish(subject, body, id)
+}
+
+// Where is an ask's state as the router keeps it: its state and its warrant, if any — read under the
+// module's own name and no other's.
+func (c *Client) Where(id string) (state string, w *asks.Warrant, err error) {
+	read := c.Record
+	if read == nil {
+		read = func(k string) (*stdio.StateEntry, error) { return stdio.SeatRecord("", k) }
+	}
+	e, err := read(id)
+	if err != nil || e == nil {
+		return "", nil, err
+	}
+	var rec struct {
+		State   string        `json:"state"`
+		Warrant *asks.Warrant `json:"warrant"`
+	}
+	if err := json.Unmarshal(e.Value, &rec); err != nil {
+		return "", nil, fmt.Errorf("the router's record of %s cannot be read: %w", id, err)
+	}
+	return rec.State, rec.Warrant, nil
+}
+
+// Handled is what came of a warrant: acted on, refused (and why), or already done.
+type Handled string
+
+const (
+	Acted    Handled = "acted"
+	Refused  Handled = "refused"
+	Done     Handled = "already acted on"
+	Recorded Handled = "ended without a choice"
+)
+
+// Take hands act a warrant once, after holding it to the ask it answers. act performs the option with the
+// module's own grants; its error is said and the warrant stays acted on (a person's decision is not
+// performed twice; the module says the failure in its own record).
+func (c *Client) Take(w asks.Warrant, act func(asks.Option, asks.Warrant) error) (Handled, error) {
+	if w.Asker != c.Module {
+		return Refused, fmt.Errorf("a warrant for %s reached %s", w.Asker, c.Module)
+	}
+	e, err := c.State.Get(key(w.Ask))
+	if err != nil {
+		return "", err
+	}
+	if e == nil {
+		return Refused, fmt.Errorf("%s holds no ask %s", c.Module, w.Ask)
+	}
+	var k Kept
+	if err := json.Unmarshal(e.Value, &k); err != nil {
+		return "", err
+	}
+	if k.Acted || k.Ended != "" {
+		return Done, nil
+	}
+	if w.Outcome != asks.OutcomeChosen {
+		k.Ended = w.Outcome
+		k.Answer = &w
+		if _, err := c.State.Update(key(w.Ask), k, e.Revision); err != nil && !errors.Is(err, stdio.ErrChanged) {
+			return "", err
+		}
+		return Recorded, nil
+	}
+	o, err := w.For(c.Module, k.Ask)
+	if err != nil {
+		return Refused, err
+	}
+	// Marked before acting: of two deliveries, or two instances, only the one whose write stands acts.
+	k.Acted, k.Ended, k.Answer = true, asks.OutcomeChosen, &w
+	if _, err := c.State.Update(key(w.Ask), k, e.Revision); err != nil {
+		if errors.Is(err, stdio.ErrChanged) {
+			return Done, nil
+		}
+		return "", err
+	}
+	return Acted, act(o, w)
+}
+
+// Listen hands every warrant for this module to Take, with act. It asks the runtime for the module's
+// events matching the router's `decided` subject for this module.
+func (c *Client) Listen(act func(asks.Option, asks.Warrant) error, said func(Handled, asks.Warrant, error)) error {
+	subscribe := c.Subscribe
+	if subscribe == nil {
+		subscribe = stdio.Subscribe
+	}
+	return subscribe(asks.Seat+".decided."+c.Module, func(e stdio.Envelope) error {
+		if !strings.HasPrefix(e.Key, asks.Seat+".decided.") {
+			return nil
+		}
+		var w asks.Warrant
+		if err := json.Unmarshal(e.Body, &w); err != nil {
+			if said != nil {
+				said(Refused, w, fmt.Errorf("a warrant could not be read: %w", err))
+			}
+			return nil
+		}
+		h, err := c.Take(w, act)
+		if h == "" && err != nil {
+			return err // the state could not be reached: offered again
+		}
+		if said != nil {
+			said(h, w, err)
+		}
+		return nil
+	})
+}

go/asker/asker_test.go

@@ -0,0 +1,141 @@
+package asker
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/asks"
+)
+
+type mem struct {
+	vals map[string]json.RawMessage
+	revs map[string]uint64
+	n    uint64
+}
+
+func (m *mem) Get(k string) (*stdio.StateEntry, error) {
+	v, ok := m.vals[k]
+	if !ok {
+		return nil, nil
+	}
+	return &stdio.StateEntry{Key: k, Value: v, Revision: m.revs[k]}, nil
+}
+func (m *mem) Create(k string, v any) (uint64, error) {
+	if _, ok := m.vals[k]; ok {
+		return 0, stdio.ErrChanged
+	}
+	return m.put(k, v)
+}
+func (m *mem) Update(k string, v any, rev uint64) (uint64, error) {
+	if rev == 0 || m.revs[k] != rev {
+		return 0, stdio.ErrChanged
+	}
+	return m.put(k, v)
+}
+func (m *mem) put(k string, v any) (uint64, error) {
+	raw, _ := json.Marshal(v)
+	m.n++
+	m.vals[k], m.revs[k] = raw, m.n
+	return m.n, nil
+}
+
+var now = time.Date(2026, 10, 8, 14, 0, 0, 0, time.UTC)
+
+func client() (*Client, map[string][]string) {
+	sent := map[string][]string{}
+	c := &Client{Module: "mesh-delivery", State: &mem{vals: map[string]json.RawMessage{}, revs: map[string]uint64{}},
+		Now: func() time.Time { return now },
+		Publish: func(subject string, body any, id string) error {
+			sent[subject] = append(sent[subject], id)
+			return nil
+		}}
+	return c, sent
+}
+
+// releaseHQ is the act the ask's one option binds.
+var releaseHQ = map[string]string{"verb": "release", "delivery": "hq"}
+
+func held() asks.Ask {
+	binds, _ := asks.ActDigest(releaseHQ)
+	return asks.Ask{ID: "d-1", Headline: "Delivery of hq held", Explanation: "Needs you: release it, or stop it.",
+		Who: asks.Operator, Expires: now.Add(time.Hour), OnExpiry: "the delivery stays held",
+		Options: []asks.Option{{ID: "release", Label: "Release", Does: "it goes on", Level: asks.Approve, Binds: binds}}}
+}
+
+func warrant() asks.Warrant {
+	return asks.Warrant{Ask: "d-1", Asker: "mesh-delivery", Outcome: asks.OutcomeChosen, Option: "release",
+		Label: "Release", Level: asks.Approve, At: now.Add(time.Minute), AskDigest: held().Digest(),
+		By: &asks.Person{Who: asks.Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"}}
+}
+
+func TestAnAskIsKeptThenPublishedUnderTheModulesOwnName(t *testing.T) {
+	c, sent := client()
+	if err := c.Ask(held()); err != nil {
+		t.Fatal(err)
+	}
+	if got := sent[asks.AskSubject("mesh-delivery")]; len(got) != 1 || got[0] != "d-1" {
+		t.Fatalf("%v", sent)
+	}
+	if err := c.Ask(held()); err == nil || !strings.Contains(err.Error(), "already made") {
+		t.Errorf("the same id was asked twice: %v", err)
+	}
+	bad := held()
+	bad.Who = "agent"
+	if err := c.Ask(bad); err == nil {
+		t.Error("an ask the contract refuses was published")
+	}
+}
+
+func TestAWarrantIsActedOnOnceAndOnlyForItsOwnAsk(t *testing.T) {
+	c, _ := client()
+	_ = c.Ask(held())
+	acted := 0
+	act := func(o asks.Option, _ asks.Warrant) error {
+		if err := o.Performs(releaseHQ); err != nil {
+			t.Errorf("the bound act: %v", err)
+		}
+		acted++
+		return nil
+	}
+	if h, err := c.Take(warrant(), act); h != Acted || err != nil || acted != 1 {
+		t.Fatalf("%s %v %d", h, err, acted)
+	}
+	if h, _ := c.Take(warrant(), act); h != Done || acted != 1 {
+		t.Errorf("a redelivery was acted on: %s", h)
+	}
+	for why, change := range map[string]func(*asks.Warrant){
+		"another asker":         func(w *asks.Warrant) { w.Asker = "mesh-controller" },
+		"an ask not made":       func(w *asks.Warrant) { w.Ask = "d-9" },
+		"another level":         func(w *asks.Warrant) { w.Level = asks.Acknowledge },
+		"an option not offered": func(w *asks.Warrant) { w.Option = "delete" },
+		"after its expiry":      func(w *asks.Warrant) { w.At = now.Add(2 * time.Hour) },
+		"another ask's digest":  func(w *asks.Warrant) { w.AskDigest = "sha256:00" },
+	} {
+		c2, _ := client()
+		_ = c2.Ask(held())
+		w := warrant()
+		change(&w)
+		if h, _ := c2.Take(w, act); h == Acted {
+			t.Errorf("a warrant from %s was acted on", why)
+		}
+	}
+	if acted != 1 {
+		t.Errorf("acted %d times", acted)
+	}
+}
+
+func TestAnAskEndedWithoutAChoiceIsRecordedAndNothingDone(t *testing.T) {
+	c, _ := client()
+	_ = c.Ask(held())
+	w := warrant()
+	w.Outcome, w.Option, w.By = asks.OutcomeExpired, "", nil
+	if h, err := c.Take(w, func(asks.Option, asks.Warrant) error { t.Fatal("acted"); return nil }); h != Recorded || err != nil {
+		t.Fatalf("%s %v", h, err)
+	}
+	if h, _ := c.Take(warrant(), func(asks.Option, asks.Warrant) error { t.Fatal("acted after it ended"); return nil }); h != Done {
+		t.Errorf("%s", h)
+	}
+}

go/asks/asks.go

@@ -0,0 +1,573 @@
+// Package asks is the contract of asking a person and answering on a channel (novox/hq ADR 0259): the
+// shapes an asker, the router and a channel exchange on the bus, and the subjects they travel on. No
+// transport and no channel's service: an asker publishes an Ask under its own name and acts on the Warrant
+// it hears; the router holds the ask, sends channels a Message, and judges the Choice a channel says; a
+// channel shows a Message and says what was chosen and by whom, as its service authenticated it.
+package asks
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// The seats (novox/hq ADR 0259 §3).
+const (
+	// Seat is held by the router: an ask and its cancel are its accepts, a warrant its event, each named by
+	// the asker.
+	Seat = "operator-channel"
+	// ChannelSeat is the kinded bench a channel holds to show and say: its accepts carry the kind.
+	ChannelSeat = "channel"
+	// IntakeSeat is the kinded bench a channel holds to say what was chosen: its events and proofs carry
+	// the kind.
+	IntakeSeat = "intake"
+)
+
+// AskSubject is where an asker publishes an ask, CancelSubject its cancel, and DecidedSubject where it
+// hears the warrant, or the ask's end without one.
+func AskSubject(asker string) string     { return "mesh.seat." + Seat + ".accept.ask." + asker }
+func CancelSubject(asker string) string  { return "mesh.seat." + Seat + ".accept.cancel." + asker }
+func DecidedSubject(asker string) string { return "mesh.seat." + Seat + ".event.decided." + asker }
+
+// The work a channel takes, on ChannelSubject.
+const (
+	Show = "show" // a message offering answers
+	Edit = "edit" // a message shown before, replaced
+	Send = "send" // a message offering nothing
+)
+
+// ChannelSubject is where the router sends a channel of a kind its work.
+func ChannelSubject(verb, kind string) string {
+	return "mesh.seat." + ChannelSeat + ".accept." + verb + "." + kind
+}
+
+// What a channel says, on IntakeSubject.
+const (
+	Chosen = "choice" // a button tapped
+	Link   = "link"   // somebody asked to be linked as the operator
+)
+
+// IntakeSubject is where a channel of a kind says what arrived.
+func IntakeSubject(what, kind string) string {
+	return "mesh.seat." + IntakeSeat + ".event." + what + "." + kind
+}
+
+// CodeProof is the one proof verb: a code the operator typed, carried by request and reply, never kept.
+const CodeProof = "code"
+
+// ProofSubject is where a channel of a kind asks a proof.
+func ProofSubject(verb, kind string) string {
+	return "mesh.seat." + IntakeSeat + ".proof." + verb + "." + kind
+}
+
+// A Level is how much proof an option's answer needs (novox/hq ADR 0234 §8, the glossary's assurance level).
+type Level string
+
+const (
+	// Acknowledge performs only what any granted principal may already do: silencing, details. No proof.
+	Acknowledge Level = "acknowledge"
+	// Approve needs one proof: a verified sender (a linked account, linked an hour or more) or a code.
+	Approve Level = "approve"
+	// Destroy needs two proofs, one of them a code.
+	Destroy Level = "destroy"
+)
+
+// Rank orders the levels; an unknown level ranks above every known one, so it is never taken as less.
+func (l Level) Rank() int {
+	switch l {
+	case Acknowledge:
+		return 0
+	case Approve:
+		return 1
+	case Destroy:
+		return 2
+	}
+	return 3
+}
+
+// Operator is the one role an ask may be answered by today.
+const Operator = "operator"
+
+// Option is one answer an ask offers: a label for the button, what it does in plain words, its level.
+type Option struct {
+	ID    string `json:"id"`
+	Label string `json:"label"`
+	Does  string `json:"does"`
+	Level Level  `json:"level"`
+	// Binds is the digest of exactly what the asker performs when this option is chosen — the verb, the
+	// machine and every argument — as ActDigest gives it. It travels in the ask, so the router's warrant,
+	// which names the ask's digest, names it too: a warrant then authorises that act and no other, and an
+	// asker whose record of the act changed after it asked finds the digests differ and does nothing.
+	// Required on an option above acknowledge.
+	Binds string `json:"binds,omitempty"`
+}
+
+// An Act is what an option binds: named fields, each a string — the verb, the machine, the level, and each
+// argument under a name of its own ("arg.delivery"). Flat on purpose: its digest is over these names and
+// values alone, never over how a language happens to encode a struct.
+type Act map[string]string
+
+// ActDigest is the digest an asker puts in Option.Binds: SHA-256 over the act's canonical encoding (canonical),
+// written "sha256:<hex>". The same names and values give the same digest in any language, whatever order
+// they were set in; a field renamed, added or emptied gives another.
+func ActDigest(act Act) (string, error) {
+	if len(act) == 0 {
+		return "", fmt.Errorf("the act cannot be digested: it names nothing")
+	}
+	keys := make([]string, 0, len(act))
+	for k := range act {
+		if k == "" {
+			return "", fmt.Errorf("the act cannot be digested: a field has no name")
+		}
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	var b strings.Builder
+	b.WriteString("novox.act.v1\n")
+	for _, k := range keys {
+		canonical(&b, k)
+		canonical(&b, act[k])
+	}
+	sum := sha256.Sum256([]byte(b.String()))
+	return "sha256:" + hex.EncodeToString(sum[:]), nil
+}
+
+// canonical writes one value as its length in bytes, a colon, the bytes and a newline: no value can be read
+// as another's end or start, so two different sequences of values never encode the same.
+func canonical(b *strings.Builder, v string) {
+	b.WriteString(strconv.Itoa(len(v)))
+	b.WriteByte(':')
+	b.WriteString(v)
+	b.WriteByte('\n')
+}
+
+// Digest is the digest of the ask exactly as its asker published it: its id, words, options with what each
+// binds, who answers, and its expiry. The router puts it in the warrant (Warrant.AskDigest), and an asker
+// acts only on a warrant whose digest is that of the ask it keeps — so a warrant answers one ask, as the
+// person was shown it, and nothing published under the same id before or after.
+//
+// It is over the ask's named fields in a fixed order, each written canonically, and the expiry as UTC
+// RFC 3339 to the nanosecond — never over a language's encoding of the struct, so a field added to Ask
+// later changes no digest until it is added here, on purpose. Whole and Details (novox/hq issue 383) follow
+// the options only when the ask gives either: an ask without them digests as it did before they existed, so
+// a router and an asker of different builds still agree on every such ask.
+func (a Ask) Digest() string {
+	var b strings.Builder
+	b.WriteString("novox.ask.v1\n")
+	for _, v := range []string{a.ID, a.Headline, a.Explanation, a.Who,
+		a.Expires.UTC().Format(time.RFC3339Nano), a.OnExpiry, a.About, strconv.FormatBool(a.Urgent),
+		strconv.Itoa(len(a.Options))} {
+		canonical(&b, v)
+	}
+	for _, o := range a.Options {
+		for _, v := range []string{o.ID, o.Label, o.Does, string(o.Level), o.Binds} {
+			canonical(&b, v)
+		}
+	}
+	// Whole and Details are written whenever either or WholeDetails is given, and WholeDetails after them whenever
+	// it is given (novox/hq ADR 0347): the fields after the options are then always one of three fixed shapes —
+	// none, the two, or the three — and the count of values the sequence holds tells them apart, so no two asks
+	// encode the same (the review of mesh-sdk #25). An ask with none of them digests as before they existed, and
+	// one without WholeDetails as before it existed.
+	if a.Whole != "" || a.Details != "" || a.WholeDetails != "" {
+		canonical(&b, a.Whole)
+		canonical(&b, a.Details)
+	}
+	if a.WholeDetails != "" {
+		canonical(&b, a.WholeDetails)
+	}
+	sum := sha256.Sum256([]byte(b.String()))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+// Ask is a request for a person's word (novox/hq ADR 0259 §4).
+type Ask struct {
+	// ID is the asker's own, unique to it.
+	ID string `json:"id"`
+	// Headline names the thing and what is wrong, in a few plain words; Explanation is what happened and
+	// what it means. Both are held to the plain rule and the content rule by the router.
+	Headline    string   `json:"headline"`
+	Explanation string   `json:"explanation"`
+	Options     []Option `json:"options"`
+	// Who may answer: Operator.
+	Who string `json:"who"`
+	// Expires is when the ask ends unanswered; OnExpiry is what the asker then does, in words the person
+	// is shown ("the delivery stays held"). An ask that authorises never defaults.
+	Expires  time.Time `json:"expires"`
+	OnExpiry string    `json:"on-expiry"`
+	// About is what the ask is about (a condition's key): a newer ask about it replaces the older.
+	About  string `json:"about,omitempty"`
+	Urgent bool   `json:"urgent,omitempty"`
+	// Whole is the explanation with its exact values whole, shown in place of Explanation on a channel kind
+	// that proves who answers (verified-sender) and carries the ask's answers (novox/hq issue 383): what the
+	// person approves — a mount point, a share, a private address — must be readable where they approve it.
+	// The asker withholds a value shaped like a secret in it, and the router refuses the ask when one is left;
+	// Explanation stays under the whole content rule everywhere else. Empty, Explanation is shown everywhere.
+	Whole string `json:"whole,omitempty"`
+	// Details are the ask's secondary words, line by line under the content rule: who proposed it, a
+	// fingerprint, how to read it whole. The router shows them in the note of the ask's own message
+	// (Message.Note), after what the ask's options do and when it expires — never in its body (novox/hq
+	// issue 639).
+	Details string `json:"details,omitempty"`
+	// WholeDetails are the Details with their exact values whole, shown in place of Details where Whole is shown
+	// in place of the explanation (a kind that proves who answers, given the ask's answers): every value an
+	// approval sets, whole, so the person reads exactly what they approve (novox/hq issue 383). Held, like
+	// Whole, to the secret rule alone; the router refuses the ask when a secret's shape is left in it. Empty,
+	// Details are shown everywhere.
+	WholeDetails string `json:"whole-details,omitempty"`
+}
+
+// What an ask's explanation is held to, so it reads at a glance on a phone (novox/hq issue 639): a summary
+// of two or three short sentences on its first line — what changes, why, what it costs or risks — then at
+// most three points, a line each, only where they add something. Whole is held to the same. Who asked, when,
+// the fingerprint and how to read it whole are Details, never the explanation.
+const (
+	SummaryLength = 300
+	MostPoints    = 3
+	PointLength   = 160
+)
+
+// Glance says why an explanation does not read at a glance, or nil: its first line, the summary, longer than
+// SummaryLength; more than MostPoints lines after it; a point longer than PointLength. Blank lines are not
+// counted. An asker holds its asks to it in its own tests; the router says, without refusing, an ask that
+// does not hold to it.
+func Glance(explanation string) error {
+	var lines []string
+	for _, l := range strings.Split(explanation, "\n") {
+		if strings.TrimSpace(l) != "" {
+			lines = append(lines, strings.TrimSpace(l))
+		}
+	}
+	var problems []string
+	switch {
+	case len(lines) == 0:
+		problems = append(problems, "it has no summary")
+	case len([]rune(lines[0])) > SummaryLength:
+		problems = append(problems, fmt.Sprintf("its summary is %d characters, more than %d", len([]rune(lines[0])), SummaryLength))
+	}
+	if len(lines) > 1+MostPoints {
+		problems = append(problems, fmt.Sprintf("it has %d points after its summary, more than %d", len(lines)-1, MostPoints))
+	}
+	for i, l := range lines {
+		if i > 0 && len([]rune(l)) > PointLength {
+			problems = append(problems, fmt.Sprintf("its point %d is %d characters, more than %d", i, len([]rune(l)), PointLength))
+		}
+	}
+	if len(problems) > 0 {
+		return errors.New("the explanation does not read at a glance: " + strings.Join(problems, "; "))
+	}
+	return nil
+}
+
+// The bounds of an ask (novox/hq ADR 0234 §8, ADR 0259 §4).
+const (
+	MostOptions    = 4
+	MostOpen       = 3
+	ApproveLasts   = 24 * time.Hour
+	DestroyLasts   = 10 * time.Minute
+	HeadlineLength = 60
+	LabelLength    = 24
+)
+
+var usableID = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$`)
+
+// UsableID says whether a name can be an ask's or an option's id: a key and a subject token both.
+func UsableID(id string) bool { return usableID.MatchString(id) }
+
+// Highest is the highest level among the ask's options.
+func (a Ask) Highest() Level {
+	high := Acknowledge
+	for _, o := range a.Options {
+		if o.Level.Rank() > high.Rank() {
+			high = o.Level
+		}
+	}
+	return high
+}
+
+// Option is the option of this id, or false.
+func (a Ask) Option(id string) (Option, bool) {
+	for _, o := range a.Options {
+		if o.ID == id {
+			return o, true
+		}
+	}
+	return Option{}, false
+}
+
+// Check is what an ask is held to before anything is shown: every refusal, in words its asker can act on.
+func (a Ask) Check(now time.Time) error {
+	var problems []string
+	say := func(format string, args ...any) { problems = append(problems, fmt.Sprintf(format, args...)) }
+	if !UsableID(a.ID) {
+		say("its id %q is not letters, digits, - and _, at most 64", a.ID)
+	}
+	if strings.TrimSpace(a.Headline) == "" || len([]rune(a.Headline)) > HeadlineLength {
+		say("its headline is empty or longer than %d characters", HeadlineLength)
+	}
+	if strings.TrimSpace(a.Explanation) == "" {
+		say("it explains nothing")
+	}
+	if a.Who != Operator {
+		say("it is answered by %q, and only the operator answers today", a.Who)
+	}
+	if len(a.Options) == 0 || len(a.Options) > MostOptions {
+		say("it offers %d options, and an ask offers one to %d", len(a.Options), MostOptions)
+	}
+	seen := map[string]bool{}
+	for _, o := range a.Options {
+		switch {
+		case !UsableID(o.ID):
+			say("an option's id %q is not letters, digits, - and _", o.ID)
+		case seen[o.ID]:
+			say("the option %s is offered twice", o.ID)
+		}
+		seen[o.ID] = true
+		if strings.TrimSpace(o.Label) == "" || len([]rune(o.Label)) > LabelLength {
+			say("the option %s's label is empty or longer than %d characters", o.ID, LabelLength)
+		}
+		if strings.TrimSpace(o.Does) == "" {
+			say("the option %s does not say what it does", o.ID)
+		}
+		if o.Level.Rank() > Destroy.Rank() {
+			say("the option %s has the level %q, which is none of acknowledge, approve, destroy", o.ID, o.Level)
+		}
+		if o.Level != Acknowledge && !strings.HasPrefix(o.Binds, "sha256:") {
+			say("the option %s authorises and does not bind what it performs (its binds is not an ActDigest)", o.ID)
+		}
+	}
+	if !a.Expires.After(now) {
+		say("it expires before it is asked")
+	}
+	switch a.Highest() {
+	case Approve:
+		if a.Expires.After(now.Add(ApproveLasts)) {
+			say("an ask that approves lasts at most %s", ApproveLasts)
+		}
+	case Destroy:
+		if a.Expires.After(now.Add(DestroyLasts)) {
+			say("an ask that destroys lasts at most %s", DestroyLasts)
+		}
+	}
+	if a.Highest() != Acknowledge && strings.TrimSpace(a.OnExpiry) == "" {
+		say("it does not say what happens when nobody answers, and an ask that authorises never defaults")
+	}
+	if a.About != "" && strings.ContainsAny(a.About, " \n") {
+		say("what it is about is a key, without spaces")
+	}
+	if len(problems) > 0 {
+		return errors.New("the ask is refused: " + strings.Join(problems, "; "))
+	}
+	return nil
+}
+
+// Outcome is how an ask ended.
+type Outcome string
+
+const (
+	OutcomeChosen    Outcome = "chosen"    // a person chose an option: a warrant
+	OutcomeExpired   Outcome = "expired"   // nobody answered in time
+	OutcomeCancelled Outcome = "cancelled" // its asker took it back
+	OutcomeReplaced  Outcome = "replaced"  // a newer ask about the same thing replaced it
+	OutcomeRefused   Outcome = "refused"   // it was never shown: Words says why
+)
+
+// Person is who chose, as the router verified them.
+type Person struct {
+	// Who is the role: Operator.
+	Who string `json:"who"`
+	// Kind is the channel kind they answered on, Identity their account on that service, Display the name
+	// the service shows, and Verified how the router knew it was them.
+	Kind     string `json:"kind"`
+	Identity string `json:"identity"`
+	Display  string `json:"display,omitempty"`
+	Verified string `json:"verified"`
+}
+
+// Warrant is the router's record that a person chose one option of one ask, or the ask's end without one
+// (novox/hq ADR 0259 §6). It carries no secret.
+type Warrant struct {
+	Ask     string  `json:"ask"`
+	Asker   string  `json:"asker"`
+	About   string  `json:"about,omitempty"`
+	Outcome Outcome `json:"outcome"`
+	// Option, Label and Level are the option chosen; By who chose it, Channel the module it came through,
+	// Proofs which proofs were present (P1, P2, P3).
+	Option  string    `json:"option,omitempty"`
+	Label   string    `json:"label,omitempty"`
+	Level   Level     `json:"level,omitempty"`
+	By      *Person   `json:"by,omitempty"`
+	Channel string    `json:"channel,omitempty"`
+	Proofs  []string  `json:"proofs,omitempty"`
+	At      time.Time `json:"at"`
+	// AskDigest is the digest of the ask as the router took it (Ask.Digest): the warrant answers that ask
+	// alone, with the options it bound.
+	AskDigest string `json:"ask-digest,omitempty"`
+	// Words are why an ask ended without a choice, or what refused it.
+	Words string `json:"words,omitempty"`
+}
+
+// Says is the warrant in the words an asker records with its act: "the operator, via telegram (user id
+// verified), chose Release".
+func (w Warrant) Says() string {
+	if w.Outcome != OutcomeChosen || w.By == nil {
+		return fmt.Sprintf("no person chose: the ask %s %s", w.Ask, w.Outcome)
+	}
+	via := w.By.Kind
+	if w.By.Verified != "" {
+		via += " (" + w.By.Verified + ")"
+	}
+	return fmt.Sprintf("the %s, via %s, chose %s", w.By.Who, via, w.Label)
+}
+
+// For checks a warrant against the ask its asker made: the same asker and ask, the same ask's digest (so the
+// same words, options and binds), a choice, an option the ask offered, at that option's level, before the
+// ask expired. An asker acts on nothing else, and then performs only what the option's Binds names.
+func (w Warrant) For(asker string, a Ask) (Option, error) {
+	if w.Asker != asker || w.Ask != a.ID {
+		return Option{}, fmt.Errorf("the warrant is for %s's ask %s, not %s's %s", w.Asker, w.Ask, asker, a.ID)
+	}
+	if w.Outcome != OutcomeChosen || w.By == nil || w.By.Who != a.Who {
+		return Option{}, fmt.Errorf("the ask %s ended %s; no person chose", a.ID, w.Outcome)
+	}
+	if d := a.Digest(); w.AskDigest != d {
+		return Option{}, fmt.Errorf("the warrant answers an ask whose digest is %q, and the ask %s kept here is %s: "+
+			"it was not the ask the person was shown", w.AskDigest, a.ID, d)
+	}
+	o, offered := a.Option(w.Option)
+	if !offered {
+		return Option{}, fmt.Errorf("the ask %s offered no option %s", a.ID, w.Option)
+	}
+	if w.Level != o.Level {
+		return Option{}, fmt.Errorf("the option %s is %s, and the warrant says %s", o.ID, o.Level, w.Level)
+	}
+	// A choice made after the ask expired is no answer to it, whatever the router said. An ask that says no
+	// expiry, or a warrant that says no time, is no answer either: neither can be shown to be in time (the
+	// confirmation review of 2026-10-09).
+	if a.Expires.IsZero() {
+		return Option{}, fmt.Errorf("the ask %s says no expiry, so no answer to it can be in time", a.ID)
+	}
+	if w.At.IsZero() {
+		return Option{}, fmt.Errorf("the warrant for the ask %s says no time it was given, so it cannot be shown to be in time", a.ID)
+	}
+	if w.At.After(a.Expires) {
+		return Option{}, fmt.Errorf("the warrant was given at %s, after the ask %s expired at %s",
+			w.At.UTC().Format(time.RFC3339), a.ID, a.Expires.UTC().Format(time.RFC3339))
+	}
+	return o, nil
+}
+
+// Performs checks that the act an asker is about to perform is the one the chosen option bound when it
+// asked: the act's digest equals the option's Binds. An acknowledge option that bound nothing passes.
+func (o Option) Performs(act Act) error {
+	if o.Binds == "" && o.Level == Acknowledge {
+		return nil
+	}
+	d, err := ActDigest(act)
+	if err != nil {
+		return err
+	}
+	if d != o.Binds {
+		return fmt.Errorf("the option %s bound %s, and the act about to be performed is %s: nothing is done", o.ID, o.Binds, d)
+	}
+	return nil
+}
+
+// Button is one answer a channel offers: its label and the router's one-time ticket for it.
+type Button struct {
+	Label  string `json:"label"`
+	Ticket string `json:"ticket"`
+}
+
+// Message is the work a channel takes: shown with buttons (Show), shown again in place (Edit), or said
+// (Send). Handle is the router's name for it, the same across a show and its edits; the channel keeps
+// which of its own messages that is. The words are the router's, shown as given.
+type Message struct {
+	Handle  string   `json:"handle"`
+	Title   string   `json:"title"`
+	Body    string   `json:"body"`
+	Buttons []Button `json:"buttons,omitempty"`
+	// Note is the message's secondary words, after its body and its buttons: who asked and when, what each
+	// answer does, when it expires, and the ask's Details. A channel shows it smaller, collapsed or set apart
+	// where it can, and after the body where it cannot (novox/hq issue 639). A channel that bounds a message's
+	// length cuts the body first and the note only when the title and the note alone do not fit, saying each
+	// cut (novox/hq ADR 0347 §5).
+	Note   string `json:"note,omitempty"`
+	Urgent bool   `json:"urgent,omitempty"`
+	Silent bool   `json:"silent,omitempty"`
+	// Reply is the Choice or LinkAsked this answers, by its ID: the channel shows it where that was made.
+	Reply string `json:"reply,omitempty"`
+	// To is the account linked as the operator on this kind, for a channel that verifies its sender: where
+	// the channel sends what is not a reply. The router's word, from its list; empty when none is linked.
+	To string `json:"to,omitempty"`
+	// Secret says the words carry something shown once (a link's code): the channel shows it and keeps no
+	// copy of it — no state, no history of its own.
+	Secret bool `json:"secret,omitempty"`
+}
+
+// Sender is who a channel's service says sent something: the account, the name it shows, and whether the
+// service authenticated it. The router alone judges whether that is the operator.
+type Sender struct {
+	Identity      string `json:"identity"`
+	Display       string `json:"display,omitempty"`
+	Authenticated bool   `json:"authenticated"`
+}
+
+// Failed is a message a channel could not deliver: its handle, why, and whether trying again could help.
+type Failed struct {
+	Handle    string    `json:"handle"`
+	Why       string    `json:"why"`
+	Permanent bool      `json:"permanent,omitempty"`
+	At        time.Time `json:"at"`
+}
+
+// Standing is what a channel says of itself, at least every five minutes and whenever it changes:
+// whether it can send now, why not, and whether its edits notify nobody.
+type Standing struct {
+	Ready         bool      `json:"ready"`
+	Why           string    `json:"why,omitempty"`
+	EditsSilently bool      `json:"edits-silently,omitempty"`
+	At            time.Time `json:"at"`
+}
+
+// What a channel says of its own delivery, on IntakeSubject.
+const (
+	FailedWhat   = "failed"
+	StandingWhat = "standing"
+)
+
+// Choice is a button chosen on a channel.
+type Choice struct {
+	// ID is the channel's own for this arrival, unique, so the router acts on it once.
+	ID     string    `json:"id"`
+	Ticket string    `json:"ticket"`
+	Handle string    `json:"handle,omitempty"`
+	Sender Sender    `json:"sender"`
+	At     time.Time `json:"at"`
+}
+
+// LinkAsked is somebody on a channel asking to be linked as the operator.
+type LinkAsked struct {
+	ID     string    `json:"id"`
+	Sender Sender    `json:"sender"`
+	At     time.Time `json:"at"`
+}
+
+// Code is a code a person typed on a channel, asked as a proof: never in an event, never kept.
+type Code struct {
+	Sender  Sender `json:"sender"`
+	Code    string `json:"code"`
+	Purpose string `json:"purpose"`
+}
+
+// ProofAnswer is the router's answer to a proof: whether it was taken, and words to say to the person.
+type ProofAnswer struct {
+	Accepted bool   `json:"accepted"`
+	Words    string `json:"words"`
+}

go/asks/asks_test.go

@@ -0,0 +1,367 @@
+package asks
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+)
+
+var now = time.Date(2026, 10, 8, 14, 0, 0, 0, time.UTC)
+
+func held() Ask {
+	return Ask{ID: "d-1", Headline: "openrazer delivery held", Explanation: "Needs you: release it, or stop it.",
+		Who: Operator, Expires: now.Add(time.Hour), OnExpiry: "the delivery stays held", About: "delivery.openrazer",
+		Options: []Option{
+			{ID: "release", Label: "Release", Does: "the delivery goes on", Level: Approve, Binds: bind("release", "openrazer")},
+			{ID: "stop", Label: "Stop", Does: "the delivery ends", Level: Approve, Binds: bind("stop", "openrazer")},
+			{ID: "silence", Label: "Silence for a week", Does: "nothing more is said for a week", Level: Acknowledge},
+		}}
+}
+
+func bind(verb, what string) string {
+	d, err := ActDigest(Act{"verb": verb, "delivery": what})
+	if err != nil {
+		panic(err)
+	}
+	return d
+}
+
+func TestASoundAskPasses(t *testing.T) {
+	if err := held().Check(now); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestAnAskIsRefusedInWordsForEachFault(t *testing.T) {
+	for want, change := range map[string]func(*Ask){
+		"is not letters":             func(a *Ask) { a.ID = "a.b" },
+		"headline is empty":          func(a *Ask) { a.Headline = "" },
+		"explains nothing":           func(a *Ask) { a.Explanation = " " },
+		"only the operator answers":  func(a *Ask) { a.Who = "agent" },
+		"offers 0 options":           func(a *Ask) { a.Options = nil },
+		"offers 5 options":           func(a *Ask) { a.Options = append(a.Options, a.Options[0], a.Options[1]) },
+		"is offered twice":           func(a *Ask) { a.Options[1].ID = "release" },
+		"does not say what it does":  func(a *Ask) { a.Options[0].Does = "" },
+		"none of acknowledge":        func(a *Ask) { a.Options[0].Level = "admin" },
+		"expires before it is asked": func(a *Ask) { a.Expires = now },
+		"approves lasts at most":     func(a *Ask) { a.Expires = now.Add(25 * time.Hour) },
+		"destroys lasts at most":     func(a *Ask) { a.Options[0].Level = Destroy },
+		"never defaults":             func(a *Ask) { a.OnExpiry = "" },
+		"is a key, without spaces":   func(a *Ask) { a.About = "a b" },
+		"does not bind what it":      func(a *Ask) { a.Options[0].Binds = "" },
+	} {
+		a := held()
+		change(&a)
+		if err := a.Check(now); err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("want a refusal saying %q, got %v", want, err)
+		}
+	}
+	ack := held()
+	ack.Options = ack.Options[2:]
+	ack.OnExpiry = ""
+	ack.Expires = now.Add(7 * 24 * time.Hour)
+	if err := ack.Check(now); err != nil {
+		t.Errorf("an ask that only acknowledges needs no expiry words and may last a week: %v", err)
+	}
+}
+
+func TestAnAskerActsOnlyOnAWarrantForItsOwnAskAndOption(t *testing.T) {
+	w := Warrant{Ask: "d-1", Asker: "mesh-delivery", Outcome: OutcomeChosen, Option: "release", Label: "Release",
+		Level: Approve, By: &Person{Who: Operator, Kind: "telegram", Identity: "42", Verified: "user id verified"},
+		AskDigest: held().Digest(), At: now.Add(time.Minute)}
+	if o, err := w.For("mesh-delivery", held()); err != nil || o.ID != "release" {
+		t.Fatalf("a sound warrant was refused: %v", err)
+	}
+	if got := w.Says(); got != "the operator, via telegram (user id verified), chose Release" {
+		t.Errorf("the warrant says %q", got)
+	}
+	for why, change := range map[string]func(*Warrant){
+		"another asker": func(w *Warrant) { w.Asker = "mesh-controller" },
+		"another ask":   func(w *Warrant) { w.Ask = "d-2" },
+		"no choice":     func(w *Warrant) { w.Outcome = OutcomeExpired },
+		"nobody":        func(w *Warrant) { w.By = nil },
+		"not offered":   func(w *Warrant) { w.Option = "delete" },
+		"a lower level": func(w *Warrant) { w.Level = Acknowledge },
+		"another role":  func(w *Warrant) { w.By = &Person{Who: "agent"} },
+		"no digest":     func(w *Warrant) { w.AskDigest = "" },
+		"no time given": func(w *Warrant) { w.At = time.Time{} },
+		"after expiry":  func(w *Warrant) { w.At = now.Add(2 * time.Hour) },
+		"another ask's digest": func(w *Warrant) {
+			other := held()
+			other.Options[0].Binds = bind("release", "another")
+			w.AskDigest = other.Digest()
+		},
+	} {
+		c := w
+		by := *w.By
+		c.By = &by
+		change(&c)
+		if _, err := c.For("mesh-delivery", held()); err == nil {
+			t.Errorf("a warrant with %s was acted on", why)
+		}
+	}
+}
+
+func TestTheSubjectsNameTheirPublisher(t *testing.T) {
+	for got, want := range map[string]string{
+		AskSubject("mesh-delivery"):         "mesh.seat.operator-channel.accept.ask.mesh-delivery",
+		DecidedSubject("mesh-delivery"):     "mesh.seat.operator-channel.event.decided.mesh-delivery",
+		ChannelSubject(Show, "telegram"):    "mesh.seat.channel.accept.show.telegram",
+		IntakeSubject(Chosen, "desktop"):    "mesh.seat.intake.event.choice.desktop",
+		ProofSubject(CodeProof, "telegram"): "mesh.seat.intake.proof.code.telegram",
+	} {
+		if got != want {
+			t.Errorf("%s, want %s", got, want)
+		}
+	}
+}
+
+// A warrant answers one ask as it was shown, and authorises the act its option bound and no other
+// (novox/hq ADR 0259 §6: the warrant is bound to the exact ask and its arguments).
+func TestAWarrantAuthorisesOnlyTheActItsOptionBound(t *testing.T) {
+	a := held()
+	// The digest survives the trip through the bus: what the router decodes and digests is what was sent.
+	raw, err := json.Marshal(a)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded Ask
+	if err := json.Unmarshal(raw, &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if decoded.Digest() != a.Digest() {
+		t.Fatalf("the ask's digest changed on the way: %s, %s", decoded.Digest(), a.Digest())
+	}
+	local := a
+	local.Expires = a.Expires.In(time.FixedZone("CEST", 2*3600))
+	if local.Digest() != a.Digest() {
+		t.Error("the same instant in another zone digests differently")
+	}
+	// Changing anything the person was shown, or what an option binds, changes the digest.
+	for what, change := range map[string]func(*Ask){
+		"the headline":     func(a *Ask) { a.Headline += "!" },
+		"the explanation":  func(a *Ask) { a.Explanation += " " },
+		"a label":          func(a *Ask) { a.Options[0].Label = "Go" },
+		"what it binds":    func(a *Ask) { a.Options[0].Binds = bind("release", "another") },
+		"the expiry":       func(a *Ask) { a.Expires = a.Expires.Add(time.Second) },
+		"what it is about": func(a *Ask) { a.About = "delivery.other" },
+	} {
+		c := held()
+		change(&c)
+		if c.Digest() == a.Digest() {
+			t.Errorf("changing %s leaves the digest", what)
+		}
+	}
+	o, _ := a.Option("release")
+	if err := o.Performs(Act{"verb": "release", "delivery": "openrazer"}); err != nil {
+		t.Errorf("the bound act was refused: %v", err)
+	}
+	if err := o.Performs(Act{"verb": "release", "delivery": "another"}); err == nil {
+		t.Error("an act the option did not bind was let through")
+	}
+	ack, _ := a.Option("silence")
+	if err := ack.Performs(Act{"anything": "x"}); err != nil {
+		t.Errorf("an acknowledgement that bound nothing: %v", err)
+	}
+}
+
+// The digests are over named fields in a canonical encoding (the review of 2026-10-09): not over Go's
+// encoding of a struct, so a field added to Ask or Option, a JSON tag renamed, or a map built in another
+// order changes nothing it should not — and every field that is shown or bound is in it.
+func TestDigestsAreCanonicalOverNamedFields(t *testing.T) {
+	a1, _ := ActDigest(Act{"verb": "release", "arg.delivery": "hq"})
+	b := Act{}
+	b["arg.delivery"] = "hq"
+	b["verb"] = "release"
+	a2, _ := ActDigest(b)
+	if a1 != a2 {
+		t.Error("the order an act was built in changed its digest")
+	}
+	// A value cannot be read as two: "a"+"b=c" is not "a=b"+"c".
+	x, _ := ActDigest(Act{"a": "b\n1:c"})
+	y, _ := ActDigest(Act{"a": "b", "c": ""})
+	if x == y {
+		t.Error("two different acts encode the same")
+	}
+	if _, err := ActDigest(Act{}); err == nil {
+		t.Error("an empty act was digested")
+	}
+	// The encoding, by hand: any language reproduces it.
+	sum := sha256.Sum256([]byte("novox.act.v1\n4:verb\n7:release\n"))
+	if got, _ := ActDigest(Act{"verb": "release"}); got != "sha256:"+hex.EncodeToString(sum[:]) {
+		t.Errorf("the act's encoding is not the one written down: %s", got)
+	}
+
+	// Every exported field of Ask and Option is in the digest: changing any one changes it.
+	base := held()
+	mutations := map[string]func(*Ask){
+		"ID":          func(a *Ask) { a.ID = "other" },
+		"Headline":    func(a *Ask) { a.Headline += "!" },
+		"Explanation": func(a *Ask) { a.Explanation += "!" },
+		"Who":         func(a *Ask) { a.Who = "someone" },
+		"Expires":     func(a *Ask) { a.Expires = a.Expires.Add(time.Nanosecond) },
+		"OnExpiry":    func(a *Ask) { a.OnExpiry += "!" },
+		"About":       func(a *Ask) { a.About += "!" },
+		"Urgent":      func(a *Ask) { a.Urgent = !a.Urgent },
+		"Options":     func(a *Ask) { a.Options = a.Options[:1] },
+		"Option.ID":   func(a *Ask) { a.Options = append([]Option(nil), a.Options...); a.Options[0].ID = "x" },
+		"Option.Label": func(a *Ask) {
+			a.Options = append([]Option(nil), a.Options...)
+			a.Options[0].Label += "!"
+		},
+		"Option.Does": func(a *Ask) { a.Options = append([]Option(nil), a.Options...); a.Options[0].Does += "!" },
+		"Option.Level": func(a *Ask) {
+			a.Options = append([]Option(nil), a.Options...)
+			a.Options[0].Level = Destroy
+		},
+		"Option.Binds": func(a *Ask) {
+			a.Options = append([]Option(nil), a.Options...)
+			a.Options[0].Binds = "sha256:00"
+		},
+	}
+	for name, mutate := range mutations {
+		c := base
+		mutate(&c)
+		if c.Digest() == base.Digest() {
+			t.Errorf("changing %s left the digest the same", name)
+		}
+	}
+	// Whole and Details (issue 383) are in the digest once given, and change it; an ask without either digests
+	// exactly as before they existed — the encoding by hand, so no build can drift from it unseen.
+	plain := Ask{ID: "p", Headline: "h", Explanation: "e", Who: Operator, Expires: now, OnExpiry: "o", About: "a",
+		Options: []Option{{ID: "ok", Label: "OK", Does: "d", Level: Acknowledge}}}
+	byHand := sha256.Sum256([]byte("novox.ask.v1\n1:p\n1:h\n1:e\n8:operator\n20:2026-10-08T14:00:00Z\n1:o\n1:a\n5:false\n1:1\n" +
+		"2:ok\n2:OK\n1:d\n11:acknowledge\n0:\n"))
+	if plain.Digest() != "sha256:"+hex.EncodeToString(byHand[:]) {
+		t.Errorf("an ask without Whole and Details does not digest as it did before them: %s", plain.Digest())
+	}
+	withWhole, withDetails := plain, plain
+	withWhole.Whole = "e, whole"
+	withDetails.Details = "fingerprint 1234"
+	if withWhole.Digest() == plain.Digest() || withDetails.Digest() == plain.Digest() || withWhole.Digest() == withDetails.Digest() {
+		t.Error("Whole or Details left the digest the same")
+	}
+	both := withWhole
+	both.Details = "fingerprint 1234"
+	changed := both
+	changed.Whole += "!"
+	if changed.Digest() == both.Digest() {
+		t.Error("changing Whole beside Details left the digest the same")
+	}
+	// A field added to Ask or Option without being added to Digest fails here.
+	if n := reflect.TypeOf(Ask{}).NumField(); n != 12 {
+		t.Errorf("Ask has %d fields, and Digest covers 12: add the new one to Digest and to this test", n)
+	}
+	if n := reflect.TypeOf(Option{}).NumField(); n != 5 {
+		t.Errorf("Option has %d fields, and Digest covers 5: add the new one to Digest and to this test", n)
+	}
+	// The same instant in another zone is the same ask.
+	z := base
+	z.Expires = z.Expires.In(time.FixedZone("x", 3600))
+	if z.Digest() != base.Digest() {
+		t.Error("the expiry's zone changed the digest")
+	}
+}
+
+// An ask that says no expiry is answered by no warrant (the confirmation review of 2026-10-09): nothing could
+// show the answer was in time.
+func TestAWarrantForAnAskWithNoExpiryIsRefused(t *testing.T) {
+	a := held()
+	a.Expires = time.Time{}
+	w := Warrant{Ask: "d-1", Asker: "mesh-delivery", Outcome: OutcomeChosen, Option: "release", Label: "Release",
+		Level: Approve, By: &Person{Who: Operator, Kind: "telegram", Identity: "42"}, AskDigest: a.Digest(),
+		At: now.Add(time.Minute)}
+	if _, err := w.For("mesh-delivery", a); err == nil {
+		t.Error("a warrant for an ask with no expiry was taken")
+	}
+}
+
+// An explanation that reads at a glance passes; a wall of text says each way it is one (novox/hq issue 639).
+func TestAnExplanationReadsAtAGlance(t *testing.T) {
+	if err := Glance("Your agents' memory follows you to every machine. A file changed on two keeps both.\n\n• Only the memory folders are carried\n• A conflict reaches you as a warning"); err != nil {
+		t.Fatalf("a summary and two points: %v", err)
+	}
+	var wall strings.Builder
+	wall.WriteString("ADR 0343 was proposed by fix-367 and approved by the knowledge base's own review.")
+	for i := 1; i <= 13; i++ {
+		wall.WriteString("\n" + strings.Repeat("A clause lead. ", 3))
+	}
+	err := Glance(wall.String())
+	if err == nil || !strings.Contains(err.Error(), "13 points") {
+		t.Fatalf("thirteen clause lines pass as a glance: %v", err)
+	}
+	if err := Glance(strings.Repeat("word ", 70)); err == nil || !strings.Contains(err.Error(), "summary is 349") {
+		t.Fatalf("a long summary passes: %v", err)
+	}
+	if err := Glance("short.\n" + strings.Repeat("p", PointLength+1)); err == nil || !strings.Contains(err.Error(), "point 1") {
+		t.Fatalf("a long point passes: %v", err)
+	}
+	if err := Glance(" \n"); err == nil {
+		t.Fatal("an empty explanation passes")
+	}
+}
+
+// A message's note travels beside its body, and is left out of the encoding when empty, so a channel older
+// than it reads every message it read before.
+func TestAMessageCarriesItsNoteApart(t *testing.T) {
+	raw, _ := json.Marshal(Message{Handle: "h", Title: "t", Body: "b", Note: "Asked by x."})
+	if !strings.Contains(string(raw), `"note":"Asked by x."`) {
+		t.Fatalf("the note is not encoded: %s", raw)
+	}
+	raw, _ = json.Marshal(Message{Handle: "h", Title: "t"})
+	if strings.Contains(string(raw), "note") {
+		t.Fatalf("an empty note is encoded: %s", raw)
+	}
+}
+
+// WholeDetails is digested when given, and an ask without it digests as before it existed: a router and an asker
+// of different builds still agree on every such ask.
+func TestWholeDetailsAreDigestedOnlyWhenGiven(t *testing.T) {
+	a := Ask{ID: "a", Headline: "h", Explanation: "e", Details: "d"}
+	before := a.Digest()
+	a.WholeDetails = "+ shares: media=/storage/media"
+	if a.Digest() == before {
+		t.Fatal("the whole details are not in the digest")
+	}
+	b := a
+	b.WholeDetails = "+ shares: media=/storage/other"
+	if a.Digest() == b.Digest() {
+		t.Fatal("two whole details digest the same")
+	}
+	a.WholeDetails = ""
+	if a.Digest() != before {
+		t.Fatal("an ask without whole details digests otherwise than before")
+	}
+}
+
+// No two asks encode the same (the review of mesh-sdk #25): whole details given beside nothing else are not read as
+// a Whole and Details that happen to spell the same values, nor as any other split of the three fields.
+func TestWholeDetailsCollideWithNoOtherAsk(t *testing.T) {
+	base := Ask{ID: "a", Headline: "h", Explanation: "e"}
+	shapes := []Ask{}
+	for _, f := range []struct{ whole, details, wholeDetails string }{
+		{"", "", "+ x: 1"},
+		{"whole-details", "+ x: 1", ""},
+		{"", "+ x: 1", ""},
+		{"+ x: 1", "", ""},
+		{"", "", "whole-details"},
+		{"", "+ x: 1", "+ x: 1"},
+		{"+ x: 1", "+ x: 1", ""},
+		{"", "", ""},
+	} {
+		a := base
+		a.Whole, a.Details, a.WholeDetails = f.whole, f.details, f.wholeDetails
+		shapes = append(shapes, a)
+	}
+	seen := map[string]int{}
+	for i, a := range shapes {
+		if j, ok := seen[a.Digest()]; ok {
+			t.Errorf("asks %d and %d digest the same: %+v / %+v", j, i, shapes[j], a)
+		}
+		seen[a.Digest()] = i
+	}
+}

go/buildstep/capacity.go

@@ -1,7 +0,0 @@
-package buildstep
-
-// CapacitySetting is the build modules' setting of the node's build capacity (novox/hq ADR 0525 §5, ADR 0567 §12): how
-// many asks the node takes at once, an integer config value set on each node's layer of mesh-config. No repository names
-// a node: each build module declares it with the default 0, which pulls nothing, and the controller (or mesh-config)
-// lays the node's value into the module's settings file.
-const CapacitySetting = "capacity"

go/buildstep/doc.go

@@ -1,5 +0,0 @@
-// Package buildstep is the contract of a build step every delivery part reads (novox/hq ADR 0593 §1): a step's id, the
-// fetch request, a step a previous process left running and its end, a failure's words, a module tree's shape, the
-// capacity setting and the launchers' names. The runner the build modules share is the Go build module's own package
-// (mesh-catalog modules/mesh-build-go/buildstep), which imports this one.
-package buildstep

go/buildstep/failure.go

@@ -1,141 +0,0 @@
-package buildstep
-
-import (
-	"fmt"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/sdkversion"
-)
-
-// Failure is one test that failed, or a package or file that failed with no test to name (a build that failed, a test
-// program that panicked, a test file that did not load). The JSON names are the ones mesh-build-go and the checker have
-// always used; File is new and an older reader ignores it.
-type Failure struct {
-	// Package is the Go package's import path, or the TypeScript package's directory in the workspace.
-	Package string `json:"package"`
-	// Test names the failing test, or the tests that were running when the program stopped; "" when none can be named.
-	Test string `json:"test,omitempty"`
-	// File is where the failing test is (a Go test's file and line is in its Cause; node names the test's file:line:col).
-	File string `json:"file,omitempty"`
-	// Cause is the one line that says why: the assertion's or the error's first line, a "panic:" line, a build's first
-	// error, or words saying how the program stopped. **Never empty, and never a passing line** (PassingLine).
-	Cause string `json:"cause,omitempty"`
-	// Output is the failing test's own output, its last lines up to OutputBytes, Cause first: an older checker reads
-	// only its first line.
-	Output string `json:"output,omitempty"`
-}
-
-// OutputBytes is the most a failure keeps of its output, and LineBytes the most of one line: four kilobytes holds a long
-// assertion message and stays far under a bus message's or a verdict's bound.
-const (
-	OutputBytes = 4096
-	LineBytes   = 1024
-)
-
-// By names a build module and the SDK it was built with, for a result's "by": the checker names it when a failure hides
-// its cause ("the build module hid the failure (<by>)").
-func By(module string) string {
-	return module + " with mesh-sdk " + sdkversion.Version()
-}
-
-// PassingLine says a line is a test runner's word for a test or a package that passed: node's '✔', TAP's "ok N" (at any
-// indent), go test's "ok  \t<pkg>", "PASS" and "--- PASS". A line of a test's own that starts "ok " is none of these. Such a line is never a failure's cause, nor part of a failure's output.
-func PassingLine(l string) bool {
-	if strings.HasPrefix(l, "ok  \t") { // go test's package line, at column 0
-		return true
-	}
-	t := strings.TrimSpace(l)
-	switch {
-	case t == "PASS", strings.HasPrefix(t, "✔"), strings.HasPrefix(t, "--- PASS"):
-		return true
-	}
-	return tapOk(t)
-}
-
-// Hidden says how a failure hides why it failed, or "" when it does not: it has no cause, or its cause is a passing line.
-// The checker says it loudly (issue 1901): a build module that sends such a failure does not keep the contract.
-func Hidden(f Failure) string {
-	c := strings.TrimSpace(f.Cause)
-	switch {
-	case c == "":
-		return "it sent no cause"
-	case PassingLine(c):
-		return fmt.Sprintf("its cause is a passing line (%q)", CutLine(c))
-	}
-	return ""
-}
-
-// Clip joins the last lines of a failure's output that fit OutputBytes, each cut to LineBytes, and says how many earlier
-// lines it left out. **Its first line is the cause**, put ahead when the kept lines do not start with it, or, with no
-// cause and lines left out, the first non-empty line, then the marker: an older checker reads only the first line.
-// Passing lines are dropped.
-func Clip(lines []string, cause string) string {
-	own := make([]string, 0, len(lines))
-	for _, l := range lines {
-		if !PassingLine(l) {
-			own = append(own, l)
-		}
-	}
-	lines = own
-	size, from := 0, len(lines)
-	for from > 0 {
-		n := len(CutLine(lines[from-1])) + 1
-		if size+n > OutputBytes && from < len(lines) {
-			break
-		}
-		size += n
-		from--
-	}
-	kept := make([]string, 0, len(lines)-from+2)
-	head := strings.TrimSpace(cause)
-	for i := 0; head == "" && i < from; i++ {
-		head = strings.TrimSpace(lines[i])
-	}
-	if head != "" && (from > 0 || len(lines) == 0 || strings.TrimSpace(lines[from]) != head) {
-		kept = append(kept, CutLine(head))
-	}
-	if from > 0 {
-		kept = append(kept, fmt.Sprintf("... (%d earlier lines)", from))
-	}
-	for _, l := range lines[from:] {
-		kept = append(kept, CutLine(l))
-	}
-	return strings.Join(kept, "\n")
-}
-
-// CutLine cuts a line to LineBytes, on a character boundary.
-func CutLine(l string) string {
-	if len(l) <= LineBytes {
-		return l
-	}
-	return strings.ToValidUTF8(l[:LineBytes], "") + "..."
-}
-
-// ConsoleFailure is the failure of a command that is no test runner (go vet, gofmt, tsc, a build script): its cause is the
-// first line that names an error (tsc's "error TS", go vet's "file.go:12:3: ..."), else the first line that is not a
-// heading ("# <package>", npm's "> script"), and its output the command's lines without passing ones.
-func ConsoleFailure(pkg, test, out string) Failure {
-	var lines []string
-	for _, l := range strings.Split(strings.ReplaceAll(stripANSI(out), "\r\n", "\n"), "\n") {
-		if t := strings.TrimSpace(l); t != "" && !PassingLine(t) {
-			lines = append(lines, strings.TrimRight(l, " \t"))
-		}
-	}
-	cause := ""
-	for _, l := range lines {
-		if t := strings.TrimSpace(l); strings.Contains(t, "error") || strings.Contains(t, "Error") || goPosition.MatchString(t) {
-			cause = t
-			break
-		}
-	}
-	for _, l := range lines {
-		if t := strings.TrimSpace(l); cause == "" && !strings.HasPrefix(t, "# ") && !strings.HasPrefix(t, "> ") && !strings.HasPrefix(t, "npm ") {
-			cause = t
-		}
-	}
-	if cause == "" {
-		cause = test + " failed and wrote nothing that says why"
-	}
-	cause = CutLine(cause)
-	return Failure{Package: pkg, Test: test, Cause: cause, Output: Clip(lines, cause)}
-}

go/buildstep/helpers.go

@@ -1,19 +0,0 @@
-package buildstep
-
-import (
-	"regexp"
-	"strings"
-)
-
-// goPosition matches a line that starts with a Go file's position, as go vet and the compiler write an error.
-var goPosition = regexp.MustCompile(`^\S+\.go:\d+(:\d+)?: `)
-
-var ansiEscape = regexp.MustCompile("\x1b\\[[0-9;]*m")
-
-func stripANSI(s string) string { return ansiEscape.ReplaceAllString(s, "") }
-
-// tapOk says a line is a passing test's "ok N - name", indented or not.
-func tapOk(l string) bool {
-	rest, ok := strings.CutPrefix(strings.TrimSpace(l), "ok ")
-	return ok && rest != "" && rest[0] >= '0' && rest[0] <= '9'
-}

go/buildstep/launchers.go

@@ -1,14 +0,0 @@
-package buildstep
-
-import "git.novox.be/novox/mesh-sdk/go/catalogue"
-
-// LauncherSuffix is what a TypeScript entrypoint's launcher is called beside it: index.js is started as
-// index.serve.mjs (novox/hq ADR 0193), an ES module by its own extension whatever the bundle's package.json says.
-const LauncherSuffix = catalogue.LauncherSuffix
-
-// Launchers are the launchers a bundle's build writes, by entrypoint, relative to the bundle's root
-// (catalogue.Launchers): the one rule mesh-build-node, build-agent, the controller and a node taking in a build share
-// (R4e, issue 1126), so the name a build writes is the name a reader expects.
-func Launchers(language string, entrypoints []string) map[string]string {
-	return catalogue.Launchers(language, entrypoints)
-}

go/buildstep/launchers_test.go

@@ -1,22 +0,0 @@
-package buildstep
-
-import (
-	"reflect"
-	"testing"
-)
-
-// A TypeScript bundle's entrypoint x.js is started as x.serve.mjs beside it (novox/hq ADR 0193), the rule mesh-build-node
-// and build-agent both apply; an entrypoint that is not .js gets none, and another language gets none.
-func TestATypeScriptEntrypointIsStartedByTheLauncherBesideIt(t *testing.T) {
-	got := Launchers("typescript", []string{"index.js", "tools/x.js", "data.json"})
-	want := map[string]string{"index.js": "index.serve.mjs", "tools/x.js": "tools/x.serve.mjs"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("Launchers(typescript) = %v, want %v", got, want)
-	}
-	if got := Launchers("go", []string{"index.js"}); len(got) != 0 {
-		t.Fatalf("a Go bundle got launchers: %v", got)
-	}
-	if got := Launchers("typescript", nil); len(got) != 0 {
-		t.Fatalf("a bundle with no entrypoint got launchers: %v", got)
-	}
-}

go/buildstep/request.go

@@ -1,163 +0,0 @@
-package buildstep
-
-import (
-	"fmt"
-	"maps"
-	"path"
-	"regexp"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-var (
-	requestCommitOK     = regexp.MustCompile(`^[0-9a-f]{40}$`)
-	requestRepositoryOK = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*$`)
-)
-
-// FetchRequest is what a build module's fetch tool is asked: the repository and the full commit, the pull request's
-// ref when only its head carries the commit, the trunk commit to merge onto for a merge preview, and, for a build of a
-// module whose every artifact names its paths, that module's directory and its named paths (novox/hq ADR 0499 clause 4).
-//
-// **The paths come from the builder, not from a manifest** (ADR 0495 clause 1; the lead's decision L8 of R4e): the
-// builder fills Dir and Paths from the indexer's Module value (Path, and KeptInputs2.Paths' keys), and the build module
-// gives the build and test steps a workspace holding those paths, the manifest and its lock files. A request without
-// them builds from the module's directory, as before.
-type FetchRequest struct {
-	Repository string   `json:"repository"`
-	Commit     string   `json:"commit"`
-	Ref        string   `json:"ref,omitempty"`
-	Base       string   `json:"base,omitempty"`
-	Dir        string   `json:"dir,omitempty"`
-	Paths      []string `json:"paths,omitempty"`
-	// Packages are the version of each mesh package the build or the check builds against (delivery.StepAsk.Packages,
-	// novox/hq ADR 0573 §2, §4): the build module writes each into the workspace's go.mod and go.sum, whatever version
-	// the repository names, checksum-verified, and names them in its log.
-	Packages delivery.PackageVersions `json:"packages,omitempty"`
-}
-
-// FetchRequestProperties are the JSON schema properties of FetchRequest's dir and paths, for a fetch tool's Input.
-func FetchRequestProperties() map[string]any {
-	return map[string]any{
-		"dir": map[string]any{"type": "string", "description": "the module's directory in the repository (\".\" for its root), with paths"},
-		"paths": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
-			"description": "the paths the module names, relative to dir, from the indexer's kept inputs: the build sees only these, the manifest and its lock files"},
-		"packages": map[string]any{"type": "object", "additionalProperties": map[string]any{"type": "string"},
-			"description": "optional: the version (a full commit) of each mesh package to build against, by its module path, whatever version go.mod names (novox/hq ADR 0573 §2); the builder and the checker fill it"},
-	}
-}
-
-// Args is r as a tool call's arguments.
-func (r FetchRequest) Args() map[string]any {
-	args := map[string]any{"repository": r.Repository, "commit": r.Commit}
-	for k, v := range map[string]string{"ref": r.Ref, "base": r.Base, "dir": r.Dir} {
-		if v != "" {
-			args[k] = v
-		}
-	}
-	if len(r.Paths) > 0 {
-		args["paths"] = append([]string(nil), r.Paths...)
-	}
-	if len(r.Packages) > 0 {
-		args["packages"] = map[string]any{}
-		for p, v := range r.Packages {
-			args["packages"].(map[string]any)[p] = v
-		}
-	}
-	return args
-}
-
-// ParseFetchRequest reads a fetch tool's arguments; arguments it does not know (a build module's own) are left to the
-// caller. It refuses a repository that is not <owner>/<name>, a commit or a base that is not 40 hex digits, paths with no
-// module directory or a directory with no path, a directory leaving the repository and a path leaving the directory,
-// naming each.
-func ParseFetchRequest(args map[string]any) (FetchRequest, error) {
-	var r FetchRequest
-	r.Repository, _ = args["repository"].(string)
-	r.Commit, _ = args["commit"].(string)
-	r.Ref, _ = args["ref"].(string)
-	r.Base, _ = args["base"].(string)
-	r.Dir, _ = args["dir"].(string)
-	switch v := args["paths"].(type) {
-	case nil:
-	case []string:
-		r.Paths = append([]string(nil), v...)
-	case []any:
-		for _, p := range v {
-			s, ok := p.(string)
-			if !ok {
-				return FetchRequest{}, fmt.Errorf("paths is a list of strings")
-			}
-			r.Paths = append(r.Paths, s)
-		}
-	default:
-		return FetchRequest{}, fmt.Errorf("paths is a list of strings")
-	}
-	packages, err := PackagesArg(args["packages"])
-	if err != nil {
-		return FetchRequest{}, err
-	}
-	r.Packages = packages
-	return r, r.Check()
-}
-
-// PackagesArg reads a tool call's packages argument, an object of strings (as JSON gives it) or the map an ask gives;
-// nil for none.
-func PackagesArg(v any) (delivery.PackageVersions, error) {
-	out := delivery.PackageVersions{}
-	switch v := v.(type) {
-	case nil:
-		return nil, nil
-	case delivery.PackageVersions:
-		maps.Copy(out, v)
-	case map[string]string:
-		maps.Copy(out, v)
-	case map[string]any:
-		for p, version := range v {
-			s, ok := version.(string)
-			if !ok {
-				return nil, fmt.Errorf("packages is an object of versions (strings), by package")
-			}
-			out[p] = s
-		}
-	default:
-		return nil, fmt.Errorf("packages is an object of versions (strings), by package")
-	}
-	if len(out) == 0 {
-		return nil, nil
-	}
-	return out, out.Check()
-}
-
-// Check is what ParseFetchRequest refuses.
-func (r FetchRequest) Check() error {
-	if !requestRepositoryOK.MatchString(r.Repository) || strings.Contains(r.Repository, "..") {
-		return fmt.Errorf("%q is not a repository, <owner>/<name>", r.Repository)
-	}
-	if !requestCommitOK.MatchString(r.Commit) {
-		return fmt.Errorf("%q is not a full commit (40 hex digits)", r.Commit)
-	}
-	if r.Base != "" && !requestCommitOK.MatchString(r.Base) {
-		return fmt.Errorf("%q is not a trunk commit (40 hex digits)", r.Base)
-	}
-	switch {
-	case len(r.Paths) > 0 && r.Dir == "":
-		return fmt.Errorf("the request names paths and names no module directory (dir) they are relative to")
-	case len(r.Paths) == 0 && r.Dir != "":
-		return fmt.Errorf("the request names a module directory and no path")
-	}
-	if r.Dir != "" && (outside(r.Dir) || strings.HasPrefix(r.Dir, "/")) {
-		return fmt.Errorf("the module directory %q leaves the repository", r.Dir)
-	}
-	for _, p := range r.Paths {
-		if p == "" || strings.HasPrefix(p, "/") || outside(p) || path.Clean(p) == "." {
-			return fmt.Errorf("the path %q leaves the module's directory or is not a path in it", p)
-		}
-	}
-	return nil
-}
-
-func outside(p string) bool {
-	c := path.Clean(p)
-	return c == ".." || strings.HasPrefix(c, "../")
-}

go/buildstep/request_test.go

@@ -1,64 +0,0 @@
-package buildstep
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// A build's fetch is handed the paths of a module that names them (novox/hq ADR 0499 clause 4): the builder fills them
-// from the indexer's kept inputs and the build module reads them from the call, never from the manifest (ADR 0495
-// clause 1). The request survives the trip through a tool call's arguments.
-func TestAFetchRequestCarriesTheNamedPathsThroughTheToolCall(t *testing.T) {
-	// And the versions of the mesh packages to build against (novox/hq ADR 0573 §2; issue 1585 S4).
-	req := FetchRequest{Repository: "novox/mesh-sdk", Commit: strings.Repeat("a", 40), Ref: "refs/pull/7/head",
-		Dir: ".", Paths: []string{"package.json", "src"}, Packages: map[string]string{"git.novox.be/novox/mesh-sdk/go": strings.Repeat("d", 40)}}
-	args := req.Args()
-	// A tool call's arguments arrive as JSON: lists of any, objects of any.
-	args["paths"] = []any{"package.json", "src"}
-	if p, ok := args["packages"].(map[string]any); !ok || p["git.novox.be/novox/mesh-sdk/go"] != strings.Repeat("d", 40) {
-		t.Fatalf("the packages are not in the call's arguments: %v", args["packages"])
-	}
-	got, err := ParseFetchRequest(args)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(got, req) {
-		t.Fatalf("got %+v, want %+v", got, req)
-	}
-	plain, err := ParseFetchRequest(map[string]any{"repository": "novox/x", "commit": strings.Repeat("b", 40),
-		"base": strings.Repeat("c", 40), "beside": []any{}})
-	if err != nil || plain.Paths != nil || plain.Base != strings.Repeat("c", 40) {
-		t.Fatalf("a request without paths: %+v, %v", plain, err)
-	}
-
-	ok := map[string]any{"repository": "novox/x", "commit": strings.Repeat("b", 40)}
-	for _, c := range []struct {
-		set  map[string]any
-		says string
-	}{
-		{map[string]any{"repository": "novox"}, "is not a repository"},
-		{map[string]any{"repository": "novox/../x"}, "is not a repository"},
-		{map[string]any{"commit": "abc"}, "is not a full commit"},
-		{map[string]any{"base": "abc"}, "is not a trunk commit"},
-		{map[string]any{"paths": []any{"src"}}, "names no module directory"},
-		{map[string]any{"dir": "modules/a", "paths": []any{"../b"}}, "leaves the module's directory"},
-		{map[string]any{"dir": "../a", "paths": []any{"src"}}, "leaves the repository"},
-		{map[string]any{"dir": "modules/a", "paths": []any{3}}, "paths is a list of strings"},
-		{map[string]any{"dir": "modules/a"}, "names a module directory and no path"},
-		{map[string]any{"packages": map[string]any{"git.novox.be/novox/mesh-sdk/go": "main"}}, "neither a full commit nor a Go semantic version"},
-		{map[string]any{"packages": map[string]any{"a b": strings.Repeat("d", 40)}}, "no module path"},
-		{map[string]any{"packages": []any{"x"}}, "packages is an object"},
-	} {
-		args := map[string]any{}
-		for k, v := range ok {
-			args[k] = v
-		}
-		for k, v := range c.set {
-			args[k] = v
-		}
-		if _, err := ParseFetchRequest(args); err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%v: %v, wanted a refusal saying %q", c.set, err, c.says)
-		}
-	}
-}

go/buildstep/stale.go

@@ -1,330 +0,0 @@
-package buildstep
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// RestartReason is why a step a previous process left running is ended.
-const RestartReason = "the build module restarted while it ran"
-
-// Boot is when this process began. A step with no owner (written by an older build) started at or after it is taken
-// for this process's, which may still run it, so EndOne refuses it.
-var Boot = time.Now()
-
-// Owner is this process as a step's owner (delivery.Step.Owner): `<boot id>.<pid>.<start>`, the node's boot id
-// (/proc/sys/kernel/random/boot_id), the pid and Boot in milliseconds, base 36. The start keeps two processes apart
-// that a reboot or a pid namespace gave the same pid. A running step whose owner is another is a previous process's.
-var Owner = ownerOf(bootID, os.Getpid(), Boot)
-
-// bootID is the node's boot id as Owner holds it; noBootID when it could not be read, which EndStaleAtStart says once.
-var bootID = readBootID()
-
-const noBootID = "no-boot-id"
-
-func ownerOf(bootID string, pid int, start time.Time) string {
-	return bootID + "." + strconv.Itoa(pid) + "." + strconv.FormatInt(start.UnixMilli(), 36)
-}
-
-// readBootID is the node's boot id, or noBootID where it cannot be read (the pid and the start then tell the processes
-// apart).
-func readBootID() string {
-	b, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
-	if id := strings.TrimSpace(string(b)); err == nil && id != "" {
-		return id
-	}
-	return noBootID
-}
-
-// Scan reads and writes a steps state with its revisions: its keys, a key's stored value and revision (nil and 0 for
-// none), a write that lands only while the key is still at the revision read (KeptState.Update), and a delete of a key
-// still at the revision read; both fail with stdio.ErrChanged when another writer was first.
-type Scan struct {
-	Keys   func() ([]string, error)
-	Get    func(key string) (json.RawMessage, uint64, error)
-	Update func(key string, value any, revision uint64) (uint64, error)
-	Delete func(key string, revision uint64) error
-}
-
-// ScanOf is the Scan of a state the process keeps.
-//
-// Its Delete reads the key again and deletes it only while it is still at the revision read: the runtime's
-// mesh/state.delete takes no revision yet, so a write landing between that read and the delete (a few milliseconds) is
-// deleted with it. For a step key that is a redelivered ask begun on this node in that moment: its running key leaves
-// the steps state until its run writes its end, which its asker still reads (a watch takes puts only).
-func ScanOf(s stdio.KeptState) Scan {
-	get := func(key string) (json.RawMessage, uint64, error) {
-		e, err := s.Get(key)
-		if err != nil || e == nil {
-			return nil, 0, err
-		}
-		return e.Value, e.Revision, nil
-	}
-	return Scan{Keys: s.Keys, Update: s.Update, Get: get, Delete: func(key string, revision uint64) error {
-		_, rev, err := get(key)
-		if err != nil {
-			return err
-		}
-		if rev != revision {
-			return stdio.ErrChanged
-		}
-		return s.Delete(key)
-	}}
-}
-
-// isAsk says a step is a pulled ask's: its key is <node>.<ask id> and its tool is "<kind> ask" (a hand-started step
-// has the tool's name). An ask's key is the stream's to settle, never a restart's: the puller leaves an ask it was
-// running unacknowledged so the stream redelivers it, and the asker's wait takes the first end it reads on the key.
-// A key a gone process owns is deleted, never ended (EndStale); one with no owner is ended only once the asker's bound
-// has passed (delivery.StepBound), when it is nobody's.
-func isAsk(key string, s delivery.Step) bool {
-	_, _, err := delivery.ParseAskStepKey(key)
-	return err == nil && strings.HasSuffix(s.Tool, " ask")
-}
-
-// AskWhat says what an ask is, in one line: its kind, and its repository, head and levels, or its module and
-// fingerprint.
-func AskWhat(a delivery.StepAsk) string {
-	short := func(s string) string {
-		if len(s) > 12 {
-			return s[:12]
-		}
-		return s
-	}
-	str := func(m map[string]any, k string) string { v, _ := m[k].(string); return v }
-	parts := []string{a.Kind + " ask"}
-	switch {
-	case a.Check != nil:
-		parts = append(parts, str(a.Check.Fetch, "repository")+"@"+short(str(a.Check.Fetch, "commit")), "levels "+strings.Join(a.Check.Levels, ","))
-		if a.Check.Run != "" {
-			parts = append(parts, "run "+a.Check.Run)
-		}
-	case a.Build != nil:
-		parts = append(parts, "module "+a.Build.Module)
-		if r := str(a.Build.Fetch, "repository"); r != "" {
-			parts = append(parts, r+"@"+short(str(a.Build.Fetch, "commit")))
-		}
-		if a.Build.FP != "" {
-			parts = append(parts, "fp "+short(a.Build.FP))
-		}
-	case a.Compose != nil:
-		parts = append(parts, "compose", str(a.Compose.Fetch, "repository")+"@"+short(str(a.Compose.Fetch, "commit")))
-	}
-	return strings.Join(parts, ", ")
-}
-
-// endRunning writes step ended failed with why, only while its key is still at revision.
-func endRunning(scan Scan, key string, step delivery.Step, revision uint64, why string) error {
-	step.State, step.Reason, step.Ended, step.Result = delivery.StepFailed, why, now().UTC(), nil
-	raw, err := delivery.EncodeStep(step)
-	if err != nil {
-		return err
-	}
-	_, err = scan.Update(key, json.RawMessage(raw), revision)
-	return err
-}
-
-// EndStale ends this node's running steps that no process of this module runs any more, and answers their ids. Only keys
-// of node are read; a value that is no step is left alone.
-//   - A hand-started step with an owner (delivery.Step.Owner) that is not this process (Owner) is ended failed with
-//     RestartReason at once, whatever its age: its process is gone and nothing redelivers it, so nothing else would
-//     write its end (issue 1890, note 21).
-//   - A pulled ask's step with an owner that is not this process is deleted, not ended (novox/hq ADR 0525 §6): the
-//     stream redelivers an ask whose node stopped (the puller neither ends nor acknowledges one at its stop), and its
-//     asker takes the first end it reads, so an end written here would fail a check the redelivery would still run. Its
-//     asker's watch takes puts only and keeps waiting for the redelivery's key, its bound the backstop; the stale running
-//     key leaves the steps state, and with it the delivery view's and the checker's count of what runs (note 21: it
-//     held one of a build node's two slots).
-//   - A step owned by this process is left: it may run now. A redelivered ask begun on this node is owned by it.
-//   - A step with no owner (written by an older build) keeps the earlier rule: a hand-started step started before
-//     `before` (the start of this process) is ended; a pulled ask is left to the stream's redelivery (isAsk) until its
-//     start is older than delivery.StepBound, and then ended "past the step bound: its asker stopped waiting at <time>".
-//
-// Each end and delete is logged, naming the step, its owner and why. A key written by another writer since it was read
-// (a redelivered ask's start, a real end) is skipped.
-func EndStale(scan Scan, node string, before time.Time, logf func(string, ...any)) ([]string, error) {
-	keys, err := scan.Keys()
-	if err != nil {
-		return nil, fmt.Errorf("buildstep: listing the steps of %s: %w", node, err)
-	}
-	var ended []string
-	for _, k := range keys {
-		n, _, perr := delivery.ParseStepKey(k)
-		if perr != nil || n != node {
-			continue
-		}
-		raw, rev, err := scan.Get(k)
-		if err != nil {
-			return ended, fmt.Errorf("buildstep: reading the step %s: %w", k, err)
-		}
-		if len(raw) == 0 {
-			continue
-		}
-		step, err := delivery.DecodeStep(raw)
-		if err != nil || step.State != delivery.StepRunning {
-			continue
-		}
-		why, said := staleWhy(k, step, before)
-		if why == "" {
-			continue
-		}
-		done := "ended"
-		if step.Owner != "" && isAsk(k, step) {
-			done = "deleted, left to the stream's redelivery"
-			if scan.Delete == nil {
-				err = fmt.Errorf("the steps state takes no delete")
-			} else {
-				err = scan.Delete(k, rev)
-			}
-		} else {
-			err = endRunning(scan, k, step, rev, why)
-		}
-		if err != nil {
-			if errors.Is(err, stdio.ErrChanged) {
-				continue
-			}
-			return ended, fmt.Errorf("buildstep: ending the step %s: %w", k, err)
-		}
-		if logf != nil {
-			logf("the step %s (%s, started %s) was left running and is %s: %s; %s", k, step.Tool,
-				step.Started.UTC().Format(time.RFC3339), done, why, said)
-		}
-		ended = append(ended, step.ID)
-	}
-	return ended, nil
-}
-
-// staleWhy is why a running step is ended (or, for an ask with an owner, deleted) by EndStale and what the log says of
-// its owner, or "" to leave it.
-func staleWhy(key string, step delivery.Step, before time.Time) (why, said string) {
-	switch {
-	case step.Owner == Owner:
-		return "", ""
-	case step.Owner != "":
-		return RestartReason, "its owner " + step.Owner + " is not this process " + Owner
-	case isAsk(key, step):
-		if !step.Started.Add(delivery.StepBound).Before(now()) {
-			return "", ""
-		}
-		return "past the step bound: its asker stopped waiting at " + step.Started.Add(delivery.StepBound).UTC().Format("2006-01-02T15:04:05Z"),
-			"it names no owner (an older build wrote it)"
-	case step.Started.Before(before):
-		return RestartReason, "it names no owner (an older build wrote it) and started before this process"
-	}
-	return "", ""
-}
-
-// EndOne ends this node's running step id (or the key <node>.<id>) as failed with why. A step that is not running is
-// refused, and so is one this process owns (Owner; for a step with no owner, one started since Boot: it may still run,
-// whether a pulled ask or a step a tool started), one live reports as held, and one whose key changed since it was read.
-func EndOne(scan Scan, node, id, why string, live func(id string) bool) (delivery.Step, error) {
-	id = strings.TrimSpace(id)
-	if n, rest, ok := strings.Cut(id, "."); ok {
-		if n != node {
-			return delivery.Step{}, fmt.Errorf("the step %q is of node %q, this module runs on %q", id, n, node)
-		}
-		id = rest
-	}
-	if strings.TrimSpace(why) == "" {
-		return delivery.Step{}, fmt.Errorf("say why the step is ended (why)")
-	}
-	key, err := delivery.StepKey(node, id)
-	if err != nil {
-		return delivery.Step{}, err
-	}
-	raw, rev, err := scan.Get(key)
-	if err != nil {
-		return delivery.Step{}, err
-	}
-	if len(raw) == 0 {
-		return delivery.Step{}, fmt.Errorf("no step %s in the steps state", key)
-	}
-	step, err := delivery.DecodeStep(raw)
-	if err != nil {
-		return delivery.Step{}, err
-	}
-	if step.State != delivery.StepRunning {
-		return delivery.Step{}, fmt.Errorf("the step %s is %s, not running", key, step.State)
-	}
-	if step.Owner == Owner || (step.Owner == "" && !step.Started.Before(Boot)) || (live != nil && live(id)) {
-		return delivery.Step{}, fmt.Errorf("the step %s was started by this process and may run now; only a step a previous process left is ended", key)
-	}
-	if err := endRunning(scan, key, step, rev, why); err != nil {
-		if errors.Is(err, stdio.ErrChanged) {
-			return delivery.Step{}, fmt.Errorf("the step %s changed while it was being ended; read it again", key)
-		}
-		return delivery.Step{}, err
-	}
-	step.State, step.Reason = delivery.StepFailed, why
-	return step, nil
-}
-
-// StaleAttempts and StaleRetry bound EndStaleAtStart's tries: the steps state is readable once the runtime serves.
-var (
-	StaleAttempts = 6
-	StaleRetry    = 5 * time.Second
-)
-
-// StaleServed is what EndStaleAtStart waits for before it reads the steps state: the runtime serving (stdio.Served).
-// The conformance kit's left-running case (conformance.LeftRunning) hands it a closed channel, to run a module's own
-// start sweep in its test.
-var StaleServed = stdio.Served
-
-// EndStaleAtStart is what a build module runs once at its start, in a goroutine: it waits for the runtime to serve,
-// then ends this node's steps a previous process left running (EndStale), trying again when the state cannot be read
-// yet. A step names its owner, so `before` (the start of this process) matters only for a step with no owner, written
-// by an older build: such a step started before it is a previous process's. When the node's boot id cannot be read it
-// says so once: Owner then tells processes apart by their pid and start only.
-func EndStaleAtStart(ctx context.Context, scan Scan, node string, before time.Time, logf func(string, ...any)) {
-	select {
-	case <-ctx.Done():
-		return
-	case <-StaleServed():
-	}
-	if bootID == noBootID && logf != nil {
-		logf("the boot id of %s cannot be read (/proc/sys/kernel/random/boot_id): its steps' owner is %s, told apart by pid and start only", node, Owner)
-	}
-	for attempt := 1; ; attempt++ {
-		ended, err := EndStale(scan, node, before, logf)
-		if err == nil {
-			if logf != nil {
-				logf("%d steps of %s left running by a previous process ended", len(ended), node)
-			}
-			return
-		}
-		if logf != nil {
-			logf("ending the steps left running (try %d of %d): %v", attempt, StaleAttempts, err)
-		}
-		if attempt >= StaleAttempts {
-			return
-		}
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(StaleRetry):
-		}
-	}
-}
-
-// EndStaleRound is EndStale as the module's periodic round runs it: at once, and only when the runtime serves (a round
-// before that is skipped, the start's EndStaleAtStart and the next round cover it). It ends the steps a previous
-// process left and the asks past delivery.StepBound.
-func EndStaleRound(scan Scan, node string, logf func(string, ...any)) {
-	select {
-	case <-stdio.Served():
-	default:
-		return
-	}
-	if _, err := EndStale(scan, node, Boot, logf); err != nil && logf != nil {
-		logf("ending the steps left running: %v", err)
-	}
-}

go/buildstep/stale_test.go

@@ -1,162 +0,0 @@
-package buildstep
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// scanOf is the steps a keys double holds, last value per key, its revision the count of its puts; a write through
-// Update lands only at the revision read, as the state's does. race, when set, runs once before the next Update's check.
-func scanOf(k *keys, race func(key string)) Scan {
-	return Scan{
-		Keys: func() ([]string, error) {
-			k.mu.Lock()
-			defer k.mu.Unlock()
-			var out []string
-			for key := range k.puts {
-				out = append(out, key)
-			}
-			return out, nil
-		},
-		Get: func(key string) (json.RawMessage, uint64, error) {
-			k.mu.Lock()
-			defer k.mu.Unlock()
-			s, ok := k.puts[key]
-			if !ok {
-				return nil, 0, nil
-			}
-			raw, err := delivery.EncodeStep(s[len(s)-1])
-			return raw, uint64(len(s)), err
-		},
-		Delete: func(key string, revision uint64) error {
-			k.mu.Lock()
-			defer k.mu.Unlock()
-			if uint64(len(k.puts[key])) != revision {
-				return stdio.ErrChanged
-			}
-			delete(k.puts, key)
-			return nil
-		},
-		Update: func(key string, value any, revision uint64) (uint64, error) {
-			if race != nil {
-				race(key)
-			}
-			k.mu.Lock()
-			n := uint64(len(k.puts[key]))
-			k.mu.Unlock()
-			if n != revision {
-				return 0, stdio.ErrChanged
-			}
-			return k.put(key, value)
-		},
-	}
-}
-
-// 1890 and 1890/AC6: EndStale ends this node's hand-started running steps of another owner at once, whatever their age,
-// and deletes its asks of another owner (the stream redelivers them, ADR 0525 §6); of
-// the steps with no owner (an older build's), the hand-started ones left running before the process began and the asks
-// past the step bound (a younger ask is the stream's to redeliver); never a step this process owns or a key written
-// meanwhile. EndOne ends one by hand, never one this process owns or started.
-func TestEndStaleAndEndOne(t *testing.T) {
-	k := newKeys()
-	boot := time.Now()
-	oldBoot := Boot
-	Boot = boot
-	defer func() { Boot = oldBoot }()
-	gone := ownerOf("b00t", 4242, boot.Add(-time.Hour))
-	put := func(node, id, tool, state string, started time.Time, owner string) {
-		key, _ := delivery.StepKey(node, id)
-		_, _ = k.put(key, json.RawMessage(mustStep(t, delivery.Step{ID: id, Tool: tool, Node: node, State: state, Started: started, Owner: owner})))
-	}
-	put("ace", "old1", "build_go_fetch", delivery.StepRunning, boot.Add(-time.Hour), "")
-	put("ace", "mjk3l9x0abcdef", "check ask", delivery.StepRunning, boot.Add(-time.Hour), "")
-	put("ace", "mjk3l9x0abcdee", "check ask", delivery.StepRunning, time.Now().Add(-5*time.Minute), "")
-	put("ace", "mjk3l9x0abcded", "check ask", delivery.StepRunning, time.Now().Add(-5*time.Minute), gone) // note 21's ghost
-	put("ace", "gone2", "build_go_test", delivery.StepRunning, boot.Add(time.Second), gone)
-	put("ace", "mine1", "check ask", delivery.StepRunning, boot.Add(-time.Hour), Owner)
-	put("ace", "raced1", "build_go_test", delivery.StepRunning, boot.Add(-time.Hour), "")
-	put("ace", "new1", "build_go_fetch", delivery.StepRunning, boot.Add(time.Second), "")
-	put("ace", "done1", "build_go_fetch", delivery.StepPassed, boot.Add(-time.Hour), gone)
-	put("g14", "other1", "build_go_fetch", delivery.StepRunning, boot.Add(-time.Hour), gone)
-	// raced1 is ended by its own run between the read and the write.
-	raced := false
-	scan := scanOf(k, func(key string) {
-		if key == "ace.raced1" && !raced {
-			raced = true
-			put("ace", "raced1", "build_go_test", delivery.StepPassed, boot.Add(-time.Hour), "")
-		}
-	})
-	var said []string
-	ended, err := EndStale(scan, "ace", boot, func(f string, a ...any) { said = append(said, fmt.Sprintf(f, a...)) })
-	if err != nil || len(ended) != 4 {
-		t.Fatalf("ended %v, %v", ended, err)
-	}
-	if _, held := k.puts["ace.mjk3l9x0abcded"]; held {
-		t.Errorf("the ghost ask's key is still held: %+v", k.last("ace.mjk3l9x0abcded"))
-	}
-	for _, key := range []string{"ace.old1", "ace.gone2"} {
-		if s := k.last(key); s.State != delivery.StepFailed || s.Reason != RestartReason || s.Ended.IsZero() {
-			t.Errorf("%s = %+v", key, s)
-		}
-	}
-	if s := k.last("ace.mjk3l9x0abcdef"); s.State != delivery.StepFailed || !strings.HasPrefix(s.Reason, "past the step bound: its asker stopped waiting at ") {
-		t.Errorf("the old ask = %+v", s)
-	}
-	if log := strings.Join(said, "\n"); !strings.Contains(log, "ace.mjk3l9x0abcded") || !strings.Contains(log, "deleted, left to the stream's redelivery") || !strings.Contains(log, "its owner "+gone+" is not this process "+Owner) {
-		t.Errorf("the log does not name the ghost and its owner:\n%s", log)
-	}
-	for key, state := range map[string]string{"ace.mjk3l9x0abcdee": delivery.StepRunning, "ace.mine1": delivery.StepRunning, "ace.raced1": delivery.StepPassed,
-		"ace.new1": delivery.StepRunning, "ace.done1": delivery.StepPassed, "g14.other1": delivery.StepRunning} {
-		if s := k.last(key); s.State != state {
-			t.Errorf("%s = %s, want %s", key, s.State, state)
-		}
-	}
-	// EndOne: refuses without why, a held step, one this process owns or (with no owner) started, a step not running and
-	// another node's; ends a step a previous process left.
-	for _, c := range []struct{ id, why string }{{"old1", ""}, {"new1", "stuck"}, {"mine1", "stuck"}, {"done1", "x"}, {"g14.other1", "x"}} {
-		if _, err := EndOne(scan, "ace", c.id, c.why, nil); err == nil {
-			t.Errorf("ended %s with why %q", c.id, c.why)
-		}
-	}
-	put("ace", "old2", "build_go_fetch", delivery.StepRunning, boot.Add(time.Second), gone)
-	if _, err := EndOne(scan, "ace", "old2", "x", func(string) bool { return true }); err == nil {
-		t.Error("ended a held step")
-	}
-	if _, err := EndOne(scan, "ace", "ace.old2", "stuck for good", nil); err != nil {
-		t.Fatal(err)
-	}
-	if s := k.last("ace.old2"); s.State != delivery.StepFailed || s.Reason != "stuck for good" || s.Owner != gone {
-		t.Errorf("old2 = %+v", s)
-	}
-	if a, b := ownerOf("b", 1, boot), ownerOf("b", 1, boot.Add(time.Second)); a == b {
-		t.Errorf("two starts of one pid share the owner %q", a)
-	}
-}
-
-func mustStep(t *testing.T, s delivery.Step) []byte {
-	t.Helper()
-	raw, err := delivery.EncodeStep(s)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return raw
-}
-
-// 1890: AskWhat names the repository, head and levels of a check ask and the module of a build ask.
-func TestAskWhat(t *testing.T) {
-	check := delivery.StepAsk{Kind: "check", Check: &delivery.CheckJob{Fetch: map[string]any{"repository": "novox/mesh-sdk", "commit": "0123456789abcdef0123"}, Levels: []string{"unit", "integration"}}}
-	if got, want := AskWhat(check), "check ask, novox/mesh-sdk@0123456789ab, levels unit,integration"; got != want {
-		t.Errorf("check = %q", got)
-	}
-	build := delivery.StepAsk{Kind: "delivery", Build: &delivery.BuildJob{Module: "mesh-x", FP: "abcdef0123456789"}}
-	if got, want := AskWhat(build), "delivery ask, module mesh-x, fp abcdef012345"; got != want {
-		t.Errorf("build = %q", got)
-	}
-}

go/buildstep/step.go

@@ -1,22 +0,0 @@
-// Package buildstep is what both build modules share: the runner of a long step that answers a tool call at once
-// and ends on its key in the module's `steps` state (novox/hq ADR 0469 §2; issue 1471), the toolchain guard
-// (issue 1473), the fetch of one commit over SSH (issue 1474), and the failure contract of a test level with the parsers
-// of go test -json and node --test's TAP that fill it (failure.go, issue 1901; its conformance kit is package conformance).
-package buildstep
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"strconv"
-	"time"
-)
-
-var now = time.Now
-
-// NewID is a step id: the time in milliseconds in base 36 and six random hex digits, lower-case letters and
-// digits only, so it is one key token and differs between two steps of one node even in one millisecond.
-func NewID() string {
-	var b [3]byte
-	_, _ = rand.Read(b[:])
-	return strconv.FormatInt(now().UnixMilli(), 36) + hex.EncodeToString(b[:])
-}

go/buildstep/step_test.go

@@ -1,72 +0,0 @@
-package buildstep
-
-import (
-	"encoding/json"
-	"sync"
-	"testing"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// keys is a steps state in memory: every value put, in order, per key, and a signal for each end.
-type keys struct {
-	mu    sync.Mutex
-	puts  map[string][]delivery.Step
-	ended chan string
-}
-
-func newKeys() *keys { return &keys{puts: map[string][]delivery.Step{}, ended: make(chan string, 16)} }
-
-func (k *keys) put(key string, value any) (uint64, error) {
-	step, err := delivery.DecodeStep(value.(json.RawMessage))
-	if err != nil {
-		return 0, err
-	}
-	k.mu.Lock()
-	k.puts[key] = append(k.puts[key], step)
-	n := uint64(len(k.puts[key]))
-	k.mu.Unlock()
-	if step.State != delivery.StepRunning {
-		k.ended <- key
-	}
-	return n, nil
-}
-
-func (k *keys) last(key string) delivery.Step {
-	k.mu.Lock()
-	defer k.mu.Unlock()
-	s := k.puts[key]
-	return s[len(s)-1]
-}
-
-func (k *keys) waitEnd(t *testing.T) string {
-	t.Helper()
-	select {
-	case key := <-k.ended:
-		return key
-	case <-time.After(3 * time.Second):
-		t.Fatal("the step never ended on its key")
-		return ""
-	}
-}
-
-// 1471/AC5: ids made in one and the same millisecond differ, and each is one key token. The clock is fixed
-// while no step runs, so no goroutine reads it meanwhile.
-func TestTwoIDsInOneMillisecondDiffer(t *testing.T) {
-	was := now
-	defer func() { now = was }()
-	at := time.Date(2026, 10, 20, 12, 0, 0, 0, time.UTC)
-	now = func() time.Time { return at }
-	seen := map[string]bool{}
-	for i := 0; i < 50; i++ {
-		id := NewID()
-		if seen[id] {
-			t.Fatalf("id %q handed out twice", id)
-		}
-		seen[id] = true
-		if _, err := delivery.StepKey("ace", id); err != nil {
-			t.Errorf("id %q: %v", id, err)
-		}
-	}
-}

go/buildstep/trees.go

@@ -1,15 +0,0 @@
-package buildstep
-
-// ModuleTree is what a merge holds of one module directory, as a build module's preview answers it (novox/hq ADR 0484
-// clause 3, as ADR 0593 §2 changes it): its git tree id, the sha256 of its module.json, the sha256 of each lock file it
-// has (go.sum, package-lock.json), and, of a module whose every artifact names its paths, each named path's git object
-// id at the commit. The indexer alone computes from them (the named tree, the fingerprint); the build module's runner
-// (mesh-build-go's buildstep.ModuleTrees) fills them.
-type ModuleTree struct {
-	Tree     string            `json:"tree"`
-	Manifest string            `json:"manifest"`
-	Locks    map[string]string `json:"locks,omitempty"`
-	Paths    map[string]string `json:"paths,omitempty"`
-	// Packages are no longer filled (ADR 0593 §2): kept so a preview written before still decodes.
-	Packages []string `json:"packages,omitempty"`
-}

go/buscalls/answer.go

@@ -1,50 +0,0 @@
-package buscalls
-
-import "encoding/json"
-
-// Unwrap reads a tool's answer whatever wraps it on its way from the tool runner (the lead's ruling 2026-11-04 13:12:
-// one reading, not a copy per module): a JSON string holding the answer; the protocol's content list, whose first
-// text is the answer and whose isError says it failed; the {output, ok, answer} form; the tool runner's {result,
-// error} envelope, whose error is the call's. It answers the answer itself, the words said with it (the output, the
-// error, or the answer's own text), and whether the tool says it succeeded. A bare answer is itself, succeeded.
-func Unwrap(raw json.RawMessage) (answer json.RawMessage, said string, ok bool) {
-	var s string
-	if json.Unmarshal(raw, &s) == nil {
-		return Unwrap(json.RawMessage(s))
-	}
-	var m map[string]json.RawMessage
-	if json.Unmarshal(raw, &m) != nil {
-		return raw, string(raw), true
-	}
-	if content, has := m["content"]; has {
-		var items []struct {
-			Text string `json:"text"`
-		}
-		var e struct {
-			IsError bool `json:"isError"`
-		}
-		_ = json.Unmarshal(raw, &e)
-		if json.Unmarshal(content, &items) == nil && len(items) > 0 {
-			inner, out, ok := Unwrap(json.RawMessage(items[0].Text))
-			return inner, out, ok && !e.IsError
-		}
-	}
-	var v struct {
-		Output string          `json:"output"`
-		OK     *bool           `json:"ok"`
-		Answer json.RawMessage `json:"answer"`
-		Result json.RawMessage `json:"result"`
-		Error  string          `json:"error"`
-	}
-	if json.Unmarshal(raw, &v) == nil {
-		switch {
-		case v.OK != nil:
-			return v.Answer, v.Output, *v.OK
-		case v.Error != "":
-			return nil, v.Error, false
-		case len(v.Result) > 0:
-			return Unwrap(v.Result)
-		}
-	}
-	return raw, string(raw), true
-}

go/buscalls/buscalls.go

@@ -1,382 +0,0 @@
-// Package buscalls is the contract of the calls a bundle makes on its own bus state through the tool runner, over the
-// bundle's pipe (novox/hq ADR 0595 §9, ADR 0597 §10, design 25 § 12.5): the object store's, a stream's read-back and
-// fill, a work queue's size and dead letters, and the ledger's. Each call names an entry by the local name its module
-// asks for it by in `requires`; the tool runner serves it from the module's membership's bindings, its own entries
-// only. Only the shapes and the method names are here: what the tool runner refuses, and why, is its own.
-//
-// It is a package of its own, imported only by the modules that use these calls and by the tool runner, so a change
-// here rebuilds those and not the module library's importers (ADR 0595 §9). It imports nothing of mesh-sdk.
-package buscalls
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"time"
-)
-
-// MetaCall is where in a `tools/call`'s `_meta` the tool runner hands a bundle the id of the tool call in flight: the id
-// ApplyRequest.Call names, so the runner stamps the caller it proved for that call as the operation's author (novox/hq
-// ADR 0597 §7). The runner writes `_meta`; a caller writes only `arguments`, so no caller can name another call.
-const MetaCall = "mesh/call"
-
-// The methods a bundle asks the tool runner, one per call.
-const (
-	ObjectsPut    = "mesh/objects.put"
-	ObjectsGet    = "mesh/objects.get"
-	ObjectsList   = "mesh/objects.list"
-	ObjectsDelete = "mesh/objects.delete"
-	ObjectsInfo   = "mesh/objects.info"
-	ObjectsWatch  = "mesh/objects.watch"
-
-	StreamRead = "mesh/stream.read"
-	StreamFill = "mesh/stream.fill"
-
-	WorkQueueSize = "mesh/workqueue.size"
-	WorkQueueDead = "mesh/workqueue.dead"
-
-	LedgerApply   = "mesh/ledger.apply"
-	LedgerGet     = "mesh/ledger.get"
-	LedgerHistory = "mesh/ledger.history"
-	LedgerWatch   = "mesh/ledger.watch"
-	LedgerQuery   = "mesh/ledger.query"
-	// The ledger's repairs, which the tool runner also serves as tools of every module owning a ledger, its own
-	// ledgers only (design 25 § 12.5).
-	LedgerRebuild  = "mesh/ledger.rebuild"
-	LedgerReindex  = "mesh/ledger.reindex"
-	LedgerSnapshot = "mesh/ledger.snapshot"
-	LedgerLag      = "mesh/ledger.lag"
-)
-
-// The methods the tool runner sends the bundle for a watch it asked, each naming the watch by its id, as `mesh/log`
-// does for a log.
-const (
-	ObjectsWatched = "mesh/objects"
-	LedgerWatched  = "mesh/ledger"
-)
-
-// Fill is how much an entry holds against its cap: its messages (or objects), its bytes and its cap in bytes.
-type Fill struct {
-	Count    uint64 `json:"count"`
-	Bytes    uint64 `json:"bytes"`
-	MaxBytes uint64 `json:"max_bytes"`
-}
-
-// Done is the answer of a call that answers nothing but that it was done.
-type Done struct{}
-
-// --- the object store
-
-// ObjectsPutRequest stores one object whole under its name, replacing one of that name.
-type ObjectsPutRequest struct {
-	Objects     string `json:"objects"`
-	Name        string `json:"name"`
-	Data        []byte `json:"data"`
-	Description string `json:"description,omitempty"`
-}
-
-// ObjectsNameRequest names one object of an object store: get, delete.
-type ObjectsNameRequest struct {
-	Objects string `json:"objects"`
-	Name    string `json:"name"`
-}
-
-// ObjectsRequest names an object store: list, info.
-type ObjectsRequest struct {
-	Objects string `json:"objects"`
-}
-
-// ObjectsWatchRequest asks the tool runner to send every object stored or deleted, as ObjectsChange under the watch's id.
-type ObjectsWatchRequest struct {
-	Objects string `json:"objects"`
-	Watch   string `json:"watch"`
-}
-
-// ObjectInfo is one object as its store holds it: put's answer, and each of list's.
-type ObjectInfo struct {
-	Name        string    `json:"name"`
-	Size        uint64    `json:"size"`
-	Chunks      uint32    `json:"chunks"`
-	Digest      string    `json:"digest"`
-	Description string    `json:"description,omitempty"`
-	Modified    time.Time `json:"modified"`
-	Deleted     bool      `json:"deleted,omitempty"`
-}
-
-// ObjectData is get's answer: the object's info and its bytes.
-type ObjectData struct {
-	Info ObjectInfo `json:"info"`
-	Data []byte     `json:"data"`
-}
-
-// ObjectsListed is list's answer: every object the store holds.
-type ObjectsListed struct {
-	Objects []ObjectInfo `json:"objects"`
-}
-
-// ObjectsChange is one object stored or deleted, sent under ObjectsWatched; Current says it was there when the watch
-// began.
-type ObjectsChange struct {
-	Watch   string     `json:"watch"`
-	Object  ObjectInfo `json:"object"`
-	Current bool       `json:"current"`
-}
-
-// --- a stream
-
-// StreamReadRequest reads a module's own stream from a sequence on, at most Limit messages, Subjects narrowing it.
-type StreamReadRequest struct {
-	Stream   string `json:"stream"`
-	From     uint64 `json:"from"`
-	Subjects string `json:"subjects,omitempty"`
-	Limit    int    `json:"limit,omitempty"`
-}
-
-// StreamRequest names a stream: fill.
-type StreamRequest struct {
-	Stream string `json:"stream"`
-}
-
-// StreamMessage is one message of a stream.
-type StreamMessage struct {
-	Sequence uint64          `json:"sequence"`
-	Subject  string          `json:"subject"`
-	Body     json.RawMessage `json:"body"`
-	At       time.Time       `json:"at"`
-}
-
-// StreamPage is read's answer: the messages in order, the sequence to read on from (0 when nothing follows) and the
-// stream's last sequence when it was read.
-type StreamPage struct {
-	Messages []StreamMessage `json:"messages"`
-	Next     uint64          `json:"next"`
-	Last     uint64          `json:"last"`
-}
-
-// StreamFilled is fill's answer: the stream's fill and its first and last sequence.
-type StreamFilled struct {
-	Fill
-	First uint64 `json:"first"`
-	Last  uint64 `json:"last"`
-}
-
-// --- a work queue
-
-// WorkQueueRequest names a work queue: size.
-type WorkQueueRequest struct {
-	Queue string `json:"queue"`
-}
-
-// WorkQueueDeadRequest asks a work queue's dead letters, at most Limit of them.
-type WorkQueueDeadRequest struct {
-	Queue string `json:"queue"`
-	Limit int    `json:"limit,omitempty"`
-}
-
-// WorkQueueSized is size's answer: the messages waiting to be taken, against the queue's cap.
-type WorkQueueSized struct {
-	Fill
-}
-
-// DeadLetter is one message delivered as often as its queue allows and never settled.
-type DeadLetter struct {
-	Sequence   uint64          `json:"sequence"`
-	Subject    string          `json:"subject"`
-	Deliveries int             `json:"deliveries"`
-	Body       json.RawMessage `json:"body,omitempty"`
-	At         time.Time       `json:"at"`
-}
-
-// WorkQueueDeadLetters is dead's answer.
-type WorkQueueDeadLetters struct {
-	Dead []DeadLetter `json:"dead"`
-}
-
-// --- the ledger (ADR 0597)
-
-// ApplyRequest applies one operation to one instance of a ledger. Call is the id of the tool call the operation
-// serves, as the tool runner handed it under MetaCall, whose caller the tool runner proved and stamps as the author
-// (ADR 0597 §7); empty, the operation carries the owning module's account alone. An author the bundle writes into Body
-// is never taken as the author.
-type ApplyRequest struct {
-	Ledger    string          `json:"ledger"`
-	Instance  string          `json:"instance"`
-	Operation string          `json:"operation"`
-	Body      json.RawMessage `json:"body,omitempty"`
-	Call      string          `json:"call,omitempty"`
-}
-
-// Applied is apply's answer: the operation was taken, with its sequence in the instance's history; StateBehind says
-// the state could not follow because its bucket is full, and catches up at the next apply after room is made (ADR
-// 0597 §6).
-type Applied struct {
-	Taken       bool   `json:"taken"`
-	Sequence    uint64 `json:"sequence"`
-	StateBehind bool   `json:"state_behind,omitempty"`
-}
-
-// Author is who an operation is by, as `apply` stamped it (ADR 0597 §7): the owning module's account, and the caller
-// of the tool call it served, as the tool runner proved it.
-type Author struct {
-	Account string `json:"account"`
-	Caller  string `json:"caller,omitempty"`
-}
-
-// InstanceRequest names one instance of a ledger: get, snapshot.
-type InstanceRequest struct {
-	Ledger   string `json:"ledger"`
-	Instance string `json:"instance"`
-}
-
-// InstanceState is get's answer: the instance's state and the sequence of the last operation it holds.
-type InstanceState struct {
-	Instance string          `json:"instance"`
-	State    json.RawMessage `json:"state"`
-	Sequence uint64          `json:"sequence"`
-}
-
-// HistoryRequest reads an instance's operations from a sequence on, at most Limit of them.
-type HistoryRequest struct {
-	Ledger   string `json:"ledger"`
-	Instance string `json:"instance"`
-	From     uint64 `json:"from,omitempty"`
-	Limit    int    `json:"limit,omitempty"`
-}
-
-// Operation is one operation as the history keeps it.
-type Operation struct {
-	Sequence  uint64          `json:"sequence"`
-	Instance  string          `json:"instance"`
-	Operation string          `json:"operation"`
-	Body      json.RawMessage `json:"body,omitempty"`
-	Author    Author          `json:"author"`
-	At        time.Time       `json:"at"`
-}
-
-// HistoryPage is history's answer: the operations oldest first, the sequence to read on from (0 when nothing
-// follows) and the instance's last sequence when it was read.
-type HistoryPage struct {
-	Operations []Operation `json:"operations"`
-	Next       uint64      `json:"next"`
-	Last       uint64      `json:"last"`
-}
-
-// LedgerWatchRequest asks the tool runner to send every change of the instances Instances names (an instance, with
-// `*` for one name and `>` for the rest) as InstanceChange under the watch's id: the current states first.
-type LedgerWatchRequest struct {
-	Ledger    string `json:"ledger"`
-	Instances string `json:"instances"`
-	Watch     string `json:"watch"`
-}
-
-// InstanceChange is one instance's new state, sent under LedgerWatched; Current says it was the state when the watch
-// began.
-type InstanceChange struct {
-	Watch    string          `json:"watch"`
-	Instance string          `json:"instance"`
-	State    json.RawMessage `json:"state"`
-	Sequence uint64          `json:"sequence"`
-	Current  bool            `json:"current"`
-}
-
-// QueryRequest reads a declared index of a ledger: the entries whose key Key names (a key, with `*` for one name and
-// `>` for the rest; empty is every key), at most Limit of them.
-type QueryRequest struct {
-	Ledger string `json:"ledger"`
-	Index  string `json:"index"`
-	Key    string `json:"key,omitempty"`
-	Limit  int    `json:"limit,omitempty"`
-}
-
-// IndexEntry is the value of one key of a declared index (IndexKey): the instance it points at, and the sequence of
-// the operation it was written from. The owner's watcher and the tool runner's reindex both write it so.
-type IndexEntry struct {
-	Instance string `json:"instance"`
-	Sequence uint64 `json:"sequence"`
-}
-
-// IndexKey is the key of an instance in a declared index: the values of the index's fields, in its order, then the
-// parts of the instance's path, all joined by ".". Each value and each path part is encoded (keyToken): every byte
-// outside [A-Za-z0-9_-] is written "=" and two upper-case hex digits ("." is "=2E", " " is "=20", "=" is "=3D"), so two
-// different keys never meet and every part is a token the bus takes. `17950.listing.a17` is the key of price 17950
-// and instance `listing/a17`. The owner's watcher and the tool runner's reindex both write it, so a reindex leaves the
-// index as the watcher keeps it.
-func IndexKey(fields []string, instance string) string {
-	parts := make([]string, 0, len(fields)+2)
-	for _, f := range fields {
-		parts = append(parts, keyToken(f))
-	}
-	for _, p := range strings.Split(instance, "/") {
-		parts = append(parts, keyToken(p))
-	}
-	return strings.Join(parts, ".")
-}
-
-// keyToken is v with every byte outside [A-Za-z0-9_-] written "=" and two upper-case hex digits (IndexKey).
-func keyToken(v string) string {
-	var b strings.Builder
-	for i := 0; i < len(v); i++ {
-		c := v[i]
-		if c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '_' || c == '-' {
-			b.WriteByte(c)
-			continue
-		}
-		fmt.Fprintf(&b, "=%02X", c)
-	}
-	return b.String()
-}
-
-// QueryAnswer is query's answer.
-type QueryAnswer struct {
-	Entries []IndexEntry `json:"entries"`
-}
-
-// RebuildFrom is what a rebuild derives the state from: the history, or the snapshot and the operations after it.
-const (
-	RebuildFromHistory  = "history"
-	RebuildFromSnapshot = "snapshot"
-)
-
-// RebuildRequest derives an instance's state again (every instance's when Instance is empty), From the history or the
-// snapshot.
-type RebuildRequest struct {
-	Ledger   string `json:"ledger"`
-	Instance string `json:"instance,omitempty"`
-	From     string `json:"from,omitempty"`
-}
-
-// ReindexRequest builds a declared index again from the history.
-type ReindexRequest struct {
-	Ledger string `json:"ledger"`
-	Index  string `json:"index"`
-}
-
-// LedgerRequest names a ledger: lag.
-type LedgerRequest struct {
-	Ledger string `json:"ledger"`
-}
-
-// Repaired is the answer of rebuild, reindex and snapshot: how many instances (or index entries) it wrote.
-type Repaired struct {
-	Written int `json:"written"`
-}
-
-// InstanceLag is one instance whose state or snapshot is behind its history: the sequences each holds.
-type InstanceLag struct {
-	Instance string `json:"instance"`
-	History  uint64 `json:"history"`
-	State    uint64 `json:"state"`
-	Snapshot uint64 `json:"snapshot"`
-}
-
-// IndexLag is how far one declared index is behind the history.
-type IndexLag struct {
-	Index  string `json:"index"`
-	Behind uint64 `json:"behind"`
-}
-
-// Lagged is lag's answer: every instance and index behind its history; none when nothing is behind.
-type Lagged struct {
-	Instances []InstanceLag `json:"instances,omitempty"`
-	Indexes   []IndexLag    `json:"indexes,omitempty"`
-}

go/buscompose/accounts.go

@@ -1,177 +0,0 @@
-package buscompose
-
-import (
-	"encoding/json"
-	"fmt"
-	"slices"
-	"strings"
-	"time"
-)
-
-// AccountsState is the grants part's state of wanted accounts, by bus user.
-const AccountsState = "accounts"
-
-// GrantsAccounts is that state as a reader names it (`<owner>.<name>`).
-const GrantsAccounts = GrantsModule + "." + AccountsState
-
-// AccountIssuedEvent is what the vault says when it minted an account: AccountIssued, never a value or a hash.
-const AccountIssuedEvent = "account-issued"
-
-// AccountIssuedSubject is where it says it, as the runtime addresses mesh-vault's events.
-const AccountIssuedSubject = "mesh.mod." + VaultSeat + ".event." + AccountIssuedEvent
-
-// ClaimedSeat is one seat a module claims, as its runtime needs it (the controller's seatClaimed): the name, the scope (a
-// node-scoped seat's verb carries the machine) and the verbs the runtime serves for it.
-type ClaimedSeat struct {
-	Seat   string   `json:"seat"`
-	Scope  string   `json:"scope"`
-	Serves []string `json:"serves,omitempty"`
-}
-
-// WantedAccount is one key of the grants part's state `accounts`: an account the mesh needs, without its password.
-type WantedAccount struct {
-	User string `json:"user"`
-	// Kind is KindModule (KindNodeTools for the runtime, named as a module is), KindProcess, KindProvisioner or
-	// KindLedger.
-	Kind   Kind   `json:"kind"`
-	Node   string `json:"node"`
-	Module string `json:"module"`
-	// Process is a KindProcess account's process id.
-	Process string `json:"process,omitempty"`
-	// URL is the bus's address as that node reaches it, `nats://<host>:<port>`; Fingerprint the bus certificate's.
-	URL         string `json:"url"`
-	Fingerprint string `json:"fingerprint,omitempty"`
-	// Claims are a module's claims with the verbs each seat promises: none for a process or a provisioner client.
-	Claims []ClaimedSeat `json:"claims,omitempty"`
-	// At is when the grants part wrote the key: not compared (Same).
-	At time.Time `json:"at"`
-}
-
-// LedgersSecret is the tool runner's own secret holding its machine's ledger accounts, a map of module to credential
-// (ADR 0597 §9).
-const LedgersSecret = "ledgers"
-
-// mintedKinds are the kinds of account the vault mints (ADR 0561 §1).
-var mintedKinds = []Kind{KindModule, KindNodeTools, KindProcess, KindProvisioner, KindLedger}
-
-// principal is the account as the composer names it.
-func (w WantedAccount) principal() Principal {
-	return Principal{Kind: w.Kind, Node: w.Node, Module: w.Module, Process: w.Process}
-}
-
-// Valid says why w is not an account the vault may mint, or nil: a kind it mints, every name a subject token, the user
-// the one the composer derives from them, and an address to reach the bus at.
-func (w WantedAccount) Valid() error {
-	if !slices.Contains(mintedKinds, w.Kind) {
-		return fmt.Errorf("%s is a %s account, which the vault never mints (ADR 0561 §4)", w.User, w.Kind)
-	}
-	for what, v := range map[string]string{"node": w.Node, "module": w.Module} {
-		if !safeSubject.MatchString(v) {
-			return fmt.Errorf("%s: the %s %q is not a name the mesh writes", w.User, what, v)
-		}
-	}
-	if w.Kind == KindProcess && !safeSubject.MatchString(w.Process) {
-		return fmt.Errorf("%s: the process %q is not a name the mesh writes", w.User, w.Process)
-	}
-	if w.Kind != KindProcess && w.Process != "" {
-		return fmt.Errorf("%s: only a process's account names a process", w.User)
-	}
-	if want := w.principal().Username(); w.User != want {
-		return fmt.Errorf("%s is not the user of a %s account of %s on %s (that is %s)", w.User, w.Kind, w.Module, w.Node, want)
-	}
-	if !strings.HasPrefix(w.URL, "nats://") || len(w.URL) == len("nats://") {
-		return fmt.Errorf("%s names no bus address (url, nats://<host>:<port>)", w.User)
-	}
-	if len(w.Claims) > 0 && w.Kind != KindModule && w.Kind != KindNodeTools {
-		return fmt.Errorf("%s: a %s account holds no seat, so it carries no claims", w.User, w.Kind)
-	}
-	return nil
-}
-
-// Same says whether two wanted accounts want the same account: every field but when it was written.
-func (w WantedAccount) Same(o WantedAccount) bool {
-	a, b := w, o
-	a.At, b.At = time.Time{}, time.Time{}
-	ra, _ := json.Marshal(a)
-	rb, _ := json.Marshal(b)
-	return string(ra) == string(rb)
-}
-
-// OwnSecret is the module's own secret the account is held in: `broker`, `broker-<process id>` or `provisioner-broker`
-// (the controller's names, ADR 0436 §2, ADR 0349 §11); a ledger account in the tool runner's `ledgers`, which keeps every
-// ledger account of its machine, by module (ADR 0597 §9).
-func (w WantedAccount) OwnSecret() string {
-	switch w.Kind {
-	case KindLedger:
-		return LedgersSecret
-	case KindProcess:
-		return "broker-" + w.Process
-	case KindProvisioner:
-		return "provisioner-broker"
-	}
-	return "broker"
-}
-
-// ReadWantedAccount reads the key user of the state: refused when it is not a valid wanted account of that user.
-func ReadWantedAccount(user string, raw []byte) (WantedAccount, error) {
-	var w WantedAccount
-	if err := json.Unmarshal(raw, &w); err != nil {
-		return WantedAccount{}, fmt.Errorf("%s %s is not a wanted account: %w", GrantsAccounts, user, err)
-	}
-	if w.User != user {
-		return WantedAccount{}, fmt.Errorf("%s %s names the user %q", GrantsAccounts, user, w.User)
-	}
-	return w, w.Valid()
-}
-
-// AccountIssued is the vault's account-issued: which account it minted, and its generation. Never a value or a hash.
-type AccountIssued struct {
-	User       string    `json:"user"`
-	Kind       Kind      `json:"kind"`
-	Node       string    `json:"node"`
-	Module     string    `json:"module"`
-	Process    string    `json:"process,omitempty"`
-	Generation int       `json:"generation"`
-	At         time.Time `json:"at"`
-}
-
-// HeldCredential is the value the account's holder reads, exactly as the controller builds it today (issueWith,
-// sealProcess and sealProvisionerClient): a module's `{url, fingerprint, node, module, user, password, claims}`, a
-// process's without claims, a provisioner client's without module or claims; an empty fingerprint or claims left out.
-func HeldCredential(w WantedAccount, password string) ([]byte, error) {
-	if err := w.Valid(); err != nil {
-		return nil, err
-	}
-	if password == "" {
-		return nil, fmt.Errorf("%s: an account is held with its password", w.User)
-	}
-	switch w.Kind {
-	case KindProcess:
-		return json.Marshal(struct {
-			URL         string `json:"url"`
-			Fingerprint string `json:"fingerprint,omitempty"`
-			Node        string `json:"node"`
-			Module      string `json:"module"`
-			User        string `json:"user"`
-			Password    string `json:"password"`
-		}{URL: w.URL, Fingerprint: w.Fingerprint, Node: w.Node, Module: w.Module, User: w.User, Password: password})
-	case KindProvisioner:
-		return json.Marshal(struct {
-			URL         string `json:"url"`
-			Fingerprint string `json:"fingerprint,omitempty"`
-			Node        string `json:"node"`
-			User        string `json:"user"`
-			Password    string `json:"password"`
-		}{URL: w.URL, Fingerprint: w.Fingerprint, Node: w.Node, User: w.User, Password: password})
-	}
-	return json.Marshal(struct {
-		URL         string        `json:"url"`
-		Fingerprint string        `json:"fingerprint,omitempty"`
-		Node        string        `json:"node"`
-		Module      string        `json:"module"`
-		User        string        `json:"user"`
-		Password    string        `json:"password"`
-		Claims      []ClaimedSeat `json:"claims,omitempty"`
-	}{URL: w.URL, Fingerprint: w.Fingerprint, Node: w.Node, Module: w.Module, User: w.User, Password: password,
-		Claims: w.Claims})
-}

go/buscompose/declaration_files.go

@@ -1,8 +0,0 @@
-package buscompose
-
-import (
-	"git.novox.be/novox/mesh-sdk/go/declaration"
-)
-
-// DeclarationFilesBucket is the prefix of the buckets' names, which mesh-sdk fixes for the node-engine and the controller alike.
-const DeclarationFilesBucket = declaration.FileBucketPrefix

go/buscompose/derived.go

@@ -1,59 +0,0 @@
-package buscompose
-
-// A Consumer is a durable subscription the controller creates on a module's behalf. A module
-// declares what it reacts to, never how delivery works, so it does not name these and cannot
-// misconfigure them.
-type Consumer struct {
-	Name   string
-	Stream string
-	// Filters are the subjects this consumer receives. One consumer per module with several
-	// filters, rather than one per consumed event: its ack subject is derived from its name, and
-	// a module with five consumers would need five ack permissions to ack its own deliveries.
-	Filters []string
-	// Queue is the queue group, set for a seat's worker so that "exactly one holder" survives a
-	// seat later being relaxed to several. Authority and delivery are kept separate on purpose.
-	Queue string
-	// Push asks the server to deliver to a subject rather than wait to be pulled.
-	//
-	// For the mesh's own consumer, where the controller wants every message to arrive in the one
-	// loop it already runs: pulling would mean a second goroutine fetching batches and handing
-	// them over, and a loop that acts on one message at a time is the property the store window
-	// depends on. A queue group implies this, because a group has nothing to pull from.
-	Push bool
-	// TakesOverFrom names a consumer of the same stream whose filter this one takes over (issue 973): made while
-	// that consumer still filters this one's subject, it starts after what that consumer has acknowledged, so a
-	// message the old one held unacknowledged is not lost to the change. Otherwise it starts as FromNow says.
-	TakesOverFrom string
-	// DeliverSubject, when set, is where a push consumer delivers instead of DeliverSubjectFor's.
-	DeliverSubject string
-	// AckWaitSeconds before an unacknowledged delivery is redelivered.
-	AckWaitSeconds int
-	// MaxDeliver is how often a message is handed over before the consumer gives it up; zero for no
-	// bound. What a consumer gives up is kept in DEAD_LETTERS by the controller (novox/hq issue 330).
-	MaxDeliver int
-	// MaxAckPending is how many deliveries the server lets stand unacknowledged at once; zero for
-	// the server's default, which is many. **One, for a consumer handled one at a time**
-	// (novox/hq issue 175): a handler that builds for minutes keeps its own message alive with a
-	// heartbeat, but everything handed over behind it times out unacknowledged and comes back —
-	// and a merge that came back rebuilt what it had just built, five times over on 2026-09-30.
-	// With one outstanding, the server holds the rest, and the heartbeat is keeping the message.
-	MaxAckPending int
-	// FromNow makes a consumer that does not exist yet start at the stream's end rather than its
-	// beginning (novox/hq issue 248). For a consumer that reacts to announcements — a merge, a build's
-	// outcome — on a stream that keeps a week of them: the server's default, everything the stream
-	// holds, replays every merge and every build of that week as if it had just happened. A consumer
-	// that exists keeps where it is, whatever this says; only its making is decided here.
-	FromNow bool
-	Why     string
-	// Resettable says why this consumer may be re-made to deliver from now by the mesh itself, with
-	// nobody asked (novox/hq to-be 45 §7, healer H4): what a reset drops, something else catches up.
-	// Empty for every consumer where nothing would — a module's, whose events would be lost to it.
-	// Not a property of the consumer on the bus: nothing here is sent to the server.
-	Resettable string
-}
-
-// ModuleConsumer is one module's durable consumer, with the module and node it is for.
-type ModuleConsumer struct {
-	Node, Module string
-	Consumer     Consumer
-}

go/buscompose/doc.go

@@ -1,5 +0,0 @@
-// Package buscompose is the bus's names and shapes every part reads (novox/hq ADR 0593 §1): the mesh's streams and
-// dead letters, a module's log, stream and buckets as the bus names them, the account a part asks for, a principal's
-// shape, and the grants part's memberships key. The composer of the bus's user list, which reads these and makes every
-// user's permissions, is the grants part's own (mesh-delivery modules/mesh-grants internal/buscompose).
-package buscompose

go/buscompose/engine.go

@@ -1,12 +0,0 @@
-package buscompose
-
-// EngineModule is the node-engine's manifest's module name, and EngineActsState its state the acts asked through the
-// node seat and its own asks are kept in (ADR 0563 §2, §3: "the engine's own state"): the bucket mesh-host_acts, keys
-// `<node>.act.<id>`, `<node>.open.<act>.<digest>` and `<node>.ask.<id>`, each written by that node's engine alone.
-const (
-	EngineModule    = "mesh-host"
-	EngineActsState = "acts"
-)
-
-// EngineActsBucket is that state's bucket.
-var EngineActsBucket = BucketName(EngineModule, EngineActsState)

go/buscompose/health_grants.go

@@ -1,102 +0,0 @@
-package buscompose
-
-import (
-	"fmt"
-	"slices"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/health"
-)
-
-// ControllerLeftoverConsumers are the ended controller's durable consumers left on the bus, one leftover of the module
-// mesh-delivery placed nowhere (issue 1126, milestone section 3), and mesh-catalog's of the controller's built-before,
-// which its manifest no longer consumes and no part composes; each `<stream>.<consumer>`.
-var ControllerLeftoverConsumers = []string{
-	"EVENTS." + ControllerName, "EVENTS." + MergesConsumerName, "EVENTS.novox_mesh-delivery", "EVENTS.novox_mesh-catalog",
-	"CONTROL." + ControllerName, DeadLetterNoticesStream + "." + ControllerName,
-}
-
-// ControllerLeftoverConsumersOn are ControllerLeftoverConsumers and, for each node given, the consumer the controller
-// made for the node's engine (`EVENTS.<node>_mesh-host`, of restic's backed-up): the engine hears that event without a
-// durable consumer, and the grants part composes none for it, so nothing reads it (issue 1126).
-func ControllerLeftoverConsumersOn(nodes []string) []string {
-	out := slices.Clone(ControllerLeftoverConsumers)
-	for _, n := range nodes {
-		if safeSubject.MatchString(n) {
-			out = append(out, "EVENTS."+n+"_"+EngineModule)
-		}
-	}
-	return out
-}
-
-// endedController is the name the ended controller had as a module: its buckets are named for it (ADR 0590 §6).
-const endedController = "mesh-controller"
-
-// ControllerLeftoverBuckets are the ended controller's buckets, each by its local name (`KV_mesh-controller_<name>`).
-var ControllerLeftoverBuckets = []string{"asked", "assignments", "builds", "calls", "checks-running", "composed",
-	"condition-history", "conditions", "declared-config", "declared-packages", "delivery-merges", "grants", "hand-acts",
-	"lease", "predefined", "rollouts", "states-announced"}
-
-// ControllerLeftoverStreams are the ended controller's streams, by their names: CONTROL, ASSIGNMENTS, each of its buckets'
-// and, for each node given, the declaration files' object bucket the controller wrote (ADR 0486 §2).
-func ControllerLeftoverStreams(nodes []string) []string {
-	out := []string{"CONTROL", AssignmentsStream}
-	for _, b := range ControllerLeftoverBuckets {
-		out = append(out, "KV_"+BucketName(endedController, b))
-	}
-	for _, n := range nodes {
-		if safeSubject.MatchString(n) {
-			out = append(out, "OBJ_"+DeclarationFilesBucket+n)
-		}
-	}
-	return out
-}
-
-// BusRemovalGrants are the whole authority of an account whose bus declares removals (ADR 0564 Limits 4, ADR 0590 clause
-// 6), each removal its grant: the node-engine's acts bucket read (STREAM.INFO with a subject filter lists what a removal
-// would take, so the tools read before they remove) and its keys removed, which nothing else may empty when it fills; and
-// the ended controller's leftovers, each consumer and each stream read and deleted by its name, for the nodes given (the
-// declaration files' object buckets). A removal outside the set is refused, as the indexer's judge refuses it in a
-// manifest (novox/hq ADR 0578 §1).
-func BusRemovalGrants(removes, nodes []string) ([]string, error) {
-	var out []string
-	for _, r := range removes {
-		switch r {
-		case catalogue.RemovesEngineActs:
-			out = append(out, "$JS.API.STREAM.INFO.KV_"+EngineActsBucket, "$KV."+EngineActsBucket+".>")
-		case catalogue.RemovesControllerLeftovers:
-			for _, c := range ControllerLeftoverConsumersOn(nodes) {
-				out = append(out, "$JS.API.CONSUMER.INFO."+c, "$JS.API.CONSUMER.DELETE."+c)
-			}
-			for _, s := range ControllerLeftoverStreams(nodes) {
-				out = append(out, "$JS.API.STREAM.INFO."+s, "$JS.API.STREAM.DELETE."+s)
-			}
-		default:
-			return nil, fmt.Errorf("a bus account removes %q, which is not one of %s (novox/hq ADR 0564 Limits 4, ADR 0590)", r,
-				strings.Join([]string{catalogue.RemovesEngineActs, catalogue.RemovesControllerLeftovers}, ", "))
-		}
-	}
-	return out, nil
-}
-
-// WatchmanHears are the core subjects the watchman subscribes, with no durable consumer (ADR 0564 clauses 4, 5 and
-// Limits 3, 11): the power seat's words (S1, ADR 0211), the providers' failing and recovered words (S8), each tool
-// runner's beat (S11), the self-check's checked (S10), a consumer deleted and the bus module's slow consumers and closed
-// connections (S9), the provisioner clients' reports (S21), the dead letters kept, and the lease write's events. Never the bus's API audit
-// (`$JS.EVENT.ADVISORY.API`): it carries every API call's request and answer in the account, the vault's hashes among
-// them (the lead, 2026-10-29).
-func WatchmanHears() []string {
-	return []string{
-		"mesh.mod.power.event.*",
-		"mesh.mod.*.event.provisioner.failing",
-		"mesh.mod.*.event.provisioner.recovered",
-		"mesh.control.*.tools-alive",
-		"mesh.seat.mesh-self-check.event." + health.EventChecked,
-		"$JS.EVENT.ADVISORY.CONSUMER.DELETED.>",
-		"mesh.mod.nats.event.bus.slow-consumer",
-		"mesh.mod.nats.event.bus.connection-closed",
-		ProvAppliedSubjects,
-		deadLetterPrefix + ">",
-	}
-}

go/buscompose/log.go

@@ -1,87 +0,0 @@
-package buscompose
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// The mesh's caps on a log: what an entry's value may weigh, what a message on the log's stream may
-// weigh — the value and its headers, which the server counts in a message's size, so a value of the
-// full size still fits with the expected-last-sequence header an append carries — and what a log holds
-// when its module says nothing and at most.
-const (
-	LogMaxEntryBytes   = 256 * 1024
-	LogMaxMessageBytes = LogMaxEntryBytes + 4*1024
-	LogDefaultMiB      = 1024
-)
-
-// A Log is one module's declared log as the bus holds it.
-type Log struct {
-	Module string
-	Name   string
-	// MaxMiB is its cap in MiB; zero is LogDefaultMiB.
-	MaxMiB int
-	// MaxAgeDays is how long an entry is kept; zero is as long as the log (catalogue.LogDeclaration).
-	MaxAgeDays int
-}
-
-// LogStreamPrefix starts every log's stream name, which no other stream of the mesh's starts with.
-const LogStreamPrefix = "LOG_"
-
-// LogStreamName is the stream a module's log lives in: `LOG_<module>_<name>`. The module and the
-// local name are each one token with no underscore, so two modules can never derive one stream.
-func LogStreamName(module, name string) string { return LogStreamPrefix + module + "_" + name }
-
-// LogSubject is the subject a log's entries are published under, without the key: an entry for key K
-// is on `<LogSubject>.<K>`.
-func LogSubject(module, name string) string { return "mesh.log." + module + "." + name }
-
-// Stream is this log's stream name.
-func (l Log) Stream() string { return LogStreamName(l.Module, l.Name) }
-
-// Subject is this log's subject, without the key.
-func (l Log) Subject() string { return LogSubject(l.Module, l.Name) }
-
-// MaxBytes is this log's cap in bytes.
-func (l Log) MaxBytes() int64 {
-	mib := l.MaxMiB
-	if mib <= 0 {
-		mib = LogDefaultMiB
-	}
-	return int64(mib) * 1024 * 1024
-}
-
-// Why is carried into the server's description of the stream, so somebody reading the server's own
-// state finds whose it is and why it is kept.
-func (l Log) Why() string {
-	return fmt.Sprintf("%s's log %q (novox/hq ADR 0297): its record of operations, one entry per operation "+
-		"under its key, appended by %s alone and kept as long as the log; never removed by the mesh, because "+
-		"it is data", l.Module, l.Name, l.Module)
-}
-
-// Config is the stream a log is, field by field as novox/hq ADR 0297 fixes it: a file stream kept by
-// limits, with no maximum age unless the log says one (ADR 0565 §10) and no cap per key, whose message is an entry's value and 4 KiB of
-// headers at most, that refuses a new entry when full rather than
-// drop an old one, and that refuses deleting an entry or purging it. Direct gets are allowed, which
-// is how the runtime reads it.
-func (l Log) Config() jetstream.StreamConfig {
-	return jetstream.StreamConfig{
-		Name:              l.Stream(),
-		Description:       l.Why(),
-		Subjects:          []string{l.Subject() + ".>"},
-		Storage:           jetstream.FileStorage,
-		Retention:         jetstream.LimitsPolicy,
-		MaxAge:            time.Duration(l.MaxAgeDays) * 24 * time.Hour,
-		MaxMsgs:           -1,
-		MaxMsgsPerSubject: -1,
-		MaxBytes:          l.MaxBytes(),
-		MaxMsgSize:        LogMaxMessageBytes,
-		Discard:           jetstream.DiscardNew,
-		AllowDirect:       true,
-		DenyDelete:        true,
-		DenyPurge:         true,
-		Replicas:          1,
-	}
-}

go/buscompose/modstreams.go

@@ -1,109 +0,0 @@
-package buscompose
-
-import (
-	"fmt"
-	"sort"
-)
-
-// moduleStreamPrefix starts every subject a module's own stream takes.
-const moduleStreamPrefix = "mesh.stream."
-
-// ModuleStreamSubject is where a module's event on its own stream lands: `mesh.stream.<module>.event.<event>`.
-// The token before `.event.` is the emitter, as on EVENTS, so a runtime reads the same key from it.
-func ModuleStreamSubject(module, event string) string {
-	return moduleStreamPrefix + module + ".event." + event
-}
-
-// A ModuleStream is one module's declared stream as the bus holds it.
-type ModuleStream struct {
-	Module string
-	// Name is its name on the bus, `MAIL`.
-	Name string
-	// Events are the events it carries, as the bus spells them (WirePattern).
-	Events     []string
-	MaxAgeDays int
-	MaxMiB     int
-	// Restricted says a trusted config value of the module grants who hears it (ADR 0363 §4).
-	Restricted bool
-	// WorkQueue says this stream holds ADR 0436 §6's work-queue retention: a message is removed once a
-	// consumer acknowledges it, and the bus refuses a new one when full rather than dropping its oldest.
-	WorkQueue bool
-	// Duplicates is the work-queue's duplicate window in hours (novox/hq ADR 0436 §6); meaningless unless
-	// WorkQueue.
-	Duplicates int
-}
-
-// Subjects are the subjects the stream takes.
-func (s ModuleStream) Subjects() []string {
-	var out []string
-	for _, e := range s.Events {
-		out = append(out, ModuleStreamSubject(s.Module, e))
-	}
-	sort.Strings(out)
-	return out
-}
-
-// Stream is the stream the controller asserts: kept by limits, its age and size the module's, dropping
-// its oldest when full — a consumer that was away catches up within the age, and the module's own record
-// answers for anything older.
-func (s ModuleStream) Stream() Stream {
-	why := fmt.Sprintf("%s's own stream (novox/hq ADR 0363): its events, kept %d days and at most %d MiB so a "+
-		"consumer that was away catches up", s.Module, s.MaxAgeDays, s.MaxMiB)
-	if s.Restricted {
-		why += "; heard only by the consumers its trusted config value grants"
-	}
-	if s.WorkQueue {
-		why += "; a work-queue (novox/hq ADR 0436 §6): a message is removed once its one consumer " +
-			"acknowledges it, and a full stream refuses a new one rather than dropping what it holds"
-	}
-	out := Stream{
-		Name:      s.Name,
-		Subjects:  s.Subjects(),
-		Retention: RetentionLimits,
-		MaxAge:    s.MaxAgeDays * 24 * 60 * 60,
-		MaxBytes:  int64(s.MaxMiB) * 1024 * 1024,
-		Why:       why,
-		// Said on the bus, so a dead letter kept from it ages out with it (novox/hq ADR 0376 §3).
-		Restricted: s.Restricted,
-	}
-	if s.WorkQueue {
-		out.Retention = RetentionWorkQueue
-		out.DiscardNew = true
-		out.DuplicatesSeconds = s.Duplicates * 60 * 60
-		// Said on the bus too, reusing the one flag a restricted stream's dead letters already age and hide
-		// by (novox/hq ADR 0436 §6, ADR 0376 §3-4): a work-queue stream's grant is always empty (ADR 0436
-		// §6 refuses one that carries a grant), so this never collides with a trusted-config restriction.
-		out.Restricted = true
-		// And its own metadata, apart from the bus's work-queue retention SEAT_* and other mesh-internal
-		// streams share without being one of this clause's: only this flag says a dead letter kept from the
-		// stream is drop-only (novox/hq ADR 0436 §6), never the stream's Retention alone.
-		out.WorkQueue = true
-	}
-	return out
-}
-
-// QueueOwner is the one process of a module that is the durable consumer of one of its own work-queue
-// streams (novox/hq ADR 0436 §1, §2, §6): named in that process's bus.queues, and checked at registration
-// to be the only one (the indexer's judge, novox/hq ADR 0578 §1).
-type QueueOwner struct {
-	// Process is the process resource's id — its bus account's name, with the node and module (novox/hq ADR
-	// 0436 §2).
-	Process string
-	// Stream is the work-queue stream's name on the bus.
-	Stream string
-	// MaxDeliver bounds how many times a message is handed over before it is given up as a dead letter
-	// (novox/hq ADR 0436 §6).
-	MaxDeliver int
-}
-
-// Heard is a module's stream another module hears, and the subjects it hears of it: its `consumes`
-// within the stream and, for a restricted stream, within what the provider's trusted config value grants it
-// (ADR 0363 §5). Composed only with at least one subject.
-type Heard struct {
-	Stream  string
-	Emitter string
-	Filters []string
-	// Restricted says the stream is restricted by its provider's trusted config value (ADR 0363 §4): then it
-	// is heard only by a module on an account of its own (ADR 0376 §1, ComposedHears).
-	Restricted bool
-}

go/buscompose/names_test.go

@@ -1,42 +0,0 @@
-package buscompose
-
-import (
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/membership"
-	"git.novox.be/novox/mesh-sdk/go/seatdef"
-)
-
-// The names this package keeps for the grants part's composer (mesh-grants internal/buscompose, ADR 0593 §1) agree with
-// what the runtime reads: the memberships bucket, and a log's stream and subject.
-func TestTheBusNamesAgree(t *testing.T) {
-	if GrantsMembershipsBucket != membership.GrantsBucket {
-		t.Fatalf("the memberships bucket is %q here and %q in membership", GrantsMembershipsBucket, membership.GrantsBucket)
-	}
-	if MembershipKey("ace", "netcheck") != "ace.netcheck" {
-		t.Fatal("a membership's key is not <node>.<module>")
-	}
-	if LogStreamName("mesh-delivery-builder", "build-log") == "" || LogSubject("mesh-delivery-builder", "build-log") == "" {
-		t.Fatal("a log has no stream or subject")
-	}
-	// 1966/AC20: a ledger's history and snapshot subjects are one contract, which the grants part grants a ledger
-	// account its publish on.
-	if h, sn := LedgerHistorySubject("m", "records"), LedgerSnapshotSubject("m", "records"); h != "mesh.ledger.m.records.history" ||
-		sn != "mesh.ledger.m.records.snapshot" {
-		t.Fatalf("a ledger's subjects are %q and %q", h, sn)
-	}
-	// 1966/AC23: a wanted account of kind ledger for m on a names the user ledger.a.m and the own secret ledgers.
-	ledger := WantedAccount{User: "ledger.a.m", Kind: KindLedger, Node: "a", Module: "m", URL: "nats://10.0.0.1:4222"}
-	if got := (Principal{Kind: KindLedger, Node: "a", Module: "m"}).Username(); got != "ledger.a.m" {
-		t.Fatalf("a ledger account is named %q", got)
-	}
-	if err := ledger.Valid(); err != nil || ledger.OwnSecret() != "ledgers" {
-		t.Fatalf("a wanted ledger account: %v, held in %q", err, ledger.OwnSecret())
-	}
-	// A seat's family is the shared events stream filtered to its subjects: a definition says the stream's age.
-	for _, st := range MeshStreams() {
-		if st.Name == EventsStream && int64(st.MaxAge) != seatdef.SharedEventsMaxAgeDays*24*60*60 {
-			t.Errorf("the shared events stream keeps %d s, a seat's definition says %d days", st.MaxAge, seatdef.SharedEventsMaxAgeDays)
-		}
-	}
-}

go/buscompose/nats.go

@@ -1,351 +0,0 @@
-// Composing the bus's own configuration.
-//
-// An account is *composed*, never called for: the controller writes accounts, users and
-// per-subject permissions into one file the host keeps current, and the server reloads it in
-// place (novox/hq ADR 0106 — never through a management API; design 25 §4).
-//
-// Everything here is pure. Given the principals, it returns the file's text — so the whole of the
-// mesh's authority model is testable as strings, with no server.
-//
-// **Permissions are per subject, so a module's own name is the server's to enforce.** ADR 0042
-// reserves a module's origin — it publishes only under its own name — and here that is a refusal
-// rather than something a library promises.
-package buscompose
-
-import (
-	"regexp"
-	"time"
-)
-
-// A Kind is what a principal is, which decides the shape of its authority rather than its
-// contents: a module's comes from its declaration, a host's from its node, and the controller's
-// and the enrolment user's are fixed.
-type Kind string
-
-const (
-	KindModule    Kind = "module"
-	KindNode      Kind = "node"
-	KindEnrolment Kind = "enrolment"
-	// KindPerson is somebody reaching the mesh's tools from a workstation (design 25 §7). Its
-	// authority is a list of tools and nothing else — not control, not declarations, not builds,
-	// and no ability to answer anything, because a person asks.
-	KindPerson Kind = "person"
-	// KindNodeTools is a machine's tool runtime (novox/hq ADR 0175, to-be 38): one process per
-	// node, on the host side, serving every assigned module's tools and every held seat's verbs.
-	// Its authority is the union of what the modules it carries would each have had for their
-	// tools — and nothing of what they consume, because tools are what it runs, not reactions.
-	KindNodeTools Kind = "node-tools"
-	// KindProvisioner is a machine's provisioner client (novox/hq ADR 0349 clauses 6 and 11, design 57 P3): a
-	// service of the module holding NodeProvisionerSeat, outside the tool runner, under an account of its own so
-	// the vault can tell it from an agent. Its authority is provisionerGrants and nothing else.
-	KindProvisioner Kind = "provisioner"
-	// KindProcess is one process of a module that declares bus (novox/hq ADR 0436 §1, §2): a service of that
-	// module, outside the tool runner and outside the module's own account, under a bus account scoped to
-	// exactly what its bus says — never root, never the operator account, and never able to answer a tool
-	// call or a seat's verb (§3). One per process and machine.
-	KindProcess Kind = "process"
-	// KindLedger is one module assignment's ledger credential (novox/hq ADR 0597 §9, design 25 § 12.4): held by that
-	// machine's tool runner, never by the module's own code, and the only account that publishes on that module's ledger
-	// histories and snapshots. One per module assignment, whose module asks for a ledger in `requires`.
-	KindLedger Kind = "ledger"
-)
-
-// LedgerHistorySubject and LedgerSnapshotSubject are the subject prefixes of one ledger's history and of its instances'
-// snapshots (novox/hq ADR 0597 §1, §8, §9): an instance's subject is the prefix, ".", and the instance's path with each
-// "/" written "." (`decision/0290` is `….decision.0290`). One contract: the grants part grants a ledger account its
-// publish on them, the tool runner appends and snapshots on them, and the bus module creates the history's stream over
-// them.
-func LedgerHistorySubject(module, local string) string {
-	return "mesh.ledger." + module + "." + local + ".history"
-}
-
-// LedgerSnapshotSubject is the subject prefix of one ledger's instances' snapshots (LedgerHistorySubject).
-func LedgerSnapshotSubject(module, local string) string {
-	return "mesh.ledger." + module + "." + local + ".snapshot"
-}
-
-// Seat is a role on the bus as a principal relates to it: the subjects it accepts, and those it
-// emits (novox/hq ADR 0118, design 29 §5).
-type Seat struct {
-	Name string
-	// Scope is where the seat has one holder. A node-scoped seat's tool carries the node in its
-	// subject, because one subject reaching six machines' holders is not an address
-	// (novox/hq ADR 0132, design 33 §4). Empty reads as mesh.
-	Scope    string
-	Accepts  []string
-	Emits    []string
-	Serves   []string
-	Versions []string // protocol versions served beside the current one; empty for v1 only
-
-	// Kinded says the seat is a kinded bench (novox/hq ADR 0234 §2, ADR 0259 §3): each holder claims one
-	// kind, and its verbs' subjects carry it. Kind is the kind this principal's claim names, for a seat it
-	// holds.
-	Kinded bool
-	Kind   string
-	// ByCaller are the accepts and emits whose last token names the calling module (ADR 0259 §3).
-	ByCaller []string
-	// Proofs are the seat's proof verbs: core request and reply, never on a stream (ADR 0259 §3).
-	Proofs []string
-	// Records are the holder's buckets, by their full name, each user reads under its own name.
-	Records []string
-	// Capabilities are what this principal's claim of a kinded bench promises (ADR 0234 §2).
-	Capabilities []string
-	// DeclaredBy is the module that declares the seat. On a kinded bench it alone submits work to a kind
-	// and answers its proofs (novox/hq ADR 0259 §8): the router, not any user or watcher of the bench.
-	DeclaredBy string
-	// PulledByKind says each accepted kind is a worker of its own on the seat's queue, filtered to that kind, which
-	// every holder pulls in the order Accepts lists them: the build seats' (novox/hq ADR 0525 §2, ADR 0536 §4).
-	PulledByKind bool
-}
-
-// A Principal is one user of the bus. Its permissions are derived from what it declares and
-// nothing else (novox/hq ADR 0043), over the three namespaces of design 29 §2: its own, the seats
-// it holds, and the seats it uses.
-type Principal struct {
-	Kind   Kind
-	Node   string
-	Module string
-	// Process is the process resource's id, for a KindProcess principal alone (novox/hq ADR 0436 §2):
-	// Username and inbox are <node>.<module>.<process id>.
-	Process string
-
-	// FilesFor are the nodes whose declaration-file buckets (novox/hq ADR 0486 §2) this principal may remove, for the bus
-	// module's tools removing the ended controller's leftovers alone (ADR 0590 clause 6): every node of the mesh, one
-	// bucket each.
-	FilesFor []string
-
-	Emits    []string
-	Consumes []string
-	Serves   []string
-
-	Holds []Seat
-	Uses  []Seat
-	// Watches are seats whose events this principal consumes. Separate from Consumes because a
-	// role's event lives under the seat's namespace and not a module's, and this package cannot tell
-	// a seat's name from a module's by looking at it — whoever resolved the declaration can, and
-	// does (novox/hq ADR 0121).
-	//
-	// **Found by a consumer reading nothing.** The catalogue consumes the build machine's outcome;
-	// with that name read as a module's, its subscription pointed at `mesh.mod.mesh-build-machine.…`,
-	// a namespace no such module owns. Every service started and the graph stayed empty.
-	Watches []Seat
-
-	// Carries are the modules whose tools this principal serves, for a KindNodeTools principal
-	// (novox/hq ADR 0175): every module assigned to its node, as each declares itself. Its
-	// serving authority is the union of theirs — each module's own tool namespace and each held
-	// seat's verbs on this node — derived from the same declarations the modules' own principals
-	// are, so the runtime can serve nothing a module could not have served for itself.
-	Carries []Declared
-
-	// Invokes are the tools this principal may call, as `<module>.<tool>`; a single `*` is every
-	// tool. A person's whole authority (design 25 §7), and a module's only if its manifest says so
-	// (novox/hq ADR 0152) — the console's does, and nothing else's.
-	//
-	// **A list, not a role.** A person is not a module and holds no seat: nothing is addressed
-	// to them, nothing is delivered to them, and they have no durable consumer to acknowledge.
-	// What they have is permission to ask. A module that invokes gains exactly the same
-	// permission and nothing beside it.
-	Invokes []string
-
-	// AsksIssued are, for the vault's holder, the tools it asks in its own name for a credential a provider's software
-	// issued, each `<module>.<tool>` (novox/hq ADR 0305, issue 723, vaultCalls): on the subject that names its caller,
-	// so the tool knows the vault asks.
-	AsksIssued []string
-
-	// AsksTheDesk says this principal is the vault's holder, which asks the desks' secret prompt in its own name
-	// (novox/hq ADR 0349 clause 9, issue 723): `node-launcher.secret` on any machine, on the subject that names
-	// its caller, and nothing else of that seat. With AsksIssued on the same principal, the vault's whole reach
-	// outside its own seat: it asks each issuing provider's tool in its own name (clause 10).
-	AsksTheDesk bool
-
-	// State is the local names of the state this principal's module keeps, and Reads the state of
-	// others it reads as `<module>.<name>` (novox/hq ADR 0201): a bucket each, kept by the owner's
-	// instances and read by whoever declares it.
-	State []string
-	Reads []string
-	// PerMachine is the local names of its state keyed by machine, reaching the key named for Node and
-	// no other; KeyedReads the keys of others' state it reads one key at a time (novox/hq ADR 0260).
-	PerMachine []string
-	KeyedReads []KeyedRead
-	// Logs is the local names of the logs this principal's module keeps (novox/hq ADR 0297).
-	Logs []string
-	// ReadLogs are, of Reads, those naming another module's log (novox/hq ADR 0571 clause 1).
-	ReadLogs []string
-	// Streams are the streams this principal's module owns, and Hears the module streams it hears with the
-	// subjects it was granted (novox/hq ADR 0363).
-	Streams []ModuleStream
-	Hears   []Heard
-	// Queues are its own work-queue streams and the one process each is the consumer of (novox/hq ADR 0436
-	// §1, §2, §6); for a KindProcess principal, its own alone.
-	Queues []QueueOwner
-	// Asks says a KindProcess principal reads the records of its module's own asks (novox/hq ADR 0436 §1),
-	// on whichever seat of Uses keeps them (novox/hq ADR 0259 §3) — never set for any other kind.
-	Asks bool
-
-	// SnapshotsTheBus is the bus's own module, the one holding mesh-broker (novox/hq ADR 0235). Its
-	// whole authority is BusSnapshotGrants: it copies the streams for the night's backup and nothing
-	// else — not its declarations, which the node's tool runtime serves for it.
-	SnapshotsTheBus bool
-	// Removes are, for a process or tools bundle account whose bus declares them, what it may remove from the bus
-	// (novox/hq ADR 0564 Limits 4): its whole authority is then BusRemovalGrants of them.
-	Removes []string
-	// DeadLetterSources are, for the watchman, the streams a dead letter it keeps may come from, by name
-	// (deadLetterSourcesOf, novox/hq ADR 0564 clause 5): never a bucket's.
-	DeadLetterSources []string
-
-	// Checks are the tools a machine principal's node-engine asks as a declared health check, each
-	// `<module>.<tool>` (novox/hq ADR 0240, to-be 48 §3): asked of the instance on its own machine and
-	// nowhere else.
-	Checks []string
-	// MovesIntoTheVault is a machine principal whose node-engine may ask the vault's `move-in` in its own name (design
-	// 57's V3, issue 676): set while the vault's holder serves it, so the engine can hand in the values sealed to its
-	// machine, which nothing else can open.
-	MovesIntoTheVault bool
-	// StatesItsKeyToTheVault is a machine principal whose node-engine may ask the vault's `node-key` in its own name
-	// (issue 786, novox/hq ADR 0372): set while the vault's holder serves it. That one verb, and nothing else new.
-	StatesItsKeyToTheVault bool
-	// AsksItsOwnSecrets is a machine principal whose node-engine may ask the vault's `own` in its own name (novox/hq
-	// ADR 0547 §2, ADR 0550 §5, issue 1126): its modules' own secrets sealed to its key, for the compositions it makes
-	// itself. Set while the vault's holder serves it.
-	AsksItsOwnSecrets bool
-	// AsksTheVaultToSign is a machine principal whose node-engine may ask the vault's `sign` in its own name, read the
-	// vault's public signing halves (`signers`) and the controller's lease key (novox/hq ADR 0550 §2): its own node's
-	// certificate, the keys it trusts, and the lease write that drops the controller's key. Set while the vault's holder
-	// serves `sign`.
-	AsksTheVaultToSign bool
-	// ServedReads are, for a machine principal, the keys of mesh-config's resolved values that other nodes' modules serve
-	// from (`<node>.<module>.<key>`, catalogue.ServedSettings): what every consumer is told, and so what a node composing
-	// its own modules reads of a provider elsewhere (issue 1126), each key alone. Sorted, none twice.
-	ServedReads []string
-	// FollowsGrantsUserList is the machine principal of the node holding mesh-broker: its node-engine reads the grants
-	// part's sealed user list, one key and an object by name (novox/hq ADR 0547 clause 7, GrantsUserListFollows).
-	FollowsGrantsUserList bool
-	// BoundBuckets are the providers' buckets of entries, `<module>_bound`, a provisioner client reads its own
-	// machine's keys of (mesh-sdk go/provider, issue 679): every bucket named bound of a module the mesh places.
-	BoundBuckets []string
-	// CreatesStreams are the streams the grants part's principal alone may create (novox/hq ADR 0547 §5; the operator,
-	// 2026-10-26 08:54): the stream of every bucket, log and stream a manifest of a module placed anywhere declares,
-	// by name. Created only, never updated or deleted: a new module state is on the bus when the grants part hears its
-	// manifest, not at the controller's next start (issue 1790).
-	CreatesStreams []string
-	// CreatesConsumers are the durable consumers the grants part's principal alone may create beside the controller
-	// (novox/hq ADR 0561 §6): each placed module's on EVENTS and each process's on its work queue (AccountConsumers), by
-	// stream and name. Created only, never updated or deleted.
-	CreatesConsumers []ModuleConsumer
-
-	// Login is a node principal's login when it is not `node.<n>`: its second login, `node.<n>--b`, composed beside or
-	// in place of the first as the vault's node-logins says (novox/hq ADR 0583 §1, issue 774). Each login is granted
-	// the node's permissions and the node's inbox `_INBOX.node.<n>`; what it calls, it calls in its own name, so the
-	// vault tells the login that confirms a rotation from the one it replaces (§3).
-	Login string
-	// RotatesItsLogin is a machine principal whose node-engine reads its own node's key of the vault's node-logins,
-	// and no other key, and confirms a switch with node-account-confirm in its own name (novox/hq ADR 0583 §1 insight,
-	// §3). Set while the vault's holder serves rotate-node.
-	RotatesItsLogin bool
-
-	// Redeems is an enrolment principal that may call the seat mesh-enrolment's redeem in its own name, and nothing else
-	// of it (novox/hq ADR 0587 §4): set while the seat's holder serves redeem. LeaseHandedAway drops the controller's
-	// enrolment subject from it, which is served no more from the lease write (§6).
-	Redeems         bool
-	LeaseHandedAway bool
-
-	// VaultEnrols says the vault's holder serves an enrolment verb (VerbsTheEnrolmentAsksTheVault): every principal but
-	// the module mesh-enrolment and its processes is then denied them, however wide its grant (ADR 0587 §1).
-	VaultEnrols bool
-
-	// PasswordHash is the bcrypt hash the mesh minted. The plaintext is sealed to the principal
-	// and never appears here: this file is written to a node's disk and read by a server, and a
-	// secret that can be read from a configuration file is a secret with a wider blast radius
-	// than the one it protects (novox/hq design 29 §10).
-	PasswordHash string
-}
-
-// enrolmentPrefix is the space every enrolling node's user and inbox live under, so the one place the
-// controller may answer an enrolment is derived from the same constant the user is named from.
-const enrolmentPrefix = "enrol"
-
-// safeSubject refuses anything that would change the meaning of a subject rather than sit inside
-// one. A name carrying a dot would silently widen a permission by adding a token; a name carrying
-// `>` or `*` would widen it to a wildcard, which is the whole authority model gone.
-var safeSubject = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
-
-// Username is how a principal is named to the server. The node is part of it, so the same module
-// on two machines holds two users, each sealed to its own — the rule management.go already
-// applies, kept.
-func (p Principal) Username() string {
-	switch p.Kind {
-	case KindPerson:
-		return "person." + p.Module
-	case KindModule, KindNodeTools:
-		// The runtime is named exactly as the module it stands for would have been: the mesh
-		// issues its credential through the same path a module's takes (`module issue`), and
-		// that path knows the node and the module, not the kind.
-		return p.Node + "." + p.Module
-	case KindProcess:
-		// One account per process and machine (novox/hq ADR 0436 §2): `<machine>.<module>.<process id>`,
-		// never the module's own name alone, which is a different account with a different secret.
-		return p.Node + "." + p.Module + "." + p.Process
-	case KindNode:
-		if p.Login != "" {
-			return p.Login
-		}
-		return "node." + p.Node
-	case KindLedger:
-		// `ledger.<machine>.<module>`: never `<node>.<module>`, which is the module's own account or the tool runner's,
-		// so the module's code never holds it.
-		return "ledger." + p.Node + "." + p.Module
-	case KindProvisioner:
-		// Named for the machine, as a node is: one client per machine, whichever module runs it, and never
-		// `<node>.<module>`, which is the module's own account or the tool runner's.
-		return "provisioner." + p.Node
-	case KindEnrolment:
-		// Per token, not one shared user. **The inbox is the reason**: with a single `enrolment`
-		// user every machine enrolling at once could read every other's answer, and an answer
-		// carries that node's credentials sealed to it. Design 25 §6 says the inbox a token
-		// derives, and a permission belongs to a user, so the user is per token.
-		//
-		// Named after the node, which **is** the token's id: a token is issued for a node record,
-		// the mesh holds one live claim per record, and the node's name is the one identifier both
-		// sides already have before anything else is agreed. It is also exactly what the other
-		// transport does, where the account is named after the node and the secret is its password.
-		return enrolmentPrefix + "." + p.Node
-	}
-	return ""
-}
-
-// inbox is a principal's own reply space. No user is ever granted a bare `_INBOX.>` (design 25
-// §4): with one account, inbox privacy is the permission list or it is nothing, so each user's
-// inbox is derived from its own identity and its permissions name that prefix and no other.
-//
-// A node's two logins share the node's inbox (novox/hq ADR 0583 §1): its answers reach it whichever login it dials as.
-func (p Principal) inbox() string {
-	if p.Kind == KindNode {
-		return "_INBOX.node." + p.Node + ".>"
-	}
-	return "_INBOX." + p.Username() + ".>"
-}
-
-// ResponseTTL is how long the bus lets a principal answer a request it received. Its one answer has
-// to come inside this, and a seat's holder answers within link.AnswerWithin — inside it by design.
-// **A broker reloading its user list forgets every answer it was about to permit**, whatever this
-// says (novox/hq issue 265): a call that is still running when the list reloads has its answer
-// refused, which is why a holder answers before it does what can reload it.
-const ResponseTTL = time.Minute
-
-// GrantsModule is the one module whose principal publishes the modules' memberships (novox/hq ADR 0547 §5): the grants
-// part, which composes them from the manifests and placement. It defines no stream and is granted no other subject here.
-const GrantsModule = "mesh-grants"
-
-// The grants part's state memberships (novox/hq ADR 0571 clause 7): one key per assignment, `<node>.<module>`, its
-// membership (Membership) bare, as the assignments stream carries it, written only when it differs. A module's runtime
-// reads its own key, the tool runner its node's; the grants part alone writes it. Both sides go through
-// membership.EncodeGrantsMembership and membership.DecodeGrantsMembership (or BareGrantsMembership for a reader with a
-// type of its own), never json of a type of their own: the grants part once wrote its wrapper here and every reader
-// served nothing (issue 774). The decoder still reads that wrapper, for the transition.
-const (
-	GrantsMembershipsState  = "memberships"
-	GrantsMembershipsBucket = GrantsModule + "_" + GrantsMembershipsState
-)
-
-// MembershipKey is an assignment's key in the grants part's memberships: `<node>.<module>`.
-func MembershipKey(node, module string) string { return node + "." + module }

go/buscompose/sdk_membership.go

@@ -1,8 +0,0 @@
-package buscompose
-
-import (
-	"git.novox.be/novox/mesh-sdk/go/membership"
-)
-
-// AssignmentsStream holds every assignment's membership, the newest per subject.
-const AssignmentsStream = membership.AssignmentsStream

go/buscompose/seattraffic.go

@@ -1,7 +0,0 @@
-package buscompose
-
-// isNewTraffic says whether a seat carries any of the rules above, so a seat that carries none is
-// composed exactly as before them.
-func (s Seat) isNewTraffic() bool {
-	return s.Kinded || len(s.ByCaller) > 0 || len(s.Proofs) > 0 || len(s.Records) > 0 || s.PulledByKind
-}

go/buscompose/state.go

@@ -1,51 +0,0 @@
-package buscompose
-
-import (
-	"fmt"
-)
-
-// The mesh's caps on a bucket, the same for every module: a value is a piece of state, not a file,
-// and a bucket that grew without bound would be one module filling the bus's disk for everyone.
-const (
-	StateMaxValueBytes = 256 * 1024
-)
-
-// A Bucket is one module's declared state as the bus holds it.
-type Bucket struct {
-	Module string
-	Name   string
-	// History is how many values a key keeps; zero is one.
-	History int
-	// TTLSeconds is how long a value lives; zero is until replaced or deleted.
-	TTLSeconds int
-	// PerMachine says each machine's instance writes only the key named for its machine (novox/hq ADR
-	// 0260), and is granted that key and no other.
-	PerMachine bool
-	// KeyTTL says the bucket allows a time to live per key (novox/hq ADR 0433 §1): its owner writes each key with its
-	// own, and the server writes a delete marker, kept KeyTTLMarkerTTL, when it ends.
-	KeyTTL bool
-}
-
-// BucketName is the bucket a module's state lives in: the module and the local name joined by an
-// underscore, which neither may contain, so two modules can never derive one bucket.
-func BucketName(module, name string) string { return module + "_" + name }
-
-// Bucket is this bucket's name on the bus.
-func (b Bucket) Bucket() string { return BucketName(b.Module, b.Name) }
-
-// Why is carried into the server's description of the bucket, so somebody reading the server's
-// own state finds whose it is and why it is kept.
-func (b Bucket) Why() string {
-	return fmt.Sprintf("%s's state %q (novox/hq ADR 0201): its current value per key, written by %s, "+
-		"read by whatever declares it reads it; kept when %s is unassigned, because it is data",
-		b.Module, b.Name, b.Module, b.Module)
-}
-
-// KeyedRead is one key of another module's state a principal reads, and no other key of it.
-type KeyedRead struct {
-	Read string `json:"read"`
-	Key  string `json:"key"`
-}
-
-// ResolvedBucket is mesh-config's state of resolved values, keyed `<node>.<module>.<key>`.
-const ResolvedBucket = "mesh-config_resolved"

go/buscompose/streams.go

@@ -1,196 +0,0 @@
-package buscompose
-
-import (
-	"strings"
-)
-
-// Retention is how a stream decides what to keep, which is the whole of what distinguishes the
-// mesh's four relationships on the wire (design 29 §4).
-type Retention string
-
-const (
-	// RetentionWorkQueue: a message is removed once a consumer acknowledges it. Exactly one
-	// worker does the work, and a worker that dies has its message redelivered.
-	RetentionWorkQueue Retention = "workqueue"
-	// RetentionLastPerSubject: only the newest message on each subject survives. This is the
-	// state shape — a node that was away gets exactly the current declaration and nothing older.
-	RetentionLastPerSubject Retention = "last_per_subject"
-	// RetentionLimits: kept until it ages or the stream fills. Events, where a subscriber that
-	// was down catches up and nobody is obliged to act.
-	RetentionLimits Retention = "limits"
-)
-
-// A Stream is one of the mesh's own, as the controller asserts it.
-type Stream struct {
-	Name      string
-	Subjects  []string
-	Retention Retention
-	// MaxAge in seconds, zero for unbounded. Per stream — JetStream has no per-subject age,
-	// which is why differing retention between modules would mean a stream each.
-	MaxAge int
-	// MaxMsgsPerSubject caps each subject independently, so one noisy emitter cannot push
-	// another's events out of a shared stream. Verified: with a cap of 3, ten messages on one
-	// subject and one on another leave four in the stream, not three.
-	MaxMsgsPerSubject int
-	// Why is carried into the assertion so an operator reading the server's own state finds the
-	// reason there, rather than only in a repository they may not have.
-	Why string
-	// Direct lets a client read a subject's last message without a consumer, which is how a
-	// runtime reads its own membership with no JetStream API beyond one request (ADR 0160).
-	Direct bool
-	// MaxBytes bounds the stream's size, zero for unbounded. With DiscardNew a full stream refuses
-	// what comes next rather than dropping what it holds: the publisher is told, and says so.
-	MaxBytes   int64
-	DiscardNew bool
-	// DuplicatesSeconds is the window in which a message id published twice is kept once; zero for the
-	// server's default (two minutes).
-	DuplicatesSeconds int
-	// AllowMsgTTL lets a message carry a time to live of its own (`Nats-TTL`), for what must not outlive the
-	// stream it came from (novox/hq ADR 0376 §3, §5).
-	AllowMsgTTL bool
-	// Restricted marks a module's stream restricted by a grant (novox/hq ADR 0363 §4), in the stream's own
-	// metadata, so whoever keeps one of its messages reads it from the bus (ADR 0376 §3).
-	Restricted bool
-	// WorkQueue marks a module stream declared retention: work-queue (novox/hq ADR 0436 §6), in the
-	// stream's own metadata, so a dead letter kept from it is read as drop-only from the bus, by the
-	// declaration and not by the bus's work-queue retention alone — which SEAT_* and other mesh-internal
-	// streams share without being one of ADR 0436's, and whose dead letters are still delivered again
-	// (ADR 0264 §4).
-	WorkQueue bool
-}
-
-// RestrictedMetadata is the key a restricted stream's metadata says it under.
-const RestrictedMetadata = "mesh-restricted"
-
-// WorkQueueMetadata is the key a module stream declared retention: work-queue (novox/hq ADR 0436 §6) says
-// it under: never set by a mesh-internal work-queue stream (a seat's, a check's), only by Stream.WorkQueue.
-const WorkQueueMetadata = "mesh-work-queue"
-
-// What a durable consumer gave up on is kept (novox/hq issue 330, design 25 §3).
-//
-// **The server says it and keeps it; the controller copies it.** A consumer that handed a message over
-// as often as it may stops offering it and publishes `$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES` with
-// the stream and the message's sequence. DeadLetterNoticesStream captures those advisories as the
-// server publishes them, so one said while no controller listens is still there when one starts. The
-// controller's consumer on it fetches the given-up message by its sequence, while the source stream
-// still holds it, and keeps a copy in DeadLettersStream under DeadLetterSubject, with the consumer,
-// the subject, how often it was handed over and when it was given up. It stays there until a person
-// delivers it again or drops it, with why; a condition is open for as long as it does.
-const (
-	DeadLetterNoticesStream = "DEAD_LETTER_NOTICES"
-	DeadLettersStream       = "DEAD_LETTERS"
-	// MaxDeliveriesAdvisories is the subject the server says a given-up message on.
-	MaxDeliveriesAdvisories = "$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.>"
-	deadLetterPrefix        = "mesh.events.dead."
-	againPrefix             = "mesh.again."
-	// DeadLettersBytes bounds the kept copies. Full, the stream refuses the next copy, which is said
-	// as the consumer's condition; it never drops one it holds.
-	DeadLettersBytes = 256 << 20
-)
-
-// DeadLetterSubject is where a message one consumer gave up on is kept: `mesh.events.dead.<stream>.<consumer>`.
-func DeadLetterSubject(stream, consumer string) string {
-	return deadLetterPrefix + stream + "." + consumer
-}
-
-// DeadLetterOf is the stream and consumer a kept message's subject names; false for any other subject.
-func DeadLetterOf(subject string) (stream, consumer string, ok bool) {
-	rest, found := strings.CutPrefix(subject, deadLetterPrefix)
-	if !found {
-		return "", "", false
-	}
-	stream, consumer, ok = strings.Cut(rest, ".")
-	return stream, consumer, ok && stream != "" && consumer != "" && !strings.Contains(consumer, ".")
-}
-
-// MeshStreams is the foundation set, in the order a person reads it.
-//
-// **EVENTS filters on the `event` token**, which is the reason that token exists. A module's
-// namespace carries both its events and its tool calls; a filter of `mesh.mod.*.>` would persist
-// every tool invocation in the mesh, and a tool call must never be persisted (design 25 §3 keeps
-// tools on core NATS, where a lost call is a timeout the caller already handles).
-func MeshStreams() []Stream {
-	return []Stream{
-		// CONTROL, the ended controller's work queue of what nodes reported, is no longer the mesh's (novox/hq ADR 0590
-		// clause 6): not declared here, which would make it again; the bus module's tools remove it.
-		{
-			Name:      "NODES",
-			Subjects:  []string{"mesh.node.*.declare"},
-			Retention: RetentionLastPerSubject,
-			Why: "one declaration per node, always the newest; a node that sees sequence n refuses " +
-				"n-1 by construction (issue 107)",
-		},
-		// The assignments stream (ADR 0160) is no longer the mesh's: a runtime reads its membership from the grants
-		// part's state memberships (ADR 0571 clause 7), and the bus module's tools delete the stream at the lease write
-		// (research 072 row 33), so it is not declared here, which would make it again.
-		{
-			Name: EventsStream,
-			// A seat's own events ride here too: they are 1:many like any event, and the
-			// `event` token keeps them clear of both the seat's work queue (`accept`) and its
-			// tools (`tool`), which must not be persisted.
-			// And an event given up on, delivered again to the one consumer that gave it up
-			// (novox/hq issue 330): under `mesh.again.<consumer>.`, which only that consumer filters.
-			Subjects:          []string{"mesh.mod.*.event.>", "mesh.seat.*.event.>", againPrefix + ">"},
-			Retention:         RetentionLimits,
-			MaxAge:            7 * 24 * 60 * 60,
-			MaxMsgsPerSubject: 10000,
-			// A restricted dead letter delivered again keeps what is left of its stream's age (ADR 0376 §5).
-			AllowMsgTTL: true,
-			Why: "a subscriber that was down catches up; tool traffic under the same prefix is " +
-				"excluded by the event token; per-subject caps keep a noisy emitter from " +
-				"evicting a quiet one without splitting the stream",
-		},
-		{
-			Name:      DeadLetterNoticesStream,
-			Subjects:  []string{MaxDeliveriesAdvisories},
-			Retention: RetentionWorkQueue,
-			MaxAge:    7 * 24 * 60 * 60,
-			Why: "the server's word that a consumer gave up on a message, kept until the controller has " +
-				"copied the message into DEAD_LETTERS (novox/hq issue 330); a week, the longest the source " +
-				"streams keep what they are about",
-		},
-		{
-			Name:              DeadLettersStream,
-			Subjects:          []string{deadLetterPrefix + ">"},
-			Retention:         RetentionLimits,
-			MaxBytes:          DeadLettersBytes,
-			DiscardNew:        true,
-			DuplicatesSeconds: 24 * 60 * 60,
-			AllowMsgTTL:       true,
-			Why: "every message a consumer gave up on, with its consumer, subject, deliveries and when, kept " +
-				"until a person delivers it again or drops it with why (novox/hq issue 330); no age but a restricted " +
-				"stream's message, which ages out with its stream (ADR 0376), and full it refuses the next copy " +
-				"rather than drop one it holds",
-		},
-		{
-			Name:      ProvAppliedStream,
-			Subjects:  []string{ProvAppliedSubjects},
-			Retention: RetentionLastPerSubject,
-			Direct:    true,
-			MaxAge:    7 * 24 * 60 * 60,
-			Why: "each machine's provisioner client's newest word on each module's files, applied, waiting or " +
-				"failed with the reason (novox/hq ADR 0349 §4): what a walk's end and a gate wait for (ADR 0362, " +
-				"ADR 0349 §15), read by subject; a week, as the events are",
-		},
-	}
-}
-
-// ProvAppliedStream keeps what each machine's provisioner client last said of each module's files, newest per
-// subject (novox/hq ADR 0349 §4, ADR 0362, design 57 P6): `prov.applied.<node>.<module>` lies outside `mesh.*`, so
-// no other stream captures it, and a report said while no controller listened is still there to be read.
-const ProvAppliedStream = "PROV_APPLIED"
-
-// ProvAppliedSubjects is every machine's client's reports: `prov.applied.<node>.<module>`, a module's name dots and
-// all (ProvisionerAppliedSubject).
-const ProvAppliedSubjects = "prov.applied.>"
-
-// The ended controller's consumers' names (novox/hq ADR 0590 clause 6): kept only so its leftovers are named for their
-// removal (ControllerLeftoverConsumers) and the watchman can read whether `controller` on DEAD_LETTER_NOTICES still
-// stands.
-const (
-	ControllerName     = "controller"
-	MergesConsumerName = "controller-merges"
-)
-
-// EventsStream holds every module's and every role's events, a build's log among them.
-const EventsStream = "EVENTS"

go/buscompose/users.go

@@ -1,107 +0,0 @@
-package buscompose
-
-import "git.novox.be/novox/mesh-sdk/go/catalogue"
-
-// Declared is one module on one node, as composing its authority needs it.
-type Declared struct {
-	Module   string
-	Emits    []string
-	Consumes []string
-	Serves   []string
-	// Served are the config keys its served values and zone name fill from its settings (catalogue.ServedSettings): what
-	// every node may read of its resolved values where it runs (Principal.ServedReads, issue 1126).
-	Served []string
-	// Holds are the seats this module claims, with the protocol each seat declares. A seat the
-	// mesh defines for itself declares no protocol, so holding one grants nothing on the bus —
-	// which is right: those seats are about who does a job, not about who may say what.
-	Holds []Seat
-	// Uses are the seats this module sends to.
-	Uses []Seat
-	// Issued are the tools that answer a credential its software issued, one per offer that says so (novox/hq
-	// ADR 0305): the controller is granted to ask each in its own name, and no other tool so.
-	Issued []string
-	// Watches are the seats whose events it consumes.
-	Watches []Seat
-	// Invokes are the tools it calls, `<module>.<tool>` or `*` (novox/hq ADR 0152).
-	Invokes []string
-	// Waits are the event families a session may wait on through the tool runner, the tool runner's module's
-	// alone (novox/hq ADR 0367 §2): its account subscribes them for a call, through no consumer.
-	Waits []Wait
-	// State is the state it keeps, each a bucket its instances write (novox/hq ADR 0201).
-	State []Bucket
-	// Logs are the logs it keeps, each a stream its instances append to (novox/hq ADR 0297).
-	Logs []Log
-	// Streams are the streams it owns, each its events' one place (novox/hq ADR 0363).
-	Streams []ModuleStream
-	// Queues are its own work-queue streams and the one process each is the consumer of (novox/hq ADR 0436
-	// §1, §2, §6): one durable consumer per entry, named `<node>_<module>_<process id>`.
-	Queues []QueueOwner
-	// Hears are the module streams it hears on this machine, each with the subjects it was granted
-	// (novox/hq ADR 0363 §5); HearsAStream says its `consumes` names a module that owns a stream, granted
-	// or not, so its membership is issued again when a grant changes.
-	Hears        []Heard
-	HearsAStream bool
-	// Reads are other modules' state it reads, each `<module>.<name>` (novox/hq ADR 0201).
-	Reads []string
-	// ReadsRefused are the reads its manifest names that the owner's announcement does not make readable (novox/hq ADR
-	// 0495 clause 3, issue 1790): granted nothing, kept to be said.
-	ReadsRefused []string
-	// ReadLogs are, of its reads, those naming another module's log (`<module>.<log>`, novox/hq ADR 0571 clause 1): filled
-	// by Users and PlacementsOf from the logs the modules placed anywhere declare, never by a caller.
-	ReadLogs []string
-	// KeyedReads are keys of other modules' state it reads, each one key alone: what a seat's holder is
-	// granted for the pieces the modules beside it offer (novox/hq ADR 0260).
-	KeyedReads []KeyedRead
-	// NoAccount says the module declares no own secret named broker, so no account could ever be
-	// delivered to it and nothing can connect as it (novox/hq issue 195). Said in the negative so a
-	// record that does not say is composed as it always was.
-	NoAccount bool
-	// SnapshotsTheBus says the module holds mesh-broker — it is the bus — and so is the one module
-	// granted the snapshot API, to copy the bus's streams for the night's backup (novox/hq ADR 0235).
-	SnapshotsTheBus bool
-	// Checks are the module's own tools its health asks, each `<module>.<tool>` (novox/hq ADR 0240, to-be
-	// 48 §3): the machine's node-engine asks them of its own node tools, and is granted that and no more.
-	Checks []string
-	// Loads says the module has a compiled bundle whose entrypoints the machine's tool runtime loads and runs
-	// (novox/hq ADR 0175; issue 1329): a helper that reaches the bus on the runner's account, so the runner
-	// must carry the module although it declares no tools.
-	Loads bool
-	// RunsAs is the account the module runs as in a runtime of its own (novox/hq ADR 0259 §8): it is never
-	// carried by the machine's runtime, and reaches the bus on its own account.
-	RunsAs string
-	// ProvisionsNode says the module runs the machine's provisioner client: it claims NodeProvisionerSeat and
-	// declares the own secret ProvisionerSecret its account is delivered in (novox/hq ADR 0349 clause 11, design 57
-	// P3). The client is given a bus account of its own, never the module's or the tool runner's.
-	ProvisionsNode bool
-	// Processes are this module's own processes that declare bus (novox/hq ADR 0436 §1), each getting a
-	// principal of its own: granted exactly what its bus says, and nothing of this module's other grants —
-	// composed whether or not the module itself has an account (NoAccount), because a process account is
-	// delivered in its own secret, broker-<process id>, never the module's `broker`.
-	Processes []ProcessPrincipal
-}
-
-// ProcessPrincipal is one process of a module that declares bus (novox/hq ADR 0436 §1, §2), as the broker
-// composes its own account from: its own emits, its own work-queue consumers, its own state, whether it
-// reads the router's records of its module's own asks, and the tools and seat verbs it calls.
-type ProcessPrincipal struct {
-	// Process is the process resource's id, naming the account <node>.<module>.<process id>.
-	Process string
-	// Emits are the events this process may publish, named as the module's own Emits are.
-	Emits []string
-	// Queues are the module's own work-queue streams this process is the one consumer of.
-	Queues []QueueOwner
-	// Removes are what its account may remove from the bus, as its bus declares them (the indexer's judge refuses any other; novox/hq
-	// ADR 0564 Limits 4): a tools bundle's account, whose whole authority is then BusRemovalGrants.
-	Removes []string
-	// State is the module's own state, by local name, this process reads and writes.
-	State []string
-	// Asks says whether this process reads the records of its module's own asks (novox/hq ADR 0259 §3), on
-	// whichever seats the module uses that keep them (the router's, operator-channel, among others).
-	Asks bool
-	// Invokes are the tools and seat verbs this process calls, each <module>.<tool> or a role's
-	// seat:<seat>.<verb>, or * for every tool on the mesh.
-	Invokes []string
-}
-
-// VaultSeat is the vault's seat: its holder alone asks the desks and the issuing providers in its own name.
-const VaultSeat = catalogue.VaultSeat

go/buscompose/waits.go

@@ -1,18 +0,0 @@
-package buscompose
-
-// Wait is one event family the tool runner's module declares: its name as the manifest gives it, and the
-// emitter — a seat or a module — and the event, as the inventory resolved them.
-type Wait struct {
-	// Name is the family as the manifest names it, `<emitter>.<event>`: what a session asks for.
-	Name    string
-	Emitter string
-	// Seat says the emitter is a seat, whose events live under the seat's namespace (novox/hq ADR 0121).
-	Seat bool
-	// Event is the event, with any further token the subject carries: `decided.claude-code`, the asker of a
-	// seat that names it last (ADR 0259 §3).
-	Event string
-	// Last names what the seat's event subject ends in — "kind" for a kinded bench, "asker" for a seat naming
-	// its caller (ADR 0259 §3) — and is empty for an event that ends at its name. A family needing it is waited
-	// on with it given, and refused without.
-	Last string
-}

go/busretry/busretry.go

@@ -1,86 +0,0 @@
-// Package busretry waits out a bus that answers nothing for a few seconds (issue 774, the sweep of 2026-10-30: bus
-// blackouts at every user-list reload). nats-server 2.11's reloadAuthorization rebuilds the accounts, and for a few
-// seconds the mesh's account has none of its imports, $JS.API.> among them: every request is answered "no responders"
-// and every JetStream call "jetstream not enabled". A write or a call made in that window failed, and was lost.
-//
-// Only an error that says the request reached no one is waited out (Undelivered): nothing was done, so asking again
-// is safe even for a write that is not idempotent. A timeout, or any answer, is never asked again: the request may
-// have been delivered. The wait is bounded (Bound, about 30 s, backing off), and said on standard error when it ends
-// without an answer.
-//
-// This is the quick fix. The thorough one is a reload that keeps the account's imports, in the bus's holder.
-package busretry
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// Bound is how long a request that reached no one is asked again; FirstWait the first pause, doubled to MostWait.
-var (
-	Bound     = 30 * time.Second
-	FirstWait = 250 * time.Millisecond
-	MostWait  = 4 * time.Second
-)
-
-// Waits sets Bound, FirstWait and MostWait and returns what puts the earlier values back. They are state every caller
-// in a process shares, so a test sets them only through it, as t.Cleanup(busretry.Waits(...)): a test that set them
-// and left them set shortened the next test's bound to milliseconds, and a loaded check machine overran it (the check
-// of release sdk1, 2026-11-02). A bound a test waits on to succeed is seconds: no slow machine reaches it.
-func Waits(bound, first, most time.Duration) (restore func()) {
-	was := [3]time.Duration{Bound, FirstWait, MostWait}
-	Bound, FirstWait, MostWait = bound, first, most
-	return func() { Bound, FirstWait, MostWait = was[0], was[1], was[2] }
-}
-
-// Undelivered says err means the request reached no one: no responders, JetStream not enabled (for the account), or
-// no response from the stream after the client's own retries on no responders; also said in words by a runtime that
-// passed the error on.
-func Undelivered(err error) bool {
-	var answered *Answered
-	if err == nil || errors.As(err, &answered) {
-		return false
-	}
-	if errors.Is(err, nats.ErrNoResponders) || errors.Is(err, jetstream.ErrJetStreamNotEnabled) ||
-		errors.Is(err, jetstream.ErrJetStreamNotEnabledForAccount) || errors.Is(err, jetstream.ErrNoStreamResponse) ||
-		errors.Is(err, nats.ErrJetStreamNotEnabled) || errors.Is(err, nats.ErrJetStreamNotEnabledForAccount) {
-		return true
-	}
-	words := strings.ToLower(err.Error())
-	return strings.Contains(words, "no responders") || strings.Contains(words, "jetstream not enabled")
-}
-
-// Answered is an error a callee answered with: the request was delivered, whatever its words say ("jetstream not
-// enabled" in a callee's own answer), so Undelivered never counts it and Do never asks it again.
-type Answered struct{ Words string }
-
-func (a *Answered) Error() string { return a.Words }
-
-// Do runs try, and again while its error says the request reached no one, until Bound has passed. blackout, when
-// given, is asked after each such error and Do stops waiting when it says the bus is not blacked out: a call nobody
-// answers because its callee is not running fails at once, as before. what names the request in the error.
-func Do[T any](what string, try func() (T, error), blackout func() bool) (T, error) {
-	v, err := try()
-	if !Undelivered(err) || (blackout != nil && !blackout()) {
-		return v, err
-	}
-	start, wait := time.Now(), FirstWait
-	for time.Since(start) < Bound {
-		time.Sleep(wait)
-		wait = min(wait*2, MostWait)
-		v, err = try()
-		if !Undelivered(err) || (blackout != nil && !blackout()) {
-			return v, err
-		}
-	}
-	err = fmt.Errorf("%s: the bus answered nothing for %s, asked again until then (a user-list reload drops the "+
-		"account's imports for a few seconds; this was longer): %w", what, time.Since(start).Round(time.Second), err)
-	fmt.Fprintf(os.Stderr, "[mesh-sdk] %v\n", err)
-	return v, err
-}

go/busretry/busretry_test.go

@@ -1,54 +0,0 @@
-package busretry
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/nats-io/nats.go"
-	"github.com/nats-io/nats.go/jetstream"
-)
-
-// Issue 774 (bus blackouts at every user-list reload): only a request that reached no one is asked again, within the
-// bound; a blackout probe that says the bus answers ends the wait at once.
-func TestABusThatAnswersNothingIsWaitedOut(t *testing.T) {
-	for _, row := range []struct {
-		name      string
-		errs      []error // what each try answers; the last repeats
-		blackout  func() bool
-		tries     int // at least
-		atMost    int
-		delivered bool
-	}{
-		{"no responders, then an answer", []error{nats.ErrNoResponders, nats.ErrNoResponders, nil}, nil, 3, 3, true},
-		{"jetstream not enabled, then an answer", []error{jetstream.ErrJetStreamNotEnabled, nil}, nil, 2, 2, true},
-		{"said in words by a runtime", []error{errors.New("nats: no responders available for request"), nil}, nil, 2, 2, true},
-		{"a timeout may have been delivered: never asked again", []error{context.DeadlineExceeded}, nil, 1, 1, false},
-		{"an answer that refuses is an answer", []error{errors.New("refused")}, nil, 1, 1, false},
-		{"nobody answers on a bus that answers: the callee is not running", []error{nats.ErrNoResponders}, func() bool { return false }, 1, 1, false},
-		{"blacked out past the bound: said", []error{jetstream.ErrJetStreamNotEnabledForAccount}, func() bool { return true }, 2, 1000, false},
-	} {
-		// A row that ends in an answer waits on a bound of seconds, which no slow machine reaches; only the row that
-		// runs past it has a short one, and asks only that it was asked again at least once.
-		bound := 10 * time.Second
-		if strings.HasPrefix(row.name, "blacked out") {
-			bound = 100 * time.Millisecond
-		}
-		t.Cleanup(Waits(bound, time.Millisecond, 4*time.Millisecond))
-		tries := 0
-		_, err := Do("the test", func() (int, error) {
-			e := row.errs[min(tries, len(row.errs)-1)]
-			tries++
-			return tries, e
-		}, row.blackout)
-		if tries < row.tries || tries > row.atMost || (err == nil) != row.delivered {
-			t.Errorf("%s: %d tries, %v", row.name, tries, err)
-		}
-		if strings.HasPrefix(row.name, "blacked out") && (!Undelivered(err) || !strings.Contains(fmt.Sprint(err), "the bus answered nothing")) {
-			t.Errorf("%s: %v", row.name, err)
-		}
-	}
-}

go/busstate.go

@@ -1,31 +0,0 @@
-package stdio
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"time"
-)
-
-// busStateCalls are the method prefixes of the calls a bundle makes on its own bus state through the runtime (novox/hq
-// ADR 0595 §9, design 25 § 12.5): their shapes and names are package buscalls's, and package busstate the typed way
-// to make them.
-var busStateCalls = []string{"mesh/objects.", "mesh/stream.", "mesh/workqueue.", "mesh/ledger."}
-
-// BusState asks the runtime one call on this bundle's own bus state, an entry its module asks for in `requires`, named
-// by its local name in params; the runtime serves it from the module's own bindings only. A method that is none of
-// those calls is refused here, before the runtime is asked.
-func BusState(method string, params any) (json.RawMessage, error) {
-	known := false
-	for _, p := range busStateCalls {
-		known = known || strings.HasPrefix(method, p)
-	}
-	if !known {
-		return nil, fmt.Errorf("%s is no call on a bundle's own bus state (%s)", method, strings.Join(busStateCalls, ", "))
-	}
-	c, err := live()
-	if err != nil {
-		return nil, err
-	}
-	return c.ask(method, params, 60*time.Second)
-}

go/busstate/busstate.go

@@ -1,59 +0,0 @@
-// Package busstate is how a bundle uses its own bus state through the runtime (novox/hq ADR 0595 §9, design 25 §
-// 12.5): the object store's put, get, list, delete and fill, each naming an entry by the local name its module asks for
-// it by in `requires`. The runtime serves the calls from the module's own bindings, its own entries only. The shapes
-// are package buscalls's; this package makes the calls.
-package busstate
-
-import (
-	"encoding/json"
-	"fmt"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buscalls"
-)
-
-// Objects is one object store the module asks for in `requires` (the template objects, ADR 0595 §2), by its local name.
-type Objects struct{ local string }
-
-// ObjectsOf is the object store of that local name.
-func ObjectsOf(local string) Objects { return Objects{local: local} }
-
-func call[T any](method string, params any) (T, error) {
-	var out T
-	raw, err := stdio.BusState(method, params)
-	if err != nil {
-		return out, err
-	}
-	if err := json.Unmarshal(raw, &out); err != nil {
-		return out, fmt.Errorf("the runtime's answer to %s: %w", method, err)
-	}
-	return out, nil
-}
-
-// Put stores one object whole under its name, replacing one of that name, and answers it as the store holds it.
-func (o Objects) Put(name string, data []byte, description string) (buscalls.ObjectInfo, error) {
-	return call[buscalls.ObjectInfo](buscalls.ObjectsPut, buscalls.ObjectsPutRequest{Objects: o.local, Name: name,
-		Data: data, Description: description})
-}
-
-// Get is one object, its info and its bytes.
-func (o Objects) Get(name string) (buscalls.ObjectData, error) {
-	return call[buscalls.ObjectData](buscalls.ObjectsGet, buscalls.ObjectsNameRequest{Objects: o.local, Name: name})
-}
-
-// List is every object the store holds.
-func (o Objects) List() ([]buscalls.ObjectInfo, error) {
-	l, err := call[buscalls.ObjectsListed](buscalls.ObjectsList, buscalls.ObjectsRequest{Objects: o.local})
-	return l.Objects, err
-}
-
-// Delete removes one object.
-func (o Objects) Delete(name string) error {
-	_, err := call[buscalls.Done](buscalls.ObjectsDelete, buscalls.ObjectsNameRequest{Objects: o.local, Name: name})
-	return err
-}
-
-// Fill is how much the store holds against its cap.
-func (o Objects) Fill() (buscalls.Fill, error) {
-	return call[buscalls.Fill](buscalls.ObjectsInfo, buscalls.ObjectsRequest{Objects: o.local})
-}

go/busstate/busstate_test.go

@@ -1,102 +0,0 @@
-package busstate
-
-import (
-	"bufio"
-	"encoding/json"
-	"io"
-	"testing"
-	"time"
-
-	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/buscalls"
-)
-
-// A bundle keeps objects in its own object store through the runtime (ADR 0595 §2, §9; A3's request for distribution's
-// incoming): each call is the runtime's method of buscalls, naming the store by its local name, and answers as the
-// runtime answered; a method that is no bus-state call is refused before the runtime is asked.
-func TestABundleKeepsObjectsThroughTheRuntime(t *testing.T) {
-	t.Setenv(stdio.ServedAs, "distribution")
-	inR, inW := io.Pipe()
-	outR, outW := io.Pipe()
-	type result struct {
-		what string
-		err  error
-		got  any
-	}
-	results := make(chan result, 8)
-	go func() {
-		_ = stdio.ServeOn("", []stdio.Tool{{Name: "keep", Run: func(map[string]any) (any, error) {
-			go func() {
-				in := ObjectsOf("incoming")
-				info, err := in.Put("t1.part0", []byte("hello"), "a part")
-				results <- result{"put", err, info.Digest}
-				data, err := in.Get("t1.part0")
-				results <- result{"get", err, string(data.Data)}
-				list, err := in.List()
-				results <- result{"list", err, len(list)}
-				results <- result{"delete", in.Delete("t1.part0"), nil}
-				fill, err := in.Fill()
-				results <- result{"fill", err, fill.MaxBytes}
-				_, err = stdio.BusState("mesh/state.get", nil)
-				results <- result{"refused", err, nil}
-			}()
-			return "started", nil
-		}}}, inR, outW)
-	}()
-	lines := bufio.NewScanner(outR)
-	next := func() map[string]any {
-		done := make(chan map[string]any, 1)
-		go func() {
-			if lines.Scan() {
-				var m map[string]any
-				_ = json.Unmarshal(lines.Bytes(), &m)
-				done <- m
-			}
-		}()
-		select {
-		case m := <-done:
-			return m
-		case <-time.After(3 * time.Second):
-			t.Fatal("the bundle said nothing")
-			return nil
-		}
-	}
-	send := func(m map[string]any) { b, _ := json.Marshal(m); _, _ = inW.Write(append(b, '\n')) }
-	send(map[string]any{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": map[string]any{"name": "keep"}})
-	answers := map[string]any{
-		buscalls.ObjectsPut:    buscalls.ObjectInfo{Name: "t1.part0", Size: 5, Digest: "SHA-256=x"},
-		buscalls.ObjectsGet:    buscalls.ObjectData{Info: buscalls.ObjectInfo{Name: "t1.part0"}, Data: []byte("hello")},
-		buscalls.ObjectsList:   buscalls.ObjectsListed{Objects: []buscalls.ObjectInfo{{Name: "t1.part0"}}},
-		buscalls.ObjectsDelete: buscalls.Done{},
-		buscalls.ObjectsInfo:   buscalls.Fill{Count: 0, MaxBytes: 20 << 30},
-	}
-	asked := map[string]map[string]any{}
-	for len(asked) < len(answers) {
-		m := next()
-		method, _ := m["method"].(string)
-		if method == "" {
-			continue // the tool's own answer
-		}
-		p, _ := m["params"].(map[string]any)
-		asked[method] = p
-		send(map[string]any{"jsonrpc": "2.0", "id": m["id"], "result": answers[method]})
-	}
-	want := map[string]any{"put": "SHA-256=x", "get": "hello", "list": 1, "delete": nil, "fill": uint64(20 << 30)}
-	for range 5 {
-		r := <-results
-		if r.err != nil || r.got != want[r.what] {
-			t.Errorf("%s answered %v, %v; want %v", r.what, r.got, r.err, want[r.what])
-		}
-	}
-	if r := <-results; r.err == nil {
-		t.Error("a call that is not on the bundle's bus state was asked of the runtime")
-	}
-	for method, p := range asked {
-		if p["objects"] != "incoming" {
-			t.Errorf("%s named the store %v, not its local name", method, p["objects"])
-		}
-	}
-	if p := asked[buscalls.ObjectsPut]; p["name"] != "t1.part0" || p["data"] != "aGVsbG8=" || p["description"] != "a part" {
-		t.Errorf("put asked %v", p)
-	}
-}

go/calladdress/calladdress.go

@@ -1,108 +0,0 @@
-// Package calladdress reads the key a module calls a tool or a seat verb by, as a module's invokes names it, with the
-// machine it is asked of after '@': `seat:<seat>.<verb>[@<node>]` or `<module>.<tool>[@<node>]` (novox/hq ADR 0159,
-// ADR 0469 §3). Every caller in the SDK parses its key here before it publishes anything, so a malformed key fails at
-// once and says why, never as a call nobody serves and a timeout (novox/hq issue 774, the lease write's stop asked on
-// `...call.stop@novox-be...`).
-package calladdress
-
-import (
-	"fmt"
-	"strings"
-)
-
-// Address is a parsed key: a seat and its verb, or a module and its tool, and the machine named, if any.
-type Address struct {
-	Seat, Verb   string
-	Module, Tool string
-	Node         string
-}
-
-// Key is the address as a module's invokes names it, without the machine.
-func (a Address) Key() string {
-	if a.Seat != "" {
-		return "seat:" + a.Seat + "." + a.Verb
-	}
-	return a.Module + "." + a.Tool
-}
-
-// Parse reads a key, refusing one with more than one '@', a node that is not one subject token, or a seat, verb, module
-// or tool that holds a wildcard, white space or (but a tool) a dot.
-func Parse(key string) (Address, error) {
-	name, node, err := cutNode(key)
-	if err != nil {
-		return Address{}, err
-	}
-	if rest, ok := strings.CutPrefix(name, "seat:"); ok {
-		seat, verb, ok := strings.Cut(rest, ".")
-		if !ok || seat == "" || verb == "" {
-			return Address{}, fmt.Errorf("%q names no seat and verb (seat:<seat>.<verb>)", key)
-		}
-		if err := tokens(key, seat, verb); err != nil {
-			return Address{}, err
-		}
-		return Address{Seat: seat, Verb: verb, Node: node}, nil
-	}
-	module, tool, ok := strings.Cut(name, ".")
-	if !ok || module == "" || tool == "" {
-		return Address{}, fmt.Errorf("%q is not <module>.<tool>, and does not start seat:<seat>.<verb>", key)
-	}
-	if err := tokens(key, module); err != nil {
-		return Address{}, err
-	}
-	if err := checkTool(key, tool); err != nil {
-		return Address{}, err
-	}
-	return Address{Module: module, Tool: tool, Node: node}, nil
-}
-
-// CheckOwn is Parse for a caller that may also name a tool of its own module by its bare name (the runtime's mesh/ask).
-func CheckOwn(key string) error {
-	name, _, err := cutNode(key)
-	if err != nil {
-		return err
-	}
-	if !strings.HasPrefix(name, "seat:") && !strings.Contains(name, ".") {
-		return tokens(key, name)
-	}
-	_, err = Parse(key)
-	return err
-}
-
-// CheckNode refuses a node name that is not one subject token.
-func CheckNode(node string) error {
-	if node == "" || strings.ContainsAny(node, ".*>@ \t\r\n") {
-		return fmt.Errorf("%q is not a node name (one subject token: no '.', '*', '>', '@' or space)", node)
-	}
-	return nil
-}
-
-func cutNode(key string) (name, node string, err error) {
-	name, node, at := strings.Cut(key, "@")
-	if !at {
-		return key, "", nil
-	}
-	if strings.Contains(node, "@") {
-		return "", "", fmt.Errorf("%q holds more than one '@': a key names at most one machine", key)
-	}
-	if err := CheckNode(node); err != nil {
-		return "", "", fmt.Errorf("%q: %w", key, err)
-	}
-	return name, node, nil
-}
-
-func tokens(key string, parts ...string) error {
-	for _, p := range parts {
-		if p == "" || strings.ContainsAny(p, ".*> \t\r\n") {
-			return fmt.Errorf("%q: %q is not one subject token (no '.', '*', '>' or space)", key, p)
-		}
-	}
-	return nil
-}
-
-// checkTool refuses a tool name with a wildcard or white space; a dot is kept, as the tool runner serves it.
-func checkTool(key, tool string) error {
-	if strings.ContainsAny(tool, "*> \t\r\n") || strings.HasPrefix(tool, ".") || strings.HasSuffix(tool, ".") {
-		return fmt.Errorf("%q: %q is not one subject token (no '*', '>' or space)", key, tool)
-	}
-	return nil
-}

go/calladdress/calladdress_test.go

@@ -1,56 +0,0 @@
-package calladdress
-
-import (
-	"strings"
-	"testing"
-)
-
-// Issue 774 notes 84-87 (the lease write's stop asked of `seat:node-service-manager.stop@novox-be` published on a subject
-// nobody serves and timed out after 30 s): a key names its machine after '@', and every other malformed key is refused
-// before anything is published, naming why.
-func TestAKeyIsParsedOrRefusedBeforeItIsPublished(t *testing.T) {
-	for _, row := range []struct {
-		key, want string // want: "seat|<seat>|<verb>|<node>", "mod|<module>|<tool>|<node>", or a refusal's words
-	}{
-		{"seat:node-service-manager.stop@novox", "seat|node-service-manager|stop|novox"},
-		{"seat:operator-channel.tell", "seat|operator-channel|tell|"},
-		{"mesh-build-go.fetch@ace", "mod|mesh-build-go|fetch|ace"},
-		{"nats.nats_users", "mod|nats|nats_users|"},
-		{"seat:node-service-manager.stop@novox@g14", "more than one '@'"},
-		{"seat:node-service-manager.stop@", "not a node name"},
-		{"seat:node-service-manager.stop@nov.ox", "not a node name"},
-		{"seat:node-files.*", "not one subject token"},
-		{"mesh-build-go.fe tch", "not one subject token"},
-		{"mesh>build.fetch", "not one subject token"},
-		{"seat:noverb", "names no seat and verb"},
-		{"nodot", "is not <module>.<tool>"},
-		{"", "is not <module>.<tool>"},
-	} {
-		a, err := Parse(row.key)
-		got := ""
-		switch {
-		case err != nil:
-			got = err.Error()
-			if !strings.Contains(got, row.want) {
-				t.Errorf("Parse(%q) refused %q, want %q", row.key, got, row.want)
-			}
-			continue
-		case a.Seat != "":
-			got = "seat|" + a.Seat + "|" + a.Verb + "|" + a.Node
-		default:
-			got = "mod|" + a.Module + "|" + a.Tool + "|" + a.Node
-		}
-		if got != row.want {
-			t.Errorf("Parse(%q) = %s, want %s", row.key, got, row.want)
-		}
-	}
-	if a, err := Parse("seat:node-files.read@g14"); err != nil || a.Key() != "seat:node-files.read" {
-		t.Errorf("the key without its machine: %q, %v", a.Key(), err)
-	}
-	if err := CheckOwn("list@ace"); err != nil {
-		t.Errorf("a module's own tool by its bare name was refused: %v", err)
-	}
-	if err := CheckOwn("li*st"); err == nil {
-		t.Error("a bare name that is not one token was accepted")
-	}
-}

go/caller.go

@@ -22,19 +22,8 @@ const MetaCaller = "mesh/caller"
 // parts are safe in a subject. Anything else the runtime named is not a caller and reads as Unproven.
 var busUser = regexp.MustCompile(`^[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]+)*$`)
 
-// MetaCall is where in a `tools/call`'s `_meta` the runtime names the id of the call in flight, the id a ledger's
-// apply names so the runtime stamps the caller it proved as the operation's author (novox/hq ADR 0597 §7):
-// buscalls.MetaCall, written here too so this package imports nothing of buscalls.
-const MetaCall = "mesh/call"
-
-// callID is the shape of a call's id: one subject-safe token, as the runtime makes it. Anything else reads as none.
-var callID = regexp.MustCompile(`^[A-Za-z0-9_-]{1,128}$`)
-
-// inFlight is what the runtime said of one call while its tool runs.
-type inFlight struct{ caller, call string }
-
-// calls holds the caller and the id of every call while its tool runs, by the arguments map that call was handed.
-var calls sync.Map // unsafe.Pointer → inFlight
+// calls holds the caller of every call while its tool runs, by the arguments map that call was handed.
+var calls sync.Map // unsafe.Pointer → string
 
 func argsKey(args map[string]any) unsafe.Pointer {
 	return reflect.ValueOf(args).UnsafePointer()
@@ -48,32 +37,11 @@ func CallerOf(args map[string]any) string {
 		return Unproven
 	}
 	if c, ok := calls.Load(argsKey(args)); ok {
-		return c.(inFlight).caller
+		return c.(string)
 	}
 	return Unproven
 }
 
-// CallIDOf is the id of the call that was handed args, as the runtime named it under MetaCall: what a ledger's apply
-// names (buscalls.ApplyRequest.Call) so the operation's author is the caller the runtime proved. Empty for arguments
-// no call was handed, or a call the runtime named no id for; read from `_meta`, never from the arguments.
-func CallIDOf(args map[string]any) string {
-	if args == nil {
-		return ""
-	}
-	if c, ok := calls.Load(argsKey(args)); ok {
-		return c.(inFlight).call
-	}
-	return ""
-}
-
-// callIn is the call id a `tools/call`'s `_meta` names, or empty.
-func callIn(meta map[string]any) string {
-	if s, ok := meta[MetaCall].(string); ok && callID.MatchString(s) {
-		return s
-	}
-	return ""
-}
-
 // callerIn is the caller a `tools/call`'s `_meta` names, or Unproven.
 func callerIn(meta map[string]any) string {
 	if s, ok := meta[MetaCaller].(string); ok && busUser.MatchString(s) {
@@ -82,10 +50,10 @@ func callerIn(meta map[string]any) string {
 	return Unproven
 }
 
-// runAs runs a tool with the caller and the call's id held for its arguments for as long as it runs.
-func runAs(t Tool, caller, call string, args map[string]any) (any, error) {
+// runAs runs a tool with the caller held for its arguments for as long as it runs.
+func runAs(t Tool, caller string, args map[string]any) (any, error) {
 	key := argsKey(args)
-	calls.Store(key, inFlight{caller, call})
+	calls.Store(key, caller)
 	defer calls.Delete(key)
 	return t.Run(args)
 }

go/caller_test.go

@@ -6,33 +6,24 @@ import (
 	"io"
 	"testing"
 	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/buscalls"
 )
 
 // callWith serves one tool that answers the caller CallerOf reads from its arguments, sends it one tools/call
 // with the params given, and returns the caller it answered.
 func callWith(t *testing.T, params map[string]any) string {
-	caller, _ := callAnswering(t, params)
-	return caller
-}
-
-// callAnswering is callWith answering the call's id CallIDOf read too.
-func callAnswering(t *testing.T, params map[string]any) (string, string) {
-	servesAlone(t)
 	t.Helper()
 	inR, inW := io.Pipe()
 	outR, outW := io.Pipe()
 	go func() {
 		_ = ServeOn("tracker", []Tool{{Name: "who", Run: func(args map[string]any) (any, error) {
-			return map[string]any{"caller": CallerOf(args), "call": CallIDOf(args)}, nil
+			return map[string]any{"caller": CallerOf(args)}, nil
 		}}}, inR, outW)
 	}()
 	defer inW.Close()
 	b, _ := json.Marshal(map[string]any{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": params})
 	_, _ = inW.Write(append(b, '\n'))
 	lines := bufio.NewScanner(outR)
-	done := make(chan [2]string, 1)
+	done := make(chan string, 1)
 	go func() {
 		if lines.Scan() {
 			var m struct {
@@ -45,20 +36,19 @@ func callAnswering(t *testing.T, params map[string]any) (string, string) {
 			_ = json.Unmarshal(lines.Bytes(), &m)
 			var answer struct {
 				Caller string `json:"caller"`
-				Call   string `json:"call"`
 			}
 			if len(m.Result.Content) > 0 {
 				_ = json.Unmarshal([]byte(m.Result.Content[0].Text), &answer)
 			}
-			done <- [2]string{answer.Caller, answer.Call}
+			done <- answer.Caller
 		}
 	}()
 	select {
 	case got := <-done:
-		return got[0], got[1]
+		return got
 	case <-time.After(3 * time.Second):
 		t.Fatal("the bundle did not answer the call")
-		return "", ""
+		return ""
 	}
 }
 
@@ -71,28 +61,6 @@ func TestAToolReadsTheCallerTheRuntimeNamed(t *testing.T) {
 	if got != "shanks.node-tools" {
 		t.Fatalf("the tool read caller %q, want the one the runtime named", got)
 	}
-	// The call's id is the runtime's too (ADR 0597 §7): read from `_meta`, never from the arguments, and none when it
-	// is not one token.
-	for _, c := range []struct {
-		args, meta map[string]any
-		want       string
-	}{
-		{map[string]any{}, map[string]any{MetaCaller: "shanks.node-tools", MetaCall: "c-7Hq2"}, "c-7Hq2"},
-		{map[string]any{}, map[string]any{MetaCaller: "shanks.node-tools"}, ""},
-		{map[string]any{MetaCall: "c-forged"}, map[string]any{}, ""},
-		{map[string]any{}, map[string]any{MetaCall: "a b"}, ""},
-		{map[string]any{}, map[string]any{MetaCall: 7}, ""},
-	} {
-		if _, call := callAnswering(t, map[string]any{"name": "who", "arguments": c.args, "_meta": c.meta}); call != c.want {
-			t.Errorf("args %v, meta %v: the tool read call %q, want %q", c.args, c.meta, call, c.want)
-		}
-	}
-	if CallIDOf(map[string]any{"x": 1}) != "" || CallIDOf(nil) != "" {
-		t.Error("arguments no call was handed have a call id")
-	}
-	if MetaCall != buscalls.MetaCall {
-		t.Errorf("the call id's place is %q here and %q in buscalls", MetaCall, buscalls.MetaCall)
-	}
 }
 
 // A caller named in the arguments is not the caller: an argument is the caller's to write.
@@ -107,54 +75,6 @@ func TestACallerInTheArgumentsIsNeverTheCaller(t *testing.T) {
 	if got != "shanks.node-tools" {
 		t.Fatalf("with a caller in the arguments the tool read %q, want the runtime's", got)
 	}
-	// A module's trusted list of callers (issue 774, ADR 0563 §8) grants the callers it names as the runtime proved them:
-	// a module on any machine, <machine>.<module> exactly, person.<name> exactly; no wildcard, never one unproven.
-	callers, err := ParseCallers([]byte(`{"callers":["node-tools","ace.claude-code","person.jo","*"]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for caller, want := range map[string]bool{"shanks.node-tools": true, "ace.claude-code": true, "g14.claude-code": false,
-		"person.jo": true, "person.node-tools": false, Unproven: false, "": false, "novox.mesh-vault": false} {
-		if callers.Allows(caller) != want {
-			t.Errorf("%q allowed: %v, want %v", caller, !want, want)
-		}
-	}
-	if _, err := ParseCallers([]byte(`{"callers":["x"],"more":1}`)); err == nil {
-		t.Error("a list with a field it does not know was read")
-	}
-	// A holder's list per verb (ADR 0627 §2): each verb's entries as above, plus every proved caller (AnyCaller) or
-	// every operator's session (AnyPerson); an unproven caller never, a verb the holder does not serve refused.
-	verbs, err := ParseVerbCallers(`{"publish":["mesh-build-go"],"versions":["*"],"release":["operator","sweep"]}`,
-		[]string{"publish", "versions", "release", "remove"}, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range []struct {
-		verb, caller string
-		want         bool
-	}{{"publish", "ace.mesh-build-go", true}, {"publish", "ace.mesh-build-node", false}, {"versions", "g14.anything", true},
-		{"versions", Unproven, false}, {"release", "person.jo", true}, {"release", "ace.operator", false},
-		{"release", "novox.sweep", true}, {"remove", "novox.sweep", false}} {
-		if got := verbs.Allowed(c.verb, c.caller) == nil; got != c.want {
-			t.Errorf("%s by %q allowed: %v, want %v", c.verb, c.caller, got, c.want)
-		}
-	}
-	if _, err := ParseVerbCallers(`{"mirror":["x"]}`, []string{"publish"}, nil); err == nil {
-		t.Error("a list naming a verb the holder does not serve was read")
-	}
-	if d, _ := ParseVerbCallers(" ", nil, VerbCallers{"publish": {"x"}}); len(d["publish"]) != 1 {
-		t.Error("an empty value is not the holder's defaults")
-	}
-	// As mesh-config resolves the value: the object itself, or written as a string; null is the defaults.
-	for _, raw := range []string{`{"publish":["a"]}`, `"{\"publish\":[\"a\"]}"`, `null`} {
-		c, err := parseConfiguredVerbCallers(json.RawMessage(raw), []string{"publish"}, VerbCallers{"publish": {"a"}})
-		if err != nil || c.Allowed("publish", "ace.a") != nil {
-			t.Errorf("the config value %s read as %v, %v", raw, c, err)
-		}
-	}
-	if ModuleOf("ace.mesh-build-go") != "mesh-build-go" {
-		t.Error("ModuleOf does not read the module of a proved caller")
-	}
 }
 
 // A runtime that names no caller — one from before issue 365, or a call on the subject that names none — is

go/callers.go

@@ -1,131 +0,0 @@
-package stdio
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"slices"
-	"strings"
-)
-
-// Callers is a module's trusted list of who may call a verb of its (novox/hq ADR 0459 §2, ADR 0563 §8), as the mesh
-// writes a list setting into a file the module reads: `{"callers": [...]}`. An entry is a module's name (that module on
-// any machine), exactly <machine>.<module>, or exactly person.<name>. Each caller is the runtime's proof (CallerOf), never
-// an argument; nobody beyond the list is granted, a wildcard is no entry, and an unproven caller never matches.
-type Callers []string
-
-// ParseCallers reads a callers file: the list under `callers`, and nothing else.
-func ParseCallers(raw []byte) (Callers, error) {
-	var f struct {
-		Callers Callers `json:"callers"`
-	}
-	dec := json.NewDecoder(bytes.NewReader(raw))
-	dec.DisallowUnknownFields()
-	if err := dec.Decode(&f); err != nil {
-		return nil, fmt.Errorf("the callers setting is not a list of callers: %v", err)
-	}
-	return f.Callers, nil
-}
-
-// Allows says whether caller, as the runtime proved it, is one the list names.
-func (c Callers) Allows(caller string) bool {
-	if caller == "" || caller == Unproven {
-		return false
-	}
-	for _, entry := range c {
-		if entry == "" || strings.ContainsAny(entry, "*> ") {
-			continue
-		}
-		if entry == caller {
-			return true
-		}
-		if !strings.Contains(entry, ".") {
-			if _, module, ok := strings.Cut(caller, "."); ok && module == entry && !strings.HasPrefix(caller, "person.") {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// VerbCallers is a holder's trusted list per verb (novox/hq ADR 0627 §2, design 51 *Who may call which verb*): for each
-// verb of the seats it holds, the callers that may call it, each entry read as Callers reads it. Two entries more stand
-// for a whole class: AnyCaller lets every proved caller call the verb (a read the mesh keeps open), AnyPerson every
-// operator's session the runtime proved as person.<name>. It names no seat and no verb: the holder gives its verbs and
-// its defaults, and keeps any rule of its own seat (who may never be on a list) beside it.
-type VerbCallers map[string][]string
-
-// The entries of a VerbCallers list that stand for a class of callers.
-const (
-	AnyCaller = "*"
-	AnyPerson = "operator"
-)
-
-// ParseVerbCallers reads a holder's config value of verb to callers; an empty value is defaults. A verb not among verbs
-// is refused, so a list that names a verb the holder does not serve is said at once.
-func ParseVerbCallers(raw string, verbs []string, defaults VerbCallers) (VerbCallers, error) {
-	if strings.TrimSpace(raw) == "" {
-		return defaults, nil
-	}
-	var c VerbCallers
-	if err := json.Unmarshal([]byte(raw), &c); err != nil {
-		return nil, fmt.Errorf("callers is not a JSON object of verb to callers: %w", err)
-	}
-	for verb := range c {
-		if !slices.Contains(verbs, verb) {
-			return nil, fmt.Errorf("callers names the verb %q, which the holder does not serve", verb)
-		}
-	}
-	return c, nil
-}
-
-// Allowed answers nil when caller, as the runtime proved it, may call verb; else the refusal naming both. An unproven
-// caller is never allowed, not even by AnyCaller.
-func (c VerbCallers) Allowed(verb, caller string) error {
-	if caller == "" || caller == Unproven {
-		return fmt.Errorf("%s: refused: the request carries no caller the tool runner proved", verb)
-	}
-	person := strings.HasPrefix(caller, "person.")
-	for _, entry := range c[verb] {
-		switch entry {
-		case AnyCaller:
-			return nil
-		case AnyPerson:
-			if person {
-				return nil
-			}
-		default:
-			if (Callers{entry}).Allows(caller) {
-				return nil
-			}
-		}
-	}
-	return fmt.Errorf("%s: refused for %s: not on the holder's caller list for %s", verb, caller, verb)
-}
-
-// ModuleOf is the module of a proved module caller, which the runtime names <machine>.<module>.
-func ModuleOf(proved string) string {
-	if _, module, ok := strings.Cut(proved, "."); ok {
-		return module
-	}
-	return proved
-}
-
-// ConfiguredVerbCallers is the holder's list as mesh-config resolved its config value key for this machine (Config):
-// a JSON object of verb to callers, or that object written as a string; an unset or empty value is defaults. A value
-// that cannot be read is an error, never the defaults, so a broken list is said, not widened.
-func ConfiguredVerbCallers(key string, verbs []string, defaults VerbCallers) (VerbCallers, error) {
-	raw, err := Config(key)
-	if err != nil {
-		return nil, fmt.Errorf("the config value %s cannot be read: %w", key, err)
-	}
-	return parseConfiguredVerbCallers(raw, verbs, defaults)
-}
-
-func parseConfiguredVerbCallers(raw json.RawMessage, verbs []string, defaults VerbCallers) (VerbCallers, error) {
-	var text string
-	if err := json.Unmarshal(raw, &text); err == nil || len(bytes.TrimSpace(raw)) == 0 || string(bytes.TrimSpace(raw)) == "null" {
-		return ParseVerbCallers(text, verbs, defaults)
-	}
-	return ParseVerbCallers(string(raw), verbs, defaults)
-}

go/catalogue/a_service_process_test.go

@@ -1,77 +0,0 @@
-package catalogue
-
-import (
-	"testing"
-)
-
-// novox/hq issue 213 (ADR 0188 §1, §3): a module's own Go service is a bundle the host runs as a
-// process, not an image. Each test holds one thing that had to change in the composer for the
-// controller to be declared that way.
-
-const aServiceDigest = "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
-
-// aServiceModule is the controller's shape in miniature: it answers tools of its own, its code is a
-// Go bundle a process runs as an account it declares, its secrets belong to that account, it
-// prepares its state, and its process replaces the container it used to run as.
-func aServiceModule(t *testing.T) Manifest {
-	t.Helper()
-	raw := `{
-	  "module": "svc", "version": "1", "tools": ["status"], "prepares": true,
-	  "own-secrets": {"store": "${dir:state}/store"},
-	  "secrets-owner": "svc",
-	  "resources": [
-	    {"id": "state", "type": "directory", "mode": "0700", "place": "mesh", "owner": "svc"},
-	    {"id": "service", "type": "process", "name": "svc", "artifact": "code",
-	     "run": ["./svc", "serve"], "user": "svc", "replaces": ["server"],
-	     "env": {"SVC_STORE_FILE": "${dir:state}/store", "SVC_STORE_PORT": "${seat:mesh-store:5432}"}},
-	    {"id": "account", "type": "user", "name": "svc", "shell": "/usr/bin/nologin", "home": "/var/lib/svc"}
-	  ],
-	  "build": {"artifacts": [{"name": "code", "kind": "bundle", "language": "go", "system": "arch",
-	    "from": "cmd/svc", "binary": "svc"}]}
-	}`
-	m, err := decodeForTest([]byte(raw))
-	if err != nil {
-		t.Fatalf("the service's manifest is refused: %v", err)
-	}
-	resolved, err := m.Resolve([]Built{{Name: "code", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "svc/code@" + aServiceDigest, Digest: aServiceDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return resolved
-}
-
-func indexOf(out []map[string]any, id string) int {
-	for i, r := range out {
-		if r["id"] == id {
-			return i
-		}
-	}
-	return -1
-}
-
-// A module that declares tools has every bundle served by the node's runtime unless it says
-// otherwise — and the controller declares the verbs it answers as tools. Its service bundle is run
-// by its own process; launched a second time by the runtime it would be a second controller
-// pretending to be an MCP server.
-func TestABundleItsOwnProcessRunsIsNotServedByTheRuntime(t *testing.T) {
-	m := aServiceModule(t)
-	if len(m.Bundles) != 1 {
-		t.Fatalf("the service's bundle was not kept: %+v", m.Bundles)
-	}
-	if loads := m.Bundles[0].Loads; len(loads) != 0 {
-		t.Fatalf("the runtime would launch the service's own bundle as tools: %v", loads)
-	}
-	// And a bundle no resource runs still is served, as a module declaring tools always had it.
-	tools := Manifest{Module: "t", Version: "1", Tools: []string{"x"},
-		Build: &Build{Artifacts: []Artifact{{Name: "tools", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/t"}}}}
-	resolved, err := tools.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "t/tools@" + aServiceDigest, Digest: aServiceDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loads := resolved.Bundles[0].Loads; len(loads) != 1 || loads[0] != "t" {
-		t.Fatalf("a tools bundle nothing runs is no longer served: %v", loads)
-	}
-}

go/catalogue/adoption.go

@@ -1,68 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"strings"
-)
-
-// AdoptionPrefix is the id prefix of what the mesh declares of its own on an adopted node. It is
-// never a module's, so none of it is ever held as found.
-const AdoptionPrefix = "adoption."
-
-// Where an opening admits from, on the wire.
-const (
-	OpeningFromEverywhere = "everywhere"
-	OpeningFromMesh       = "mesh"
-)
-
-// The two paths a packet reaches a port by: received by the machine, or forwarded to a
-// container that publishes it.
-const (
-	PathIncoming  = "incoming"
-	PathForwarded = "forwarded"
-)
-
-// Guard resources: the refusal-only table, the unit that loads it, and that unit running.
-const (
-	GuardPath = "/etc/mesh/guard.nft"
-	GuardUnit = "mesh-guard.service"
-	// GuardUnitPath is where the unit is written.
-	GuardUnitPath = "/etc/systemd/system/" + GuardUnit
-)
-
-// GuardPackage is the package that carries nft.
-const GuardPackage = "nftables"
-
-// Published is every port the given containers publish on the machine, by protocol and machine
-// port, mapped to the container's own port. A mapping bound to loopback is left out: nothing off
-// the machine reaches it, forwarded or not.
-func Published(resources []map[string]any) map[string]map[int]int {
-	out := map[string]map[int]int{}
-	for _, r := range resources {
-		if fmt.Sprint(r["type"]) != "container" {
-			continue
-		}
-		listed, _ := r["ports"].([]any)
-		for _, entry := range listed {
-			written := strings.TrimSpace(fmt.Sprint(entry))
-			protocol := "tcp"
-			if cut := strings.LastIndex(written, "/"); cut >= 0 {
-				protocol = written[cut+1:]
-			}
-			// Indexed from the end, so an IPv6 address's own colons never shift the ports.
-			outer, inner, address, ok := mapping(written)
-			if !ok {
-				continue
-			}
-			switch strings.Trim(address, "[]") {
-			case "127.0.0.1", "localhost", "::1":
-				continue
-			}
-			if out[protocol] == nil {
-				out[protocol] = map[int]int{}
-			}
-			out[protocol][outer] = inner
-		}
-	}
-	return out
-}

go/catalogue/adoption_test.go

@@ -1,61 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"testing"
-)
-
-// novox/hq ADR 0100: on an adopted node the found firewall stays in force. The mesh declares
-// openings where it would have loaded a filter, and guards its own ports in a table that only
-// refuses.
-
-// hub is the private network's generator on the hub: it opens the hub's port from anywhere.
-type hub struct{}
-
-// anAdoptedAnchor is the control-node's set: the store, the bus, the registry, the private network,
-// a served module and the filter module.
-func anAdoptedAnchor() Resolution {
-	return Resolution{Node: "anchor", Modules: []Manifest{
-		{Module: "network", Computed: "overlay"},
-		{Module: "postgres", Guards: []int{5432},
-			Listens: []Listening{{Port: 5432, From: FromMesh}},
-			Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-store",
-				"ports": []any{"5432:5432"}}}},
-		{Module: "lavinmq", Guards: []int{15672},
-			Listens: []Listening{{Port: 5671, From: FromMesh}, {Port: 5672, From: FromMesh}},
-			Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-broker",
-				"ports": []any{"5671:5671", "5672:5672", "127.0.0.1:15672:15672"}}}},
-		{Module: "distribution",
-			Listens: []Listening{{Port: 5000, From: FromMesh}},
-			Resources: []map[string]any{{"id": "store", "type": "container", "name": "registry",
-				"ports": []any{"5000"}}}},
-		{Module: "hello-web",
-			Listens: []Listening{{Port: 8080, From: FromEverywhere}},
-			Resources: []map[string]any{{"id": "server", "type": "container", "name": "hello-web",
-				"ports": []any{"8080"}}}},
-		{Module: "helper", Listens: []Listening{{Port: 9000, From: FromMachine}}},
-		{Module: "nftables", Filtering: &Filtering{Into: "/etc/nftables.conf"},
-			Resources: []map[string]any{{"id": "load", "type": "service", "unit": "mesh-filter.service",
-				"state": "running", "restart-on": []any{"filtering"}}}},
-	}}
-}
-
-func byID(resources []map[string]any) map[string]map[string]any {
-	out := map[string]map[string]any{}
-	for _, r := range resources {
-		out[r["id"].(string)] = r
-	}
-	return out
-}
-
-// A mapping bound to loopback is not published to anything off the machine — in either address
-// family — and an address's own colons never shift the ports.
-func TestPublishedLeavesOutLoopbackInBothFamilies(t *testing.T) {
-	got := Published([]map[string]any{{"type": "container", "ports": []any{
-		"127.0.0.1:15672:15672", "[::1]:8080:80", "localhost:9090:90",
-		"[::]:8443:443", "0.0.0.0:5000:5000", "5353:53/udp"}}})
-	want := map[string]map[int]int{"tcp": {8443: 443, 5000: 5000}, "udp": {5353: 53}}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("published is %v, want %v", got, want)
-	}
-}

go/catalogue/amqp_is_not_a_provision_test.go

@@ -1,77 +0,0 @@
-package catalogue
-
-import (
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/internal/beside"
-)
-
-// **The word does not come back through a manifest** (novox/hq ADR 0131). A module that wants
-// messaging wants the mesh's bus, reached through the sdk and named by the `mesh-broker` seat. Naming
-// the old wire protocol asks for the one server being retired, so both directions are refused at the
-// parser — this is judged from the manifest alone, no store needed.
-
-// And the catalogue (internal/beside) names it nowhere — the three modules that did are removed under
-// design 28 task 5.4, not converted.
-func TestNoCatalogueManifestNamesAmqp(t *testing.T) {
-	modules, err := filepath.Glob(filepath.Join(beside.Catalogue(t), "*", "module.json"))
-	modules0 := modules
-	if err != nil || len(modules) == 0 {
-		t.Fatalf("no manifests in the catalogue, so this proved nothing: %v", err)
-	}
-	for _, path := range modules {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if strings.Contains(string(raw), `"amqp"`) {
-			t.Errorf("%s names amqp, which is not a provision (novox/hq ADR 0131)",
-				filepath.Base(filepath.Dir(path)))
-		}
-	}
-	// Nor does this package's code name any module the catalogue holds (ADR 0601 §4): what a module is, its manifest
-	// says. The names are read from the catalogue's module directories, never from a list here; every string literal of
-	// the package's non-test files is read, and a module's name is refused unless it is also a seat's name or one of the
-	// words below, which name something else.
-	t.Run("the package names no module", func(t *testing.T) {
-		modules := map[string]bool{}
-		for _, path := range modules0 {
-			modules[filepath.Base(filepath.Dir(path))] = true
-		}
-		// Words that are a module's name and name something else here: a language, an environment's rendering, a package.
-		elsewhere := map[string]bool{"go": true, "systemd": true, "nftables": true}
-		fset := token.NewFileSet()
-		files, _ := filepath.Glob("*.go")
-		for _, f := range files {
-			if strings.HasSuffix(f, "_test.go") {
-				continue
-			}
-			parsed, err := parser.ParseFile(fset, f, nil, 0)
-			if err != nil {
-				t.Fatal(err)
-			}
-			ast.Inspect(parsed, func(n ast.Node) bool {
-				lit, ok := n.(*ast.BasicLit)
-				if !ok || lit.Kind != token.STRING {
-					return true
-				}
-				word, err := strconv.Unquote(lit.Value)
-				if err != nil || !modules[word] || elsewhere[word] {
-					return true
-				}
-				if _, seat := SeatNamed(word); seat {
-					return true
-				}
-				t.Errorf("%s names the module %s", fset.Position(lit.Pos()), word)
-				return true
-			})
-		}
-	})
-}

go/catalogue/artifact_sweep_seat.go

@@ -1,7 +0,0 @@
-package catalogue
-
-import contractseats "git.novox.be/novox/mesh-contracts/go/seats"
-
-// ArtifactSweepSeat is the seat artifact-store-tools holds. Not the seat mesh-artifact-store, the store itself held by
-// distribution, and not the provision artifact-store it delivers.
-const ArtifactSweepSeat = contractseats.MeshArtifactSweep

go/catalogue/artifacts.go

@@ -1,146 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-
-	contractseats "git.novox.be/novox/mesh-contracts/go/seats"
-)
-
-// ArtifactStoreScheme marks a reference to something in the mesh's artifact store, kept without
-// the store's address.
-const ArtifactStoreScheme = ArtifactStoreProvision + "://"
-
-// Recorded is a reference as the mesh records it: the artifact store's address, if the builder wrote
-// one, taken off.
-//
-// For a reference the builder announced — one it pushed to the store — which is the only kind
-// this is called on. An image the builder named `<host>/<path>@sha256:…` is kept as its path; an
-// archive it named `http://<host>/v2/<path>/blobs/<digest>` likewise. A reference with no address
-// in it — an image id from a genesis build that had nowhere to publish, a package version — is
-// what it was.
-func Recorded(reference string) string {
-	if _, _, seat := InRegistrySeat(reference); seat || strings.HasPrefix(reference, ArtifactStoreScheme) {
-		return reference
-	}
-	if rest, isURL := strings.CutPrefix(reference, "http://"); isURL {
-		if _, path, ok := strings.Cut(rest, "/v2/"); ok && strings.Contains(path, "/blobs/") {
-			return ArtifactStoreScheme + path
-		}
-		return reference
-	}
-	host, path, ok := strings.Cut(reference, "/")
-	if !ok || !isRegistryHost(host) || !strings.Contains(path, "@sha256:") {
-		return reference
-	}
-	return ArtifactStoreScheme + path
-}
-
-// isRegistryHost is the runtime's own rule for reading the first component of a reference as a
-// registry rather than as a namespace: it has a dot or a port in it, or it is localhost.
-func isRegistryHost(component string) bool {
-	return component == "localhost" || strings.ContainsAny(component, ".:")
-}
-
-// InArtifactStore reports whether a reference is a kept one, and what it names there: `<module>/<artifact>@<digest>`
-// for an image, `<module>/<artifact>/blobs/<digest>` for a bundle or an archive. **It reads both forms** (novox/hq ADR
-// 0605 §9): the older `artifact-store://<path>`, and the form a registry seat answers, `<seat>/<module>/<artifact>@<digest>`
-// through container-image-registry or oci-artifact-registry, whose blob it names the way the older form did.
-func InArtifactStore(reference string) (path string, kept bool) {
-	if seat, rest, ok := InRegistrySeat(reference); ok {
-		if seat == OciArtifactRegistrySeat {
-			name, digest, _ := strings.Cut(rest, "@")
-			return name + "/blobs/" + digest, true
-		}
-		return rest, true
-	}
-	return strings.CutPrefix(reference, ArtifactStoreScheme)
-}
-
-// RegistrySeats are the seats a reference of the registry form names first, the two that front the artifact store
-// (novox/hq ADR 0605 §1, §9).
-var RegistrySeats = []string{ContainerImageRegistrySeat, OciArtifactRegistrySeat}
-
-// The four registry seats (novox/hq ADR 0605 §1), named here so the rest of mesh-sdk takes them from the seat set
-// through catalogue alone (ADR 0625 §3).
-const (
-	NpmPackageRegistrySeat     = contractseats.NpmPackageRegistry
-	GoPackageRegistrySeat      = contractseats.GoPackageRegistry
-	ContainerImageRegistrySeat = contractseats.ContainerImageRegistry
-	OciArtifactRegistrySeat    = contractseats.OciArtifactRegistry
-)
-
-// PublishSeats are the seats an artifact is published through (ADR 0605 §1).
-var PublishSeats = []string{NpmPackageRegistrySeat, GoPackageRegistrySeat, ContainerImageRegistrySeat, OciArtifactRegistrySeat}
-
-// The seats of the vault, the provisioner, the hand acts' record and the conditions' keeper, as the seat set names them,
-// for the rest of mesh-sdk (ADR 0625 §3).
-const (
-	VaultSeat       = contractseats.MeshVault
-	ProvisionerSeat = contractseats.MeshProvisioner
-)
-
-// SeatReference is the reference a build names an image, bundle, archive or upstream copy by once it published it
-// through a registry seat (novox/hq ADR 0605 §9): `<seat>/<module>/<artifact>@sha256:<digest>`, as InRegistrySeat reads
-// it back. The store's address is left out, as in the older form: a reader routes it (Routed).
-func SeatReference(seat, module, artifact, digest string) string {
-	return seat + "/" + module + "/" + artifact + "@" + digest
-}
-
-// InRegistrySeat reads a reference in the form a registry seat answers, `<seat>/<module>/<artifact>@sha256:<digest>`:
-// the seat it came through and the rest. A seat's name holds no dot or port, so no image of an outside registry reads
-// as one, and a kept `artifact-store://` reference is not one.
-//
-// It also reads the holder's own naming of an upstream copy through container-image-registry,
-// `container-image-registry/upstream/<host>/<path>@sha256:<digest>`, whose rest InUpstream reads.
-func InRegistrySeat(reference string) (seat, path string, ok bool) {
-	first, rest, found := strings.Cut(reference, "/")
-	if !found || !strings.Contains(rest, "@sha256:") {
-		return "", "", false
-	}
-	if _, _, upstream := InUpstream(rest); upstream && first == ContainerImageRegistrySeat {
-		return first, rest, true
-	}
-	if strings.Count(rest, "/") != 1 {
-		return "", "", false
-	}
-	for _, s := range RegistrySeats {
-		if first == s {
-			return s, rest, true
-		}
-	}
-	return "", "", false
-}
-
-// UpstreamPrefix opens the holder's own name for an upstream copy it keeps: `upstream/<host>/<path>@<digest>`, after
-// `container-image-registry/` in the seat's form and after `artifact-store://` in the older one.
-const UpstreamPrefix = "upstream/"
-
-// InUpstream reads a path in the holder's naming of an upstream copy, `upstream/<host>/<path>@sha256:<digest>` (the path
-// InRegistrySeat or InArtifactStore gives back): the upstream registry host and the image's path there, with its digest.
-// A host is read as the runtime reads one (a dot, a port, or localhost).
-func InUpstream(path string) (host, image string, ok bool) {
-	rest, found := strings.CutPrefix(path, UpstreamPrefix)
-	if !found {
-		return "", "", false
-	}
-	host, image, found = strings.Cut(rest, "/")
-	name, digest, pinned := strings.Cut(image, "@")
-	if !found || !isRegistryHost(host) || name == "" || strings.HasPrefix(name, "/") || strings.HasSuffix(name, "/") ||
-		strings.Contains(name, "//") || !pinned || !strings.HasPrefix(digest, "sha256:") || strings.Contains(digest, "/") {
-		return "", "", false
-	}
-	return host, image, true
-}
-
-// Routed is a kept reference as a machine fetches it, through the artifact store at `address`
-// (host:port). A reference that is not a kept one is what it was.
-func Routed(reference, address string) string {
-	path, kept := InArtifactStore(reference)
-	if !kept {
-		return reference
-	}
-	if strings.Contains(path, "/blobs/") {
-		return "http://" + address + "/v2/" + path
-	}
-	return address + "/" + path
-}

go/catalogue/artifacts_test.go

@@ -1,70 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A build is recorded by what it is; where it is pushed is composed where it is used (novox/hq
-// 04-ISSUES/102).
-
-var digest = "sha256:" + strings.Repeat("d", 64)
-
-func TestAReferenceIsRecordedWithoutTheStoresAddress(t *testing.T) {
-	cases := map[string]string{
-		"anchor.internal:5100/gitea/server@" + digest:                 ArtifactStoreScheme + "gitea/server@" + digest,
-		"localhost:5000/gitea/server@" + digest:                       ArtifactStoreScheme + "gitea/server@" + digest,
-		"http://anchor.internal:5100/v2/gitea/config/blobs/" + digest: ArtifactStoreScheme + "gitea/config/blobs/" + digest,
-		ArtifactStoreScheme + "gitea/server@" + digest:                ArtifactStoreScheme + "gitea/server@" + digest,
-		digest:                  digest,
-		"@novox/sdk@1.2.3":      "@novox/sdk@1.2.3",
-		"gitea/gitea@" + digest: "gitea/gitea@" + digest,
-		"https://registry.example/v2/gitea/config/blobs/" + digest: "https://registry.example/v2/gitea/config/blobs/" + digest,
-		// The form a registry seat answers is recorded as it is (ADR 0605 §9).
-		"container-image-registry/gitea/server@" + digest: "container-image-registry/gitea/server@" + digest,
-		"oci-artifact-registry/gitea/config@" + digest:    "oci-artifact-registry/gitea/config@" + digest,
-	}
-	for announced, want := range cases {
-		if got := Recorded(announced); got != want {
-			t.Errorf("Recorded(%q) = %q, want %q", announced, got, want)
-		}
-	}
-	// And every reader reads both forms: a kept reference and the seat's are fetched from the same place.
-	for reference, want := range map[string]string{
-		ArtifactStoreScheme + "gitea/server@" + digest:       "10.0.0.1:5000/gitea/server@" + digest,
-		"container-image-registry/gitea/server@" + digest:    "10.0.0.1:5000/gitea/server@" + digest,
-		ArtifactStoreScheme + "gitea/config/blobs/" + digest: "http://10.0.0.1:5000/v2/gitea/config/blobs/" + digest,
-		"oci-artifact-registry/gitea/config@" + digest:       "http://10.0.0.1:5000/v2/gitea/config/blobs/" + digest,
-		"registry.example/gitea/server@" + digest:            "registry.example/gitea/server@" + digest,
-		"mesh-artifact-store/gitea/server@" + digest:         "mesh-artifact-store/gitea/server@" + digest,
-		// An upstream copy under the holder's own naming, in both forms.
-		"container-image-registry/upstream/quay.io:443/org/app@" + digest: "10.0.0.1:5000/upstream/quay.io:443/org/app@" + digest,
-		ArtifactStoreScheme + "upstream/quay.io:443/org/app@" + digest:    "10.0.0.1:5000/upstream/quay.io:443/org/app@" + digest,
-	} {
-		if got := Routed(reference, "10.0.0.1:5000"); got != want {
-			t.Errorf("Routed(%q) = %q, want %q", reference, got, want)
-		}
-	}
-	// A build module names what it published in the seat's form, and reads it back as the seat it came through.
-	for _, seat := range RegistrySeats {
-		ref := SeatReference(seat, "gitea", "config", digest)
-		if got, path, ok := InRegistrySeat(ref); !ok || got != seat || path != "gitea/config@"+digest {
-			t.Errorf("SeatReference(%s) = %q, read back as %q %q %v", seat, ref, got, path, ok)
-		}
-	}
-	// The holder's naming of an upstream copy reads through the image seat only, and InUpstream reads its host and path.
-	for reference, want := range map[string]bool{
-		"container-image-registry/upstream/quay.io:443/org/app@" + digest: true,
-		"oci-artifact-registry/upstream/quay.io:443/org/app@" + digest:    false,
-		"container-image-registry/upstream/org/app@" + digest:             false,
-		"container-image-registry/upstream/quay.io/app":                   false,
-	} {
-		_, path, ok := InRegistrySeat(reference)
-		if ok != want {
-			t.Errorf("InRegistrySeat(%q) read %v, want %v", reference, ok, want)
-		}
-		if host, image, up := InUpstream(path); ok && (!up || host != "quay.io:443" || image != "org/app@"+digest) {
-			t.Errorf("InUpstream(%q) = %q %q %v", path, host, image, up)
-		}
-	}
-}

go/catalogue/backup_placement.go

@@ -1,4 +0,0 @@
-package catalogue
-
-// BackupNamespace is the placeholder kind of the machine's backup lines and data.
-const BackupNamespace = "backup"

go/catalogue/backup_placement_test.go

@@ -1,10 +0,0 @@
-package catalogue
-
-// A machine's backup lines are placement (design 57 L3, issue 794): the holder of node-backup names them as
-// `${backup:lines}` and `${backup:data}`, which a handed holder has its client fill from the plan and an unhanded
-// one has the controller fill as it fills `${contribution:node-backup:backup}` and `${...:data}`: the same text.
-
-func dataModule(name string) string {
-	return `{"module":"` + name + `","version":"1","resources":[{"id":"d","type":"directory","mode":"0700"}],
-  "data":{"own":[{"id":"d","path":"${dir:d}","class":"irreplaceable","why":"the ` + name + ` data"}]}}`
-}

go/catalogue/bootstrap_cycle_test.go

@@ -1,49 +0,0 @@
-package catalogue
-
-import (
-	"testing"
-)
-
-// Naming the image directly is the way out, and must stay accepted.
-func TestAnArtifactStoreThatNamesItsImageIsAccepted(t *testing.T) {
-	_, err := decodeForTest([]byte(`{"module":"registry","version":"1",` +
-		`"provides":[{"name":"artifact-store","scope":"mesh"}],` +
-		`"resources":[{"id":"store","type":"container","name":"mesh-registry",` +
-		`"image":"registry@sha256:` +
-		`266f282fabd7cd3df053ee7c658c77b42380d1a2f0d8e5a1c0d7a6d5b5c4a3b2",` +
-		`"ports":["5000:5000"]}]}`))
-	if err != nil {
-		t.Fatalf("the one way an artifact store can be delivered was refused: %v", err)
-	}
-}
-
-// And an ordinary module still builds whatever it likes.
-func TestAModuleThatDoesNotProvideTheStoreStillBuilds(t *testing.T) {
-	_, err := decodeForTest([]byte(`{"module":"forge","version":"1",` +
-		`"build":{"artifacts":[{"name":"forge","kind":"upstream","from":"gitea/gitea:1.22"}]},` +
-		`"resources":[{"id":"run","type":"container","name":"forge","artifact":"forge"}]}`))
-	if err != nil {
-		t.Fatalf("an ordinary module was caught by a rule about the artifact store: %v", err)
-	}
-}
-
-// A mapping that names an address still names the port, and the machine side is still the middle.
-//
-// The foundation bundle writes "127.0.0.1:5432:5432" today, so the shape is not hypothetical.
-// Found in review: the first cut split on the first colon, read "127.0.0.1" as the machine port,
-// failed to parse it, and silently skipped the mapping — which put the filter back on the
-// declared port, the exact fault MachineSide was written to end.
-func TestAnAddressedMappingStillNamesThePort(t *testing.T) {
-	m := Manifest{Module: "store", Resources: []map[string]any{
-		{"type": "container", "id": "server", "ports": []any{"127.0.0.1:8080:80"}},
-	}}
-	for _, named := range []int{8080, 80} {
-		at, mayAssign := m.MachineSide(named)
-		if mayAssign {
-			t.Fatalf("%d was reassigned though the manifest published it explicitly", named)
-		}
-		if at != 8080 {
-			t.Fatalf("naming %d gave %d; the machine side of 127.0.0.1:8080:80 is 8080", named, at)
-		}
-	}
-}

go/catalogue/bound.go

@@ -1,61 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"strings"
-)
-
-// KeptBinding is one consumer this resolution would have moved, and did not.
-type KeptBinding struct {
-	// Machine is where the consumer runs, and Consumer the module there that is bound.
-	Machine  string
-	Consumer string
-	// Provision is what it is bound for.
-	Provision string
-	// Bound is the provider it was recorded at, and still is; Would is the one the resolution chose.
-	Bound Chosen
-	Would Chosen
-}
-
-// String is the condition's sentence: the move, where the data is, and the act that confirms it.
-func (k KeptBinding) String() string {
-	return fmt.Sprintf("would move %s's %s from %s to %s — its data is on %s; kept there. "+
-		"`pin %s %s %s %s` to confirm a move (and move the data first)",
-		k.Consumer, k.Provision, k.Bound, k.Would, k.Bound, k.Machine, k.Provision, k.Would.Node, k.Would.Module)
-}
-
-// Unbound is one consumer that still asks for a provision and whose own resolution binds it to
-// another provider than the one a pair credential on record was made with (novox/hq issue 274).
-//
-// **A provider is granted exactly the consumers bound to it.** The credential from the old provider
-// stays on record — it is the key to a login that provider keeps, disabled, with the consumer's data,
-// until a person deletes it with `cleanup delete` (ADR 0230), and a pin back must find it — but it is
-// no longer granted, so the provider stops being asked for it and retires it. Said on every plan and
-// push of the provider, so a credential the mesh keeps and does not use is never kept silently.
-type Unbound struct {
-	// Provision is what was required, Provider the machine the credential on record is from.
-	Provision string `json:"provision"`
-	Provider  string `json:"provider"`
-	// Consumer is the machine, Module the module on it that requires it, Local the credential's
-	// name inside it where it keeps several (ADR 0094).
-	Consumer string `json:"consumer"`
-	Module   string `json:"module"`
-	Local    string `json:"local,omitempty"`
-	// BoundTo is every provider the consumer's resolution binds this credential to now; empty when
-	// it binds it nowhere — the module asks for the provision under other local names.
-	BoundTo []string `json:"bound_to,omitempty"`
-}
-
-func (u Unbound) String() string {
-	who := u.Module
-	if u.Local != "" {
-		who += " (as " + u.Local + ")"
-	}
-	now := "is bound to no provider under that name"
-	if len(u.BoundTo) > 0 {
-		now = "is bound to " + strings.Join(u.BoundTo, ", ")
-	}
-	return fmt.Sprintf("%s on %s %s for %s, not to %s — %s no longer grants it, so it retires that "+
-		"login and keeps its data until `cleanup delete` (ADR 0230); the credential from %s stays on "+
-		"record while that login does", who, u.Consumer, now, u.Provision, u.Provider, u.Provider, u.Provider)
-}

go/catalogue/bound_into_files.go

@@ -1,8 +0,0 @@
-package catalogue
-
-func orNothing(names []string) string {
-	if len(names) == 0 {
-		return "nothing"
-	}
-	return join(names)
-}

go/catalogue/bound_into_files_test.go

@@ -1,27 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A name too long to stay distinct is refused before anything is created.
-func TestAnIdentityTooLongToBeDistinctIsRefused(t *testing.T) {
-	if err := CheckIdentity("anchor", "keycloak"); err != nil {
-		t.Fatalf("an ordinary consumer was refused: %v", err)
-	}
-	if err := CheckIdentity(strings.Repeat("n", 40), strings.Repeat("m", 40)); err == nil {
-		t.Fatal("an identity that providers would shorten was accepted")
-	}
-}
-
-// Two modules on one node get two identities, which is the whole point of both issues.
-func TestTwoModulesOnOneNodeAreTwoIdentities(t *testing.T) {
-	if ConsumerIdentity("anchor", "gitea") == ConsumerIdentity("anchor", "keycloak") {
-		t.Fatal("two consumers on one machine share an identity")
-	}
-	// And one module on two nodes, likewise.
-	if ConsumerIdentity("anchor", "gitea") == ConsumerIdentity("laptop", "gitea") {
-		t.Fatal("one module on two machines shares an identity")
-	}
-}

go/catalogue/bound_test.go

@@ -1,46 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A consumer of a provision that keeps its data stays bound where its data is (novox/hq ADR 0232,
-// issue 273).
-//
-// The incident, exactly: a machine runs its own store and five consumers of it; the mesh's store seat
-// is held by the store on another machine. Issue 258's rule — the seat's holder elsewhere answers
-// before this machine's own provider — re-bound all five to the holder, each was made a fresh, empty
-// database there, and nothing said so.
-
-func TestAnOfferSaysWhetherItKeepsConsumerData(t *testing.T) {
-	var o Offer
-	if err := json.Unmarshal([]byte(`{"name":"wildcard-resolution","scope":"mesh","keeps-consumer-data":false}`), &o); err != nil {
-		t.Fatal(err)
-	}
-	if o.KeepsConsumerData == nil || *o.KeepsConsumerData {
-		t.Fatalf("read %+v", o)
-	}
-	out, err := json.Marshal(o)
-	if err != nil || !strings.Contains(string(out), `"keeps-consumer-data":false`) {
-		t.Fatalf("wrote %s, %v", out, err)
-	}
-	yes, no := true, false
-	granting := Manifest{Module: "g", Provides: []Offer{{Name: "p", Scope: ScopeMesh}}, Grants: map[string]string{"p": "/g"}}
-	if !granting.KeepsConsumerData("p") {
-		t.Error("a provider granting each consumer a credential keeps what it writes, unsaid")
-	}
-	if (Manifest{Module: "r", Provides: []Offer{{Name: "p", Scope: ScopeMesh}}}).KeepsConsumerData("p") {
-		t.Error("a provider granting nothing keeps nothing, unsaid")
-	}
-	granting.Provides[0].KeepsConsumerData = &no
-	if granting.KeepsConsumerData("p") {
-		t.Error("what an offer says, it gets")
-	}
-	said := Manifest{Module: "s", Provides: []Offer{{Name: "p", Scope: ScopeMesh, KeepsConsumerData: &yes}}}
-	if !said.KeepsConsumerData("p") || !KeepsConsumerData(map[string]Manifest{"s": said, "r": {Module: "r",
-		Provides: []Offer{{Name: "p", Scope: ScopeMesh, KeepsConsumerData: &no}}}}, "p") {
-		t.Error("a name any provider says keeps data keeps data")
-	}
-}

go/catalogue/broker_seat_test.go

@@ -1,45 +0,0 @@
-package catalogue
-
-import (
-	"testing"
-)
-
-// The old broker is gone from the catalogue (novox/hq ADR 0131, design 28 task 5.4), so it is no
-// longer a fixture here. That two eligible holders stand beside each other with one on record is
-// pinned in holdings_test.go against manifests this package owns.
-
-// **A seat and the interface it delivers are different names, and renaming one must not rename
-// the other** (novox/hq ADR 0118). This nearly went wrong: the seats were renamed to the `mesh-*`
-// prefix, and a blanket search-and-replace also renamed `npm-package-registry` and `git` where
-// they are *provisions* — which a consumer requires and a provider offers. The tests failed with
-// "the package registry is served on <nil>", which does not say "you renamed an interface".
-func TestRenamingASeatDidNotRenameTheInterfaceItDelivers(t *testing.T) {
-	for _, pair := range []struct{ seat, delivers string }{
-		{"git", "git"},
-		{"npm-package-registry", "npm-package-registry"},
-		{"mesh-artifact-store", "artifact-store"},
-		{"mesh-store", "postgres-database"},
-		{"mesh-broker", "mesh-bus"},
-	} {
-		s, known := SeatNamed(pair.seat)
-		if !known {
-			t.Fatalf("%q is not a seat", pair.seat)
-		}
-		if s.Delivers != pair.delivers {
-			t.Errorf("the %s seat delivers %q, expected %q — renaming the seat moved the "+
-				"interface with it, and every consumer requiring it would stop resolving",
-				pair.seat, s.Delivers, pair.delivers)
-		}
-		// **Three of these deliberately share a name with what they deliver**, and that is not an
-		// incomplete rename. Renaming a seat that delivers a provision cascades to every consumer
-		// requiring it, with a mesh-wide window where a holder stops resolving mid-flight — so the
-		// trunk deferred exactly those three (novox/hq ADR 0121) while renaming the node-scoped ones.
-		// What this test is for is the other direction: that renaming a seat never moves the
-		// interface, which once produced "the package registry is served on <nil>".
-	}
-}
-
-// A manifest written against an old seat name is told what it became rather than refused as
-// unknown. **That map is the controller's store now, not this package** (novox/hq ADR 0122): a
-// rename is a row, so the courtesy survives a rename nobody recompiled for. Checked where the
-// table is read, not here, where there is no longer a hardcoded list to check against.

go/catalogue/brokered_test.go

@@ -1,35 +0,0 @@
-package catalogue
-
-import (
-	"testing"
-)
-
-// Where the answer to a requirement is allowed to live.
-//
-// A shell, a display server and a private network have to be on the machine that needs them. A
-// database does not — it runs somewhere and is reached over the network. Both were written
-// `requires`, so both were answered the same way, and the second answer was to install PostgreSQL
-// on every machine that runs a web application.
-
-// onNetwork is a set of providers, all of them reachable. Written as a helper because a machine
-// that cannot reach the one answering its requirement is its own case, tested separately.
-// reachable is this machine, on the private network.
-func reachable() Node {
-	n := workstation()
-	n.At = "workstation.internal"
-	return n
-}
-
-func TestTheShortFormStillMeansHere(t *testing.T) {
-	// `"provides": ["shell"]` must keep meaning what it meant, or every existing manifest
-	// silently changes meaning.
-	m, err := decodeForTest([]byte(`{"module":"zsh","version":"1","provides":["shell"]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(m.Provides) != 1 || m.Provides[0].At() != ScopeNode {
-		t.Fatalf("a plain name is no longer node-scoped: %v", m.Provides)
-	}
-}
-
-// Being told, which is the difference between knowing and being able to.

go/catalogue/bucket_shares.go

@@ -1,83 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"regexp"
-)
-
-// BucketShare is one entry of `shares` on a module's requirement of `s3-bucket` (novox/hq ADR 0468 §8): who else may
-// put or get in the consumer's bucket, and with which methods. Not the NFS shares of shares.go (ADR 0263).
-//
-//	"requires": [{"name": "s3-bucket", "shares": [{"to": "seat:node-files", "methods": ["put"]},
-//	                                             {"to": "print-and-scan", "methods": ["get"]}]}]
-//
-// `to` is a module name, or `seat:<seat name>`. `methods` is a non-empty subset of get and put, without a repeat.
-// Shares are allowed on `s3-bucket` only, and no two entries name the same `to`.
-type BucketShare struct {
-	To      string   `json:"to"`
-	Methods []string `json:"methods"`
-}
-
-// BucketRequirement is the requirement `shares` may be written on.
-const BucketRequirement = "s3-bucket"
-
-// RequireSharesKey is where a stored manifest keeps the shares of its requirements: beside `requires`, which stays a
-// plain list of names, for the reason OptionalRequiresKey is beside it. An older controller sets the unknown key
-// aside instead of failing the catalogue.
-const RequireSharesKey = "requires-shares"
-
-// SharesValue is the key of the value a consumer gives the provider of s3-bucket in its grant: the list of
-// {to, methods} sorted by `to`. A consumer's own `contributes` may not name it.
-const SharesValue = "shares"
-
-var shareTarget = regexp.MustCompile(`^(seat:)?[a-z0-9][a-z0-9-]*$`)
-
-// checkBucketShares refuses a malformed `shares` of one requirement, naming the entry and ADR 0468 §8.
-func checkBucketShares(requirement string, shares []BucketShare) error {
-	if len(shares) == 0 {
-		return nil
-	}
-	if requirement != BucketRequirement {
-		return fmt.Errorf("requires %s: `shares` is allowed on %s only (novox/hq ADR 0468 §8)", requirement, BucketRequirement)
-	}
-	seen := map[string]bool{}
-	for i, s := range shares {
-		at := fmt.Sprintf("requires %s: shares[%d] (to %q)", requirement, i, s.To)
-		if !shareTarget.MatchString(s.To) {
-			return fmt.Errorf("%s: `to` is a module name or seat:<seat name> (novox/hq ADR 0468 §8)", at)
-		}
-		if seen[s.To] {
-			return fmt.Errorf("%s: a second entry for the same `to` (novox/hq ADR 0468 §8)", at)
-		}
-		seen[s.To] = true
-		if len(s.Methods) == 0 {
-			return fmt.Errorf("%s: `methods` is empty; name get, put or both (novox/hq ADR 0468 §8)", at)
-		}
-		used := map[string]bool{}
-		for _, method := range s.Methods {
-			if method != "get" && method != "put" {
-				return fmt.Errorf("%s: method %q is not get or put (novox/hq ADR 0468 §8)", at, method)
-			}
-			if used[method] {
-				return fmt.Errorf("%s: method %q twice (novox/hq ADR 0468 §8)", at, method)
-			}
-			used[method] = true
-		}
-	}
-	return nil
-}
-
-// readRequireShares reads the stored form's side key.
-func readRequireShares(raw json.RawMessage) (map[string][]BucketShare, error) {
-	var out map[string][]BucketShare
-	if err := json.Unmarshal(raw, &out); err != nil {
-		return nil, fmt.Errorf("%s: an object of requirement to a list of {to, methods}: %w", RequireSharesKey, err)
-	}
-	for requirement, shares := range out {
-		if err := checkBucketShares(requirement, shares); err != nil {
-			return nil, err
-		}
-	}
-	return out, nil
-}

go/catalogue/bucket_shares_test.go

@@ -1,72 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// Issue 1591: `shares` on a requirement of s3-bucket (novox/hq ADR 0468 §8).
-
-const filesWithShares = `{"module":"files","version":"1","requires":["shell",
-	{"name":"s3-bucket","shares":[{"to":"seat:node-files","methods":["put"]},{"to":"print-and-scan","methods":["get","put"]}]}]}`
-
-// 1591/AC1: parsed, the shares are on the manifest; stored, `requires` is plain names and the side key holds them.
-func TestSharesParseAndAreStoredBesideRequires(t *testing.T) {
-	m := mustParse(t, filesWithShares)
-	want := []BucketShare{{To: "seat:node-files", Methods: []string{"put"}}, {To: "print-and-scan", Methods: []string{"get", "put"}}}
-	if !reflect.DeepEqual(m.RequireShares["s3-bucket"], want) {
-		t.Fatalf("the shares read as %+v", m.RequireShares)
-	}
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var keys map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &keys); err != nil {
-		t.Fatal(err)
-	}
-	if string(keys["requires"]) != `["shell","s3-bucket"]` {
-		t.Errorf("the stored requires is not plain names: %s", keys["requires"])
-	}
-	if !strings.Contains(string(keys[RequireSharesKey]), `"seat:node-files"`) {
-		t.Errorf("the side key does not hold the shares: %s", raw)
-	}
-	var again Manifest
-	if err := json.Unmarshal(raw, &again); err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(again, m) {
-		t.Fatalf("not lossless:\n%+v\n%+v", again, m)
-	}
-}
-
-// 1591/AC2: a malformed share is refused, naming the entry and ADR 0468 §8.
-func TestAMalformedShareIsRefused(t *testing.T) {
-	cases := map[string]string{
-		"unknown method": `{"name":"s3-bucket","shares":[{"to":"a","methods":["delete"]}]}`,
-		"empty to":       `{"name":"s3-bucket","shares":[{"to":"","methods":["get"]}]}`,
-		"malformed to":   `{"name":"s3-bucket","shares":[{"to":"Seat:X y","methods":["get"]}]}`,
-		"empty methods":  `{"name":"s3-bucket","shares":[{"to":"a","methods":[]}]}`,
-		"duplicate to":   `{"name":"s3-bucket","shares":[{"to":"a","methods":["get"]},{"to":"a","methods":["put"]}]}`,
-		"duplicate verb": `{"name":"s3-bucket","shares":[{"to":"a","methods":["get","get"]}]}`,
-		"other require":  `{"name":"route","shares":[{"to":"a","methods":["get"]}]}`,
-	}
-	for name, entry := range cases {
-		_, err := decodeForTest([]byte(`{"module":"files","version":"1","requires":[` + entry + `]}`))
-		if err == nil {
-			t.Errorf("%s: accepted", name)
-			continue
-		}
-		if !strings.Contains(err.Error(), "ADR 0468 §8") || !strings.Contains(err.Error(), "requires") {
-			t.Errorf("%s: the error does not name the entry and the ADR: %v", name, err)
-		}
-	}
-	// The stored form is held to the same rules.
-	_, err := decodeForTest([]byte(`{"module":"files","version":"1","requires":["s3-bucket"],
-		"requires-shares":{"s3-bucket":[{"to":"a","methods":[]}]}}`))
-	if err == nil || !strings.Contains(err.Error(), "ADR 0468 §8") {
-		t.Errorf("the stored form was accepted: %v", err)
-	}
-}

go/catalogue/build.go

@@ -1,365 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"path"
-	"sort"
-	"strings"
-)
-
-// Built is one artifact after it exists: where it is and what it hashes to.
-type Built struct {
-	// Name is what the manifest called it.
-	Name string
-	// Kind is "image" or "archive".
-	Kind string
-	// Reference is what a machine uses to get it — an image reference for an image, a URL for an
-	// archive. Both already carry the digest for an image; an archive carries it separately.
-	Reference string
-	// Digest is "sha256:<hex>", for an archive. An image reference already ends in one.
-	Digest string
-	// Launchers are, for a bundle in an interpreted language, the executable the build wrote beside
-	// each entrypoint, by entrypoint (novox/hq ADR 0193): what the node's runtime starts to serve it.
-	Launchers map[string]string
-	// Texts are, for the archive a module packs its templates into (TemplatesArtifact), each file's text as the
-	// build read it back from the packed archive, by its path inside it (novox/hq ADR 0349 §2). Never carried on
-	// the wire or kept: Resolve reads them into the files' content, which is what the mesh holds.
-	Texts map[string]string `json:"-"`
-}
-
-// Resolve fills a manifest's resources in from what was built.
-//
-// Every resource naming an artifact is rewritten to name the thing itself, and the `artifact` key
-// is removed — because it is a build-time word and the host has never heard of it. A resource
-// naming an artifact nothing produced is refused: it would otherwise reach a machine with an
-// empty image or an unpinned archive, which is the shape of failure that looks like success.
-func (m Manifest) Resolve(built []Built) (Manifest, error) {
-	if m.Build == nil && len(built) == 0 {
-		return m, nil
-	}
-
-	by := map[string]Built{}
-	for _, b := range built {
-		by[b.Name] = b
-	}
-	// Declared and not produced is a build that did not do what the manifest asked, and saying so
-	// here beats a machine reporting it later.
-	var missing []string
-	if m.Build != nil {
-		for _, a := range m.Build.Artifacts {
-			if _, ok := by[a.Name]; !ok {
-				missing = append(missing, a.Name)
-			}
-		}
-	}
-	if len(missing) > 0 {
-		sort.Strings(missing)
-		return Manifest{}, fmt.Errorf(
-			"%s says it builds %s and the build did not produce %s — the build did not do what "+
-				"the manifest asked, which is a different fault from a resource asking for the "+
-				"wrong thing",
-			m.Module, strings.Join(missing, " and "), oneOrOther(len(missing)))
-	}
-
-	// **Each template's text, as the build read it back from its templates archive** (novox/hq ADR 0349 §2): into
-	// the file's content, so what the mesh holds and composes is what the same text inline would be.
-	var handed *Handed
-	if m.Templated() {
-		name := TemplatesArtifact(m)
-		texts := by[name].Texts
-		if name == "" || texts == nil {
-			return Manifest{}, fmt.Errorf("%s names templates, and the build carried no text read back from the "+
-				"archive it packs %s/ into (%q): the builder that built it does not read templates",
-				m.Module, m.TemplatesDir(), name)
-		}
-		dir := m.TemplatesDir()
-		filled, err := fillTemplates(m.Module, dir, m.Resources, func(template string) (string, bool) {
-			t, ok := texts[strings.TrimPrefix(template, dir+"/")]
-			return t, ok
-		}, fmt.Sprintf("the archive %q", name))
-		if err != nil {
-			return Manifest{}, err
-		}
-		items, err := fillItemTemplates(m, m.Items, func(template string) (string, bool) {
-			t, ok := texts[strings.TrimPrefix(template, dir+"/")]
-			return t, ok
-		}, fmt.Sprintf("the archive %q", name))
-		if err != nil {
-			return Manifest{}, err
-		}
-		// And, for a moved module, where its templates are and which one each file and item is filled from
-		// (handed.go): read while its resources and items still name their templates.
-		handed = handedBy(m, by[name])
-		m.Resources = filled
-		m.Items = items
-	}
-
-	out := m
-	out.Handed = handed
-	out.Build = nil
-	// Read with the build, like Build: the manifest the mesh holds carries each file's text (issue 731).
-	out.Templates = ""
-	out.Resources = nil
-	// What the build compiled, kept on the resolved manifest (novox/hq ADR 0175): a tools bundle is
-	// named by no resource of the module's own — the node's runtime loads it — so this is the only
-	// place the mesh would otherwise not have it. In artifact order, so two resolutions of one
-	// build compare equal.
-	out.Bundles = nil
-	if m.Build != nil {
-		run := runByAResource(m)
-		for _, a := range m.Build.Artifacts {
-			if a.Kind != ArtifactBundle {
-				continue
-			}
-			made := by[a.Name]
-			loads := BundleLoads(m, a, run)
-			// **Kept, never routed** (ADR 0155): the builder publishes to the store at the address
-			// it reached it by, and a manifest carrying that address names an installation —
-			// registration refused node-tools for exactly this on 2026-10-02. The build record
-			// already keeps the store-relative form; the resolved manifest keeps the same, and
-			// composition routes it through the store a machine reaches (Routed).
-			out.Bundles = append(out.Bundles, Bundle{
-				Name: a.Name, Source: Recorded(made.Reference), Digest: made.Digest,
-				Language: a.Language, Entrypoints: append([]string(nil), a.Entrypoints...),
-				Loads: loads, Env: copyWords(a.Env), Launchers: copyWords(made.Launchers),
-				Binary: BinaryOf(a), Bus: a.Bus,
-			})
-		}
-		sort.Slice(out.Bundles, func(i, j int) bool { return out.Bundles[i].Name < out.Bundles[j].Name })
-	}
-	for _, r := range m.Resources {
-		named, _ := r["artifact"].(string)
-		if named == "" {
-			out.Resources = append(out.Resources, r)
-			continue
-		}
-		artifact, ok := by[named]
-		if !ok {
-			return Manifest{}, fmt.Errorf(
-				"%s: %v uses the artifact %q, and this module builds no such thing",
-				m.Module, r["id"], named)
-		}
-
-		filled := map[string]any{}
-		for k, v := range r {
-			filled[k] = v
-		}
-		delete(filled, "artifact")
-		switch artifact.Kind {
-		case ArtifactPackage:
-			// A package is not a resource on any machine; it is consumed by other builds. A
-			// resource that names one is a manifest error, named here rather than shipped.
-			return Manifest{}, fmt.Errorf(
-				"%s: %v uses %q, which is a package — a build input, not a resource a machine runs",
-				m.Module, r["id"], named)
-		case ArtifactImage, ArtifactUpstream:
-			filled["image"] = artifact.Reference
-			// An image is not unpacked anywhere, so it has no directory to be named for its
-			// version and `${version}` has nothing to mean. Refused rather than left as literal
-			// text in a path, which is how it would reach a machine and be created as a directory
-			// called `${version}`.
-			for key, value := range filled {
-				if text, isText := value.(string); isText && strings.Contains(text, versionRef) {
-					return Manifest{}, fmt.Errorf(
-						"%s: %v says %s in %q, and %q is an image — an image is not unpacked, so "+
-							"it has no versioned place. %s is for an archive or a bundle",
-						m.Module, r["id"], versionRef, key, named, versionRef)
-				}
-			}
-		case ArtifactArchive, ArtifactBundle:
-			// The same on the wire: both are bytes fetched by digest and unpacked. They differ in
-			// how they were made — one packed as it stood, the other compiled first — and a
-			// machine has no reason to care which.
-			// Kept, not routed, for the reason the bundles above are (ADR 0155).
-			filled["source"] = Recorded(artifact.Reference)
-			filled["digest"] = artifact.Digest
-			// **And `${version}`, so a resource can name a place that is this build's alone**
-			// (novox/hq ADR 0141, 04-ISSUES/142). A component is unpacked into a directory named
-			// for its version so it can read its own version from its path — and until this,
-			// nothing could compose that path: an archive named a fixed one in the manifest and
-			// nothing interpolated the build into it, so nothing could ask for
-			// `…/versions/<version>/` and every machine took a hand-placed fallback.
-			//
-			// The version is the artifact's own digest, short. Not the commit: two builds of one
-			// commit are meant to be the same bytes (the toolchains are `-trimpath` for this), and
-			// a content-addressed version means an unchanged build resolves to the path it already
-			// had — so re-composing a declaration moves nothing, where a commit would move the
-			// path of an identical binary and recreate everything that reads it.
-			for key, value := range filled {
-				filled[key] = withVersion(value, versionOf(artifact.Digest))
-			}
-		default:
-			return Manifest{}, fmt.Errorf("%s: %q is a %q, and an artifact is %q, %q, %q or %q",
-				m.Module, named, artifact.Kind, ArtifactImage, ArtifactArchive, ArtifactUpstream,
-				ArtifactBundle)
-		}
-		out.Resources = append(out.Resources, filled)
-	}
-	return out, nil
-}
-
-// withVersion is a resource's value with `${version}` filled: in a string, and in each string of a map —
-// a process's env, where the controller is told which build it is (novox/hq issue 352). Anything else is
-// left as it is.
-func withVersion(value any, version string) any {
-	switch v := value.(type) {
-	case string:
-		if strings.Contains(v, versionRef) {
-			return strings.ReplaceAll(v, versionRef, version)
-		}
-	case map[string]any:
-		out := make(map[string]any, len(v))
-		for k, x := range v {
-			out[k] = withVersion(x, version)
-		}
-		return out
-	case map[string]string:
-		out := make(map[string]string, len(v))
-		for k, x := range v {
-			out[k] = strings.ReplaceAll(x, versionRef, version)
-		}
-		return out
-	}
-	return value
-}
-
-// NamedPaths are the paths a module's fingerprint takes its tree from (novox/hq ADR 0499 clause 2): the union of the
-// paths its artifacts name, cleaned and sorted, and every true only when the module builds something and every artifact
-// names paths; otherwise none, and the module keeps its directory's tree.
-//
-// **Read by the core alone** (ADR 0495 clause 1, the lead's decision L8 of R4e): the indexer and its merge preview
-// (buildstep.ModuleTrees) call it. A build module's fetch step is handed the paths by the builder, from the indexer's
-// kept inputs (delivery.KeptInputs2.Paths), and reads no manifest for them.
-func (m Manifest) NamedPaths() (paths []string, every bool) {
-	if m.Build == nil || len(m.Build.Artifacts) == 0 {
-		return nil, false
-	}
-	seen := map[string]bool{}
-	for _, a := range m.Build.Artifacts {
-		if len(a.Paths) == 0 {
-			return nil, false
-		}
-		for _, p := range a.Paths {
-			seen[path.Clean(p)] = true
-		}
-	}
-	for p := range seen {
-		paths = append(paths, p)
-	}
-	sort.Strings(paths)
-	return paths, true
-}
-
-// oneOrOther keeps the message readable for one artifact and for several, because a message that
-// says "neither" about one thing reads as a bug in the message.
-func oneOrOther(n int) string {
-	if n == 1 {
-		return "it"
-	}
-	return "them"
-}
-
-// compilesToABinary is whether this language's bundle is a binary for one operating system rather
-// than code that runs wherever its interpreter does.
-//
-// **Asked of the language, not of the artifact.** A module says what it is written in; what that
-// implies is the mesh's to know, exactly as the compiler is (novox/hq ADR 0142). Asking the artifact
-// would let two artifacts in one language disagree about whether they are portable.
-func compilesToABinary(language string) bool {
-	switch strings.ToLower(strings.TrimSpace(language)) {
-	case "go":
-		return true
-	default:
-		return false
-	}
-}
-
-// versionRef is how a resource names the version of the artifact it uses: ${version}.
-//
-// No artifact name in it, because the resource already says which artifact it is for — a second
-// name would be a second thing to keep in step with the first.
-const versionRef = "${version}"
-
-// versionOf is an artifact's version as a path names it: its digest, short.
-//
-// **Content-addressed on purpose.** The alternative is the commit a build came from, and two builds
-// of one commit are meant to produce the same bytes — every toolchain here is `-trimpath` for that
-// reason. A commit-named path would move for an identical binary, and everything reading that path
-// would be recreated for a change that is not one. A digest-named path moves exactly when the bytes
-// do.
-//
-// Twelve hex characters: enough that two of this mesh's builds will not collide, short enough to
-// read in a path and in a journal line. The `sha256:` prefix goes, because a directory name carrying
-// a colon is a directory name people quote wrong.
-func versionOf(digest string) string {
-	hex := strings.TrimPrefix(strings.TrimSpace(digest), "sha256:")
-	if len(hex) > 12 {
-		return hex[:12]
-	}
-	return hex
-}
-
-func copyWords(in map[string]string) map[string]string {
-	if len(in) == 0 {
-		return nil
-	}
-	out := make(map[string]string, len(in))
-	for k, v := range in {
-		out[k] = v
-	}
-	return out
-}
-
-// BinaryOf is what a bundle compiled to a binary is called once built: what the artifact names, else
-// the package it is built from, else the artifact's own name (novox/hq 04-ISSUES/142). Empty for a
-// language that does not compile to one. The builder writes the binary under this name, and the
-// composer runs it by it, so both ask here.
-func BinaryOf(a Artifact) string {
-	if !compilesToABinary(a.Language) {
-		return ""
-	}
-	if name := strings.TrimSpace(a.Binary); name != "" {
-		return name
-	}
-	if from := strings.Trim(a.From, "./"); from != "" {
-		return path.Base(from)
-	}
-	return a.Name
-}
-
-// runByAResource is the artifacts one of a module's own resources names — a process that runs it,
-// a step, an archive that unpacks it — by name.
-func runByAResource(m Manifest) map[string]bool {
-	named := map[string]bool{}
-	for _, r := range m.Resources {
-		if a, ok := r["artifact"].(string); ok && a != "" {
-			named[a] = true
-		}
-	}
-	return named
-}
-
-// BundleLoads is what the runtime loads of the bundle artifact a of m (run: the bundles one of m's own resources runs,
-// runByAResource): what the artifact said, else every entrypoint of a module that declares tools, else nothing; a
-// bundle compiled to a binary is served by its binary. The rule a build's resolution keeps on Bundle.Loads, and what a
-// module composed as what runs of it reads again when the runtime already dropped it (issue 1126).
-func BundleLoads(m Manifest, a Artifact, run map[string]bool) []string {
-	// What the runtime loads: what the artifact said, else every entrypoint of a module
-	// that declares tools, else nothing (the field's own rule; see Artifact.Loads).
-	//
-	// **Never, unasked, a bundle one of the module's own resources runs** (novox/hq issue 213).
-	// A process the host runs is the module's service, not its tools: the controller declares
-	// the verbs it answers as `tools` and serves them itself, and its bundle would otherwise
-	// have been launched a second time by the node's runtime, as an MCP child it is not.
-	loads := append([]string(nil), a.Loads...)
-	if a.Loads == nil && len(m.Tools) > 0 && !run[a.Name] {
-		loads = append([]string(nil), a.Entrypoints...)
-		// A bundle compiled to a binary has no entrypoints: the binary is what it is, and what
-		// the runtime starts to serve it (novox/hq ADR 0193). So a Go tools bundle is served
-		// as Go — the runtime execs it — exactly as a TypeScript one is through its launcher.
-		if bin := BinaryOf(a); bin != "" {
-			loads = []string{bin}
-		}
-	}
-	return loads
-}

go/catalogue/build_system_test.go

@@ -1,8 +0,0 @@
-package catalogue
-
-// bundleFor is a manifest whose one artifact is a bundle in the given language and system.
-func bundleFor(language, system string) Manifest {
-	return Manifest{Module: "a-component", Build: &Build{Artifacts: []Artifact{
-		{Name: "binary", Kind: ArtifactBundle, Language: language, System: system},
-	}}}
-}

go/catalogue/build_test.go

@@ -1,122 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The manifest in a repository and the manifest the mesh holds are two documents.
-//
-// A digest is not knowable until something is built, so a repository carrying one would be a
-// repository whose file is wrong the moment anybody edits anything — and the mesh would be pinning
-// a value nobody could have checked.
-
-func buildable() Manifest {
-	return Manifest{
-		Module: "meshboard", Version: "1",
-		Build: &Build{Artifacts: []Artifact{
-			{Name: "server", Kind: ArtifactImage, From: "Dockerfile"},
-			{Name: "theme", Kind: ArtifactArchive, From: "files"},
-		}},
-		Resources: []map[string]any{
-			{"id": "svc", "type": "container", "name": "meshboard", "artifact": "server"},
-			{"id": "look", "type": "archive", "path": "/opt/meshboard", "artifact": "theme"},
-			{"id": "dir", "type": "directory", "path": "/opt/meshboard"},
-		},
-	}
-}
-
-func wasBuilt() []Built {
-	return []Built{
-		{Name: "server", Kind: ArtifactImage,
-			Reference: "registry.invalid/meshboard@sha256:" + strings.Repeat("a", 64)},
-		{Name: "theme", Kind: ArtifactArchive,
-			Reference: "https://store.invalid/theme.tar.gz",
-			Digest:    "sha256:" + strings.Repeat("b", 64)},
-	}
-}
-
-func TestAResourceNamingAnArtifactBecomesOneNamingTheThing(t *testing.T) {
-	got, err := buildable().Resolve(wasBuilt())
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range got.Resources {
-		if r["artifact"] != nil {
-			// A build-time word the host has never heard of. Leaving it would be a field the
-			// strict decoder refuses on the machine, at the worst moment.
-			t.Fatalf("%v still names an artifact: %v", r["id"], r)
-		}
-	}
-	if got.Resources[0]["image"] != "registry.invalid/meshboard@sha256:"+strings.Repeat("a", 64) {
-		t.Fatalf("the image was not filled in: %v", got.Resources[0])
-	}
-	if got.Resources[1]["source"] != "https://store.invalid/theme.tar.gz" ||
-		got.Resources[1]["digest"] != "sha256:"+strings.Repeat("b", 64) {
-		t.Fatalf("the archive was not filled in: %v", got.Resources[1])
-	}
-	// And a resource that names nothing is untouched.
-	if got.Resources[2]["path"] != "/opt/meshboard" || len(got.Resources[2]) != 3 {
-		t.Fatalf("an ordinary resource was changed: %v", got.Resources[2])
-	}
-	// The built manifest carries no build section: it is the derived document, and something
-	// holding both would invite somebody to build from it again.
-	if got.Build != nil {
-		t.Fatal("the built manifest still says how to build itself")
-	}
-}
-
-func TestAnArtifactDeclaredAndNotBuiltIsRefused(t *testing.T) {
-	// A build that did not do what the manifest asked. Said here rather than by a machine later
-	// reporting an empty image.
-	_, err := buildable().Resolve(wasBuilt()[:1])
-	if err == nil {
-		t.Fatal("a manifest resolved with an artifact missing")
-	}
-	if !strings.Contains(err.Error(), "theme") {
-		t.Fatalf("the refusal does not name what is missing: %v", err)
-	}
-	// And it must blame the build rather than the resource. A resource asking for something that
-	// does not exist is a manifest fault; a build not producing what the manifest declared is a
-	// build fault, and telling somebody to fix the wrong one costs an afternoon.
-	if !strings.Contains(err.Error(), "the build did not produce") {
-		t.Fatalf("the refusal blames the wrong thing: %v", err)
-	}
-}
-
-func TestAResourceNamingSomethingTheModuleDoesNotBuildIsRefused(t *testing.T) {
-	m := buildable()
-	m.Resources = append(m.Resources,
-		map[string]any{"id": "other", "type": "archive", "path": "/x", "artifact": "nothing"})
-	if _, err := m.Resolve(wasBuilt()); err == nil {
-		t.Fatal("a resource naming an artifact nobody builds was accepted")
-	}
-}
-
-func TestAModuleThatBuildsNothingIsOrdinary(t *testing.T) {
-	// Most of what a person installs is configuration. Requiring an empty build section would be
-	// a field that exists to be left blank.
-	m := Manifest{Module: "shell", Version: "1", Resources: []map[string]any{
-		{"id": "rc", "type": "file", "path": "/etc/zsh/zshrc", "content": "setopt"},
-	}}
-	got, err := m.Resolve(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Resources) != 1 {
-		t.Fatalf("got %v", got.Resources)
-	}
-}
-
-func TestAResourceNamingAPackageIsRefused(t *testing.T) {
-	m, err := decodeForTest([]byte(`{"module":"a","version":"1","slug":"a",
-		"build":{"artifacts":[{"name":"lib","kind":"package","language":"typescript"}]},
-		"resources":[{"id":"svc","type":"container","name":"a","artifact":"lib"}]}`))
-	if err != nil {
-		t.Fatalf("parse: %v", err)
-	}
-	_, err = m.Resolve([]Built{{Name: "lib", Kind: ArtifactPackage, Reference: "@novox/a@1.0.0"}})
-	if err == nil {
-		t.Fatal("a resource backed by a package was accepted; a package is not a resource")
-	}
-}

go/catalogue/bus_snapshot_test.go

@@ -1,46 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/internal/beside"
-)
-
-// The catalogue's bus protects its streams by the snapshot, not as live files: its streams' item is a
-// dump into its snapshots, it has the account the dump runs as, and the dump runs the snapshot
-// program in the bus's own container.
-func TestTheCataloguesBusIsBackedUpBySnapshot(t *testing.T) {
-	raw, err := os.ReadFile(filepath.Join(beside.Catalogue(t), "nats", "module.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	m, err := decodeForTest(raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, account := m.OwnSecrets["broker"]; !account {
-		t.Fatal("the bus declares no account, so its snapshot could not reach it")
-	}
-	var found bool
-	if m.Data == nil {
-		t.Fatal("the bus declares no data")
-	}
-	for _, it := range m.Data.Own {
-		if it.ID != "jetstream" {
-			continue
-		}
-		found = true
-		if !it.Backup.IsDump() || it.Backup.Into != "snapshots" {
-			t.Fatalf("the bus's streams are protected by %+v, not a snapshot into its snapshots", it.Backup)
-		}
-		if !strings.Contains(it.Backup.Dump, "mesh-nats-snapshot snapshot") {
-			t.Fatalf("the dump does not run the snapshot program: %s", it.Backup.Dump)
-		}
-	}
-	if !found {
-		t.Fatal("the bus declares no item for its streams")
-	}
-}

go/catalogue/busstate.go

@@ -1,207 +0,0 @@
-package catalogue
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"strings"
-)
-
-// Bus state is what a module keeps on the bus, asked for as a provision of the bus module in `requires` (novox/hq ADR
-// 0595 §1, design 32 § 4): an entry of `requires` in its typed long form, the local name, the storage type, the template
-// and the template's options. This is the contract only (ADR 0578 §7, ADR 0593 §1): the entry's shape, decoded
-// leniently. Every rule that judges an entry (a template known, an option within its bound, a fixed setting not given)
-// is the indexer's judge's.
-
-// The storage types (design 25 § 12.1): the stream is the base; the key-value bucket, the object store and the ledger
-// are built on it, each with calls of its own (ADR 0595 §2).
-const (
-	StorageStream      = "stream"
-	StorageKeyValue    = "key-value"
-	StorageObjectStore = "object-store"
-	StorageLedger      = "ledger"
-)
-
-// The six templates, each a storage type with a predefined configuration (ADR 0595 §2, design 25 § 12.1): state on
-// key-value, events, work queue and log on stream, objects on object store, ledger on ledger. A bare stream names
-// none and gives its own Configuration.
-const (
-	TemplateState     = "state"
-	TemplateEvents    = "events"
-	TemplateWorkQueue = "work-queue"
-	TemplateLog       = "log"
-	TemplateObjects   = "objects"
-	TemplateLedger    = "ledger"
-)
-
-// The option names, a template's settings a module may change (design 25 § 12.1's table), written as the old sections
-// wrote them, so a module that moves carries its old settings as options unchanged (ADR 0595 §11). Which option a
-// template takes, and its bound, is the judge's.
-const (
-	// OptionPastValues is how many past values a state's key keeps (the old `state`'s `history`).
-	OptionPastValues = "history"
-	// OptionTimeToLive is how long a state's value lives, in seconds.
-	OptionTimeToLive = "ttl-seconds"
-	// OptionLifetimePerKey is whether a state's key may be given a lifetime of its own.
-	OptionLifetimePerKey = "key-ttl"
-	// OptionPerMachine is whether a state is kept one bucket per machine.
-	OptionPerMachine = "per-machine"
-	// OptionAgeDays is how long a stream keeps a message, in days.
-	OptionAgeDays = "max-age-days"
-	// OptionCapMiB is the cap of a stream, a bucket or an object store, in MiB.
-	OptionCapMiB = "max-mib"
-	// OptionGrant names the trusted config value granting another module a part of it (ADR 0363 §4, ADR 0592 §9).
-	OptionGrant = "grant"
-	// OptionDeliveries is how many times a work queue's message is delivered before it is a dead letter.
-	OptionDeliveries = "max-deliveries"
-	// OptionDuplicates is how long, in seconds, a work queue detects a message sent twice.
-	OptionDuplicates = "duplicates"
-)
-
-// ConfigWhenFull is what a configuration of its own says a bare stream does when full: WhenFullRefuse or
-// WhenFullDropOldest. In a template it is fixed, never an option (ADR 0595 §3).
-const (
-	ConfigWhenFull     = "when-full"
-	WhenFullRefuse     = "refuse"
-	WhenFullDropOldest = "drop-oldest"
-)
-
-// The ledger effects, what an operation does to an instance's state (ADR 0597 §2): one of this fixed set.
-const (
-	// EffectSetFields sets the state's fields to the operation's Fields.
-	EffectSetFields = "set-fields"
-	// EffectSetEntry sets one entry of the state's map Into, under the key the operation's field Key holds, to its Fields.
-	EffectSetEntry = "set-entry"
-	// EffectAppend appends the operation's Fields to the state's list Into.
-	EffectAppend = "append"
-	// EffectRemove removes the entry of the map Into under the operation's field Key, or, naming no Into, the instance's
-	// state.
-	EffectRemove = "remove"
-)
-
-// LedgerType is one type of a ledger (ADR 0597 §1): a schema and the operations allowed on it, with its indexes. An
-// instance of it is named by a path whose first part is the type's name (`decision/0290`).
-type LedgerType struct {
-	Name string `json:"name"`
-	// Schema is the type's fields, by name.
-	Schema map[string]LedgerField `json:"schema"`
-	// Operations are the operations allowed on an instance, each with its effect.
-	Operations []LedgerOperation `json:"operations"`
-	// Indexes are its declared indexes, each a second key-value bucket kept by a watcher (ADR 0597 §4).
-	Indexes []LedgerIndex `json:"indexes,omitempty"`
-}
-
-// LedgerField is one field of a ledger type's schema.
-type LedgerField struct {
-	// Type is the field's value type, as the schema names it.
-	Type string `json:"type"`
-	// DigestOf names the text field this field is the digest of (ADR 0597 §2): `apply` refuses an operation whose
-	// digest does not match its text.
-	DigestOf string `json:"digest-of,omitempty"`
-}
-
-// LedgerOperation is one operation a ledger type allows, and its effect on the state.
-type LedgerOperation struct {
-	Name string `json:"name"`
-	// Effect is one of the ledger effects (EffectSetFields, EffectSetEntry, EffectAppend, EffectRemove).
-	Effect string `json:"effect"`
-	// Fields are the operation's fields its effect copies into the state; it may carry more (ADR 0597 §2).
-	Fields []string `json:"fields,omitempty"`
-	// Into is the state's map (EffectSetEntry, EffectRemove) or list (EffectAppend) the effect writes.
-	Into string `json:"into,omitempty"`
-	// Key is the operation's field holding the entry's key (EffectSetEntry, EffectRemove).
-	Key string `json:"key,omitempty"`
-	// Sequence and Author are whether the effect also writes the operation's sequence and its proven author.
-	Sequence bool `json:"sequence,omitempty"`
-	Author   bool `json:"author,omitempty"`
-}
-
-// LedgerIndex is one declared index of a ledger type: its name, and the fields it is kept on.
-type LedgerIndex struct {
-	Name string   `json:"name"`
-	On   []string `json:"on"`
-}
-
-// BusStateField is where a stored manifest keeps its bus-state entries: beside `requires`, which stays a plain list of
-// names, as OptionalRequiresKey keeps the optional ones.
-const BusStateField = "bus-state"
-
-// BusStateEntry is one piece of a module's bus state, as its manifest asks for it.
-type BusStateEntry struct {
-	// Name is its local name; the mesh, never the module, names it on the bus (ADR 0201 §4).
-	Name string `json:"name"`
-	// Storage is its storage type (design 25 § 12.1): how the bus keeps it.
-	Storage string `json:"storage"`
-	// Template is the predefined configuration of that storage type it uses; empty for a bare stream, which gives
-	// Configuration instead.
-	Template string `json:"template,omitempty"`
-	// Options are the template's settings the module changes, by option name; each value as the manifest wrote it.
-	Options map[string]json.RawMessage `json:"options,omitempty"`
-	// Configuration is a configuration of the module's own, where no template fits: a bare stream's, or a ledger's
-	// whose history expires (ADR 0595 §2).
-	Configuration map[string]json.RawMessage `json:"configuration,omitempty"`
-	// Types are a ledger's types (ADR 0597 §1), for the storage type ledger only.
-	Types []LedgerType `json:"types,omitempty"`
-}
-
-// isBusStateEntry is whether a `requires` item in its long form asks for bus state: it names a storage type.
-func isBusStateEntry(raw json.RawMessage) bool {
-	var keys map[string]json.RawMessage
-	if json.Unmarshal(raw, &keys) != nil {
-		return false
-	}
-	_, has := keys["storage"]
-	return has
-}
-
-// readBusStateEntry reads one bus-state entry leniently (ADR 0578 §3): a key it does not know, at any depth, is set
-// aside and its path named, never refused. An error is only an entry of the wrong shape.
-func readBusStateEntry(raw json.RawMessage) (BusStateEntry, []string, error) {
-	var tree any
-	dec := json.NewDecoder(bytes.NewReader(raw))
-	dec.UseNumber()
-	if err := dec.Decode(&tree); err != nil {
-		return BusStateEntry{}, nil, err
-	}
-	var aside []string
-	strict := func(e *BusStateEntry) error {
-		b, err := json.Marshal(tree)
-		if err != nil {
-			return err
-		}
-		d := json.NewDecoder(bytes.NewReader(b))
-		d.DisallowUnknownFields()
-		return typedUnknown(d.Decode(e))
-	}
-	for tries := 0; ; tries++ {
-		var e BusStateEntry
-		err := strict(&e)
-		if err == nil {
-			return e, aside, nil
-		}
-		unknown := asUnknownField(err)
-		if unknown == nil || tries > 64 {
-			return BusStateEntry{}, nil, err
-		}
-		path, ok := removalThatHelps(tree, unknown.Field, err.Error(), func() error { var e BusStateEntry; return strict(&e) })
-		if !ok {
-			if removeEvery(tree, unknown.Field) == 0 {
-				return BusStateEntry{}, nil, err
-			}
-			path = "…." + unknown.Field
-		}
-		aside = append(aside, path)
-	}
-}
-
-// setAsideAlso adds paths read without to what a manifest set aside (SetAside), in its words.
-func setAsideAlso(unknown string, paths []string) string {
-	if len(paths) == 0 {
-		return unknown
-	}
-	if unknown == "" {
-		field := paths[0][strings.LastIndex(paths[0], ".")+1:]
-		unknown = fmt.Sprintf("json: unknown field %q", field)
-	}
-	return unknown + " (read without " + strings.Join(paths, ", ") + ")"
-}

go/catalogue/busy.go

@@ -1,69 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"sort"
-	"strings"
-	"time"
-)
-
-// BusyField is the resource field.
-const BusyField = "busy"
-
-// The bounds of one ask (ADR 0335), the node-engine's own, held here near the author.
-const (
-	BusyTimeoutDefault = 10 * time.Second
-	BusyTimeoutCeiling = time.Minute
-)
-
-// Busy is one container's busy, read.
-type Busy struct {
-	Command string
-	Timeout time.Duration
-}
-
-// ReadBusy reads a resource's `busy` field, its default applied. False when it carries none.
-func ReadBusy(r map[string]any) (Busy, bool, []string) {
-	raw, present := r[BusyField]
-	if !present {
-		return Busy{}, false, nil
-	}
-	id := fmt.Sprint(r["id"])
-	fields, ok := raw.(map[string]any)
-	if !ok {
-		return Busy{}, true, []string{fmt.Sprintf("%s: busy is %T; it is an object with a command", id, raw)}
-	}
-	var problems []string
-	keys := make([]string, 0, len(fields))
-	for k := range fields {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		if k != "command" && k != "timeout" {
-			problems = append(problems, fmt.Sprintf("%s: its busy says %q; busy has a command and a timeout", id, k))
-		}
-	}
-	b := Busy{Timeout: BusyTimeoutDefault}
-	if v, has := fields["command"]; has {
-		s, ok := v.(string)
-		if !ok {
-			problems = append(problems, fmt.Sprintf("%s: its busy's command is %T; it is text", id, v))
-		}
-		b.Command = strings.TrimSpace(s)
-	}
-	if v, has := fields["timeout"]; has {
-		s, _ := v.(string)
-		d, err := time.ParseDuration(strings.TrimSpace(s))
-		switch {
-		case err != nil:
-			problems = append(problems, fmt.Sprintf("%s: its busy's timeout is %v; it is a duration such as \"10s\"", id, v))
-		case d <= 0 || d > BusyTimeoutCeiling:
-			problems = append(problems, fmt.Sprintf("%s: an ask of its busy takes more than nothing and at most %s, not %s",
-				id, BusyTimeoutCeiling, d))
-		default:
-			b.Timeout = d
-		}
-	}
-	return b, true, problems
-}

go/catalogue/catalog_seat.go

@@ -1,61 +0,0 @@
-package catalogue
-
-import contractseats "git.novox.be/novox/mesh-contracts/go/seats"
-
-import "encoding/json"
-
-// CatalogSeat is the seat of the catalog: what the mesh holds of every module (novox/hq ADR 0604 §1). Its states are
-// its holder's: the modules the trunk holds, their manifests by digest and the module graph (the indexer's states
-// `modules`, `manifests` and `graph`), announced with who may read them; a reader that only watches reads them and calls
-// no verb. It names no event. What must be built again is no verb: a module whose fingerprint differs from its newest
-// build, which the delivery view derives. The verbs' answers are CatalogModules, CatalogOne, CatalogProvides and
-// CatalogDependents, whose field names are those of the catalog module's tools they replace.
-const CatalogSeat = contractseats.MeshCatalog
-
-// CatalogEntry is one module of the catalog: its repository, its directory there ("." for the root), the merge commit it
-// was last changed at, and its new-form fingerprint or why it has none.
-type CatalogEntry struct {
-	Module     string `json:"module"`
-	Repository string `json:"repository"`
-	Path       string `json:"path"`
-	Commit     string `json:"commit"`
-	FP         string `json:"fp,omitempty"`
-	None       string `json:"none,omitempty"`
-}
-
-// CatalogModule is one module whole: its entry and its manifest as the trunk holds it.
-type CatalogModule struct {
-	CatalogEntry
-	Manifest json.RawMessage `json:"manifest"`
-}
-
-// CatalogEnd is a module that provides, requires or depends on something, with its commit; Scope is a provider's scope
-// (a module provides its own name at node scope).
-type CatalogEnd struct {
-	Module string `json:"module"`
-	Commit string `json:"commit"`
-	Scope  string `json:"scope,omitempty"`
-}
-
-// CatalogModules is the answer of the verb modules: every module the trunk holds, sorted by name.
-type CatalogModules struct {
-	Modules []CatalogEntry `json:"modules"`
-}
-
-// CatalogOne is the answer of the verb module.
-type CatalogOne struct {
-	Module CatalogModule `json:"module"`
-}
-
-// CatalogProvides is the answer of the verb provides: the modules that provide the provision and those that require it.
-type CatalogProvides struct {
-	Provision string       `json:"provision"`
-	Provides  []CatalogEnd `json:"provides"`
-	Requires  []CatalogEnd `json:"requires"`
-}
-
-// CatalogDependents is the answer of the verb dependents: the modules whose build edges reach the module.
-type CatalogDependents struct {
-	Module     string       `json:"module"`
-	Dependents []CatalogEnd `json:"dependents"`
-}

go/catalogue/catalogue_check_test.go

@@ -1,20 +0,0 @@
-package catalogue
-
-import (
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/internal/beside"
-)
-
-// TestEveryCatalogueManifestParses runs the real catalogue through the real gate.
-//
-// Not a fixture: the point is whether the manifests as written are accepted by the control plane that
-// will read them, and a copy of one manifest proves nothing about the other seventy-one.
-// catalogueRoot is the catalogue these checks run over: in a merge check the clone the build seat put
-// beside this one, elsewhere the copy captured in testdata/beside (internal/beside). A check that only
-// ran when somebody remembered a variable was a check nobody ran (novox/hq issue 134), and one that read
-// whatever checkout sat beside judged the machine, not the change (novox/hq issue 432): it never skips.
-func catalogueRoot(t *testing.T) string {
-	t.Helper()
-	return beside.Dir(t, "mesh-catalog")
-}

go/catalogue/catalogue_read_test.go

@@ -1,8 +0,0 @@
-package catalogue
-
-// readManifest is one manifest of the catalogue as ReadTreeManifest read it.
-type readManifest struct {
-	path     string // the module.json
-	manifest Manifest
-	err      error
-}

go/catalogue/checker_seat.go

@@ -1,9 +0,0 @@
-package catalogue
-
-import contractseats "git.novox.be/novox/mesh-contracts/go/seats"
-
-// CheckerSeat is the seat mesh-delivery-checker holds.
-//
-// Deprecated: a whole seat's name is mesh-contracts' (seats.MeshDeliveryChecker); kept for its importers until their
-// next change takes it from there (testdata/seat-names.txt).
-const CheckerSeat = contractseats.MeshDeliveryChecker

go/catalogue/chosen.go

@@ -1,26 +0,0 @@
-package catalogue
-
-// Chosen is the provider somebody named for a provision: the module, and the node it runs on. Both,
-// always (novox/hq #258) — a provision comes from a module, and the same module on two machines is
-// two answers, so neither half alone says which. Module is empty only on a record made before this
-// was asked, and such a record is honoured exactly as long as it is unambiguous.
-type Chosen struct {
-	Node   string
-	Module string
-}
-
-func (c Chosen) String() string {
-	if c.Module == "" {
-		return c.Node
-	}
-	return c.Node + "/" + c.Module
-}
-
-func oneOf(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}

go/catalogue/collections.go

@@ -1,64 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"path"
-	"strings"
-)
-
-// Item is one item a module contributes to a collection: its template in the module's repository, or, in the
-// manifest the mesh holds, the template's text, read back from the build's templates archive like a file's.
-//
-// **Attributes, a capability and a name** (design 57 L3, issue 777): an item may carry `attributes` (string keys and
-// values; `order`, a whole number 0–99 defaulting to 50, orders the items of one placeholder) and `if-capability`,
-// the capability a machine must report for the item to be placed on it. A module may give several items to one
-// collection, each then with a `name` unique within the module and the collection. A collector takes only the items
-// whose attributes match, `${collected:<collection>:<k>=<v>,…}`, and all of them without the selector.
-type Item struct {
-	Collection   string            `json:"collection"`
-	Name         string            `json:"name,omitempty"`
-	Template     string            `json:"template,omitempty"`
-	Content      string            `json:"content,omitempty"`
-	Attributes   map[string]string `json:"attributes,omitempty"`
-	IfCapability string            `json:"if-capability,omitempty"`
-}
-
-// ItemKey is an item's key among its module's: the collection, and `/<name>` for a named item.
-func ItemKey(collection, name string) string {
-	if name == "" {
-		return collection
-	}
-	return collection + "/" + name
-}
-
-func (it Item) key() string { return ItemKey(it.Collection, it.Name) }
-
-// OrderAttribute is the attribute that orders items.
-const OrderAttribute = "order"
-
-// Collection is one collection a module collects, and the comment its tool writes a line in: each contributor's item
-// is introduced by `<comment> <contributor>`, and by nothing without one.
-type Collection struct {
-	Name    string `json:"name"`
-	Comment string `json:"comment,omitempty"`
-}
-
-// CollectedNamespace is a collection's placeholder namespace, `${collected:<collection>}`.
-const CollectedNamespace = "collected"
-
-// EnvironmentCollection is the one collection of the session environment (design 57 L3, issue 795): its items are
-// typed by attributes, a variable (`kind=variable`, `name`) or a PATH entry (`kind=path`, `at=start|end`), and the
-// template's text is the value or the entry. A collector names the rendering, `${collected:environment:posix}` or
-// `${collected:environment:systemd}`, which is not a selector.
-const EnvironmentCollection = "environment"
-
-// itemTemplateProblem is what is wrong with an item's template path, or "".
-func itemTemplateProblem(m Manifest, name string) string {
-	dir := m.TemplatesDir()
-	if strings.HasPrefix(name, "/") || path.Clean(name) != name || !strings.HasPrefix(name, dir+"/") ||
-		strings.Contains(name, "\\") {
-		return fmt.Sprintf("the template %q is not a file under %s/ of its own repository: a template is %q, a "+
-			"plain relative path, and the build packs only %s/", name, dir, dir+"/<name>", dir)
-	}
-	return ""
-}

go/catalogue/collections_l3_test.go

@@ -1,14 +0,0 @@
-package catalogue
-
-// An item may carry attributes and a capability, a module may give several items to one collection, and a
-// placeholder may select by attributes (design 57 L3, issue 777). The controller leaves out of a plan an item whose
-// capability the machine lacks, accepts a selecting placeholder where it accepts the collection, and renders a
-// selected moved item into an old placeholder exactly as the contribution it replaces.
-
-const (
-	barsText      = "top\n${collected:blocks:bar=top,place=status}bottom\n${collected:blocks:bar=bottom,place=status}${collected:blocks}"
-	barContribute = `{"module":"power","version":"1","moved":true,
-  "items":[{"collection":"blocks","name":"battery","if-capability":"battery","attributes":{"bar":"bottom","place":"status","order":"20"},"template":"files/battery"},
-           {"collection":"blocks","name":"clock","attributes":{"bar":"top","place":"status"},"template":"files/clock"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`
-)

go/catalogue/collections_test.go

@@ -1,32 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-)
-
-// A collection is declared and filled by the client (novox/hq ADR 0349 §13, design 57 L1, issue 684): a collector
-// names a collection it collects, a contributor an item from a template of its own, and a handed composition plans
-// both for the node's provisioner client and renders neither. The three old namespaces read as collections of their
-// own name. Each file is filled one way: a piece of the other form on the machine is said as not placed.
-
-const (
-	collectorZsh = `{"module":"zsh","version":"1","moved":true,
-  "claims":[{"name":"node-login-shell","scope":"node"}],
-  "collections":[{"name":"widgets","comment":"#"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[{"id":"rc","type":"file","path":"${machine:account-home}/.zshrc","owner":"${machine:account}",
-    "mode":"0644","template":"files/zshrc"}]}`
-	zshrcText       = "# zsh\n${shell:zsh:normal}${collected:widgets}"
-	contributorText = "source ${machine:account-home}/.p10k.zsh\n"
-	contributorP10k = `{"module":"prompt","version":"1","moved":true,
-  "items":[{"collection":"shell:zsh:normal","template":"files/zsh"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`
-	oldFormAliases = `{"module":"aliases","version":"1",
-  "shell":[{"for":"zsh","slot":"normal","code":"alias ll='ls -l'\n"}]}`
-)
-
-func builtWith(module string, texts map[string]string) []Built {
-	return []Built{{Name: "files", Kind: ArtifactArchive,
-		Reference: ArtifactStoreScheme + module + "/files/blobs/sha256:" + strings.Repeat("e", 64),
-		Digest:    "sha256:" + strings.Repeat("e", 64), Texts: texts}}
-}

go/catalogue/config.go

@@ -1,201 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"regexp"
-	"slices"
-)
-
-// ConfigField is the manifest key a module declares its config values under.
-const ConfigField = "config"
-
-// TakesConfigField is the key a mergeable file names the config values it takes by.
-const TakesConfigField = "takes-config"
-
-// SettingsField is the old name of ConfigField, read as its alias.
-const SettingsField = "settings"
-
-// configRef is how a file asks for a config value: ${config:<key>}, the same keys as settingRef.
-var configRef = regexp.MustCompile(`\$\{config:([a-z0-9][a-z0-9_.-]*)\}`)
-
-// takesConfigKey and takesSettingsKey are the two spellings as a key of a JSON object. A string value is never
-// followed by a colon, and a quote inside a string is escaped, so these match only keys.
-var (
-	takesConfigKey   = regexp.MustCompile(`"` + TakesConfigField + `"(\s*):`)
-	takesSettingsKey = regexp.MustCompile(`"` + TakesSettingsField + `"(\s*):`)
-)
-
-// The types a config value may have (ADR 0348 §4).
-const (
-	ConfigNumber  = "number"
-	ConfigString  = "string"
-	ConfigBoolean = "boolean"
-	ConfigObject  = "object"
-	ConfigList    = "list"
-)
-
-// accountFacts are what the mesh places for a module's account, never config values (ADR 0348 §11).
-var accountFacts = map[string]bool{"puid": true, "pgid": true}
-
-// configForms is which of the two forms a manifest was written in, by the words of each it uses.
-type configForms struct {
-	config, settings []string
-}
-
-// DeclaresConfig is whether the manifest is written in the config form: `config`, `takes-config` or
-// `${config:<key>}` (ADR 0348 §1, §11).
-func (m Manifest) DeclaresConfig() bool { return len(m.forms.config) > 0 }
-
-// toSettingsForm is raw with the config form's placeholders and takes-config read as the settings form's, and
-// which words of each form it used. `config` itself is a top-level key, renamed where the keys are read
-// (UnmarshalJSON).
-func toSettingsForm(raw []byte) ([]byte, configForms) {
-	var f configForms
-	if configRef.Match(raw) {
-		f.config = append(f.config, "${config:…}")
-	}
-	if takesConfigKey.Match(raw) {
-		f.config = append(f.config, TakesConfigField)
-	}
-	if settingRef.Match(raw) {
-		f.settings = append(f.settings, "${setting:…}")
-	}
-	if takesSettingsKey.Match(raw) {
-		f.settings = append(f.settings, TakesSettingsField)
-	}
-	if len(f.config) == 0 {
-		return raw, f
-	}
-	raw = configRef.ReplaceAllFunc(raw, func(ref []byte) []byte {
-		return []byte("${setting:" + string(configRef.FindSubmatch(ref)[1]) + "}")
-	})
-	raw = takesConfigKey.ReplaceAllFunc(raw, func(key []byte) []byte {
-		return []byte(`"` + TakesSettingsField + `"` + string(takesConfigKey.FindSubmatch(key)[1]) + ":")
-	})
-	return raw, f
-}
-
-// toConfigForm is a manifest written in the settings form's words, as JSON, in the config form's: what
-// toSettingsForm and UnmarshalJSON read, written back.
-func toConfigForm(raw []byte) ([]byte, error) {
-	var keys map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &keys); err != nil {
-		return nil, err
-	}
-	if settings, has := keys[SettingsField]; has {
-		keys[ConfigField] = settings
-		delete(keys, SettingsField)
-		var err error
-		if raw, err = json.Marshal(keys); err != nil {
-			return nil, err
-		}
-	}
-	raw = settingRef.ReplaceAllFunc(raw, func(ref []byte) []byte {
-		return []byte("${config:" + string(settingRef.FindSubmatch(ref)[1]) + "}")
-	})
-	raw = takesSettingsKey.ReplaceAllFunc(raw, func(key []byte) []byte {
-		return []byte(`"` + TakesConfigField + `"` + string(takesSettingsKey.FindSubmatch(key)[1]) + ":")
-	})
-	return raw, nil
-}
-
-// configDeclaration is the config form's declaration as written: nothing of the settings form's, and nothing
-// unsaid.
-type configDeclaration struct {
-	Type        string   `json:"type,omitempty"`
-	Description string   `json:"description,omitempty"`
-	Enum        []any    `json:"enum,omitempty"`
-	Minimum     *float64 `json:"minimum,omitempty"`
-	Maximum     *float64 `json:"maximum,omitempty"`
-	Pattern     string   `json:"pattern,omitempty"`
-	Trusted     bool     `json:"trusted,omitempty"`
-	Predefined  string   `json:"predefined,omitempty"`
-	Default     any      `json:"default,omitempty"`
-	Required    bool     `json:"required,omitempty"`
-	Runtime     bool     `json:"runtime,omitempty"`
-	RenamedFrom string   `json:"renamed-from,omitempty"`
-}
-
-// MarshalJSON writes a settings declaration exactly as before, and a config declaration without the settings
-// form's kind and why, and without a default it does not have.
-func (d SettingDeclaration) MarshalJSON() ([]byte, error) {
-	type plain SettingDeclaration
-	if d.Kind != "" || d.Why != "" {
-		return json.Marshal(plain(d))
-	}
-	return json.Marshal(configDeclaration{Type: d.Type, Description: d.Description, Enum: d.Enum,
-		Minimum: d.Minimum, Maximum: d.Maximum, Pattern: d.Pattern, Trusted: d.Trusted, Predefined: d.Predefined,
-		Default: d.Default, Required: d.Required, Runtime: d.Runtime, RenamedFrom: d.RenamedFrom})
-}
-
-// validationProblems is what is wrong with a declaration's validation, and its default against it.
-func validationProblems(d SettingDeclaration) []string {
-	var problems []string
-	isNumber := d.Type == ConfigNumber
-	if len(d.Enum) > 0 && d.Type != ConfigNumber && d.Type != ConfigString {
-		problems = append(problems, fmt.Sprintf("an enum is for a number or a string, and this is a %s", d.Type))
-	}
-	if (d.Minimum != nil || d.Maximum != nil) && !isNumber {
-		problems = append(problems, fmt.Sprintf("a minimum or maximum is for a number, and this is a %s", d.Type))
-	}
-	if d.Minimum != nil && d.Maximum != nil && *d.Minimum > *d.Maximum {
-		problems = append(problems, fmt.Sprintf("its minimum %v is above its maximum %v", *d.Minimum, *d.Maximum))
-	}
-	var pattern *regexp.Regexp
-	if d.Pattern != "" {
-		if d.Type != ConfigString {
-			problems = append(problems, fmt.Sprintf("a pattern is for a string, and this is a %s", d.Type))
-		}
-		var err error
-		if pattern, err = regexp.Compile(`^(?:` + d.Pattern + `)$`); err != nil {
-			problems = append(problems, fmt.Sprintf("its pattern %q is not a regular expression: %v", d.Pattern, err))
-		}
-	}
-	for _, v := range d.Enum {
-		if !ofType(v, d.Type) {
-			problems = append(problems, fmt.Sprintf("its enum holds %v, which is not a %s", v, d.Type))
-		}
-	}
-	if d.Default == nil {
-		return problems
-	}
-	if !ofType(d.Default, d.Type) {
-		if d.Type != "" {
-			problems = append(problems, fmt.Sprintf("its default %v is not a %s", d.Default, d.Type))
-		}
-		return problems
-	}
-	if len(d.Enum) > 0 && !slices.ContainsFunc(d.Enum, func(v any) bool { return v == d.Default }) {
-		problems = append(problems, fmt.Sprintf("its default %v is not one of %v", d.Default, d.Enum))
-	}
-	if n, ok := d.Default.(float64); ok {
-		if d.Minimum != nil && n < *d.Minimum {
-			problems = append(problems, fmt.Sprintf("its default %v is below its minimum %v", n, *d.Minimum))
-		}
-		if d.Maximum != nil && n > *d.Maximum {
-			problems = append(problems, fmt.Sprintf("its default %v is above its maximum %v", n, *d.Maximum))
-		}
-	}
-	if s, ok := d.Default.(string); ok && pattern != nil && !pattern.MatchString(s) {
-		problems = append(problems, fmt.Sprintf("its default %q does not match its pattern %q", s, d.Pattern))
-	}
-	return problems
-}
-
-// ofType is whether a value read from JSON is of a config type.
-func ofType(v any, kind string) bool {
-	switch v.(type) {
-	case float64:
-		return kind == ConfigNumber
-	case string:
-		return kind == ConfigString
-	case bool:
-		return kind == ConfigBoolean
-	case map[string]any:
-		return kind == ConfigObject
-	case []any:
-		return kind == ConfigList
-	}
-	return false
-}

go/catalogue/config_move.go

@@ -1,17 +0,0 @@
-package catalogue
-
-import "strings"
-
-// ValueProblems is what is wrong with a value for a declaration: its type, and its enum, bounds or pattern.
-func ValueProblems(d SettingDeclaration, v any) []string {
-	if v == nil {
-		return []string{"no value"}
-	}
-	d.Default = v
-	d.Required = false
-	var problems []string
-	for _, p := range validationProblems(d) {
-		problems = append(problems, strings.ReplaceAll(p, "its default", "the value"))
-	}
-	return problems
-}

go/catalogue/config_rename_test.go

@@ -1,48 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A takes-config entry may lay a value under the name the file's software reads (issue 751): the key stays a
-// config key, lower-case, and the file names its own variable, such as ATLASSIAN_URL.
-
-// renaming is inConfigForm with its rules file taking `url` as NOTIFIER_URL, a value the code reading the file
-// falls back on when the file lacks it.
-func renaming() map[string]any {
-	m := inConfigForm()
-	m["config"].(map[string]any)["url"] = map[string]any{"type": "string",
-		"description": "the address the notifier posts to, a URL; unset, the notifier's own environment says it",
-		"default":     ""}
-	resourceOf(m, "rules")["takes-config"] = []any{"position", "theme",
-		map[string]any{"key": "url", "as": "NOTIFIER_URL"}}
-	return m
-}
-
-func listHolds(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-
-func TestARenamedEntryIsWrittenBackAsItWasSaid(t *testing.T) {
-	m, err := parseRaw(t, renaming())
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(raw), `"takes-config":["position","theme",{"as":"NOTIFIER_URL","key":"url"}]`) {
-		t.Fatalf("written back as %s", raw)
-	}
-	if _, err := decodeForTest(raw); err != nil {
-		t.Fatalf("read again: %v", err)
-	}
-}

go/catalogue/config_test.go

@@ -1,188 +0,0 @@
-package catalogue
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A module declares its config (novox/hq ADR 0348 §1, §4, §5, §6, §8, §11; design 57 package K1, issue 660):
-// one registration refusal per rule of design 57's K1, the old names read as aliases, and a module rewritten
-// from settings to config composing byte-identically.
-
-// inConfigForm is a module in the config form that registers: every value typed, described, defaulted or
-// required, placed in a file or read at runtime, and its mergeable file naming its keys.
-func inConfigForm() map[string]any {
-	return map[string]any{
-		"module":  "notifier",
-		"version": "1",
-		"config": map[string]any{
-			"font-size": map[string]any{"type": "number", "description": "the notification's font size, in points",
-				"minimum": 6, "maximum": 40, "default": 10},
-			"width": map[string]any{"type": "number", "description": "the notification's width, in pixels",
-				"default": 250},
-			"position": map[string]any{"type": "string", "description": "the corner it shows in, a word",
-				"enum": []any{"top-right", "top-left"}, "default": "top-right"},
-			"theme": map[string]any{"type": "string", "description": "the colour theme, a lower-case name",
-				"pattern": "[a-z]+", "default": "dark"},
-			"history": map[string]any{"type": "number", "description": "how many notifications it keeps, a count",
-				"default": 20, "runtime": true},
-			"sender": map[string]any{"type": "string", "description": "the address it mails a digest from",
-				"required": true},
-		},
-		"resources": []any{
-			map[string]any{"id": "configuration", "type": "file", "path": "/x/notifierrc",
-				"content": "font = Inter ${config:font-size}\nwidth = ${config:width}\nfrom = ${config:sender}\n"},
-			map[string]any{"id": "rules", "type": "file", "path": "/x/rules.json", "merge": "json",
-				"takes-config": []any{"position", "theme"}, "content": "{\"position\": \"top-right\"}\n"},
-			map[string]any{"id": "notifier", "type": "service", "unit": "notifier.service",
-				"reload-on": []any{"configuration"}, "restart-on": []any{"rules"}},
-		},
-	}
-}
-
-// declaration is one value of inConfigForm's config, to change in place.
-func declaration(m map[string]any, key string) map[string]any {
-	return m["config"].(map[string]any)[key].(map[string]any)
-}
-
-func resourceOf(m map[string]any, id string) map[string]any {
-	for _, r := range m["resources"].([]any) {
-		if r.(map[string]any)["id"] == id {
-			return r.(map[string]any)
-		}
-	}
-	return nil
-}
-
-func parseRaw(t *testing.T, m map[string]any) (Manifest, error) {
-	t.Helper()
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return decodeForTest(raw)
-}
-
-// refused is that the manifest is refused with every one of these words.
-func refused(t *testing.T, m map[string]any, words ...string) {
-	t.Helper()
-	_, err := parseRaw(t, m)
-	if err == nil {
-		t.Fatalf("registered; wanted a refusal saying %q", words)
-	}
-	for _, w := range words {
-		if !strings.Contains(err.Error(), w) {
-			t.Fatalf("refused without %q:\n%v", w, err)
-		}
-	}
-}
-
-func TestAModuleInTheConfigFormRegisters(t *testing.T) {
-	m, err := parseRaw(t, inConfigForm())
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !m.DeclaresConfig() {
-		t.Fatal("a module declaring config is not read as in the config form")
-	}
-	d := m.Settings["font-size"]
-	if d.Type != "number" || d.Description == "" || d.Minimum == nil || *d.Minimum != 6 || d.Default != float64(10) {
-		t.Fatalf("font-size read as %+v", d)
-	}
-	if s := m.Settings["sender"]; !s.Required || s.Default != nil {
-		t.Fatalf("sender read as %+v", s)
-	}
-}
-
-// withPredefined is the list of predefined keys the mesh published, for the length of a test.
-func withPredefined(t *testing.T, keys PredefinedList) {
-	t.Helper()
-	was := ReplacePublished(keys)
-	t.Cleanup(func() { ReplacePublished(was) })
-}
-
-// What the mesh holds is what was written: a module in the config form is written back in it, and read again
-// the same.
-func TestAConfigManifestIsWrittenBackInItsOwnForm(t *testing.T) {
-	m, err := parseRaw(t, inConfigForm())
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, said := range []string{`"config":`, `${config:font-size}`, `"takes-config":`, `"required":true`} {
-		if !strings.Contains(string(raw), said) {
-			t.Fatalf("written back without %s: %s", said, raw)
-		}
-	}
-	for _, unsaid := range []string{`"settings":`, `${setting:`, `"takes-settings"`, `"kind"`, `"why"`, `"default":null`} {
-		if strings.Contains(string(raw), unsaid) {
-			t.Fatalf("written back with %s: %s", unsaid, raw)
-		}
-	}
-	again, err := decodeForTest(raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	twice, _ := json.Marshal(again)
-	if !bytes.Equal(raw, twice) {
-		t.Fatalf("read again it is written\n%s\nwhere it was\n%s", twice, raw)
-	}
-
-	// The registry milestone's words round-trip the same (design 32): a config value's old name, an artifact's series
-	// and contracts marker, the series a module accepts of a package; absent, a series is 0.1.
-	declared := []byte(`{"module":"c","version":"1","config":{"font":{"type":"string","renamed-from":"font-name"}},
-		"packages":{"mesh-sdk":"0.2"},
-		"build":{"artifacts":[{"name":"go","kind":"package","language":"go","paths":["go"],"series":"0.2",
-			"generated-from":"seats"},{"name":"lib","kind":"package","language":"typescript"}]}}`)
-	m, err = decodeForTest(declared)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if m.Settings["font"].RenamedFrom != "font-name" || m.AcceptedSeries("mesh-sdk") != "0.2" ||
-		m.AcceptedSeries("mesh-contracts") != DefaultSeries || m.Build.Artifacts[0].SeriesOf() != "0.2" ||
-		m.AcceptedSeries("mesh-sdk", "0.1") != "0.2" || m.AcceptedSeries("mesh-contracts", "0.10", "x", "0.3", "1.0") != "0.3" ||
-		m.Build.Artifacts[0].GeneratedFrom != "seats" || m.Build.Artifacts[1].SeriesOf() != "0.1" {
-		t.Fatalf("read %+v", m)
-	}
-	raw, _ = json.Marshal(m)
-	for _, said := range []string{`"renamed-from":"font-name"`, `"packages":{"mesh-sdk":"0.2"}`, `"series":"0.2"`,
-		`"generated-from":"seats"`} {
-		if !strings.Contains(string(raw), said) {
-			t.Errorf("written back without %s: %s", said, raw)
-		}
-	}
-	if strings.Count(string(raw), `"series"`) != 1 {
-		t.Errorf("a series nobody said is written: %s", raw)
-	}
-}
-
-// A module in the settings form is written back byte for byte as before.
-func TestASettingsManifestIsWrittenBackAsBefore(t *testing.T) {
-	d := SettingDeclaration{Kind: KindPreference, Default: float64(10), Why: "readable"}
-	raw, err := json.Marshal(d)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(raw) != `{"kind":"preference","default":10,"why":"readable"}` {
-		t.Fatalf("written as %s", raw)
-	}
-}
-
-// 1658/AC1: a value whose only placement is ${config:key} in an item's text is placed.
-func TestConfigCountsAnItemsTextAsAPlacement(t *testing.T) {
-	m := map[string]any{
-		"module": "m", "version": "1",
-		"config": map[string]any{
-			"k": map[string]any{"type": "string", "description": "a word the item says", "default": "x"},
-		},
-		"items": []any{map[string]any{"collection": "a", "content": "k = ${config:k}\n"}},
-	}
-	if _, err := parseRaw(t, m); err != nil {
-		t.Fatalf("a value placed only in an item's text is refused: %v", err)
-	}
-}

go/catalogue/consumer_into_serves.go

@@ -1,14 +0,0 @@
-package catalogue
-
-import (
-	"sort"
-)
-
-func sortedAnyKeys(values map[string]any) []string {
-	out := make([]string, 0, len(values))
-	for k := range values {
-		out = append(out, k)
-	}
-	sort.Strings(out)
-	return out
-}

go/catalogue/consumers.go

@@ -1,4 +0,0 @@
-package catalogue
-
-// ConsumersNamespace is a provider's consumers' credentials' placeholder namespace, `${consumers:<provision>}`.
-const ConsumersNamespace = "consumers"

go/catalogue/consumes_start_test.go

@@ -1,24 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// 1279/AC4 (ADR 0443 §4): no module is given a way to ask where its consumer starts. A consumes entry is an event's
-// name; one that carries a key asking for the stream's history is refused by name, so the safe start is the only one.
-func TestAConsumesEntryAskingWhereItStartsIsRefused(t *testing.T) { // 1279/AC4
-	for _, key := range []string{"from", "start", "deliver"} {
-		raw := `{"module":"audit","version":"1","consumes":[{"event":"shop.order.placed","` + key + `":"beginning"}]}`
-		_, err := decodeForTest([]byte(raw))
-		if err == nil {
-			t.Fatalf("a consumes entry with %q was accepted", key)
-		}
-		if !strings.Contains(err.Error(), `"`+key+`"`) || !strings.Contains(err.Error(), "consumes") {
-			t.Errorf("the refusal for %q does not name the key and the field: %v", key, err)
-		}
-	}
-	if _, err := decodeForTest([]byte(`{"module":"audit","version":"1","consumes":["shop.order.placed"]}`)); err != nil {
-		t.Errorf("a plain consumes entry was refused: %v", err)
-	}
-}

go/catalogue/contributes_test.go

@@ -1,44 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"testing"
-)
-
-// The other half of an edge.
-//
-// `requires` says a thing must be there. It never said what to do with it — a web application
-// requiring a reverse proxy has to say *which name, which port*, and there was nowhere to put
-// that. The two modules that needed it most, the proxy and the VPN, went round the outside and
-// opened a connection to the control plane's database, which is why every node held a credential
-// to it permanently.
-
-// A provision answered from anywhere in the mesh has consumers on other machines, and the
-// provider has to know who they are. Contributions were node-local until this, which meant the
-// one case that most needed them was the one they did not reach.
-
-func provider() Manifest {
-	return Manifest{Module: "postgres", Version: "1",
-		Provides: FromAnywhere("postgres-database"),
-		Receives: map[string]string{"postgres-database": "/var/lib/postgres/grants/mesh.json"},
-		Grants:   map[string]string{"postgres-database": "/var/lib/postgres/grants"},
-	}
-}
-
-func grantedTo(t *testing.T, out []map[string]any) []Contribution {
-	t.Helper()
-	for _, r := range out {
-		if r["path"] != "/var/lib/postgres/grants/mesh.json" {
-			continue
-		}
-		var parsed struct {
-			Given []Contribution `json:"given"`
-		}
-		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
-			t.Fatal(err)
-		}
-		return parsed.Given
-	}
-	t.Fatalf("the provider was given no manifest: %v", out)
-	return nil
-}

go/catalogue/control_records_seats.go

@@ -1,12 +0,0 @@
-package catalogue
-
-import contractseats "git.novox.be/novox/mesh-contracts/go/seats"
-
-// The two seats.
-const (
-	WantsSeat    = contractseats.MeshWants
-	HandActsSeat = contractseats.MeshHandActs
-)
-
-// controlRecordsDecision is the record that made the two seats.
-const controlRecordsDecision = "novox/hq ADR 0565"