Serve a module from a runtime on its own account instead of switching users, keep bus words from bundles, and never give up a channel's work (hq ADR 0259 revision)

node-tools/internal/runtime/runtime.go

@@ -53,6 +53,13 @@ type ListedTool struct {
 	Subjects    []string        `json:"subjects,omitempty"`
 }
 
+// NodeRuntimeModule is the module that is a machine's runtime, serving every module on it.
+const NodeRuntimeModule = "node-tools"
+
+// runtimeOnly are the words of the runtime's own environment no bundle is given.
+var runtimeOnly = map[string]bool{ToolEnv: true, ToolModules: true, "MESH_BROKER_FILE": true,
+	"MESH_BROKER_URL": true, "MESH_CONSOLE_LISTEN": true}
+
 // ServedModulesFrom reads MESH_TOOL_MODULES: `<module>=<entrypoint>` entries, comma-separated, several
 // per module. The one-module form — a bare path, or the runtime's own module — is the per-module
 // containers' (to-be 38 WP4c) and refused here: the node's runtime imports nothing.
@@ -66,9 +73,20 @@ func ServedModulesFrom(spec, own string) ([]Served, error) {
 		}
 		module, path, ok := strings.Cut(entry, "=")
 		module, path = strings.TrimSpace(module), strings.TrimSpace(path)
-		if !ok || module == "" || path == "" || module == own {
-			return nil, fmt.Errorf("%s: %q is not <module>=<entrypoint> of another module; the node's "+
-				"runtime launches the bundles it is given and imports nothing (novox/hq ADR 0193)", ToolModules, entry)
+		if !ok || module == "" || path == "" {
+			return nil, fmt.Errorf("%s: %q is not <module>=<entrypoint>; the runtime launches the bundles it "+
+				"is given and imports nothing (novox/hq ADR 0193)", ToolModules, entry)
+		}
+		// The node's runtime serves the machine's modules and never itself. **A runtime on a module's own
+		// account serves that module and nothing else** (novox/hq ADR 0259 §8): the router and a channel that
+		// proves its sender reach the bus on an account of their own, never the machine's runtime.
+		switch {
+		case own == NodeRuntimeModule && module == own:
+			return nil, fmt.Errorf("%s: %q is the runtime itself; it launches the bundles it is given and "+
+				"imports nothing (novox/hq ADR 0193)", ToolModules, entry)
+		case own != NodeRuntimeModule && module != own:
+			return nil, fmt.Errorf("%s: %q is another module's; a runtime on %s's own account serves %s alone "+
+				"(novox/hq ADR 0259)", ToolModules, entry, own, own)
 		}
 		if _, seen := by[module]; !seen {
 			order = append(order, module)
@@ -135,28 +153,7 @@ func Run(conn *bus.Conn, served []Served, envs map[string]map[string]string, log
 	node := conn.Node()
 
 	base := os.Environ()
-	envFor := func(module string) []string {
-		words := map[string]string{}
-		for _, kv := range base {
-			if k, v, ok := strings.Cut(kv, "="); ok && k != ToolEnv {
-				words[k] = v
-			}
-		}
-		for k, v := range envs[module] {
-			words[k] = v
-		}
-		words["MESH_SERVED_MODULE"] = module
-		words["MESH_MODULE"] = module
-		if node != "" {
-			words["MESH_NODE"] = node
-		}
-		out := make([]string, 0, len(words))
-		for k, v := range words {
-			out = append(out, k+"="+v)
-		}
-		sort.Strings(out)
-		return out
-	}
+	envFor := func(module string) []string { return BundleEnv(base, envs[module], module, node) }
 
 	// The module's events, for every child of it that subscribes (ADR 0198): one consumer per module,
 	// bound the first time any of its children subscribes, each event handed to every child that did.
@@ -710,11 +707,11 @@ func (b *moduleBus) Seat(verb string, params json.RawMessage, handOn func(string
 	conn := b.all.conn
 	switch verb {
 	case "publish":
-		seq, err := conn.SeatPublish(b.module, asked.Subject, asked.Body, asked.ID)
+		seq, duplicate, err := conn.SeatPublishSaid(b.module, asked.Subject, asked.Body, asked.ID)
 		if err != nil {
 			return nil, err
 		}
-		return json.Marshal(map[string]any{"sequence": seq})
+		return json.Marshal(map[string]any{"sequence": seq, "duplicate": duplicate})
 	case "prove":
 		return conn.SeatProve(b.module, asked.Subject, asked.Body)
 	case "kinds":
@@ -779,3 +776,32 @@ func (b *moduleBus) bind(key string, stop func()) {
 	}
 	b.all.seatBound[b.module+" "+key] = stop
 }
+
+// BundleEnv is what one module's bundle is started with: the runtime's environment without its own words,
+// the module's composed words over it, and the module's and machine's names. **No bus word reaches a
+// bundle** (security review of 2026-10-08): the credential and the bus's address are the runtime's, and a
+// bundle reaches the bus only through the runtime.
+func BundleEnv(base []string, given map[string]string, module, node string) []string {
+	words := map[string]string{}
+	for _, kv := range base {
+		if k, v, ok := strings.Cut(kv, "="); ok && !runtimeOnly[k] {
+			words[k] = v
+		}
+	}
+	for k, v := range given {
+		if !runtimeOnly[k] {
+			words[k] = v
+		}
+	}
+	words["MESH_SERVED_MODULE"] = module
+	words["MESH_MODULE"] = module
+	if node != "" {
+		words["MESH_NODE"] = node
+	}
+	out := make([]string, 0, len(words))
+	for k, v := range words {
+		out = append(out, k+"="+v)
+	}
+	sort.Strings(out)
+	return out
+}