Stamp a ledger operation with the caller the runner proved for the call in flight it names, refusing another module's call or one not in flight; serve the ledger calls on the pipe (issue 1966 T5)

node-tools/internal/launch/event_answer_test.go

@@ -52,6 +52,7 @@ func (b *subscribing) BusState(string, json.RawMessage) (json.RawMessage, error)
 func (b *subscribing) BusStateWatch(string, json.RawMessage, func(json.RawMessage) error) (func(), error) {
 	return func() {}, nil
 }
+func (b *subscribing) Begin(string) (string, func()) { return "", func() {} }
 func (b *subscribing) Subscribe(d func(json.RawMessage) error) error {
 	b.mu.Lock()
 	defer b.mu.Unlock()

node-tools/internal/launch/launch.go

@@ -52,12 +52,21 @@ type Tool struct {
 // stdio.CallerOf, and says Unproven when it is absent.
 const MetaCaller = "mesh/caller"
 
-// callParams is a `tools/call`'s params: the tool, its arguments as the caller sent them, and — only when the
-// subject named one — the caller, in `_meta`, which the runtime writes and no caller can.
-func callParams(name, caller string, args json.RawMessage) map[string]any {
+// callParams is a `tools/call`'s params: the tool, its arguments as the caller sent them, and in `_meta`, which the
+// runtime writes and no caller can, the caller — only when the subject named one — and the id of the call in flight
+// (mesh-sdk buscalls.MetaCall), which a ledger's apply names so the runtime stamps the caller it proved (novox/hq ADR
+// 0597 §7).
+func callParams(name, caller, call string, args json.RawMessage) map[string]any {
 	params := map[string]any{"name": name, "arguments": args}
+	meta := map[string]any{}
 	if caller != "" {
-		params["_meta"] = map[string]any{MetaCaller: caller}
+		meta[MetaCaller] = caller
+	}
+	if call != "" {
+		meta[buscalls.MetaCall] = call
+	}
+	if len(meta) > 0 {
+		params["_meta"] = meta
 	}
 	return params
 }
@@ -101,6 +110,9 @@ type Bus interface {
 	BusState(method string, params json.RawMessage) (json.RawMessage, error)
 	// BusStateWatch hands deliver each change of an objects or a ledger watch, the current ones first.
 	BusStateWatch(method string, params json.RawMessage, deliver func(change json.RawMessage) error) (stop func(), err error)
+	// Begin says a tool call of the module is in flight for the caller the runtime proved, and answers its id, which the
+	// bundle is handed in the call's `_meta`, and the end to call once the call is answered (novox/hq ADR 0597 §7).
+	Begin(caller string) (id string, end func())
 }
 
 // busStateCalls are the methods of mesh-sdk buscalls a bundle asks and BusState answers.
@@ -659,7 +671,9 @@ func Start(module, entry string, env []string, mesh Bus, logf func(string, ...an
 				if len(args) == 0 || string(args) == "null" {
 					args = json.RawMessage("{}")
 				}
-				res, err := asking("tools/call", callParams(full, caller, args), CallTimeout)
+				call, end := mesh.Begin(caller)
+				defer end()
+				res, err := asking("tools/call", callParams(full, caller, call, args), CallTimeout)
 				if err != nil {
 					return nil, err
 				}