TLS-1, TLS-2, TLS-3: the runner declares its own secret ledgers, refuses a bundle tool named as a ledger repair, and states the capabilities of its calls in its PING (issue 1966)

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

node-tools/internal/console/manifest_waits_test.go

@@ -39,3 +39,22 @@ func TestTheManifestNamesTheFirstFamiliesOneByOne(t *testing.T) {
 		t.Errorf("the tool runner consumes %v: a wait is no consumer (ADR 0367 §2)", m.Consumes)
 	}
 }
+
+// issue 1966 TLS-1: the tool runner declares its own secret `ledgers`, each module's ledger credential, in the directory it
+// keeps its broker credential in, which is where the runner reads it (runtime.LedgersFileOf).
+func TestTheManifestDeclaresTheRunnersOwnSecretLedgers(t *testing.T) {
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m struct {
+		OwnSecrets map[string]string `json:"own-secrets"`
+	}
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]string{"broker": "${dir:mesh-state}/broker", "ledgers": "${dir:mesh-state}/ledgers"}
+	if !reflect.DeepEqual(m.OwnSecrets, want) {
+		t.Errorf("own secrets %v, want %v", m.OwnSecrets, want)
+	}
+}