record whether an agent's config sets privateUsers in its closure record

swarm-controller/src/meta_build.rs

@@ -370,6 +370,7 @@ pub(crate) async fn run(
             out_path,
             system,
             cached,
+            private_users,
         }) => {
             let built_rev = meta_rev.clone();
             let closure = AgentClosure {
@@ -378,6 +379,7 @@ pub(crate) async fn run(
                 system,
                 built_unix: unix_now(),
                 cached,
+                private_users,
             };
             match queue.record(&agent, &closure).await {
                 Ok(()) => {
@@ -486,10 +488,15 @@ mod tests {
         }
 
         fn built_cached(cached: bool) -> Self {
+            Self::built_with(cached, false)
+        }
+
+        fn built_with(cached: bool, private_users: bool) -> Self {
             Self::answering(Ok(FromMetaReply::Built {
                 out_path: "/nix/store/x-toplevel".to_owned(),
                 system: "x86_64-linux".to_owned(),
                 cached,
+                private_users,
             }))
         }
     }
@@ -617,6 +624,22 @@ mod tests {
         }
     }
 
+    /// The record says what the builder said about the agent's user namespace,
+    /// both ways; a builder that said nothing leaves it off.
+    #[tokio::test]
+    async fn the_record_carries_the_builders_private_users_answer() {
+        for private_users in [true, false] {
+            let queue = FakeQueue::built_with(true, private_users);
+            let outcome = run_with(&FakeHead::reading(Ok(Some(REV))), &queue).await;
+            assert_eq!(outcome, Outcome::Done);
+            let recorded = queue.recorded.lock().unwrap();
+            let [(_, closure)] = recorded.as_slice() else {
+                panic!("one record: {recorded:?}")
+            };
+            assert_eq!(closure.private_users, private_users);
+        }
+    }
+
     /// Any `nix` failure, a timeout included, fails the node at once with what
     /// the builder said: not a no-verdict failure, and nothing is recorded. The
     /// green test above is the control that a record is written when the build
@@ -898,6 +921,7 @@ mod tests {
             system: "x86_64-linux".to_owned(),
             built_unix: 1,
             cached: false,
+            private_users: true,
         };
         client.record("atlas", &closure).await.expect("written");
         closure.store_path = "/nix/store/b".to_owned();