BLOCKED on srcfl/ftw#743 — make the signed artifact agree that myuplink is read-only

[HuggeK]

Warning

Do not merge before srcfl/ftw#743 has landed and shipped.
A read-only myuplink reaching a host without that change loses its token
refresh and stops reading. CI here is also expected red — see the last
section.

This is the second half of #64. #64 corrects the catalog label for five
drivers that are badged Control while refusing every command. This corrects
the signed artifact for the one of the five where that is not just a label.

The channel does not read the manifest's control field. It infers control
from the presence of a driver_command entrypoint:

controls = has_driver_command and not declares_read_only

myuplink's entrypoint exists and returns false unconditionally, so the
channel publishes it control_enabled: true, read_only: false, with a write
permission. This makes it declare read_only = true in its own DRIVER table —
the mechanism the channel already documents as authoritative.

The problem that makes this more than a one-line change

The read-only guard replaces host.http_post with a function that raises, and
myuplink POSTs to /oauth/token for the token it reads with. So it declares
auth_post_path, and the generated guard confines the POST rather than
trusting it:

host.http_post = function(url, ...)
    local path = type(url) == "string" and url:match("^[^?]*") or ""
    if path:sub(-#__sourceful_ftw_auth_path) == __sourceful_ftw_auth_path then
        return __sourceful_ftw_http_post(url, ...)
    end
    error("this driver declares itself read-only: POST is allowed only for authentication")
end

A path rather than a URL because base_url is config-overridable — a hardcoded
URL would break any site pointing the driver elsewhere.

Every other read-only driver was checked, and none is affected

Rebuilding the channel and cross-referencing each read-only driver's source
against the functions the guard replaces: only myuplink calls one, and
only http_post. deye, pixii and solaredge call modbus_write but
publish control-capable, so they are never guarded.

The exemption is opt-in and asserted to stay that way:
test_signing_in_is_declared_or_it_does_not_happen fails if any driver other
than myuplink loses the blanket denial, and checks that every other read-only
driver still has neither auth_post_path nor http.post.

Why CI is red here, which is the second thing needing a decision

drivers/tests/conftest.py exempts a driver byte-identical to baselines/ftw
from catalog conventions, and says a driver "stops being exempt the moment
someone edits it". Adding two metadata fields to the DRIVER table costs
myuplink that exemption and lights up 7 convention checks it was never
written to meet — among them should use 'http://' scheme and reference config.port for an HTTPS cloud API, and should call host.emit() when
emitting metrics only is the driver's stated design.

So this needs a maintainer's call: mark those checks as not applying to a
cloud driver, or accept myuplink diverging from FTW's copy. I did not want to
pick either inside a labelling fix.

Version moved 1.1.1 → 1.2.0: the Lua changed, so the artifact bytes moved.
The signed channel accepts this tree check confirms the bump covers it.

🤖 Generated with Claude Code