From 39a8d8d7ee62e3cf6c811020463b1c1244d9323e Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Wed, 4 Nov 2026 15:19:12 +0100
Subject: [PATCH] CAT-BG6: buildstep is declared as mesh-build-go's Go package,
 series 0.1

So the builder numbers it and a user outside this repository accepts a series
instead of naming a commit.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
---
 modules/mesh-build-go/README.md                       |  4 +++-
 .../mesh-build-go/cmd/mesh-build-go/manifest_test.go  | 11 +++++++++++
 modules/mesh-build-go/module.json                     |  9 +++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/modules/mesh-build-go/README.md b/modules/mesh-build-go/README.md
index 391fcc89..345c48e4 100644
--- a/modules/mesh-build-go/README.md
+++ b/modules/mesh-build-go/README.md
@@ -170,7 +170,9 @@ and xz, read in Go as the build agent reads it, issue 1590); it runs no command
 - The build runner (the pull of asks, the step lifecycle, the toolchain guard, the fetch, the parsers of `go test -json` and
   `node --test`, `Pack`, the conformance kit and the `mesh-pack` command) is this module's package
   `git.novox.be/novox/mesh-catalog/modules/mesh-build-go/buildstep`, a Go module of its own in `buildstep/`. mesh-build-node
-  and mesh-build-image require it and replace it to the sibling directory, since it is the same repository. What the delivery
+  and mesh-build-image require it and replace it to the sibling directory, since it is the same repository. It is declared
+  as this module's Go package artifact `buildstep`, series `0.1` (ADR 0606): a user in another repository accepts its
+  series, never a commit. What the delivery
   parts read of a step (the failure contract, the fetch request, the stale-step sweep, the step id) stays in mesh-sdk's
   `buildstep`.
 - The seat generator (design 26 *Contracts modules*) is the package `buildstep/seatgen` and the command `buildstep/cmd/seatgen`,
diff --git a/modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go b/modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go
index ccf81f13..2e7d3684 100644
--- a/modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go
+++ b/modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go
@@ -75,6 +75,17 @@ func TestManifestDeclaresTheAccountTheCapabilityAndThePackages(t *testing.T) {
 	if want := []string{"bubblewrap", "git", "openssh", "postgresql"}; !slices.Equal(packages, want) {
 		t.Errorf("packages = %v, want %v", packages, want)
 	}
+	// buildstep, which mesh-build-node and mesh-build-image require, is a Go package of this module, numbered in
+	// series 0.1 (CAT-BG6; ADR 0606): its users accept a series, never a commit.
+	declared := false
+	for _, a := range m.Build.Artifacts {
+		if a.Name == "buildstep" {
+			declared = a.Kind == "package" && a.Language == "go" && slices.Equal(a.Paths, []string{"buildstep"}) && a.Series == "0.1"
+		}
+	}
+	if !declared {
+		t.Errorf("artifacts %+v declare no Go package buildstep in series 0.1", m.Build.Artifacts)
+	}
 }
 
 // The work and cache directories are outside the home (ADR 0466 §1), owned by the account.
diff --git a/modules/mesh-build-go/module.json b/modules/mesh-build-go/module.json
index f1c93941..004d1392 100644
--- a/modules/mesh-build-go/module.json
+++ b/modules/mesh-build-go/module.json
@@ -206,6 +206,15 @@
         "name": "files",
         "kind": "archive",
         "from": "files"
+      },
+      {
+        "name": "buildstep",
+        "kind": "package",
+        "language": "go",
+        "paths": [
+          "buildstep"
+        ],
+        "series": "0.1"
       }
     ]
   }