CAT-BG2: the step answers no h1: sum, since nothing in the contract carries it on

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/mesh-build-go/README.md

@@ -144,7 +144,7 @@ builder writes the older form beside it while a counted node-engine reads only t
 seat nothing holds, fails the step `not stored: <artifact>: <the holder's words>`. The packed bytes never stay on the node.
 The module writes into no store itself and requires no `artifact-store`. A Go package (kind `package`, language `go`; `gopackage.go`) is
 the directory its one path names packed as Go's module zip, every file under `<module path>@<version>/`, its digest the
-zip's and its `h1:` sum answered beside it; a trunk build the builder gave a version publishes it through
+zip's (no `h1:` sum is answered: nothing carries it on); a trunk build the builder gave a version publishes it through
 `go-package-registry` under its Go module path and that version (the manifest `invokes` both verbs) and answers
 `<module path>@<version>`; a candidate's is packed under `v0.0.0` and publishes nothing. The go build runs shut off in bubblewrap (ADR 0448, `isolate.go`): no
 network, none of the account, the caches beneath a throwaway layer unless the step is told `publish` (a trunk build). An artifact that is neither a Go

modules/mesh-build-go/cmd/mesh-build-go/build.go

@@ -38,8 +38,6 @@ type BuildResult struct {
 	// §9): oci-artifact-registry/<module>/<artifact>@<digest>. The builder writes the older form beside it while a
 	// counted node-engine reads only that (ADR 0624 §1, §3).
 	Reference string `json:"reference"`
-	// Sum is a Go package's h1: hash, Go's go.sum hash of its module zip (CAT-BG2); empty for every other artifact.
-	Sum string `json:"sum,omitempty"`
 }
 
 func (m *Module) buildTool() StepTool {
@@ -48,7 +46,7 @@ func (m *Module) buildTool() StepTool {
 		Description: "Build one Go bundle, archive or Go package artifact of a module of a fetched workspace with the build agent's " +
 			"recipe, by the installed Go and no network, and pack it (a Go package as Go's module zip); a bundle or archive is " +
 			"published on oci-artifact-registry, a Go package given a version on go-package-registry under its module path. " +
-			"Answers a step id at once; the step ends on its key with the artifact's digest, size, reference and a Go package's h1: sum.",
+			"Answers a step id at once; the step ends on its key with the artifact's digest, size and reference.",
 		Input: map[string]any{
 			"type": "object",
 			"properties": map[string]any{

modules/mesh-build-go/cmd/mesh-build-go/gopackage.go

@@ -2,7 +2,8 @@ package main
 
 // The build of a Go package (CAT-BG2; novox/hq design 51 *Publishing*, ADR 0605 §3, §9): the directory the artifact
 // names (its one path, else the module's own) packed as Go's module zip, every file under <module path>@<version>/,
-// as Go's module proxy protocol serves it; its digest is the zip's sha256, its h1: sum (Go's go.sum hash) beside it. A
+// as Go's module proxy protocol serves it; its digest is the zip's sha256 (no h1: sum is answered: nothing in the contract carries
+// it on, the lead's ruling on A3n). A
 // trunk build given a version by the builder publishes it through go-package-registry under its Go module path (the
 // name the forge's Go seat takes, the lead's ruling 3 on A3k) and that version; a candidate's publishes nothing. The
 // zip is made in this process, after nothing ran: packing a tree runs no code of it.
@@ -19,7 +20,6 @@ import (
 
 	"golang.org/x/mod/modfile"
 	"golang.org/x/mod/module"
-	"golang.org/x/mod/sumdb/dirhash"
 	modzip "golang.org/x/mod/zip"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
@@ -75,13 +75,9 @@ func (m *Module) buildGoPackage(ctx context.Context, workspace, dir string, art
 	if err != nil {
 		return BuildResult{}, err
 	}
-	sum, err := dirhash.HashZip(file.Name(), dirhash.Hash1)
-	if err != nil {
-		return BuildResult{}, fmt.Errorf("the h1: sum of %s: %w", art.Name, err)
-	}
 	d := sha256.Sum256(body)
 	digest := "sha256:" + hex.EncodeToString(d[:])
-	res := BuildResult{Artifact: art.Name, Digest: digest, Size: len(body), Sum: sum}
+	res := BuildResult{Artifact: art.Name, Digest: digest, Size: len(body)}
 	if version == "" {
 		return res, nil
 	}

modules/mesh-build-go/cmd/mesh-build-go/publish_test.go

@@ -156,8 +156,8 @@ func TestThePackedFileLeavesTheNodeOnceItsPushAnswered(t *testing.T) {
 }
 
 // CAT-BG2 (REG S23, ADR 0605 §3, §9; the lead's ruling 3 on A3k): a Go package is built as Go's module zip of the
-// directory its artifact names, every file under <module path>@<version>/, its digest the zip's and its h1: sum beside
-// it. A trunk build given a version publishes it through go-package-registry under its Go module path and that version,
+// directory its artifact names, every file under <module path>@<version>/, its digest the zip's.
+// A trunk build given a version publishes it through go-package-registry under its Go module path and that version,
 // and answers <module path>@<version>; a candidate's (no version) publishes nothing and answers its digest alone. A
 // directory with no go.mod fails the step naming it.
 func TestAGoPackageIsBuiltAsAModuleZipAndPublishedUnderItsModulePath(t *testing.T) {
@@ -197,7 +197,7 @@ func TestAGoPackageIsBuiltAsAModuleZipAndPublishedUnderItsModulePath(t *testing.
 	}
 	args["version"], args["seat"] = "v0.1.15", GoPackageSeat
 	res, st := run(args)
-	if st.State != delivery.StepPassed || res.Reference != "git.example/demo/go@v0.1.15" || !strings.HasPrefix(res.Sum, "h1:") {
+	if st.State != delivery.StepPassed || res.Reference != "git.example/demo/go@v0.1.15" {
 		t.Fatalf("a trunk Go package: %s %q, %+v", st.State, st.Reason, res)
 	}
 	if len(store.published) != 1 {