diff --git a/modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go b/modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go
new file mode 100644
index 00000000..d223cdaa
--- /dev/null
+++ b/modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go
@@ -0,0 +1,292 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+const commitSHA = "0123456789abcdef0123456789abcdef01234567"
+
+// cmdRecord is one command a step ran.
+type cmdRecord struct {
+	env  []string
+	line string
+}
+
+// fakeStep answers the commands of a fetch: git succeeds, rev-parse answers the commit, ls-files answers the
+// go.mod files, and a go command answers by rule.
+type fakeStep struct {
+	mu      sync.Mutex
+	calls   []cmdRecord
+	gomods  string
+	gate    chan struct{} // when set, the first git command waits for it
+	goRule  func(line string) forgekey.Ran
+	vendors []string // directories (relative to the tree) that get a vendor/modules.txt at checkout
+}
+
+func (f *fakeStep) run(ctx context.Context, env []string, name string, args ...string) forgekey.Ran {
+	line := name + " " + strings.Join(args, " ")
+	f.mu.Lock()
+	f.calls = append(f.calls, cmdRecord{env: env, line: line})
+	f.mu.Unlock()
+	if f.gate != nil && strings.Contains(line, " init ") {
+		<-f.gate
+	}
+	switch {
+	case name == "git" && strings.Contains(line, " rev-parse HEAD"):
+		return forgekey.Ran{Stdout: commitSHA + "\n"}
+	case name == "git" && strings.Contains(line, " ls-files "):
+		return forgekey.Ran{Stdout: f.gomods}
+	case name == "git" && strings.Contains(line, " checkout "):
+		for i, a := range args {
+			if a == "-C" {
+				for _, v := range f.vendors {
+					os.MkdirAll(filepath.Join(args[i+1], v, "vendor"), 0o755)
+					os.WriteFile(filepath.Join(args[i+1], v, "vendor", "modules.txt"), nil, 0o644)
+				}
+			}
+		}
+	case name == "go" && f.goRule != nil:
+		return f.goRule(line)
+	}
+	return forgekey.Ran{}
+}
+
+func (f *fakeStep) lines() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := []string{}
+	for _, c := range f.calls {
+		out = append(out, c.line)
+	}
+	return out
+}
+
+func fetchModule(t *testing.T, f *fakeStep) (*Module, *keptStates) {
+	t.Helper()
+	states := newStates()
+	m := moduleWith(states, "go1.27.1")
+	m.Run, m.Home, m.Work, m.Cache = f.run, t.TempDir(), t.TempDir(), t.TempDir()
+	return m, states
+}
+
+func fetchTool(t *testing.T, m *Module) func(map[string]any) (any, error) {
+	t.Helper()
+	for _, tool := range m.Tools(m.StepTools()) {
+		if tool.Name == "build_go_fetch" {
+			return tool.Run
+		}
+	}
+	t.Fatal("no tool build_go_fetch")
+	return nil
+}
+
+var fetchArgs = map[string]any{"repository": "novox/mesh-sdk", "commit": commitSHA}
+
+// 1485/AC1: git is asked through FetchCommit with the ssh remote, and go mod download and verify run in each go.mod
+// directory (not in one that vendors) with GOTOOLCHAIN=local, GOFLAGS=-mod=mod and the module's cache paths.
+func TestFetchAsksGitForTheSshRemoteAndDownloadsEachModule(t *testing.T) {
+	f := &fakeStep{gomods: "go.mod\nsub/dir/go.mod\nvend/go.mod\n", vendors: []string{"vend"}}
+	m, states := fetchModule(t, f)
+	if _, err := fetchTool(t, m)(fetchArgs); err != nil {
+		t.Fatal(err)
+	}
+	st := states.waitEnd(t)
+	if st.State != delivery.StepPassed {
+		t.Fatalf("the step ended %s: %s", st.State, st.Reason)
+	}
+	lines := strings.Join(f.lines(), "\n")
+	for _, want := range []string{
+		"remote add origin ssh://mesh-forge/novox/mesh-sdk.git",
+		"fetch --no-tags --depth 1 origin " + commitSHA,
+		"checkout -q --detach " + commitSHA,
+	} {
+		if !strings.Contains(lines, want) {
+			t.Errorf("git was not asked %q:\n%s", want, lines)
+		}
+	}
+	downloads, verifies := 0, 0
+	for _, c := range f.calls {
+		switch {
+		case strings.HasPrefix(c.line, "go -C ") && strings.HasSuffix(c.line, " mod download"):
+			downloads++
+		case strings.HasPrefix(c.line, "go -C ") && strings.HasSuffix(c.line, " mod verify"):
+			verifies++
+		default:
+			continue
+		}
+		if strings.Contains(c.line, "vend") {
+			t.Errorf("a module that vendors was downloaded: %s", c.line)
+		}
+		env := strings.Join(c.env, " ")
+		for _, want := range []string{"GOTOOLCHAIN=local", "GOFLAGS=-mod=mod", "GOMODCACHE=" + filepath.Join(m.Cache, "gomod"), "GOCACHE=" + filepath.Join(m.Cache, "gobuild"), "GOPRIVATE=git.novox.be"} {
+			if !strings.Contains(env, want) {
+				t.Errorf("%s: environment lacks %s: %s", c.line, want, env)
+			}
+		}
+	}
+	if downloads != 2 || verifies != 2 {
+		t.Errorf("%d downloads and %d verifies, want 2 each (go.mod and sub/dir/go.mod):\n%s", downloads, verifies, lines)
+	}
+	var res FetchResult
+	if err := json.Unmarshal(st.Result, &res); err != nil {
+		t.Fatal(err)
+	}
+	if res.Commit != commitSHA || strings.Join(res.Modules, ",") != ".,sub/dir,vend" || res.Workspace == "" {
+		t.Errorf("result = %s", st.Result)
+	}
+	if _, err := os.Stat(filepath.Join(m.Work, res.Workspace, "tree")); err != nil {
+		t.Errorf("the workspace is not in the work directory: %v", err)
+	}
+}
+
+// 1485/AC2: a variable such as MESH_REGISTRY_PASSWORD or a *_TOKEN of the process is seen by no command of the step:
+// the runner builds the environment from scratch, and the step passes it nothing of the kind.
+func TestNoCommandOfTheStepSeesAPasswordOrAToken(t *testing.T) {
+	t.Setenv("MESH_REGISTRY_PASSWORD", "hunter2-registry")
+	t.Setenv("FORGE_TOKEN", "hunter2-token")
+	t.Setenv("HOME", "/not/the/account")
+	r := StepRunner("/home/account")
+	got := r(context.Background(), []string{"EXTRA=1"}, "env")
+	if got.Status != 0 {
+		t.Fatalf("env: %+v", got)
+	}
+	for _, secret := range []string{"hunter2", "MESH_REGISTRY_PASSWORD", "FORGE_TOKEN", "/not/the/account"} {
+		if strings.Contains(got.Stdout, secret) {
+			t.Errorf("a command saw %q:\n%s", secret, got.Stdout)
+		}
+	}
+	for _, want := range []string{"HOME=/home/account", "EXTRA=1", "PATH="} {
+		if !strings.Contains(got.Stdout, want) {
+			t.Errorf("a command lacks %q:\n%s", want, got.Stdout)
+		}
+	}
+
+	f := &fakeStep{gomods: "go.mod\n"}
+	m, states := fetchModule(t, f)
+	fetchTool(t, m)(fetchArgs)
+	states.waitEnd(t)
+	for _, c := range f.calls {
+		for _, w := range c.env {
+			if k, _, _ := strings.Cut(w, "="); strings.HasSuffix(k, "TOKEN") || strings.HasSuffix(k, "PASSWORD") || strings.HasSuffix(k, "SECRET") {
+				t.Errorf("%s was given %s", c.line, w)
+			}
+		}
+	}
+}
+
+// 1485/AC3: go mod verify failing ends the step failed naming the directory and the first line of its output.
+func TestAVerifyThatFailsEndsTheStepNamingTheDirectoryAndTheLine(t *testing.T) {
+	f := &fakeStep{gomods: "go.mod\ntools/go.mod\n", goRule: func(line string) forgekey.Ran {
+		if strings.HasSuffix(line, "tools mod verify") || strings.Contains(line, "/tools mod verify") {
+			return forgekey.Ran{Status: 1, Stdout: "\nexample.org/x v1.0.0: dir has been modified\nsecond line\n"}
+		}
+		return forgekey.Ran{}
+	}}
+	m, states := fetchModule(t, f)
+	if _, err := fetchTool(t, m)(fetchArgs); err != nil {
+		t.Fatal(err)
+	}
+	st := states.waitEnd(t)
+	if st.State != delivery.StepFailed {
+		t.Fatalf("the step ended %s, want failed", st.State)
+	}
+	if !strings.Contains(st.Reason, "tools") || !strings.Contains(st.Reason, "example.org/x v1.0.0: dir has been modified") || strings.Contains(st.Reason, "second line") {
+		t.Errorf("reason = %q", st.Reason)
+	}
+}
+
+// 1485/AC4: the call answers a step id before the fetch ends, and the key then ends passed with the workspace.
+func TestTheCallAnswersAStepIdBeforeTheFetchEnds(t *testing.T) {
+	f := &fakeStep{gomods: "go.mod\n", gate: make(chan struct{})}
+	m, states := fetchModule(t, f)
+	out, err := fetchTool(t, m)(fetchArgs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	answer := out.(map[string]any)
+	id, _ := answer["step"].(string)
+	if id == "" || answer["key"] != "ace."+id {
+		t.Fatalf("answer = %v, want a step id and its key", answer)
+	}
+	select {
+	case <-states.ended:
+		t.Fatal("the step ended while git was held")
+	case <-time.After(50 * time.Millisecond):
+	}
+	states.mu.Lock()
+	running := states.steps["ace."+id]
+	states.mu.Unlock()
+	if len(running) != 1 || running[0].State != delivery.StepRunning {
+		t.Errorf("the key holds %+v, want one running step", running)
+	}
+	close(f.gate)
+	select {
+	case key := <-states.ended:
+		if key != "ace."+id {
+			t.Errorf("ended %s", key)
+		}
+	case <-time.After(3 * time.Second):
+		t.Fatal("the step never ended")
+	}
+	states.mu.Lock()
+	last := states.steps["ace."+id][len(states.steps["ace."+id])-1]
+	states.mu.Unlock()
+	var res FetchResult
+	if last.State != delivery.StepPassed || json.Unmarshal(last.Result, &res) != nil || res.Workspace == "" {
+		t.Errorf("the key ends %+v", last)
+	}
+}
+
+func TestARepositoryThatIsNotOwnerSlashNameIsRefusedBeforeAnythingRuns(t *testing.T) {
+	for _, repo := range []string{"", "mesh-sdk", "../etc/passwd", "a/b/c", "a/..", "-o/x", "https://x/y"} {
+		f := &fakeStep{}
+		m, states := fetchModule(t, f)
+		fetchTool(t, m)(map[string]any{"repository": repo, "commit": commitSHA})
+		st := states.waitEnd(t)
+		if st.State != delivery.StepFailed || len(f.lines()) != 0 {
+			t.Errorf("%q: the step ended %s after %d commands", repo, st.State, len(f.lines()))
+		}
+	}
+}
+
+// Workspaces older than a day are removed; younger ones, and anything that is not a workspace, stay.
+func TestWorkspacesOlderThanADayAreRemoved(t *testing.T) {
+	m := &Module{Work: t.TempDir()}
+	for name, age := range map[string]time.Duration{"old1": 25 * time.Hour, "young": time.Hour, "Keep-This": 48 * time.Hour} {
+		dir := filepath.Join(m.Work, name)
+		os.MkdirAll(filepath.Join(dir, "tree"), 0o755)
+		when := time.Now().Add(-age)
+		os.Chtimes(dir, when, when)
+	}
+	m.CleanWorkspaces(time.Now())
+	for name, want := range map[string]bool{"old1": false, "young": true, "Keep-This": true} {
+		_, err := os.Stat(filepath.Join(m.Work, name))
+		if (err == nil) != want {
+			t.Errorf("%s present = %v, want %v", name, err == nil, want)
+		}
+	}
+}
+
+// The work and cache directories the code uses are the ones the manifest places, and neither is in the home.
+func TestWorkAndCacheAreTheDirectoriesTheManifestPlacesOutsideTheHome(t *testing.T) {
+	m := readManifest(t)
+	home := resource(t, m, "account")["home"].(string)
+	for id, path := range map[string]string{"work": WorkDir, "cache": CacheDir} {
+		if resource(t, m, id)["path"] != path {
+			t.Errorf("%s: the manifest places %v, the code uses %s", id, resource(t, m, id)["path"], path)
+		}
+		if path == home || strings.HasPrefix(path, home+"/") {
+			t.Errorf("%s %s is in the home %s", id, path, home)
+		}
+	}
+}
diff --git a/modules/mesh-build-go/cmd/mesh-build-go/forge_test.go b/modules/mesh-build-go/cmd/mesh-build-go/forge_test.go
new file mode 100644
index 00000000..b4e1d4b1
--- /dev/null
+++ b/modules/mesh-build-go/cmd/mesh-build-go/forge_test.go
@@ -0,0 +1,246 @@
+package main
+
+// The forge side of a build module (novox/hq ADR 0466 §2 and §4, issue 1484). This file is the same for every build
+// module: mesh-build-node takes a copy and changes the three constants below.
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/binary"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/forgekey"
+)
+
+const (
+	forgeModule  = "mesh-build-go"
+	forgeHome    = "/var/lib/mesh-build-go"
+	forgeModuleD = "../.." // the module's directory, where module.json and files/ are
+)
+
+type forgeManifest struct {
+	Requires  []any            `json:"requires"`
+	State     []any            `json:"state"`
+	Resources []map[string]any `json:"resources"`
+	Build     struct {
+		Artifacts []map[string]any `json:"artifacts"`
+	} `json:"build"`
+}
+
+func readForgeManifest(t *testing.T) forgeManifest {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(forgeModuleD, "module.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m forgeManifest
+	if err := json.Unmarshal(raw, &m); err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+func forgeTemplate(t *testing.T, r map[string]any) string {
+	t.Helper()
+	name, _ := r["template"].(string)
+	if name == "" {
+		t.Fatalf("resource %v names no template", r["id"])
+	}
+	raw, err := os.ReadFile(filepath.Join(forgeModuleD, filepath.FromSlash(name)))
+	if err != nil {
+		t.Fatalf("resource %v names %s: %v", r["id"], name, err)
+	}
+	return string(raw)
+}
+
+func forgeResource(t *testing.T, m forgeManifest, id string) map[string]any {
+	t.Helper()
+	for _, r := range m.Resources {
+		if r["id"] == id {
+			if r["owner"] != forgeModule {
+				t.Errorf("%s is owned by %v, not the module's own account", id, r["owner"])
+			}
+			if p, _ := r["path"].(string); !strings.HasPrefix(p, "${dir:") || strings.Contains(p, "account-home") {
+				t.Errorf("%s is at %q: a path of the account's own home (${dir:...}), never the operator's", id, p)
+			}
+			return r
+		}
+	}
+	t.Fatalf("no resource %q", id)
+	return nil
+}
+
+var forgeSample = map[string]string{
+	"known_host": "[novox.internal]:222 ssh-ed25519 AAAAC3Nza",
+	"host_key":   "ssh-ed25519 AAAAC3Nza",
+	"ssh_host":   "novox.internal",
+	"ssh_alias":  "mesh-forge",
+	"ssh_port":   "222",
+	"ssh_base":   "ssh://git@novox.internal:222/",
+	"https_base": "https://git.novox.be/",
+}
+
+// forgeRender fills ${bound:forge-account:<key>} with the sample values, as the provisioner client does.
+func forgeRender(t *testing.T, s string) string {
+	t.Helper()
+	for k, v := range forgeSample {
+		s = strings.ReplaceAll(s, "${bound:forge-account:"+k+"}", v)
+	}
+	if strings.Contains(s, "${") {
+		t.Errorf("unfilled placeholder in %q", s)
+	}
+	return s
+}
+
+// 1484/AC1: given sample bound values, the ssh config has Host mesh-forge, IdentitiesOnly yes and the key under the
+// module's own home; known_hosts carries the host key; git's config rewrites https_base to ssh://mesh-forge/; no
+// ${ is left.
+func TestForgeFilesRenderFromTheBoundValuesInTheModulesOwnHome(t *testing.T) {
+	m := readForgeManifest(t)
+
+	cfg := forgeResource(t, m, "ssh-config")
+	want := "Host mesh-forge\n  HostName novox.internal\n  Port 222\n  HostKeyAlias mesh-forge\n  User git\n  IdentityFile ~/.ssh/mesh_ed25519\n  IdentitiesOnly yes\n"
+	if got := forgeRender(t, forgeTemplate(t, cfg)); got != want {
+		t.Errorf("ssh config = %q, want %q", got, want)
+	}
+	if cfg["path"] != "${dir:ssh-dir}/config" || cfg["mode"] != "0600" || cfg["into"] != nil {
+		t.Errorf("ssh config resource = %v, want the whole file ${dir:ssh-dir}/config at mode 0600", cfg)
+	}
+
+	kh := forgeResource(t, m, "known-hosts")
+	if got := strings.TrimSpace(forgeRender(t, forgeTemplate(t, kh))); got != "mesh-forge ssh-ed25519 AAAAC3Nza" {
+		t.Errorf("known_hosts = %q", got)
+	}
+
+	g := forgeResource(t, m, "git-config")
+	wantGit := "[url \"ssh://mesh-forge/\"]\n\tinsteadOf = https://git.novox.be/\n"
+	if got := forgeRender(t, forgeTemplate(t, g)); got != wantGit {
+		t.Errorf("git config = %q, want %q", got, wantGit)
+	}
+
+	dir := forgeResource(t, m, "ssh-dir")
+	if dir["mode"] != "0700" || dir["path"] != "${dir:state}/.ssh" {
+		t.Errorf("ssh-dir = %v, want ${dir:state}/.ssh at mode 0700", dir)
+	}
+}
+
+// 1484/AC2: the module requires forge-account, keeps the state keys, and every file resource takes its text from a
+// template in the files/ archive (novox/hq ADR 0349 §2).
+func TestManifestRequiresForgeAccountKeepsKeysAndTakesFilesFromTemplates(t *testing.T) {
+	m := readForgeManifest(t)
+	if len(m.Requires) != 1 || m.Requires[0] != "forge-account" {
+		t.Errorf("requires = %v, want [forge-account]", m.Requires)
+	}
+	keeps := false
+	for _, s := range m.State {
+		if s == "keys" {
+			keeps = true
+		}
+	}
+	if !keeps {
+		t.Errorf("state = %v lacks keys", m.State)
+	}
+	files := 0
+	for _, r := range m.Resources {
+		if _, inline := r["content"]; inline {
+			t.Errorf("resource %v keeps its text inline", r["id"])
+		}
+		if r["type"] == "file" {
+			files++
+			forgeTemplate(t, r)
+		}
+	}
+	if files == 0 {
+		t.Errorf("no file resource: the forge's ssh files are missing")
+	}
+	packs := 0
+	for _, a := range m.Build.Artifacts {
+		if a["kind"] == "archive" && a["from"] == "files" && a["name"] == "files" {
+			packs++
+		}
+	}
+	if packs != 1 {
+		t.Errorf("the build packs files/ into %d archives named files, not one", packs)
+	}
+}
+
+// forgeEd25519Line is a public key line with a well-formed ed25519 blob.
+func forgeEd25519Line(comment string) string {
+	blob := []byte{}
+	for _, part := range [][]byte{[]byte("ssh-ed25519"), make([]byte, 32)} {
+		l := make([]byte, 4)
+		binary.BigEndian.PutUint32(l, uint32(len(part)))
+		blob = append(append(blob, l...), part...)
+	}
+	return "ssh-ed25519 " + base64.StdEncoding.EncodeToString(blob) + " " + comment
+}
+
+type forgeKeys struct{ puts map[string][]byte }
+
+func (f *forgeKeys) Put(key string, value any) (uint64, error) {
+	raw, _ := json.Marshal(value)
+	if f.puts == nil {
+		f.puts = map[string][]byte{}
+	}
+	f.puts[key] = raw
+	return uint64(len(f.puts)), nil
+}
+
+// forgeKeygen stands in for ssh-keygen: it writes the pair the command names.
+func forgeKeygen(_ context.Context, _ []string, name string, args ...string) forgekey.Ran {
+	var file, comment string
+	for i, a := range args {
+		switch a {
+		case "-f":
+			file = args[i+1]
+		case "-C":
+			comment = args[i+1]
+		}
+	}
+	if name != "ssh-keygen" || file == "" {
+		return forgekey.Ran{Status: 1, Stderr: "unexpected"}
+	}
+	os.WriteFile(file, []byte("PRIVATE\n"), 0o600)
+	os.WriteFile(file+".pub", []byte(forgeEd25519Line(comment)+"\n"), 0o644)
+	return forgekey.Ran{}
+}
+
+// 1484/AC3: given the bundle started with an empty home, the keeper writes <node>.<module> with kind builder, and
+// the key is in the home's .ssh.
+func TestTheKeeperWritesTheModulesEntryWithKindBuilder(t *testing.T) {
+	home, st := t.TempDir(), &forgeKeys{}
+	if err := keeperFor(home, "ace", forgeModule, forgeKeygen, st).Once(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(home, ".ssh", "mesh_ed25519")); err != nil {
+		t.Errorf("no key in an empty home: %v", err)
+	}
+	raw, ok := st.puts["ace."+forgeModule]
+	if !ok || len(st.puts) != 1 {
+		t.Fatalf("entries = %v, want one at ace.%s", st.puts, forgeModule)
+	}
+	var e forgekey.KeyEntry
+	if err := json.Unmarshal(raw, &e); err != nil {
+		t.Fatal(err)
+	}
+	if e.Kind != "builder" || e.Node != "ace" || e.Account != forgeModule || !strings.HasPrefix(e.Public, "ssh-ed25519 ") {
+		t.Errorf("entry = %s", raw)
+	}
+	if strings.Contains(strings.ToUpper(string(raw)), "PRIVATE") {
+		t.Errorf("the entry carries private material: %s", raw)
+	}
+}
+
+// The home the manifest places is the one the account is given, so the keeper's home and the templates' agree.
+func TestTheAccountsHomeIsTheOneTheManifestNames(t *testing.T) {
+	m := readForgeManifest(t)
+	for _, r := range m.Resources {
+		if r["type"] == "user" && r["name"] == forgeModule && r["home"] != forgeHome {
+			t.Errorf("the account's home is %v, want %s", r["home"], forgeHome)
+		}
+	}
+}
diff --git a/modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go b/modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go
new file mode 100644
index 00000000..e1436f55
--- /dev/null
+++ b/modules/mesh-build-go/cmd/mesh-build-go/manifest_test.go
@@ -0,0 +1,150 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The catalogue's root and this module's directory.
+const (
+	catalogueRoot = "../../../.."
+	moduleDir     = "../.."
+)
+
+func readManifest(t *testing.T) catalogue.Manifest {
+	t.Helper()
+	m, err := catalogue.ReadTreeManifest(catalogueRoot, moduleDir)
+	if err != nil {
+		t.Fatalf("mesh-sdk's validator refuses module.json: %v", err)
+	}
+	return m
+}
+
+func resource(t *testing.T, m catalogue.Manifest, id string) map[string]any {
+	t.Helper()
+	for _, r := range m.Resources {
+		if r["id"] == id {
+			return r
+		}
+	}
+	t.Fatalf("module.json declares no resource %q", id)
+	return nil
+}
+
+// 1483/AC1: mesh-sdk's validator accepts the module (alone on a shelf too), and it runs as mesh-build-go with its
+// home at mode 0700, requires user-namespaces and declares the four packages.
+func TestManifestIsValidAndDeclaresTheAccountTheCapabilityAndThePackages(t *testing.T) {
+	m := readManifest(t)
+	if problems := catalogue.CatalogueProblems(catalogue.Shelf{m.Module: m}); len(problems) > 0 {
+		t.Errorf("the catalogue's rules refuse it: %v", problems)
+	}
+	if m.Module != "mesh-build-go" || m.RunsAs != "mesh-build-go" {
+		t.Errorf("module %q runs as %q, want mesh-build-go as itself", m.Module, m.RunsAs)
+	}
+	account := resource(t, m, "account")
+	if account["type"] != "user" || account["name"] != "mesh-build-go" || account["shell"] != "/usr/bin/nologin" || account["home"] != "/var/lib/mesh-build-go" {
+		t.Errorf("account = %v", account)
+	}
+	home := resource(t, m, "state")
+	if home["type"] != "directory" || home["mode"] != "0700" || home["owner"] != "mesh-build-go" || home["place"] != "." {
+		t.Errorf("home = %v, want its directory at mode 0700 owned by the account", home)
+	}
+	if !slices.Contains(m.Capabilities, "user-namespaces") {
+		t.Errorf("capabilities = %v, want user-namespaces", m.Capabilities)
+	}
+	packages := []string{}
+	for _, r := range m.Resources {
+		if r["type"] == "package" {
+			packages = append(packages, r["package"].(string))
+		}
+	}
+	slices.Sort(packages)
+	if want := []string{"git", "go", "openssh", "postgresql"}; !slices.Equal(packages, want) {
+		t.Errorf("packages = %v, want %v", packages, want)
+	}
+}
+
+// The work and cache directories are outside the home (ADR 0466 §1), owned by the account.
+func TestWorkAndCacheDirectoriesLieOutsideTheHome(t *testing.T) {
+	m := readManifest(t)
+	for _, id := range []string{"work", "cache"} {
+		r := resource(t, m, id)
+		path, _ := r["path"].(string)
+		if path == "" || path == "/var/lib/mesh-build-go" || len(path) > len("/var/lib/mesh-build-go") && path[:len("/var/lib/mesh-build-go/")] == "/var/lib/mesh-build-go/" {
+			t.Errorf("%s is at %q, inside or at the home", id, path)
+		}
+		if r["owner"] != "mesh-build-go" {
+			t.Errorf("%s is owned by %v", id, r["owner"])
+		}
+	}
+}
+
+// The states are the three the module keeps, no seat is claimed (ADR 0469 §6), and the health is the module's own
+// tool, which the manifest also lists among its tools.
+func TestManifestKeepsItsStatesClaimsNoSeatAndDeclaresItsHealthTool(t *testing.T) {
+	m := readManifest(t)
+	states := []string{}
+	for _, s := range m.State {
+		states = append(states, s.Name)
+	}
+	slices.Sort(states)
+	if want := []string{"keys", "steps", "toolchains"}; !slices.Equal(states, want) {
+		t.Errorf("state = %v, want %v", states, want)
+	}
+	if len(m.Claims) != 0 {
+		t.Errorf("claims = %v, want no seat", m.Claims)
+	}
+	if !slices.Contains(m.Tools, HealthTool) {
+		t.Errorf("tools = %v lack %s", m.Tools, HealthTool)
+	}
+	raw, _ := os.ReadFile(filepath.Join(moduleDir, "module.json"))
+	if !strings.Contains(string(raw), `"tool": "`+HealthTool+`"`) {
+		t.Errorf("runtime-health does not name %s", HealthTool)
+	}
+}
+
+// Every tool the manifest names is served, and every tool served is named.
+func TestTheToolsServedAreTheToolsTheManifestNames(t *testing.T) {
+	m := readManifest(t)
+	served := []string{}
+	for _, tool := range (&Module{}).Tools((&Module{}).StepTools()) {
+		served = append(served, tool.Name)
+	}
+	slices.Sort(served)
+	named := slices.Clone(m.Tools)
+	slices.Sort(named)
+	if !slices.Equal(served, named) {
+		t.Errorf("served %v, manifest names %v", served, named)
+	}
+}
+
+// 1482/AC4: gitea's manifest reads the keys state of both build modules, and the catalogue's validator accepts it with the
+// build modules beside it: each owner present declares the state read (a read of a state its owner does not keep is
+// refused).
+func TestGiteaReadsTheBuildModulesKeysAndTheCatalogueAcceptsThemTogether(t *testing.T) {
+	var all []catalogue.Manifest
+	var gitea catalogue.Manifest
+	for _, name := range []string{"gitea", "mesh-build-go", "mesh-build-node"} {
+		m, err := catalogue.ReadTreeManifest(catalogueRoot, filepath.Join(catalogueRoot, "modules", name))
+		if err != nil {
+			t.Fatalf("mesh-sdk's validator refuses modules/%s/module.json: %v", name, err)
+		}
+		all = append(all, m)
+		if name == "gitea" {
+			gitea = m
+		}
+	}
+	for _, want := range []string{"mesh-build-go.keys", "mesh-build-node.keys", "ssh-client.keys"} {
+		if !slices.Contains(gitea.Reads, want) {
+			t.Errorf("gitea reads %v, lacks %s", gitea.Reads, want)
+		}
+	}
+	if problems := catalogue.StateReadsNothingDeclares(all); len(problems) > 0 {
+		t.Errorf("a read names a state its owner does not keep: %v", problems)
+	}
+}