Join: merge A3 (wip/registry-a3)

Conflicts, both sides kept: artifact-store-tools' invokes (the assigner's
and indexer's read tools, followed through views, beside the registry
seats' hold, release and remove), its main (the views reader and the
seat asker), its manifest row; gitea's invokes (the indexer's read tool,
the hand act and the builder's versions) and its consumes of the
indexer's views. gitea's account test takes the packages account's
names; repoCheckFacts, removed on main, is not imported. No catalogue
module reads the indexer's state.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/artifact-store-tools/README.md

@@ -115,3 +115,13 @@ Any command other than the two read-only scripts fails the test.
 Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
 
 - `${dir:state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+
+### The sweep through the registry seats
+
+The sweep writes nothing to the store's door (CAT-AS1, ADR 0617 §2): it asks the registry seats the store's holder
+serves. Each kept bundle or archive is held on `oci-artifact-registry` and each kept copy of an upstream base on
+`container-image-registry` (`hold`, with why it is kept) before anything goes; each eligible one is released, then
+removed for `retention` on its seat (`release`, `remove`). It reads a reference in both forms, `artifact-store://<path>`
+and `<seat>/<module>/<artifact>@<digest>`, as one artifact, and says artifacts-gone in the form the build named it. A
+call a seat refuses stops the sweep and writes the finding `sweep-refused` in the module's findings; the next sweep no
+seat refuses clears it (`sweepseats.go`).

modules/artifact-store-tools/cmd/artifact-store-tools/door.go

@@ -21,20 +21,12 @@ import (
 // door is registry.Store at the store's address as this machine reaches it.
 type door struct{ s registry.Store }
 
-func (d *door) Address() string                                  { return d.s.Address }
-func (d *door) Hold(ctx context.Context, r string) (bool, error) { return d.s.Hold(ctx, r) }
-func (d *door) Holds(ctx context.Context, r string) error        { return d.s.Holds(ctx, r) }
+// It is read only: what the sweep holds and removes it asks the registry seats (sweepseats.go).
+func (d *door) Address() string                           { return d.s.Address }
+func (d *door) Holds(ctx context.Context, r string) error { return d.s.Holds(ctx, r) }
 func (d *door) IsIndex(ctx context.Context, r string) (bool, error) {
 	return d.s.IsIndex(ctx, r)
 }
-func (d *door) LetGo(ctx context.Context, r string) error { return d.s.LetGo(ctx, r) }
-func (d *door) SpareKept(ctx context.Context, keptImages, touching []string) error {
-	spare, err := d.s.SpareKeptIndexes(ctx, keptImages, touching)
-	if err == nil {
-		d.s.Spare = spare
-	}
-	return err
-}
 
 // DoorAt reads the store's address (host:port) from the file the manifest fills from the seat mesh-artifact-store's
 // reach, each time, so a store that moved is reached where it is now.

modules/artifact-store-tools/cmd/artifact-store-tools/holder.go

@@ -71,15 +71,12 @@ type Bus interface {
 	Publish(subject string, body any) error
 }
 
-// Door is the artifact store's own door: registry.Store, behind an interface so a test needs no store.
+// Door is the artifact store's own door, read only: registry.Store, behind an interface so a test needs no store. What
+// the sweep holds and removes it asks the registry seats (Seats, sweepseats.go).
 type Door interface {
 	Address() string
-	Hold(ctx context.Context, reference string) (bool, error)
 	Holds(ctx context.Context, reference string) error
 	IsIndex(ctx context.Context, reference string) (bool, error)
-	LetGo(ctx context.Context, reference string) error
-	// SpareKept sets the platform manifests a kept index names aside before an index is let go of (ADR 0257).
-	SpareKept(ctx context.Context, keptImages, touching []string) error
 }
 
 // Holder is the seat's holder.
@@ -89,8 +86,10 @@ type Holder struct {
 	// Listed is the store's own listing now (Store.View); nil reads none, and then nothing is said gone or collected.
 	Listed func(ctx context.Context) (*View, error)
 	Acts   handacts.Recorder
-	Now    func() time.Time
-	Logf   func(string, ...any)
+	// Seats asks a registry seat's verb, `seat:<seat>.<verb>` (hold, remove): the runtime's stdio.Ask in main.
+	Seats func(key string, body any) (json.RawMessage, error)
+	Now   func() time.Time
+	Logf  func(string, ...any)
 
 	sweep sync.Mutex // one sweep at a time
 	mu    sync.Mutex
@@ -219,7 +218,7 @@ func KeepSet(builds []Build, wants []Want) map[string]*Ref {
 	out := map[string]*Ref{}
 	for _, b := range builds {
 		for _, a := range b.Artifacts {
-			reference := catalogue.Recorded(a.Reference)
+			reference := canonical(catalogue.Recorded(a.Reference))
 			if _, ours := catalogue.InArtifactStore(reference); !ours || a.Kind == "package" {
 				continue
 			}
@@ -513,13 +512,13 @@ func (h *Holder) Sweep(ctx context.Context, s Sweeping) (*CollectAnswer, error)
 		return nil, err
 	}
 	a := &CollectAnswer{DryRun: s.DryRun, WouldLetGo: []string{}, LetGo: []string{}}
-	var keptArchives, keptImages, eligible []string
+	var keptArchives, eligible []string
 	for _, r := range j.sorted() {
 		switch {
-		case r.Kept && r.Kind == "archive":
+		case r.Kept && (r.Kind == "archive" || isCopy(r.Reference)):
+			// What retention would remove unless held: a bundle or an archive, and a copied base (ADR 0617 §2).
 			keptArchives = append(keptArchives, r.Reference)
 		case r.Kept:
-			keptImages = append(keptImages, r.Reference)
 		default:
 			if held, known := inStore(j.view, r.Reference); known && !held {
 				continue // collected already
@@ -545,33 +544,25 @@ func (h *Holder) Sweep(ctx context.Context, s Sweeping) (*CollectAnswer, error)
 	a.Store = door.Address()
 	within, stop := context.WithTimeout(ctx, SweepBudget)
 	defer stop()
-	// Hold before letting go (ADR 0251 §8): a kept archive that cannot be held stops the sweep before any delete.
+	// Hold before letting go (ADR 0251 §8, ADR 0617 §2): each kept archive and copied base is held on its seat; one that
+	// cannot be held stops the sweep before any removal and writes the sweep's finding.
 	var missing []string
 	for _, r := range keptArchives {
-		wrote, err := door.Hold(within, r)
-		switch {
-		case err == nil:
-			if wrote {
-				a.HoldersWritten++
-			}
-		case errors.Is(err, registry.Gone):
+		if held, known := inStore(j.view, r); known && !held {
 			missing = append(missing, r)
-		case errors.Is(err, registry.ErrNotOurs):
-		default:
+			continue
+		}
+		if _, err := h.holdOnSeat(r, keptWhy(j.refs[r])); err != nil {
 			a.Stopped = fmt.Sprintf("not every kept archive could be held, so nothing was let go: holding %s: %v", r, err)
 			a.Left = len(eligible)
+			h.sweepFinding("the hold of "+r, err)
 			return a, nil
 		}
+		a.HoldersWritten++
 	}
 	a.Held, a.Missing = len(keptArchives)-len(missing), len(missing)
 	h.sayGone(j, missing, "a kept archive the store does not hold")
-	if s.Confirmed {
-		if err := door.SpareKept(within, keptImages, eligible); err != nil {
-			a.Stopped = fmt.Sprintf("which platform manifests a kept index names could not be read, so nothing was let go: %v", err)
-			a.Left = len(eligible)
-			return a, nil
-		}
-	}
+	refused := false
 	for i, r := range eligible {
 		if i >= s.Most || within.Err() != nil {
 			a.Left = len(eligible) - i
@@ -595,24 +586,19 @@ func (h *Holder) Sweep(ctx context.Context, s Sweeping) (*CollectAnswer, error)
 				continue
 			}
 		}
-		err := door.LetGo(within, r)
-		switch {
-		case err == nil || errors.Is(err, registry.Gone):
-		case errors.Is(err, registry.ErrNotOurs):
-			a.Skipped++
-			continue
-		default:
-			a.Stopped = fmt.Sprintf("the store refused to let go of %s, so nothing more was asked: %v", r, err)
-			a.Left = len(eligible) - i
-		}
-		if a.Stopped != "" {
-			break
-		}
-		// Recorded in the hand-act log, each one (ADR 0565 §10; the operator's "option A").
+		// Removed through its seat (ADR 0617 §2), recorded in the hand-act log, each one (ADR 0565 §10; the operator's
+		// "option A").
 		why := s.Why
 		if why == "" {
 			why = "eligible: no want names it and it is not among its module's " + fmt.Sprint(KeptBuilds) + " newest builds"
 		}
+		if err := h.removeOnSeat(r, why); err != nil {
+			a.Stopped = fmt.Sprintf("a registry seat refused to remove %s, so nothing more was asked: %v", r, err)
+			a.Left = len(eligible) - i
+			h.sweepFinding("the removal of "+r, err)
+			refused = true
+			break
+		}
 		if _, err := h.Acts.Record(handacts.Request{What: "let go of " + r + " (" + s.By + ")", Why: why,
 			Cause: "artifact-store-sweep", Verb: "collect"}); err != nil {
 			h.logf("%s was let go of and could not be recorded in the hand-act log: %v", r, err)
@@ -620,6 +606,9 @@ func (h *Holder) Sweep(ctx context.Context, s Sweeping) (*CollectAnswer, error)
 		a.LetGo = append(a.LetGo, r)
 	}
 	h.sayGone(j, a.LetGo, "let go of")
+	if !refused {
+		h.sweepClean()
+	}
 	return a, nil
 }
 
@@ -639,7 +628,7 @@ func (h *Holder) sayGone(j *judged, refs []string, how string) {
 				byKey[b.Key] = g
 				keys = append(keys, b.Key)
 			}
-			g.Gone = append(g.Gone, r)
+			g.Gone = append(g.Gone, namedBy(b, r))
 		}
 	}
 	sort.Strings(keys)
@@ -654,6 +643,17 @@ func (h *Holder) sayGone(j *judged, refs []string, how string) {
 	}
 }
 
+// namedBy is the reference b names r by, in the form its key holds (the older one or the seat's): the builder matches
+// artifacts-gone against its own key.
+func namedBy(b Build, r string) string {
+	for _, a := range b.Artifacts {
+		if rec := catalogue.Recorded(a.Reference); canonical(rec) == r {
+			return rec
+		}
+	}
+	return r
+}
+
 // AfterBuild is the sweep at a build's end.
 func (h *Holder) AfterBuild(key string) {
 	a, err := h.Sweep(context.Background(), Sweeping{Most: MostPerSweep, By: "after the build " + key})
@@ -687,7 +687,7 @@ func (h *Holder) Held(refs []string) (delivery.HeldAnswer, error) {
 	defer stop()
 	a := delivery.HeldAnswer{Store: door.Address(), Held: []string{}, Gone: []string{}}
 	for _, r := range refs {
-		switch err := door.Holds(asking, r); {
+		switch err := door.Holds(asking, canonical(r)); {
 		case err == nil:
 			a.Held = append(a.Held, r)
 		case errors.Is(err, registry.Gone):
@@ -901,6 +901,9 @@ func (h *Holder) Observe(ctx context.Context) error {
 		return fmt.Errorf("the findings: %w", err)
 	}
 	for _, k := range keys {
+		if k == sweepFindingKey {
+			continue // the sweep's own finding, which the sweep clears
+		}
 		if _, still := now[k]; !still {
 			// A finding of a first view unanswered is the reader's (views.Reader), cleared by its answer, not by a sweep.
 			if raw, found, err := h.Bus.Get(FindingsState, k); err == nil && found {

modules/artifact-store-tools/cmd/artifact-store-tools/holder_integration_test.go

@@ -173,15 +173,32 @@ func TestTheSeatSweepsAtABuildsEndOnARealBusWithNoLease(t *testing.T) {
 	}); err != nil {
 		t.Fatal(err)
 	}
-	h := &Holder{Bus: findingsAt{realBus: bus}, Door: mem.Door, Listed: mem.Listed, Now: time.Now, Logf: t.Logf}
-	h.Acts = handacts.Recorder{Ask: func(key string, body any) (json.RawMessage, error) {
+	// The registry seats' holder on the bus (CAT-AS1): the sweep holds and removes through their verbs.
+	for _, seat := range []string{"oci-artifact-registry", "container-image-registry"} {
+		if _, err := nc.Subscribe("mesh.seat."+seat+".tool.*", func(m *nats.Msg) {
+			var body map[string]any
+			_ = json.Unmarshal(m.Data, &body)
+			mu.Lock()
+			out, err := door.seat("seat:"+seat+"."+m.Subject[strings.LastIndex(m.Subject, ".")+1:], body)
+			mu.Unlock()
+			if err != nil {
+				out, _ = json.Marshal(map[string]string{"error": err.Error()})
+			}
+			_ = m.Respond(out)
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	ask := func(key string, body any) (json.RawMessage, error) {
 		raw, _ := json.Marshal(body)
 		m, err := nc.Request("mesh.seat."+strings.TrimPrefix(strings.Replace(key, ".", ".tool.", 1), "seat:"), raw, 5*time.Second)
 		if err != nil {
 			return nil, err
 		}
 		return m.Data, nil
-	}}
+	}
+	h := &Holder{Bus: findingsAt{realBus: bus}, Door: mem.Door, Listed: mem.Listed, Seats: ask, Now: time.Now, Logf: t.Logf}
+	h.Acts = handacts.Recorder{Ask: ask}
 
 	// A build's end heard from the builds bucket, as follow hands it over.
 	kv, _ := bus.kv(BuildsRead)

modules/artifact-store-tools/cmd/artifact-store-tools/holder_test.go

@@ -3,7 +3,9 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 	"sync"
@@ -15,6 +17,8 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/handacts"
 	"git.novox.be/novox/mesh-sdk/go/health"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+
 	"artifactstoretools/internal/registry"
 )
 
@@ -85,21 +89,56 @@ func (b *memBus) Publish(subject string, body any) error {
 	return nil
 }
 
-// memDoor is the store's door in memory: what it holds, which references are indexes, and what was asked.
+// memDoor is the store's door in memory, read only, and the registry seats' holder: what it holds, which references are
+// indexes, what the seats were asked (asked: "hold <ref>", "let go <ref>"; calls: each seat call as its key and name), the
+// holds asked (held), and the calls it refuses (refuse: by "<verb> <ref>").
 type memDoor struct {
 	holds   map[string]bool
 	indexes map[string]bool
 	asked   []string
+	calls   []string
+	held    map[string]bool
+	refuse  map[string]error
+}
+
+// seat is the registry seats' holder, as Holder.Seats calls it.
+func (d *memDoor) seat(key string, body any) (json.RawMessage, error) {
+	raw, _ := json.Marshal(body)
+	var in struct{ Name, Digest, Reason string }
+	_ = json.Unmarshal(raw, &in)
+	seat, verb, _ := strings.Cut(strings.TrimPrefix(key, "seat:"), ".")
+	ref := catalogue.ArtifactStoreScheme + in.Name + "@" + in.Digest
+	if seat == "oci-artifact-registry" {
+		ref = catalogue.ArtifactStoreScheme + in.Name + "/blobs/" + in.Digest
+	}
+	d.calls = append(d.calls, key+" "+in.Name+"@"+in.Digest+" "+in.Reason)
+	if err := d.refuse[verb+" "+ref]; err != nil {
+		return nil, err
+	}
+	if d.held == nil {
+		d.held = map[string]bool{}
+	}
+	switch verb {
+	case "hold":
+		d.asked = append(d.asked, "hold "+ref)
+		d.held[ref] = true
+		return json.Marshal(map[string]any{"held": true})
+	case "release":
+		released := d.held[ref] // what is not held answers released false, as the seat's definition says
+		delete(d.held, ref)
+		return json.Marshal(map[string]any{"released": released})
+	case "remove":
+		if d.held[ref] {
+			return nil, fmt.Errorf("remove: refused: %s@%s is held; release it first", in.Name, in.Digest)
+		}
+		d.asked = append(d.asked, "let go "+ref)
+		delete(d.holds, ref)
+		return json.Marshal(map[string]any{"removed": true})
+	}
+	return nil, fmt.Errorf("no verb %s", key)
 }
 
 func (d *memDoor) Address() string { return "10.0.0.5:5000" }
-func (d *memDoor) Hold(_ context.Context, r string) (bool, error) {
-	d.asked = append(d.asked, "hold "+r)
-	if !d.holds[r] {
-		return false, registry.Gone
-	}
-	return false, nil
-}
 func (d *memDoor) Holds(_ context.Context, r string) error {
 	if !d.holds[r] {
 		return registry.Gone
@@ -107,15 +146,6 @@ func (d *memDoor) Holds(_ context.Context, r string) error {
 	return nil
 }
 func (d *memDoor) IsIndex(_ context.Context, r string) (bool, error) { return d.indexes[r], nil }
-func (d *memDoor) LetGo(_ context.Context, r string) error {
-	d.asked = append(d.asked, "let go "+r)
-	delete(d.holds, r)
-	return nil
-}
-func (d *memDoor) SpareKept(context.Context, []string, []string) error {
-	d.asked = append(d.asked, "spare")
-	return nil
-}
 
 // mirror is a copy of an upstream base in the store, the n-th.
 func mirror(n int) string {
@@ -194,7 +224,7 @@ func aMesh(t *testing.T) (*Holder, *memBus, *memDoor, *[]string) {
 	want, _ := json.Marshal(delivery.Want{V: delivery.Version, FP: fp(1), Self: true})
 	_ = b.Put(WantsRead, "want.ace.letta", json.RawMessage(want))
 	var acts []string
-	h := &Holder{Bus: b, Door: func() (Door, error) { return door, nil },
+	h := &Holder{Bus: b, Door: func() (Door, error) { return door, nil }, Seats: door.seat,
 		Listed: func(context.Context) (*View, error) { return &View{L: listing}, nil },
 		Now:    func() time.Time { return day.Add(48 * time.Hour) },
 		Acts: handacts.Recorder{Ask: func(key string, body any) (json.RawMessage, error) {
@@ -246,18 +276,43 @@ func TestTheSeatKeepsTheFiveNewestAndTheWantedAndSweepsWithNoLease(t *testing.T)
 		left    int
 		skipped int
 		unlog   int
+		// held is how many kept archives and copies are held (7 when 0); seatForm names letta's 2nd and 3rd builds in the
+		// seat's form; refuse is the seat call refused, "<verb> <ref>".
+		held     int
+		seatForm bool
+		refuse   string
 	}{
 		{name: "a build's end", how: "build", letGo: all},
+		// ADR 0605 §9: a build that names its artifacts in the seat's form is the same artifact: removed and held under the
+		// seat's name and digest, and said gone in its own form.
+		{name: "the seat's form", most: MostPerSweep, letGo: all, seatForm: true},
+		// A seat that refuses a removal stops the sweep; the finding sweep-refused is written, and cleared by a clean run.
+		{name: "a refused removal", most: MostPerSweep, letGo: []string{archiveRef("letta", 2)}, left: 2, refuse: "remove " + imageRef("letta", 2)},
 		{name: "a confirmed collect", how: "collect", letGo: all},
 		{name: "a sweep", most: MostPerSweep, letGo: all},
 		{name: "an index waits", index: true, most: MostPerSweep, letGo: []string{archiveRef("letta", 2), mirror(1)}, skipped: 1},
 		{name: "bounded", most: 1, letGo: []string{archiveRef("letta", 2)}, left: 2},
 		// A kept build the log no longer holds: what it stood on is unknown, so no copy goes.
-		{name: "a kept build's bases unknown", most: MostPerSweep, letGo: []string{archiveRef("letta", 2), imageRef("letta", 2)}, unlog: 3},
+		{name: "a kept build's bases unknown", most: MostPerSweep, letGo: []string{archiveRef("letta", 2), imageRef("letta", 2)}, unlog: 3, held: 8},
 	} {
 		t.Run(c.name, func(t *testing.T) {
 			h, b, door, acts := aMesh(t)
 			door.indexes[imageRef("letta", 2)] = c.index
+			if c.held == 0 {
+				c.held = 7
+			}
+			if c.seatForm {
+				for _, n := range []int{2, 3} {
+					key, _ := delivery.BuilderBuildKey("letta", fp(n))
+					raw, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, Manifest: strings.Repeat("d", 64), Artifacts: []delivery.BuiltArtifact{
+						{Name: "image", Kind: "image", Digest: digestOf(imageRef("letta", n)), Reference: catalogue.SeatReference("container-image-registry", "letta", "image", digestOf(imageRef("letta", n)))},
+						{Name: "files", Kind: "archive", Digest: digestOf(archiveRef("letta", n)), Reference: catalogue.SeatReference("oci-artifact-registry", "letta", "files", digestOf(archiveRef("letta", n)))}}})
+					_ = b.Put(BuildsRead, key, json.RawMessage(raw))
+				}
+			}
+			if c.refuse != "" {
+				door.refuse = map[string]error{c.refuse: errors.New("the store is read only")}
+			}
 			if c.unlog > 0 {
 				b.log = append(b.log[:c.unlog-1:c.unlog-1], b.log[c.unlog:]...)
 			}
@@ -284,7 +339,7 @@ func TestTheSeatKeepsTheFiveNewestAndTheWantedAndSweepsWithNoLease(t *testing.T)
 				if err != nil {
 					t.Fatal(err)
 				}
-				if fmt.Sprint(a.LetGo) != fmt.Sprint(c.letGo) || a.Left != c.left || a.Skipped != c.skipped || a.Held != 6 || a.Missing != 0 {
+				if fmt.Sprint(a.LetGo) != fmt.Sprint(c.letGo) || a.Left != c.left || a.Skipped != c.skipped || a.Held != c.held || a.Missing != 0 {
 					t.Fatalf("let go of %v (left %d, skipped %d, held %d, missing %d), want %v", a.LetGo, a.Left, a.Skipped, a.Held, a.Missing, c.letGo)
 				}
 			}
@@ -298,8 +353,34 @@ func TestTheSeatKeepsTheFiveNewestAndTheWantedAndSweepsWithNoLease(t *testing.T)
 					held++
 				}
 			}
-			if held != 6 {
-				t.Errorf("the store was asked %v: the six kept archives are held first", door.asked)
+			if held != c.held {
+				t.Errorf("the seats were asked %v: the %d kept archives and copies are held first", door.asked, c.held)
+			}
+			// Each removal asks the seat that holds it, by its name and digest, for retention, after a release.
+			for _, call := range door.calls {
+				if strings.Contains(call, ".remove ") && !strings.HasSuffix(call, " "+Retention) {
+					t.Errorf("a removal asked %q, not for retention", call)
+				}
+			}
+			if c.letGo[0] == archiveRef("letta", 2) && !slices.Contains(door.calls, "seat:oci-artifact-registry.remove letta/files@"+digestOf(archiveRef("letta", 2))+" "+Retention) {
+				t.Errorf("the seats were called %v", door.calls)
+			}
+			_, finding, _ := b.Get(FindingsState, sweepFindingKey)
+			if finding != (c.refuse != "") {
+				t.Errorf("the sweep's finding is written: %v, want %v", finding, c.refuse != "")
+			}
+			if c.refuse != "" {
+				door.refuse = nil
+				if _, err := h.Sweep(context.Background(), Sweeping{Most: MostPerSweep, By: "again"}); err != nil {
+					t.Fatal(err)
+				}
+				if _, still, _ := b.Get(FindingsState, sweepFindingKey); still {
+					t.Error("a clean sweep left the sweep's finding")
+				}
+				return
+			}
+			if c.seatForm && !strings.Contains(b.published[0], `"container-image-registry/letta/image@`+digestOf(imageRef("letta", 2))+`"`) {
+				t.Errorf("artifacts-gone does not name the build's own form: %v", b.published)
 			}
 			if len(*acts) != len(c.letGo) || !strings.HasPrefix((*acts)[0], "seat:mesh-hand-acts.hand-act ") ||
 				!strings.Contains((*acts)[0], c.letGo[0]) {

modules/artifact-store-tools/cmd/artifact-store-tools/main.go

@@ -34,7 +34,7 @@ func main() {
 	v.Follow(delivery.AssignerModule, "wants", WantsTool)
 	v.Follow(delivery.IndexerModule, "manifests", ManifestsTool)
 	h := &Holder{Bus: runtimeBus{views: v}, Door: DoorAt(os.Getenv("MESH_ARTIFACT_STORE_ADDRESS_FILE")), Listed: s.View,
-		Now: time.Now, Logf: logf}
+		Seats: stdio.Ask, Now: time.Now, Logf: logf}
 	h.Acts = handacts.Recorder{Ask: stdio.Ask}
 	v.Start(context.Background())
 	go follow(h, v)

modules/artifact-store-tools/cmd/artifact-store-tools/store_test.go

@@ -472,7 +472,10 @@ func TestTheToolsServedAreTheToolsTheManifestNames(t *testing.T) {
 	}
 	// ADR 0571 clause 2: it holds the seat mesh-artifact-sweep and serves its verbs, and calls no verb of the controller's;
 	// it reads no controller state, the lease neither (issue 1126).
-	want := []string{"seat:mesh-hand-acts.hand-act", CatalogueModules, CatalogueModule, WantsTool, ManifestsTool}
+	// CAT-AS1: what it holds and removes it asks the two registry seats the artifact store's holder serves.
+	want := []string{"seat:mesh-hand-acts.hand-act", CatalogueModules, CatalogueModule, WantsTool, ManifestsTool,
+		"seat:oci-artifact-registry.hold", "seat:oci-artifact-registry.release", "seat:oci-artifact-registry.remove",
+		"seat:container-image-registry.hold", "seat:container-image-registry.release", "seat:container-image-registry.remove"}
 	if !reflect.DeepEqual(m.Invokes, want) {
 		t.Errorf("invokes %v", m.Invokes)
 	}

modules/artifact-store-tools/cmd/artifact-store-tools/sweepseats.go

@@ -0,0 +1,147 @@
+package main
+
+// **The sweep asks the registry seats** (CAT-AS1; novox/hq ADR 0617 §2, design 51): the artifact store's write side is
+// its holder's, so the sweep no longer deletes or holds over the store's door. What it keeps from retention it asks the
+// seat's `hold` for (a kept bundle or archive on oci-artifact-registry, a kept copy of an upstream base on
+// container-image-registry), and what is eligible it asks the seat's `remove` for, with the sweep's reason; both verbs
+// are in the manifest's `invokes`, and only this module is on their caller lists. A reference is read in both forms
+// (ADR 0605 §9): the older `artifact-store://<path>` and the seat's `<seat>/<module>/<artifact>@<digest>`; the keep set
+// keys each by the older form, so the two meet as one artifact. A call a seat refuses stops the sweep and writes the
+// sweep's finding, sweep-refused; the next sweep with no refusal clears it.
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	ociseat "git.novox.be/novox/mesh-contracts/go/seats/ociartifactregistry"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/health"
+
+	reg "git.novox.be/novox/mesh-contracts/go/seats/containerimageregistry"
+)
+
+// SweepRefused is the sweep's finding: a seat refused a hold or a remove the sweep asked.
+const SweepRefused = "sweep-refused"
+
+// sweepFindingKey is the one key of the sweep's finding in the module's findings.
+var sweepFindingKey = health.FindingKey(health.ScopeModule, Module, SweepRefused)
+
+// canonical is a kept reference in the older form, `artifact-store://<path>`, whichever form it came in; another is as
+// it was.
+func canonical(reference string) string {
+	path, kept := catalogue.InArtifactStore(reference)
+	if !kept {
+		return reference
+	}
+	return catalogue.ArtifactStoreScheme + path
+}
+
+// seatOf is the seat, name and digest a kept reference is held under: a bundle or an archive on oci-artifact-registry,
+// an image or a copy of an upstream base on container-image-registry.
+func seatOf(reference string) (seat, name, digest string, err error) {
+	path, kept := catalogue.InArtifactStore(reference)
+	if !kept {
+		return "", "", "", fmt.Errorf("%s is no reference into the mesh's registries", reference)
+	}
+	if name, digest, ok := strings.Cut(path, "/blobs/"); ok {
+		return ociseat.Seat, name, digest, nil
+	}
+	if name, digest, ok := strings.Cut(path, "@"); ok {
+		return reg.Seat, name, digest, nil
+	}
+	return "", "", "", fmt.Errorf("%s names no digest", reference)
+}
+
+// isCopy is whether a kept reference is a copy of an upstream base.
+func isCopy(reference string) bool {
+	path, _ := catalogue.InArtifactStore(reference)
+	return strings.HasPrefix(path, "upstream/")
+}
+
+// askSeat asks verb of the seat reference is held on, with body built from its name and digest.
+func (h *Holder) askSeat(reference, verb string, body func(name, digest string) any, answer any) error {
+	seat, name, digest, err := seatOf(reference)
+	if err != nil {
+		return err
+	}
+	if h.Seats == nil {
+		return fmt.Errorf("this process reaches no registry seat")
+	}
+	raw, err := h.Seats("seat:"+seat+"."+verb, body(name, digest))
+	if err != nil {
+		return fmt.Errorf("%s's %s of %s@%s: %w", seat, verb, name, digest, err)
+	}
+	if answer != nil && len(raw) > 0 {
+		if err := json.Unmarshal(raw, answer); err != nil {
+			return fmt.Errorf("%s's answer to %s: %w", seat, verb, err)
+		}
+	}
+	return nil
+}
+
+// holdOnSeat asks the seat to keep reference from retention, for why.
+func (h *Holder) holdOnSeat(reference, why string) (bool, error) {
+	var a reg.HoldAnswer
+	err := h.askSeat(reference, reg.VerbHold, func(name, digest string) any {
+		return reg.HoldInput{Name: name, Digest: digest, Reason: why}
+	}, &a)
+	if err == nil && !a.Held {
+		err = fmt.Errorf("%s: the seat answered it is not held", reference)
+	}
+	return a.Held, err
+}
+
+// Retention is the reason of a removal by digest, the sweep's alone (design 51 *Who may call which verb*): the holder
+// removes an untagged thing only for it. The seat's definition names it.
+const Retention = reg.RemoveInputReasonRetention
+
+// removeOnSeat lets reference go: a hold an earlier sweep asked while it was kept is released first (the holder
+// refuses to remove a held thing; one not held answers released false), then it is removed for retention. why goes with
+// the release; the hand act records it.
+func (h *Holder) removeOnSeat(reference, why string) error {
+	if err := h.askSeat(reference, reg.VerbRelease, func(name, digest string) any {
+		return reg.ReleaseInput{Name: name, Digest: digest, Reason: why}
+	}, &reg.ReleaseAnswer{}); err != nil {
+		return err
+	}
+	return h.askSeat(reference, reg.VerbRemove, func(name, digest string) any {
+		return reg.RemoveInput{Name: name, Digest: digest, Reason: Retention}
+	}, &reg.RemoveAnswer{})
+}
+
+// sweepFinding writes the sweep's finding: what the seat refused, and why.
+func (h *Holder) sweepFinding(what string, err error) {
+	at := h.now().UTC()
+	f := health.Finding{V: health.FindingVersion, Key: sweepFindingKey, Kind: SweepRefused,
+		Subject:  health.Subject{Scope: health.ScopeModule, ID: Module},
+		Severity: health.Warning, Resolver: health.ResolverOperator,
+		Summary:  fmt.Sprintf("the artifact sweep stopped: a registry seat refused %s (the evidence names why)", what),
+		Headline: "The artifact sweep stopped",
+		Explanation: "The sweep keeps what the mesh still needs and removes the rest through the registry seats. A seat " +
+			"refused one of its asks, so it stopped before anything more was removed; what it kept stays kept.",
+		Needs:    "read the seat holder's journal for the refusal; the next sweep asks again.",
+		Resolved: "Resolved: the artifact sweep ran through without a refusal",
+		Evidence: []health.Evidence{{At: at, Said: fmt.Sprintf("%s: %v", what, err)}},
+		Source:   "CAT-AS1", Observer: Module, At: at}
+	if werr := h.Bus.Put(FindingsState, sweepFindingKey, f); werr != nil {
+		h.logf("the sweep's finding (%s: %v) could not be written: %v", what, err, werr)
+	}
+}
+
+// sweepClean clears the sweep's finding after a sweep no seat refused.
+func (h *Holder) sweepClean() {
+	if _, found, err := h.Bus.Get(FindingsState, sweepFindingKey); err == nil && found {
+		if err := h.Bus.Delete(FindingsState, sweepFindingKey); err != nil {
+			h.logf("the sweep's finding could not be cleared: %v", err)
+		}
+	}
+}
+
+// keptWhy is why a kept reference is held, as the seat's hold takes it.
+func keptWhy(r *Ref) string {
+	if r == nil || len(r.Why) == 0 {
+		return "kept by the artifact sweep"
+	}
+	return "kept: " + strings.Join(r.Why, "; ")
+}

modules/artifact-store-tools/go.mod

@@ -8,6 +8,8 @@ require (
 )
 
 require (
+	git.novox.be/novox/mesh-contracts/go/seats/containerimageregistry v0.0.0-00010101000000-000000000000
+	git.novox.be/novox/mesh-contracts/go/seats/ociartifactregistry v0.0.0-00010101000000-000000000000
 	github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/klauspost/compress v1.20.0 // indirect

modules/artifact-store-tools/internal/registry/blob.go

@@ -1,57 +0,0 @@
-package registry
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io"
-	"net/http"
-)
-
-// blobBound is the most GetBlob reads: a templates archive is a few kilobytes; anything near this is no archive a
-// take-in reads text from.
-const blobBound = 64 << 20
-
-// GetBlob is the archive a recorded reference names (`artifact-store://<repository>/blobs/sha256:<hex>`), read whole
-// and checked against the digest it names: bytes that hash to another digest are refused, never read (R4e: the
-// controller reads a templates archive by the reference of a builder's done key). Gone when the store does not hold
-// it; ErrNotOurs for a reference outside the store or one that is not an archive.
-func (s Store) GetBlob(ctx context.Context, reference string) ([]byte, error) {
-	repository, digest, archive, err := s.archive(reference)
-	if err != nil {
-		return nil, err
-	}
-	if !archive {
-		return nil, fmt.Errorf("%w: %s is not an archive", ErrNotOurs, reference)
-	}
-	request, err := http.NewRequestWithContext(ctx, http.MethodGet, s.url(repository, "blobs", digest), nil)
-	if err != nil {
-		return nil, err
-	}
-	response, err := s.client().Do(request)
-	if err != nil {
-		return nil, fmt.Errorf("cannot reach the artifact store at %s: %w", s.Address, err)
-	}
-	defer response.Body.Close()
-	switch response.StatusCode {
-	case http.StatusOK:
-	case http.StatusNotFound:
-		return nil, Gone
-	default:
-		return nil, fmt.Errorf("the artifact store answered %s for %s/blobs/%s", response.Status, repository, digest)
-	}
-	body, err := io.ReadAll(io.LimitReader(response.Body, blobBound+1))
-	if err != nil {
-		return nil, fmt.Errorf("reading %s/blobs/%s: %w", repository, digest, err)
-	}
-	if len(body) > blobBound {
-		return nil, fmt.Errorf("%s/blobs/%s is larger than %d bytes, which no archive read here is", repository, digest, blobBound)
-	}
-	sum := sha256.Sum256(body)
-	if got := "sha256:" + hex.EncodeToString(sum[:]); got != digest {
-		return nil, fmt.Errorf("the artifact store answered %s/blobs/%s with bytes of the digest %s: refused", repository,
-			digest, got)
-	}
-	return body, nil
-}

modules/artifact-store-tools/internal/registry/blob_test.go

@@ -1,44 +0,0 @@
-package registry
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-// A take-in reads a templates archive by its reference, and only bytes of the digest the reference names.
-func TestGetBlobReadsOnlyTheBytesOfItsDigest(t *testing.T) {
-	good := []byte("the archive")
-	sum := sha256.Sum256(good)
-	digest := "sha256:" + hex.EncodeToString(sum[:])
-	liar := "sha256:" + strings.Repeat("0", 64)
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case strings.HasSuffix(r.URL.Path, "/x/files/blobs/"+digest), strings.HasSuffix(r.URL.Path, "/x/files/blobs/"+liar):
-			_, _ = w.Write(good)
-		default:
-			w.WriteHeader(http.StatusNotFound)
-		}
-	}))
-	defer server.Close()
-	s := Store{Address: strings.TrimPrefix(server.URL, "http://")}
-	ctx := context.Background()
-	body, err := s.GetBlob(ctx, "artifact-store://x/files/blobs/"+digest)
-	if err != nil || string(body) != string(good) {
-		t.Fatalf("the archive: %q %v", body, err)
-	}
-	if _, err := s.GetBlob(ctx, "artifact-store://x/files/blobs/"+liar); err == nil || !strings.Contains(err.Error(), "refused") {
-		t.Fatalf("bytes of another digest are read: %v", err)
-	}
-	if _, err := s.GetBlob(ctx, "artifact-store://x/other/blobs/"+digest); !errors.Is(err, Gone) {
-		t.Fatalf("a blob the store does not hold: %v", err)
-	}
-	if _, err := s.GetBlob(ctx, "registry.example/x@"+digest); !errors.Is(err, ErrNotOurs) {
-		t.Fatalf("a reference outside the store: %v", err)
-	}
-}

modules/artifact-store-tools/internal/registry/hold.go

@@ -1,345 +0,0 @@
-package registry
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// Every archive the store keeps is held by a manifest (novox/hq issue 253, ADR 0189).
-//
-// **The store's collector marks only from manifests.** The mesh's store is a stock registry, and
-// its nightly `registry garbage-collect` walks every manifest in every repository, marks the blobs
-// those manifests name, and deletes every blob it did not mark. An image is a manifest, so what
-// the mesh keeps of an image survives. An archive was not: the builder put it in the store as a
-// bare blob — upload, then `PUT ?digest=` — and nothing in the store names it. To the collector a
-// bare blob is unreferenced, so the first real collection would have deleted every archive the
-// mesh holds, kept or not, and every machine pinning a bundle would have found it gone. The
-// collector runs `--dry-run` until this is true.
-//
-// **So each archive gets a holder**: the smallest OCI image manifest that names it — the empty
-// config, one layer, nothing else — put in the archive's own repository, by digest, untagged. The
-// collector marks it and so keeps the archive; the sweep lets go of an archive by deleting its
-// holder first, which is what lets the bytes go at the next collection.
-//
-// **Nothing a machine reads changes.** The recorded reference stays
-// `artifact-store://<module>/<artifact>/blobs/sha256:…`, and machines fetch the blob exactly as
-// before. The holder is the store's bookkeeping, not a second way to reach anything.
-//
-// **Deterministic, so it never needs recording.** The holder is composed from the archive's digest
-// and size alone, in a fixed field order with no timestamps or annotations, so the sweep can
-// compute which manifest holds any archive from the reference it already has plus one HEAD for the
-// size. No schema change, no second record that could disagree with the store.
-
-const (
-	// mediaManifest is the type a holder is put and asked for as.
-	mediaManifest = "application/vnd.oci.image.manifest.v1+json"
-	// mediaEmpty is the OCI empty descriptor's type: a config that says nothing, for a manifest
-	// whose only purpose is to name its layer.
-	mediaEmpty = "application/vnd.oci.empty.v1+json"
-	// emptyDigest is the digest of `{}`, the empty config's content, fixed by the OCI spec.
-	emptyDigest = "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"
-	// mediaArchive is the layer type an archive is held as. Every archive the builder publishes is
-	// `pack`'s gzipped tar, so this is the true type and not a placeholder — and it is a constant,
-	// not read from anywhere, because the holder must be recomputable from the reference alone.
-	mediaArchive = "application/vnd.oci.image.layer.v1.tar+gzip"
-)
-
-// emptyConfig is the content emptyDigest names.
-var emptyConfig = []byte("{}")
-
-// manifestAccept is what a manifest is asked for as. A registry answers a manifest HEAD only in a
-// type the caller named, and answers 404 to a bare one for a manifest it holds perfectly well
-// (measured 2026-09-28; internal/builder/registry.go says how that was found).
-var manifestAccept = []string{
-	mediaManifest,
-	"application/vnd.docker.distribution.manifest.v2+json",
-}
-
-type descriptor struct {
-	MediaType string `json:"mediaType"`
-	Digest    string `json:"digest"`
-	Size      int64  `json:"size"`
-}
-
-type holderManifest struct {
-	SchemaVersion int          `json:"schemaVersion"`
-	MediaType     string       `json:"mediaType"`
-	Config        descriptor   `json:"config"`
-	Layers        []descriptor `json:"layers"`
-}
-
-// Holder is the manifest that holds an archive in the store, and its digest.
-//
-// A pure function of the archive's digest and size: the same two in give the same bytes out,
-// always, because `encoding/json` writes a struct's fields in their declared order and there is
-// nothing here that varies by when or where it was composed.
-func Holder(digest string, size int64) (body []byte, holder string) {
-	body, err := json.Marshal(holderManifest{
-		SchemaVersion: 2,
-		MediaType:     mediaManifest,
-		Config:        descriptor{MediaType: mediaEmpty, Digest: emptyDigest, Size: int64(len(emptyConfig))},
-		Layers:        []descriptor{{MediaType: mediaArchive, Digest: digest, Size: size}},
-	})
-	if err != nil {
-		// Marshalling a struct of strings and integers cannot fail.
-		panic(err)
-	}
-	sum := sha256.Sum256(body)
-	return body, "sha256:" + hex.EncodeToString(sum[:])
-}
-
-// Hold makes sure the store holds this archive by a manifest, and says whether it had to write one.
-//
-// Takes a reference as the mesh records it. An image is its own manifest and needs no holder, so
-// it answers false and nothing is asked. Idempotent: a holder already there is left alone, which
-// is what lets the sweep run it over every kept archive on every build and so backfill the bare
-// blobs published before holders existed (novox/hq issue 253).
-//
-// Gone when the store does not hold the archive at all: there is nothing to hold, and that is a
-// fact the caller reports rather than one this invents a remedy for.
-func (s Store) Hold(ctx context.Context, reference string) (bool, error) {
-	repository, digest, archive, err := s.archive(reference)
-	if err != nil || !archive {
-		return false, err
-	}
-	size, err := s.blobSize(ctx, repository, digest)
-	if err != nil {
-		return false, err
-	}
-	return s.HoldBlob(ctx, repository, digest, size)
-}
-
-// Held is whether the store holds this archive by its manifest. Asks and changes nothing — the
-// question an operator needs answered with "none unheld" before the collector is let loose.
-//
-// An image answers true: it is its own manifest. An archive the store does not have answers Gone.
-func (s Store) Held(ctx context.Context, reference string) (bool, error) {
-	repository, digest, archive, err := s.archive(reference)
-	if err != nil {
-		return false, err
-	}
-	if !archive {
-		return true, nil
-	}
-	size, err := s.blobSize(ctx, repository, digest)
-	if err != nil {
-		return false, err
-	}
-	_, holder := Holder(digest, size)
-	return s.has(ctx, s.url(repository, "manifests", holder), manifestAccept...)
-}
-
-// HoldBlob puts the holder for a blob of this digest and size into its repository, unless it is
-// there already. Answers whether it wrote one.
-//
-// The builder calls this with the size it has just uploaded; the sweep, through Hold, with the size
-// the store reports. Both arrive at the same holder, which is the point of composing it.
-func (s Store) HoldBlob(ctx context.Context, repository, digest string, size int64) (bool, error) {
-	if s.Address == "" {
-		return false, fmt.Errorf("this mesh has no artifact store on its network to hold %s/%s in", repository, digest)
-	}
-	body, holder := Holder(digest, size)
-	there, err := s.has(ctx, s.url(repository, "manifests", holder), manifestAccept...)
-	if err != nil {
-		return false, err
-	}
-	if there {
-		return false, nil
-	}
-
-	// The config must be in the repository before a manifest naming it is accepted: a registry
-	// refuses a manifest whose blobs it cannot find there, which is the property that makes a
-	// holder mean something.
-	if err := s.putBlob(ctx, repository, emptyDigest, emptyConfig); err != nil {
-		return false, err
-	}
-
-	// **By digest, never by tag.** A tag would be one more name to move and one more thing the
-	// collector's `--delete-untagged` would read as meaningful; the mesh names nothing by tag that
-	// it pins by digest, and an untagged manifest is kept by plain collection.
-	request, err := http.NewRequestWithContext(ctx, http.MethodPut,
-		s.url(repository, "manifests", holder), bytes.NewReader(body))
-	if err != nil {
-		return false, err
-	}
-	request.Header.Set("Content-Type", mediaManifest)
-	response, err := s.client().Do(request)
-	if err != nil {
-		return false, err
-	}
-	defer response.Body.Close()
-	if response.StatusCode != http.StatusCreated {
-		said, _ := io.ReadAll(io.LimitReader(response.Body, 4096))
-		return false, fmt.Errorf("the artifact store refused to hold %s/%s: %s %s",
-			repository, digest, response.Status, strings.TrimSpace(string(said)))
-	}
-	return true, nil
-}
-
-// letGoOfHolder deletes the manifest holding an archive, before the archive's own link goes.
-//
-// **Holder first.** Deleting the blob link alone leaves a manifest still naming the blob, and the
-// collector would keep its bytes for ever on the strength of it — the sweep would record the
-// archive collected while the disk said otherwise. Deleting the holder first and failing before
-// the link goes leaves an unheld archive that the next sweep still offers, which is safe.
-//
-// A store that no longer has the blob answers Gone: without its size the holder cannot be named,
-// and without the blob there is nothing left for a holder to keep. A store that never had a holder
-// for it — an archive published before holders, never backfilled — answers 404 to the delete, and
-// that is the outcome wanted.
-func (s Store) letGoOfHolder(ctx context.Context, repository, digest string) error {
-	size, err := s.blobSize(ctx, repository, digest)
-	if err != nil {
-		return err
-	}
-	_, holder := Holder(digest, size)
-	err = s.remove(ctx, s.url(repository, "manifests", holder), repository+"/manifests/"+holder)
-	if err == Gone {
-		return nil
-	}
-	return err
-}
-
-// archive reads a recorded reference into its repository and digest, and whether it is an archive
-// at all. Refuses as ErrNotOurs anything the mesh did not put in its own store.
-func (s Store) archive(reference string) (repository, digest string, archive bool, err error) {
-	path, kept := catalogue.InArtifactStore(reference)
-	if !kept {
-		return "", "", false, fmt.Errorf("%w: %s", ErrNotOurs, reference)
-	}
-	if s.Address == "" {
-		return "", "", false, fmt.Errorf("this mesh has no artifact store on its network to ask about %s", reference)
-	}
-	repository, kind, digest, err := split(path)
-	if err != nil {
-		return "", "", false, err
-	}
-	return repository, digest, kind == "blobs", nil
-}
-
-// blobSize is how large the store says a blob is; Gone when it does not have it.
-func (s Store) blobSize(ctx context.Context, repository, digest string) (int64, error) {
-	request, err := http.NewRequestWithContext(ctx, http.MethodHead, s.url(repository, "blobs", digest), nil)
-	if err != nil {
-		return 0, err
-	}
-	response, err := s.client().Do(request)
-	if err != nil {
-		return 0, fmt.Errorf("cannot reach the artifact store at %s: %w", s.Address, err)
-	}
-	defer response.Body.Close()
-	switch response.StatusCode {
-	case http.StatusOK:
-	case http.StatusNotFound:
-		return 0, Gone
-	default:
-		return 0, fmt.Errorf("the artifact store answered %s for %s/blobs/%s", response.Status, repository, digest)
-	}
-	// Read from the header rather than ContentLength: a HEAD's ContentLength is what the response
-	// says it would have sent, which Go reports faithfully, but a proxy in between is free to drop
-	// it, and the header is what the registry itself wrote.
-	if length := response.Header.Get("Content-Length"); length != "" {
-		if n, err := strconv.ParseInt(length, 10, 64); err == nil && n >= 0 {
-			return n, nil
-		}
-	}
-	if response.ContentLength >= 0 {
-		return response.ContentLength, nil
-	}
-	return 0, fmt.Errorf("the artifact store holds %s/blobs/%s and will not say how large it is", repository, digest)
-}
-
-// putBlob uploads a small blob unless the repository already has it: ask where, then put it there
-// naming the digest — the registry's own two steps, the same the builder takes for an archive.
-func (s Store) putBlob(ctx context.Context, repository, digest string, body []byte) error {
-	if there, err := s.has(ctx, s.url(repository, "blobs", digest)); err != nil {
-		return err
-	} else if there {
-		return nil
-	}
-	start, err := http.NewRequestWithContext(ctx, http.MethodPost,
-		"http://"+s.Address+"/v2/"+repository+"/blobs/uploads/", nil)
-	if err != nil {
-		return err
-	}
-	begun, err := s.client().Do(start)
-	if err != nil {
-		return fmt.Errorf("cannot start an upload to %s: %w", repository, err)
-	}
-	begun.Body.Close()
-	if begun.StatusCode != http.StatusAccepted {
-		return fmt.Errorf("the artifact store answered %s when asked where to put a blob in %s", begun.Status, repository)
-	}
-	where := begun.Header.Get("Location")
-	if where == "" {
-		return fmt.Errorf("the artifact store accepted an upload to %s and said nowhere to put it", repository)
-	}
-	if strings.HasPrefix(where, "/") {
-		where = "http://" + s.Address + where
-	}
-	separator := "?"
-	if strings.Contains(where, "?") {
-		separator = "&"
-	}
-	put, err := http.NewRequestWithContext(ctx, http.MethodPut, where+separator+"digest="+digest, bytes.NewReader(body))
-	if err != nil {
-		return err
-	}
-	put.Header.Set("Content-Type", "application/octet-stream")
-	done, err := s.client().Do(put)
-	if err != nil {
-		return err
-	}
-	defer done.Body.Close()
-	if done.StatusCode != http.StatusCreated {
-		said, _ := io.ReadAll(io.LimitReader(done.Body, 4096))
-		return fmt.Errorf("the artifact store refused a blob in %s: %s %s", repository, done.Status, strings.TrimSpace(string(said)))
-	}
-	return nil
-}
-
-// has is whether the store answers 200 for a HEAD at that URL.
-func (s Store) has(ctx context.Context, url string, accept ...string) (bool, error) {
-	request, err := http.NewRequestWithContext(ctx, http.MethodHead, url, nil)
-	if err != nil {
-		return false, err
-	}
-	for _, media := range accept {
-		request.Header.Add("Accept", media)
-	}
-	response, err := s.client().Do(request)
-	if err != nil {
-		return false, fmt.Errorf("cannot reach the artifact store at %s: %w", s.Address, err)
-	}
-	defer response.Body.Close()
-	switch response.StatusCode {
-	case http.StatusOK:
-		return true, nil
-	case http.StatusNotFound:
-		return false, nil
-	default:
-		return false, fmt.Errorf("the artifact store answered %s for %s", response.Status, url)
-	}
-}
-
-func (s Store) url(repository, kind, digest string) string {
-	return "http://" + s.Address + "/v2/" + repository + "/" + kind + "/" + digest
-}
-
-func (s Store) client() *http.Client {
-	if s.HTTP != nil {
-		return s.HTTP
-	}
-	return &http.Client{Timeout: 30 * time.Second}
-}

modules/artifact-store-tools/internal/registry/hold_test.go

@@ -1,268 +0,0 @@
-package registry
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strconv"
-	"strings"
-	"sync"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// Every kept archive is held by a manifest (novox/hq issue 253, ADR 0189).
-//
-// Against an in-memory registry that keeps blobs and manifests per repository and refuses what a
-// registry refuses — a blob whose digest does not match, a manifest whose digest does not match
-// or whose blobs the repository does not have, a manifest asked for without an Accept naming its
-// type. What is asserted is this side's decisions; the live test below asserts the registry's.
-
-type memRegistry struct {
-	mu        sync.Mutex
-	blobs     map[string][]byte // repository + "@" + digest
-	manifests map[string][]byte // repository + "@" + digest
-	writes    []string          // every PUT and DELETE, as "METHOD path"
-}
-
-func digestOf(body []byte) string {
-	sum := sha256.Sum256(body)
-	return "sha256:" + hex.EncodeToString(sum[:])
-}
-
-func (m *memRegistry) serve(t *testing.T) Store {
-	t.Helper()
-	m.blobs = map[string][]byte{}
-	m.manifests = map[string][]byte{}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		m.mu.Lock()
-		defer m.mu.Unlock()
-		path := strings.TrimPrefix(r.URL.Path, "/v2/")
-		if r.Method == http.MethodPut || r.Method == http.MethodDelete {
-			m.writes = append(m.writes, r.Method+" "+r.URL.Path)
-		}
-		switch {
-		case r.Method == http.MethodPost && strings.HasSuffix(path, "/blobs/uploads/"):
-			repository := strings.TrimSuffix(path, "/blobs/uploads/")
-			w.Header().Set("Location", "/upload/"+repository+"?state=x")
-			w.WriteHeader(http.StatusAccepted)
-		case r.Method == http.MethodPut && strings.HasPrefix(r.URL.Path, "/upload/"):
-			repository := strings.TrimPrefix(r.URL.Path, "/upload/")
-			body, _ := io.ReadAll(r.Body)
-			digest := r.URL.Query().Get("digest")
-			if digest != digestOf(body) {
-				w.WriteHeader(http.StatusBadRequest)
-				return
-			}
-			m.blobs[repository+"@"+digest] = body
-			w.WriteHeader(http.StatusCreated)
-		case strings.Contains(path, "/blobs/"):
-			repository, digest, _ := strings.Cut(path, "/blobs/")
-			key := repository + "@" + digest
-			body, ok := m.blobs[key]
-			if !ok {
-				w.WriteHeader(http.StatusNotFound)
-				return
-			}
-			switch r.Method {
-			case http.MethodHead:
-				w.Header().Set("Content-Length", strconv.Itoa(len(body)))
-				w.WriteHeader(http.StatusOK)
-			case http.MethodDelete:
-				delete(m.blobs, key)
-				w.WriteHeader(http.StatusAccepted)
-			default:
-				w.WriteHeader(http.StatusMethodNotAllowed)
-			}
-		case strings.Contains(path, "/manifests/"):
-			repository, digest, _ := strings.Cut(path, "/manifests/")
-			key := repository + "@" + digest
-			switch r.Method {
-			case http.MethodHead:
-				if _, ok := m.manifests[key]; !ok || !strings.Contains(r.Header.Get("Accept"), mediaManifest) {
-					w.WriteHeader(http.StatusNotFound)
-					return
-				}
-				w.WriteHeader(http.StatusOK)
-			case http.MethodPut:
-				body, _ := io.ReadAll(r.Body)
-				if digest != digestOf(body) {
-					w.WriteHeader(http.StatusBadRequest)
-					return
-				}
-				var named holderManifest
-				if err := json.Unmarshal(body, &named); err != nil {
-					w.WriteHeader(http.StatusBadRequest)
-					return
-				}
-				for _, d := range append([]descriptor{named.Config}, named.Layers...) {
-					if _, ok := m.blobs[repository+"@"+d.Digest]; !ok {
-						w.WriteHeader(http.StatusBadRequest)
-						fmt.Fprintf(w, "MANIFEST_BLOB_UNKNOWN %s", d.Digest)
-						return
-					}
-				}
-				m.manifests[key] = body
-				w.WriteHeader(http.StatusCreated)
-			case http.MethodDelete:
-				if _, ok := m.manifests[key]; !ok {
-					w.WriteHeader(http.StatusNotFound)
-					return
-				}
-				delete(m.manifests, key)
-				w.WriteHeader(http.StatusAccepted)
-			}
-		default:
-			w.WriteHeader(http.StatusNotFound)
-		}
-	}))
-	t.Cleanup(server.Close)
-	return Store{Address: strings.TrimPrefix(server.URL, "http://")}
-}
-
-// bare puts an archive in the store the way the builder did before holders: a blob, nothing more.
-func (m *memRegistry) bare(repository string, body []byte) string {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	digest := digestOf(body)
-	m.blobs[repository+"@"+digest] = body
-	return catalogue.ArtifactStoreScheme + repository + "/blobs/" + digest
-}
-
-func TestTheHolderIsComposedFromTheDigestAndSizeAlone(t *testing.T) {
-	// The sweep must arrive at the very manifest the builder wrote, with nothing recorded between
-	// them. Same inputs, same bytes — and a different size is a different holder, so a holder can
-	// never be mistaken for one of a different blob.
-	digest := "sha256:" + strings.Repeat("a", 64)
-	one, first := Holder(digest, 42)
-	two, second := Holder(digest, 42)
-	if !bytes.Equal(one, two) || first != second {
-		t.Fatalf("the same archive composed two holders:\n%s\n%s", one, two)
-	}
-	if _, other := Holder(digest, 43); other == first {
-		t.Fatal("a different size composed the same holder")
-	}
-	want := `{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json",` +
-		`"config":{"mediaType":"application/vnd.oci.empty.v1+json",` +
-		`"digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2},` +
-		`"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"` + digest + `","size":42}]}`
-	if string(one) != want {
-		t.Fatalf("the holder is\n%s\nwant\n%s", one, want)
-	}
-	if digestOf(emptyConfig) != emptyDigest {
-		t.Fatalf("the empty config's digest is %s, not %s", digestOf(emptyConfig), emptyDigest)
-	}
-}
-
-func TestHoldBackfillsABareArchiveAndIsIdempotent(t *testing.T) {
-	// The archives published before this have no holder. Hold, run over every kept archive on
-	// every sweep, writes one the first time and nothing after.
-	m := &memRegistry{}
-	store := m.serve(t)
-	ctx := context.Background()
-	body := []byte("a theme")
-	reference := m.bare("shell/config", body)
-
-	if held, err := store.Held(ctx, reference); err != nil || held {
-		t.Fatalf("a bare blob reads as held=%v (%v)", held, err)
-	}
-	wrote, err := store.Hold(ctx, reference)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !wrote {
-		t.Fatal("holding a bare archive wrote nothing")
-	}
-	_, holder := Holder(digestOf(body), int64(len(body)))
-	if _, ok := m.manifests["shell/config@"+holder]; !ok {
-		t.Fatalf("the store holds manifests %v; want %s", m.manifests, holder)
-	}
-	if held, err := store.Held(ctx, reference); err != nil || !held {
-		t.Fatalf("after holding, held=%v (%v)", held, err)
-	}
-
-	writes := len(m.writes)
-	wrote, err = store.Hold(ctx, reference)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if wrote || len(m.writes) != writes {
-		t.Fatalf("holding again wrote %v", m.writes[writes:])
-	}
-}
-
-func TestAnImageNeedsNoHolderAndAMissingArchiveIsGone(t *testing.T) {
-	m := &memRegistry{}
-	store := m.serve(t)
-	ctx := context.Background()
-
-	// An image is its own manifest: nothing is asked.
-	wrote, err := store.Hold(ctx, catalogue.ArtifactStoreScheme+"web/app@sha256:"+strings.Repeat("b", 64))
-	if err != nil || wrote || len(m.writes) != 0 {
-		t.Fatalf("holding an image wrote=%v err=%v writes=%v", wrote, err, m.writes)
-	}
-	// An archive the store does not have is a fact to report, not something to invent a holder for.
-	_, err = store.Hold(ctx, catalogue.ArtifactStoreScheme+"web/config/blobs/sha256:"+strings.Repeat("c", 64))
-	if !errors.Is(err, Gone) {
-		t.Fatalf("holding a missing archive answered %v, want Gone", err)
-	}
-	// And a reference that is not the mesh's is refused as such.
-	if _, err := store.Hold(ctx, "docker.io/library/registry@sha256:abc"); !errors.Is(err, ErrNotOurs) {
-		t.Fatalf("holding a vendor's image answered %v, want ErrNotOurs", err)
-	}
-}
-
-func TestLettingGoOfAnArchiveDeletesItsHolderFirst(t *testing.T) {
-	// A holder left behind would keep the bytes through every collection while the record said
-	// collected; the link deleted first and the holder failing after would be that exactly.
-	m := &memRegistry{}
-	store := m.serve(t)
-	ctx := context.Background()
-	body := []byte("an old theme")
-	reference := m.bare("shell/config", body)
-	if _, err := store.Hold(ctx, reference); err != nil {
-		t.Fatal(err)
-	}
-	m.writes = nil
-
-	if err := store.LetGo(ctx, reference); err != nil {
-		t.Fatal(err)
-	}
-	_, holder := Holder(digestOf(body), int64(len(body)))
-	want := []string{
-		"DELETE /v2/shell/config/manifests/" + holder,
-		"DELETE /v2/shell/config/blobs/" + digestOf(body),
-	}
-	if strings.Join(m.writes, "\n") != strings.Join(want, "\n") {
-		t.Fatalf("the store was asked\n%s\nwant\n%s", strings.Join(m.writes, "\n"), strings.Join(want, "\n"))
-	}
-	if len(m.manifests) != 0 {
-		t.Fatalf("a holder survived: %v", m.manifests)
-	}
-	// Asked again, the archive is already gone, which is the outcome wanted.
-	if err := store.LetGo(ctx, reference); !errors.Is(err, Gone) {
-		t.Fatalf("letting go twice answered %v, want Gone", err)
-	}
-}
-
-func TestLettingGoOfAnUnheldArchiveStillDeletesIt(t *testing.T) {
-	// An archive published before holders and let go of before any sweep held it: the holder's
-	// delete answers 404, which is the outcome wanted, and the blob still goes.
-	m := &memRegistry{}
-	store := m.serve(t)
-	reference := m.bare("shell/config", []byte("never held"))
-	if err := store.LetGo(context.Background(), reference); err != nil {
-		t.Fatal(err)
-	}
-	if len(m.blobs) != 0 {
-		t.Fatalf("the blob survived: %v", m.blobs)
-	}
-}

modules/artifact-store-tools/internal/registry/platforms_test.go

@@ -1,176 +0,0 @@
-package registry
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"strings"
-	"sync"
-	"testing"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-)
-
-// An index is let go of with the platform manifests it names, except those a kept index of the same
-// repository names too (novox/hq ADR 0257). Each platform manifest is a manifest of the repository in
-// its own right, and the store's collector keeps every manifest a repository holds — so an index let go
-// of alone frees nothing of the images it names.
-
-func digestN(n int) string { return fmt.Sprintf("sha256:%064x", n) }
-
-// indexStore holds indexes and images in one repository, answers GETs with their documents, and records
-// every delete.
-type indexStore struct {
-	mu      sync.Mutex
-	indexes map[string][]string // digest → the platform manifests it names
-	images  map[string]bool
-	deleted []string
-}
-
-func (s *indexStore) serve(t *testing.T) Store {
-	t.Helper()
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		s.mu.Lock()
-		defer s.mu.Unlock()
-		digest := r.URL.Path[strings.LastIndex(r.URL.Path, "/")+1:]
-		switch r.Method {
-		case http.MethodGet:
-			if children, ok := s.indexes[digest]; ok {
-				var named []string
-				for _, c := range children {
-					named = append(named, `{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"`+c+`","size":1}`)
-				}
-				w.Header().Set("Content-Type", "application/vnd.oci.image.index.v1+json")
-				_, _ = w.Write([]byte(`{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[` +
-					strings.Join(named, ",") + `]}`))
-				return
-			}
-			if s.images[digest] {
-				w.Header().Set("Content-Type", "application/vnd.oci.image.manifest.v1+json")
-				_, _ = w.Write([]byte(`{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","layers":[]}`))
-				return
-			}
-			w.WriteHeader(http.StatusNotFound)
-		case http.MethodHead:
-			if _, ok := s.indexes[digest]; ok || s.images[digest] {
-				w.WriteHeader(http.StatusOK)
-				return
-			}
-			w.WriteHeader(http.StatusNotFound)
-		case http.MethodDelete:
-			if _, ok := s.indexes[digest]; !ok && !s.images[digest] {
-				w.WriteHeader(http.StatusNotFound)
-				return
-			}
-			s.deleted = append(s.deleted, digest)
-			delete(s.indexes, digest)
-			delete(s.images, digest)
-			w.WriteHeader(http.StatusAccepted)
-		default:
-			w.WriteHeader(http.StatusBadRequest)
-		}
-	}))
-	t.Cleanup(server.Close)
-	return Store{Address: strings.TrimPrefix(server.URL, "http://")}
-}
-
-func TestAnIndexGoesWithItsPlatformsAndAKeptIndexKeepsItsOwn(t *testing.T) {
-	// Two indexes of one image's repository: the old one names platforms 11 and 12, the kept one 12 and 13.
-	s := &indexStore{
-		indexes: map[string][]string{digestN(1): {digestN(11), digestN(12)}, digestN(2): {digestN(12), digestN(13)}},
-		images:  map[string]bool{digestN(11): true, digestN(12): true, digestN(13): true},
-	}
-	store := s.serve(t)
-	repository := "upstream/docker.io/library/golang"
-	old := catalogue.ArtifactStoreScheme + repository + "@" + digestN(1)
-	kept := catalogue.ArtifactStoreScheme + repository + "@" + digestN(2)
-	spare, err := store.SpareKeptIndexes(context.Background(), []string{kept}, []string{old})
-	if err != nil {
-		t.Fatal(err)
-	}
-	store.Spare = spare
-
-	if err := store.LetGo(context.Background(), old); err != nil {
-		t.Fatal(err)
-	}
-	// Its own platform first, the index last; the platform the kept index names is left in place.
-	if !slices.Equal(s.deleted, []string{digestN(11), digestN(1)}) {
-		t.Fatalf("deleted %v; want the old index's own platform, then the index", s.deleted)
-	}
-	if !s.images[digestN(12)] || !s.images[digestN(13)] {
-		t.Fatal("a platform a kept index names was let go of")
-	}
-}
-
-func TestWithoutSparingAnIndexGoesAloneAndAnImageNamesNoPlatforms(t *testing.T) {
-	s := &indexStore{indexes: map[string][]string{digestN(1): {digestN(11)}}, images: map[string]bool{digestN(11): true, digestN(5): true}}
-	store := s.serve(t)
-	// No Spare: as before ADR 0257, the index alone.
-	if err := store.LetGo(context.Background(), catalogue.ArtifactStoreScheme+"web/base@"+digestN(1)); err != nil {
-		t.Fatal(err)
-	}
-	if !slices.Equal(s.deleted, []string{digestN(1)}) {
-		t.Fatalf("without a Spare, deleted %v", s.deleted)
-	}
-	// An image is one delete, with a Spare or without.
-	s.deleted = nil
-	spare, err := store.SpareKeptIndexes(context.Background(), nil, []string{catalogue.ArtifactStoreScheme + "web/app@" + digestN(5)})
-	if err != nil {
-		t.Fatal(err)
-	}
-	store.Spare = spare
-	if err := store.LetGo(context.Background(), catalogue.ArtifactStoreScheme+"web/app@"+digestN(5)); err != nil {
-		t.Fatal(err)
-	}
-	if !slices.Equal(s.deleted, []string{digestN(5)}) {
-		t.Fatalf("an image was let go of as %v", s.deleted)
-	}
-	// An index the store no longer holds is Gone, and nothing is deleted on its account.
-	s.deleted = nil
-	err = store.LetGo(context.Background(), catalogue.ArtifactStoreScheme+"web/base@"+digestN(9))
-	if !errors.Is(err, Gone) || len(s.deleted) != 0 {
-		t.Fatalf("an index the store does not hold: %v, deleted %v", err, s.deleted)
-	}
-}
-
-func TestASpareThatCannotBeReadKeepsTheIndex(t *testing.T) {
-	s := &indexStore{indexes: map[string][]string{digestN(1): {digestN(11)}}, images: map[string]bool{digestN(11): true}}
-	store := s.serve(t)
-	store.Spare = func(context.Context, string) (map[string]bool, error) { return nil, fmt.Errorf("the store went away") }
-	err := store.LetGo(context.Background(), catalogue.ArtifactStoreScheme+"web/base@"+digestN(1))
-	if err == nil || !strings.Contains(err.Error(), "was kept") {
-		t.Fatalf("a spare that could not be read: %v", err)
-	}
-	if len(s.deleted) != 0 {
-		t.Fatalf("deleted %v without knowing what a kept index names", s.deleted)
-	}
-}
-
-// The spare list is read whole before the sweep: a kept index that cannot be read is an error before
-// anything is deleted, and a repository not read before keeps its index.
-func TestASpareListIsReadWholeBeforeAnythingGoes(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusInternalServerError)
-	}))
-	t.Cleanup(server.Close)
-	store := Store{Address: strings.TrimPrefix(server.URL, "http://")}
-	kept := catalogue.ArtifactStoreScheme + "web/base@" + digestN(2)
-	old := catalogue.ArtifactStoreScheme + "web/base@" + digestN(1)
-	if _, err := store.SpareKeptIndexes(context.Background(), []string{kept}, []string{old}); err == nil {
-		t.Fatal("a kept index the store would not answer for was taken as naming nothing")
-	}
-
-	s := &indexStore{indexes: map[string][]string{digestN(1): {digestN(11)}}, images: map[string]bool{digestN(11): true}}
-	good := s.serve(t)
-	spare, err := good.SpareKeptIndexes(context.Background(), nil, []string{catalogue.ArtifactStoreScheme + "other/repo@" + digestN(3)})
-	if err != nil {
-		t.Fatal(err)
-	}
-	good.Spare = spare
-	if err := good.LetGo(context.Background(), old); err == nil || len(s.deleted) != 0 {
-		t.Fatalf("an index in a repository not read before the sweep was let go of: %v, deleted %v", err, s.deleted)
-	}
-}

modules/artifact-store-tools/internal/registry/read.go

@@ -0,0 +1,76 @@
+package registry
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+)
+
+// blobSize is how large the store says a blob is; Gone when it does not have it.
+func (s Store) blobSize(ctx context.Context, repository, digest string) (int64, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodHead, s.url(repository, "blobs", digest), nil)
+	if err != nil {
+		return 0, err
+	}
+	response, err := s.client().Do(request)
+	if err != nil {
+		return 0, fmt.Errorf("cannot reach the artifact store at %s: %w", s.Address, err)
+	}
+	defer response.Body.Close()
+	switch response.StatusCode {
+	case http.StatusOK:
+	case http.StatusNotFound:
+		return 0, Gone
+	default:
+		return 0, fmt.Errorf("the artifact store answered %s for %s/blobs/%s", response.Status, repository, digest)
+	}
+	// Read from the header rather than ContentLength: a HEAD's ContentLength is what the response
+	// says it would have sent, which Go reports faithfully, but a proxy in between is free to drop
+	// it, and the header is what the registry itself wrote.
+	if length := response.Header.Get("Content-Length"); length != "" {
+		if n, err := strconv.ParseInt(length, 10, 64); err == nil && n >= 0 {
+			return n, nil
+		}
+	}
+	if response.ContentLength >= 0 {
+		return response.ContentLength, nil
+	}
+	return 0, fmt.Errorf("the artifact store holds %s/blobs/%s and will not say how large it is", repository, digest)
+}
+
+// has is whether the store answers 200 for a HEAD at that URL.
+func (s Store) has(ctx context.Context, url string, accept ...string) (bool, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodHead, url, nil)
+	if err != nil {
+		return false, err
+	}
+	for _, media := range accept {
+		request.Header.Add("Accept", media)
+	}
+	response, err := s.client().Do(request)
+	if err != nil {
+		return false, fmt.Errorf("cannot reach the artifact store at %s: %w", s.Address, err)
+	}
+	defer response.Body.Close()
+	switch response.StatusCode {
+	case http.StatusOK:
+		return true, nil
+	case http.StatusNotFound:
+		return false, nil
+	default:
+		return false, fmt.Errorf("the artifact store answered %s for %s", response.Status, url)
+	}
+}
+
+func (s Store) url(repository, kind, digest string) string {
+	return "http://" + s.Address + "/v2/" + repository + "/" + kind + "/" + digest
+}
+
+func (s Store) client() *http.Client {
+	if s.HTTP != nil {
+		return s.HTTP
+	}
+	return &http.Client{Timeout: 30 * time.Second}
+}

modules/artifact-store-tools/internal/registry/store.go

@@ -1,13 +1,6 @@
-// Package registry speaks to the mesh's artifact store over its own door.
-//
-// Only what the mesh needs that nothing else does: letting go of something it put there
-// (novox/hq ADR 0189, issue 108), and holding every archive it keeps by a manifest so the store's
-// own collector does not take it (novox/hq issue 253). Pushing is the builder's, through the container runtime; reading
-// is every machine's, through its runtime. This is the one operation that belongs to the thing
-// holding the records, because it is the only one that is a decision rather than a transfer.
-//
-// Copied from mesh-controller internal/artifacts at e04846e9 (novox/hq ADR 0571 clause 2): the seat mesh-artifact-sweep lets
-// go of what it no longer keeps exactly as the controller's sweep did; the controller's copy goes with its lease.
+// Package registry reads the mesh's artifact store over its own door: whether it holds what a reference names, and
+// whether a manifest is an index. It writes nothing: what the artifact sweep holds and removes it asks the registry
+// seats the store's holder serves (CAT-AS1, novox/hq ADR 0617 §2).
 package registry
 
 import (
@@ -29,10 +22,6 @@ type Store struct {
 	Address string
 	// HTTP is the client used; nil is a client with a modest timeout.
 	HTTP *http.Client
-	// Spare says, for one repository, which manifests a kept index there names: the platform
-	// manifests an index being let go of must leave in place (novox/hq ADR 0257). Nil spares every
-	// platform manifest — an index is then let go of alone, as it was before.
-	Spare func(ctx context.Context, repository string) (map[string]bool, error)
 }
 
 // Gone is the answer when the store does not hold it: the outcome wanted, already true.
@@ -46,86 +35,6 @@ var Gone = errors.New("the store does not hold it")
 // error" is how a cautious loop became one that did nothing while reporting the right number.
 var ErrNotOurs = errors.New("not a reference into the mesh's artifact store")
 
-// LetGo asks the store to drop one artifact the mesh recorded making.
-//
-// Takes a reference as the mesh records it — `artifact-store://<module>/<artifact>@sha256:…` for
-// an image, `…/blobs/sha256:…` for an archive — because that is the identity every record uses,
-// and composes the address here at the moment of use.
-//
-// An archive is let go of in two deletes, its holder manifest and then the blob's link (novox/hq
-// issue 253); an image in one.
-//
-// Returns Gone when the store answers that it does not have it. That is not a failure: the sweep
-// wants the artifact absent, and it is. It is distinguished from success only so a caller can say
-// which of the two happened.
-func (s Store) LetGo(ctx context.Context, reference string) error {
-	// **Strict, and deliberately** (novox/hq issue 226). Only a reference the mesh keeps in its
-	// own vocabulary is addressed here. `Recorded` would read `docker.io/library/registry@sha256:…`
-	// as the mesh's too — it cannot tell one registry host from another — so normalising belongs
-	// where the provenance is known, which is the sweep reading its own build records, not here
-	// where the only job is to refuse anything that is not plainly ours.
-	path, kept := catalogue.InArtifactStore(reference)
-	if !kept {
-		// Nothing the mesh put in its own store. Refused rather than attempted: composing a
-		// delete for a reference of unknown shape is how a sweep reaches something that is not
-		// the mesh's. Distinguished from a store that refuses, so a sweep skips this and goes on.
-		return fmt.Errorf("%w: %s", ErrNotOurs, reference)
-	}
-	if s.Address == "" {
-		return fmt.Errorf("this mesh has no artifact store on its network to ask about %s", reference)
-	}
-	repository, kind, digest, err := split(path)
-	if err != nil {
-		return err
-	}
-	if kind == "blobs" {
-		// **An archive's holder goes before the archive** (novox/hq issue 253): a manifest left
-		// naming the blob would keep its bytes through every collection while the record said
-		// collected. Gone here means the store has no such blob, so there is nothing to let go.
-		if err := s.letGoOfHolder(ctx, repository, digest); err != nil {
-			return err
-		}
-	}
-	if kind == "manifests" && s.Spare != nil {
-		// **An index's platform manifests go before the index** (novox/hq ADR 0257). Each was put
-		// under its own digest, so each is a manifest of the repository in its own right, and the
-		// store's collector keeps every manifest a repository holds: an index let go of alone frees
-		// no byte of the images it names. Before, not after, so a sweep cut short leaves the index
-		// to be asked about again, and with it the list of what is still to go.
-		if err := s.letGoOfPlatforms(ctx, repository, digest, reference); err != nil {
-			return err
-		}
-	}
-	return s.remove(ctx, s.url(repository, kind, digest), reference)
-}
-
-// letGoOfPlatforms deletes the manifests an index names, except those a kept index of the same
-// repository also names. A manifest that is not an index names none.
-func (s Store) letGoOfPlatforms(ctx context.Context, repository, digest, reference string) error {
-	children, err := s.Platforms(ctx, repository, digest)
-	if err != nil || len(children) == 0 {
-		// Gone: there is no index to read, and the delete that follows says so.
-		if errors.Is(err, Gone) {
-			return nil
-		}
-		return err
-	}
-	spared, err := s.Spare(ctx, repository)
-	if err != nil {
-		return fmt.Errorf("cannot say which platform manifests of %s a kept index names, so %s was kept: %w",
-			repository, reference, err)
-	}
-	for _, child := range children {
-		if spared[child] {
-			continue
-		}
-		if err := s.remove(ctx, s.url(repository, "manifests", child), reference+" (its "+child+")"); err != nil && !errors.Is(err, Gone) {
-			return err
-		}
-	}
-	return nil
-}
-
 // anyManifest is every manifest the store may hold, indexes included, so it answers with the
 // document as it is.
 var anyManifest = []string{
@@ -172,84 +81,6 @@ func (s Store) Platforms(ctx context.Context, repository, digest string) ([]stri
 	return out, nil
 }
 
-// SpareKeptIndexes is a Spare for a sweep, read whole before it starts: for every repository an
-// image reference of `touching` is in, each kept manifest there and every platform manifest a kept
-// index there names. Any read that fails is an error, and the sweep lets nothing go. A repository not
-// read here is answered with an error, so an index in it is kept. A kept index the store no longer
-// holds names nothing.
-func (s Store) SpareKeptIndexes(ctx context.Context, kept, touching []string) (func(context.Context, string) (map[string]bool, error), error) {
-	imageIn := func(reference string) (repository, digest string, ok bool) {
-		path, ours := catalogue.InArtifactStore(reference)
-		if !ours {
-			return "", "", false
-		}
-		repository, kind, digest, err := split(path)
-		if err != nil || kind != "manifests" {
-			return "", "", false
-		}
-		return repository, digest, true
-	}
-	read := map[string]map[string]bool{}
-	for _, reference := range touching {
-		if repository, _, ok := imageIn(reference); ok {
-			read[repository] = map[string]bool{}
-		}
-	}
-	for _, reference := range kept {
-		repository, digest, ok := imageIn(reference)
-		spared, touched := read[repository]
-		if !ok || !touched {
-			continue
-		}
-		spared[digest] = true
-		children, err := s.Platforms(ctx, repository, digest)
-		if errors.Is(err, Gone) {
-			continue
-		}
-		if err != nil {
-			return nil, fmt.Errorf("reading the kept %s@%s: %w", repository, digest, err)
-		}
-		for _, c := range children {
-			spared[c] = true
-		}
-	}
-	return func(_ context.Context, repository string) (map[string]bool, error) {
-		spared, done := read[repository]
-		if !done {
-			return nil, fmt.Errorf("%s was not read before the sweep began", repository)
-		}
-		return spared, nil
-	}, nil
-}
-
-// remove asks the store to delete what is at url. Gone when it has no such thing.
-func (s Store) remove(ctx context.Context, url, what string) error {
-	request, err := http.NewRequestWithContext(ctx, http.MethodDelete, url, nil)
-	if err != nil {
-		return err
-	}
-	response, err := s.client().Do(request)
-	if err != nil {
-		return err
-	}
-	defer response.Body.Close()
-	switch response.StatusCode {
-	case http.StatusAccepted, http.StatusOK, http.StatusNoContent:
-		return nil
-	case http.StatusNotFound:
-		return Gone
-	case http.StatusMethodNotAllowed:
-		// The registry was started without deletion enabled. Said plainly, because the remedy is
-		// a setting on the store's module and not anything about this artifact.
-		return fmt.Errorf(
-			"the artifact store refuses deletion: its server was started without it enabled "+
-				"(REGISTRY_STORAGE_DELETE_ENABLED), so nothing can be collected until the store "+
-				"module is applied again (novox/hq ADR 0189). Asking about %s", what)
-	default:
-		return fmt.Errorf("the artifact store answered %s for %s", response.Status, what)
-	}
-}
-
 // split reads a recorded path into the repository, which endpoint names the thing, and the digest.
 //
 // Two shapes, which are the two the mesh records: `<repository>@sha256:<hex>` is a manifest, and
@@ -279,22 +110,6 @@ func (s Store) IsIndex(ctx context.Context, reference string) (bool, error) {
 	return len(children) > 0, err
 }
 
-// HoldsManifest is whether the store holds the manifest a recorded image reference names.
-func (s Store) HoldsManifest(ctx context.Context, reference string) (bool, error) {
-	path, ours := catalogue.InArtifactStore(reference)
-	if !ours {
-		return false, fmt.Errorf("%w: %s", ErrNotOurs, reference)
-	}
-	repository, kind, digest, err := split(path)
-	if err != nil {
-		return false, err
-	}
-	if kind != "manifests" {
-		return false, fmt.Errorf("%w: %s names a blob, not a manifest", ErrNotOurs, reference)
-	}
-	return s.has(ctx, s.url(repository, kind, digest), anyManifest...)
-}
-
 // Holds is whether the store holds what a recorded reference names: the blob of an archive, the manifest of an image.
 // Gone when it does not; asks and changes nothing (ADR 0526 clause 3: a registration by hand is refused at bytes that
 // are not there).

modules/artifact-store-tools/internal/registry/store_test.go

@@ -11,124 +11,66 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
-// Asking the store to let go of what the mesh no longer keeps (novox/hq ADR 0189, issue 108).
-//
-// A fake store records what it was asked to delete, so what is asserted is the mesh's decision
-// and the shape of the request — not the registry's behaviour, which is the registry's to test.
-
-func fakeStore(t *testing.T, answer int) (Store, *[]string) {
-	t.Helper()
+// The store's door is read only (CAT-AS1: what the sweep holds and removes it asks the registry seats): Holds says
+// whether the store holds what a reference names, in either reference form, IsIndex whether it is an index; a reference
+// that is not the mesh's own is never asked. A fake store answers by path and records what it was asked.
+func TestTheDoorReadsWhatTheStoreHoldsAndWritesNothing(t *testing.T) {
+	const index = `{"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"digest":"sha256:c1"}]}`
+	const image = `{"mediaType":"application/vnd.oci.image.manifest.v1+json","layers":[]}`
 	var asked []string
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == http.MethodHead && strings.Contains(r.URL.Path, "/blobs/") {
-			// An archive's size, asked so its holder can be named (novox/hq issue 253). A store
-			// that does not have the thing does not have its blob either.
-			if answer == http.StatusNotFound {
-				w.WriteHeader(http.StatusNotFound)
-				return
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		asked = append(asked, r.Method+" "+r.URL.Path)
+		switch r.URL.Path {
+		case "/v2/web/app/manifests/sha256:abc", "/v2/web/files/blobs/sha256:def":
+			if r.Method == http.MethodGet {
+				_, _ = w.Write([]byte(image))
+			} else {
+				w.Header().Set("Content-Length", "7")
 			}
-			w.Header().Set("Content-Length", "7")
-			w.WriteHeader(http.StatusOK)
-			return
+		case "/v2/web/app/manifests/sha256:idx":
+			if r.Method == http.MethodGet {
+				_, _ = w.Write([]byte(index))
+			}
+		default:
+			w.WriteHeader(http.StatusNotFound)
 		}
-		if r.Method != http.MethodDelete {
-			t.Errorf("the store was asked %s %s; collecting is a delete", r.Method, r.URL.Path)
-		}
-		asked = append(asked, r.URL.Path)
-		w.WriteHeader(answer)
 	}))
-	t.Cleanup(server.Close)
-	return Store{Address: strings.TrimPrefix(server.URL, "http://")}, &asked
-}
-
-func TestAnImageAndAnArchiveAreAskedForAtTheirOwnEndpoints(t *testing.T) {
-	// The two shapes the mesh records: a manifest by digest, and a blob by digest. They are
-	// different endpoints, and asking at the wrong one answers 404 — which this would then
-	// record as collected, leaving the bytes on disk for ever while the record says otherwise.
-	store, asked := fakeStore(t, http.StatusAccepted)
+	defer srv.Close()
+	store := Store{Address: strings.TrimPrefix(srv.URL, "http://")}
 	ctx := context.Background()
-
-	image := catalogue.ArtifactStoreScheme + "web/app@sha256:abc123"
-	archive := catalogue.ArtifactStoreScheme + "web/config/blobs/sha256:def456"
-	if err := store.LetGo(ctx, image); err != nil {
-		t.Fatal(err)
-	}
-	if err := store.LetGo(ctx, archive); err != nil {
-		t.Fatal(err)
-	}
-	// The archive's holder goes first, then the archive (novox/hq issue 253).
-	_, holder := Holder("sha256:def456", 7)
-	want := []string{
-		"/v2/web/app/manifests/sha256:abc123",
-		"/v2/web/config/manifests/" + holder,
-		"/v2/web/config/blobs/sha256:def456",
-	}
-	if strings.Join(*asked, " ") != strings.Join(want, " ") {
-		t.Fatalf("the store was asked %v; want %v", *asked, want)
-	}
-}
-
-func TestAStoreThatDoesNotHaveItAnswersGone(t *testing.T) {
-	// The outcome wanted, already true. Told apart from success only so the sweep can say which
-	// happened; both are recorded, because retrying for ever is the thing to avoid.
-	store, _ := fakeStore(t, http.StatusNotFound)
-	err := store.LetGo(context.Background(), catalogue.ArtifactStoreScheme+"web/app@sha256:abc123")
-	if !errors.Is(err, Gone) {
-		t.Fatalf("a store that does not hold it answered %v, want Gone", err)
-	}
-}
-
-func TestAStoreWithDeletionOffSaysSoAndNamesTheRemedy(t *testing.T) {
-	// The registry answers 405 when it was started without deletion enabled. The remedy is a
-	// setting on the store's module, and saying "405" would send somebody to the wrong place.
-	store, _ := fakeStore(t, http.StatusMethodNotAllowed)
-	err := store.LetGo(context.Background(), catalogue.ArtifactStoreScheme+"web/app@sha256:abc123")
-	if err == nil {
-		t.Fatal("a store that refuses deletion was read as success")
-	}
-	if !strings.Contains(err.Error(), "REGISTRY_STORAGE_DELETE_ENABLED") {
-		t.Fatalf("the refusal does not name the remedy: %v", err)
-	}
-}
-
-func TestAReferenceThatIsNotTheMeshsOwnIsNeverAsked(t *testing.T) {
-	// The whole safety of the sweep is that it names only what the mesh recorded putting there.
-	// A reference of another shape — a vendor's image, a package version — is refused rather
-	// than composed into a delete somewhere that is not the mesh's store.
-	store, asked := fakeStore(t, http.StatusAccepted)
-	for _, reference := range []string{
-		"docker.io/library/registry@sha256:abc123",
-		"registry@sha256:abc123",
-		"1.4.2",
+	for name, c := range map[string]struct {
+		reference string
+		holds     error // nil, Gone or ErrNotOurs
+		index     bool
+	}{
+		"an image":                      {reference: catalogue.ArtifactStoreScheme + "web/app@sha256:abc"},
+		"an image in the seat's form":   {reference: catalogue.SeatReference("container-image-registry", "web", "app", "sha256:abc")},
+		"an archive":                    {reference: catalogue.ArtifactStoreScheme + "web/files/blobs/sha256:def"},
+		"an archive in the seat's form": {reference: catalogue.SeatReference("oci-artifact-registry", "web", "files", "sha256:def")},
+		"an index":                      {reference: catalogue.ArtifactStoreScheme + "web/app@sha256:idx", index: true},
+		"an image the store lacks":      {reference: catalogue.ArtifactStoreScheme + "web/app@sha256:999", holds: Gone},
+		"an archive the store lacks":    {reference: catalogue.ArtifactStoreScheme + "web/files/blobs/sha256:999", holds: Gone},
+		"another registry's image":      {reference: "docker.io/library/alpine@sha256:abc", holds: ErrNotOurs},
+		"a reference naming no digest":  {reference: catalogue.ArtifactStoreScheme + "web/app:latest", holds: ErrNotOurs},
 	} {
-		if err := store.LetGo(context.Background(), reference); err == nil {
-			t.Errorf("%s was asked about; it is not a reference into the mesh's store", reference)
-		}
-	}
-	if len(*asked) != 0 {
-		t.Fatalf("the store was asked about %v", *asked)
-	}
-}
-
-// A reference this sweep will not address says so as ErrNotOurs, which is a fact about the
-// record and not about the store (novox/hq issue 226).
-//
-// The sweep skips one and abandons itself for the other, so they cannot be the same error. The
-// first live run met a reference recorded with the store's old address, read the refusal as "the
-// store refuses everything", and collected none of the 1681 it had found.
-func TestAReferenceThisSweepWillNotAddressIsToldApartFromAStoreRefusing(t *testing.T) {
-	store, asked := fakeStore(t, http.StatusAccepted)
-	for _, reference := range []string{
-		"docker.io/library/registry@sha256:abc123",
-		"127.0.0.1:5100/mesh-tools/build@sha256:abc123",
-		"1.4.2",
-	} {
-		err := store.LetGo(context.Background(), reference)
-		if !errors.Is(err, ErrNotOurs) {
-			t.Errorf("%s answered %v; a sweep must be able to skip it and go on", reference, err)
-		}
-	}
-	if len(*asked) != 0 {
-		t.Fatalf("the store was asked about %v", *asked)
+		t.Run(name, func(t *testing.T) {
+			asked = nil
+			if err := store.Holds(ctx, c.reference); !errors.Is(err, c.holds) && (err != nil || c.holds != nil) {
+				t.Errorf("Holds = %v, want %v", err, c.holds)
+			}
+			if c.holds == nil {
+				if got, err := store.IsIndex(ctx, c.reference); err != nil || got != c.index {
+					t.Errorf("IsIndex = %v, %v, want %v", got, err, c.index)
+				}
+			}
+			for _, a := range asked {
+				if !strings.HasPrefix(a, "HEAD ") && !strings.HasPrefix(a, "GET ") {
+					t.Errorf("the door asked %s: it writes nothing", a)
+				}
+			}
+			if errors.Is(c.holds, ErrNotOurs) && len(asked) != 0 {
+				t.Errorf("a reference that is not the mesh's own was asked: %v", asked)
+			}
+		})
 	}
 }

modules/artifact-store-tools/module.json

@@ -22,7 +22,13 @@
     "seat:mesh-catalog.modules",
     "seat:mesh-catalog.module",
     "mesh-delivery-assigner.assigner_read_wants",
-    "mesh-delivery-indexer.indexer_read_manifests"
+    "mesh-delivery-indexer.indexer_read_manifests",
+    "seat:oci-artifact-registry.hold",
+    "seat:oci-artifact-registry.release",
+    "seat:oci-artifact-registry.remove",
+    "seat:container-image-registry.hold",
+    "seat:container-image-registry.release",
+    "seat:container-image-registry.remove"
   ],
   "reads": [
     "mesh-delivery-builder.builds",