The Go fetch takes zero-version requirements from the module graph and proves them with a shut-off load; mesh-build-image and -node name nodebuildgo (issue 1966)

Conversation 1 Commits 3 Files Changed 9

+263 -34

3 Commits

Author	SHA1	Message	Date
jschoubben	4a3914ee1c	S4: the fetch proves with a shut-off package load that it downloaded all a step loads (issue 1966) mesh/delivery merged: source.main moved to novox/mesh-catalog@7cc81512a389 Details mesh/check checking 4a3914ee1ce7 on 3c0b4d29a8ea go mod download loads only the module graph a go.mod names; a vet, a test or a build then loads packages shut off from the network and failed far from the fetch, in fewer words (the builder's "pull_drop.go:11:2: module lookup disabled by GOPROXY=off"). After each directory's download the fetch loads its packages with their tests shut off and fails naming each package whose load would reach the network. The graph of a sibling laid beside is loaded once with the network first, so a go.mod the composer's build reads and the graph's download skipped is fetched, then proven the same way. 1966/AC178-2: a row of TestAVerifyThatFailsEndsTheStepNamingTheDirectoryAndTheLine; the beside case in TestTheFetchDownloadsTheGraphOfASiblingModuleLaidWithTheTreesItRequires. Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ	2026-11-10 13:10:44 +01:00
jschoubben	ce3284fc8f	S3: the fetch takes a module's zero-version requirements from its module graph (issue 1966) ADR 0573 §2 builds every module against the latest published version of each mesh package it uses, whatever its go.mod names. The fetch took versions only for packages the directory's own go.mod names, so a package only a module it replaces by a directory requires (mesh-build-image replacing buildstep, which imports the node-build-go seat package) was never taken: go mod download passed and every shut-off step looked it up on the network. Now the requirements of each module the directory replaces by a directory count too, taken the same way (the ask, its repository's asked head, else the latest) and said as named by that directory. 1966/AC178-1: rows of TestARequirementAtTheZeroVersionIsTakenFromTheAskOrTheTrunk. Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ	2026-11-10 13:08:00 +01:00
jschoubben	ad6e813fb0	S2: mesh-build-image and mesh-build-node name nodebuildgo, which buildstep imports (issue 1966) Since buildstep's drop verb imports the node-build-go seat package, both modules' shut-off vet, test and build looked it up on the network: their go.mod did not name it, so the fetch took no version for it. go mod tidy adds it as an indirect requirement. Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ	2026-11-10 13:04:39 +01:00

Author

SHA1

Message

Date

jschoubben

4a3914ee1c

S4: the fetch proves with a shut-off package load that it downloaded all a step loads (issue 1966)

mesh/delivery merged: source.main moved to novox/mesh-catalog@7cc81512a389

Details

mesh/check checking 4a3914ee1ce7 on 3c0b4d29a8ea

go mod download loads only the module graph a go.mod names; a vet, a test or a build then loads
packages shut off from the network and failed far from the fetch, in fewer words (the builder's
"pull_drop.go:11:2: module lookup disabled by GOPROXY=off"). After each directory's download the
fetch loads its packages with their tests shut off and fails naming each package whose load
would reach the network. The graph of a sibling laid beside is loaded once with the network
first, so a go.mod the composer's build reads and the graph's download skipped is fetched, then
proven the same way.

1966/AC178-2: a row of TestAVerifyThatFailsEndsTheStepNamingTheDirectoryAndTheLine; the beside
case in TestTheFetchDownloadsTheGraphOfASiblingModuleLaidWithTheTreesItRequires.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

2026-11-10 13:10:44 +01:00

jschoubben

ce3284fc8f

S3: the fetch takes a module's zero-version requirements from its module graph (issue 1966)

ADR 0573 §2 builds every module against the latest published version of each mesh package it
uses, whatever its go.mod names. The fetch took versions only for packages the directory's own
go.mod names, so a package only a module it replaces by a directory requires (mesh-build-image
replacing buildstep, which imports the node-build-go seat package) was never taken: go mod
download passed and every shut-off step looked it up on the network. Now the requirements of
each module the directory replaces by a directory count too, taken the same way (the ask, its
repository's asked head, else the latest) and said as named by that directory.

1966/AC178-1: rows of TestARequirementAtTheZeroVersionIsTakenFromTheAskOrTheTrunk.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

2026-11-10 13:08:00 +01:00

jschoubben

ad6e813fb0

S2: mesh-build-image and mesh-build-node name nodebuildgo, which buildstep imports (issue 1966)

Since buildstep's drop verb imports the node-build-go seat package, both modules' shut-off vet,
test and build looked it up on the network: their go.mod did not name it, so the fetch took no
version for it. go mod tidy adds it as an indirect requirement.

Claude-Session: https://claude.ai/code/session_01JG73KEq4zoDfM9WtYpcQgZ

2026-11-10 13:04:39 +01:00

The Go fetch takes zero-version requirements from the module graph and proves them with a shut-off load; mesh-build-image and -node name nodebuildgo (issue 1966) #654