Bundles go through oci-artifact-registry and answer the seat's reference; a trunk package is packed under the builder's version and published through npm-package-registry, so the holder can check it with the builder. Reads are anonymous, so the write pair, the sealed secret and the store's address go. The one-part sender moves into buildstep for both build modules, so the move to the registry clients is made in one place. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig