Check a delivery group's member beside its siblings' merges, judged by the group's controller (issue 867, ADR 0382)

A mesh-host change and a mesh-controller change that need each other could not both pass their own checks: each read the other at its base. The check now asks mesh-delivery for the group's open siblings into a base of the same name, reads each at its head merged onto its base, builds the judge from a controller sibling's merge in the isolated judge environment keyed on its inputs, and names the siblings in the verdict. With no answer from mesh-delivery the verdict says it could not learn them; a pull request with no sibling is checked as before. TestReplay867 replays the failure.

Co-Authored-By: Claude <noreply@anthropic.com>

cmd/mesh-builder/main.go

@@ -337,7 +337,8 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 			result.Check = &link.CheckOutcome{Verdict: v.Verdict, Summary: v.Summary, Report: v.Report,
 				Took: v.Took.Round(time.Second).String(), Gate: layerOf(v.Gate), RepoCheck: layerOf(v.Repo),
 				Head: v.Head, Trunk: v.Trunk, Beside: v.Beside, Built: checkBuiltOf(v.Built),
-				Release: v.Release, JudgedBy: v.JudgedBy, BesideAt: v.BesideAt, Validator: v.Validator}
+				Release: v.Release, JudgedBy: v.JudgedBy, BesideAt: v.BesideAt, Validator: v.Validator,
+				Siblings: siblingsOut(v.Siblings), SiblingsUnknown: v.SiblingsUnknown, JudgeFrom: v.JudgeFrom}
 			// What each of a group's heads was judged as (novox/hq ADR 0323 §6).
 			for _, m := range v.Members {
 				result.Check.Members = append(result.Check.Members, link.CheckedMember{Owner: m.Owner, Repo: m.Repo,
@@ -467,7 +468,11 @@ func checkSpecOf(request link.BuildRequest) builder.CheckSpec {
 		Owner: c.Owner, Repo: c.Repo, Number: c.Number, Paths: c.Paths, Beside: map[string]builder.Beside{},
 		Modules: c.Modules, New: c.New, Manifests: c.Manifests, Judge: c.Judge, Base: c.Base,
 		Toolchain: builder.ToolchainOf(request.Held), Toolchains: builder.ToolchainsOf(request.Held),
-		Tests: c.Tests, StoreOnly: c.StoreOnly, Release: c.Release}
+		Tests: c.Tests, StoreOnly: c.StoreOnly, Release: c.Release, SiblingsUnknown: c.SiblingsUnknown}
+	for _, s := range c.Siblings {
+		spec.Siblings = append(spec.Siblings, builder.Sibling{Repository: s.Repository, Number: s.Number, Head: s.Head,
+			Base: s.Base, Dir: s.Dir})
+	}
 	for dir, b := range c.Beside {
 		spec.Beside[dir] = builder.Beside{Repository: b.Repository, Ref: b.Ref, Else: b.Else}
 	}
@@ -482,6 +487,16 @@ func checkSpecOf(request link.BuildRequest) builder.CheckSpec {
 	return spec
 }
 
+// siblingsOut is the siblings a check read as the outcome carries them (novox/hq ADR 0382 §4).
+func siblingsOut(read []builder.JudgedSibling) []link.CheckSibling {
+	var out []link.CheckSibling
+	for _, s := range read {
+		out = append(out, link.CheckSibling{Repository: s.Repository, Number: s.Number, Head: s.Head, Base: s.Base,
+			BaseCommit: s.BaseCommit})
+	}
+	return out
+}
+
 // judgeCache is the judge cache the build agent's manifest declares (MESH_JUDGE_CACHE, novox/hq ADR 0358 §6): a
 // directory mounted at the same path on the host, so a judge build's mounts name what the agent sees. Empty when the
 // agent declares none, and every judge is then built cold under its check's root.

cmd/mesh-builder/release_test.go

@@ -3,6 +3,7 @@ package main
 import (
 	"testing"
 
+	"github.com/novox/mesh-controller/internal/builder"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -25,3 +26,21 @@ func TestTheBuildSeatHandsTheCheckItsReleaseBranch(t *testing.T) {
 		t.Fatalf("with no judge cache declared, %q is used", got)
 	}
 }
+
+// The siblings a check is asked to read reach the build seat's spec and, as read, the outcome (novox/hq ADR 0382).
+func TestTheSiblingsAnAskNamesReachTheSpecAndTheOutcome(t *testing.T) {
+	spec := checkSpecOf(link.BuildRequest{Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Base: "main",
+		Siblings:        []link.CheckSibling{{Repository: "novox/mesh-controller", Number: 346, Head: "a", Base: "main", Dir: "mesh-controller"}},
+		SiblingsUnknown: "why"}})
+	if len(spec.Siblings) != 1 || spec.Siblings[0] != (builder.Sibling{Repository: "novox/mesh-controller", Number: 346,
+		Head: "a", Base: "main", Dir: "mesh-controller"}) || spec.SiblingsUnknown != "why" {
+		t.Fatalf("the spec reads %+v", spec)
+	}
+	out := siblingsOut([]builder.JudgedSibling{{Repository: "novox/mesh-controller", Number: 346, Head: "a", Base: "main", BaseCommit: "b"}})
+	if len(out) != 1 || out[0].BaseCommit != "b" || out[0].Number != 346 {
+		t.Fatalf("the outcome reads %+v", out)
+	}
+	if plain := checkSpecOf(link.BuildRequest{Check: &link.CheckRequest{Owner: "o", Repo: "r"}}); plain.Siblings != nil {
+		t.Fatalf("a request that names none has siblings %+v", plain.Siblings)
+	}
+}

cmd/mesh-controller/check_siblings.go

@@ -0,0 +1,120 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// **A delivery group's member is checked beside the other members' heads** (novox/hq ADR 0382, issue 867).
+//
+// A mesh-host change and a mesh-controller change that need each other could not both pass their own merge checks:
+// each was read beside the other's repository at the commit the mesh runs, which holds neither change. So the
+// controller asks mesh-delivery's `groups` once for every pull request's check it asks (§1), and names, in the ask,
+// the group's other open pull requests into a base of the same name, in a repository the build seat reads beside the
+// check — mesh-lab never — each with its whole head. The build seat reads those repositories at the sibling's merge (§2).
+// A pull request for which mesh-delivery answered and named no sibling is asked exactly as before (§7).
+
+// wholeCommit is a commit as the forge says a head: forty hexadecimal characters.
+var wholeCommit = regexp.MustCompile(`^[0-9a-f]{40}$`)
+
+// besideRepositories are the repositories (lower case, owner/repo) a check reads beside its own, by the directory each
+// is found under — the core's, as besideOf clones them, and mesh-sdk beside the controller; never mesh-lab, which is
+// always read at its trunk.
+func besideRepositories(entries []inventory.Entry) map[string]string {
+	read := map[string]string{}
+	for _, e := range entries {
+		dir, core := coreModules[e.Manifest.Module]
+		if !core || e.Provided || e.Source.Repository == "" {
+			continue
+		}
+		read[nameOf(e.Source.Repository)] = dir
+		if dir == "mesh-controller" && e.Source.Seat != "" {
+			read[nameOf(siblingOf(e.Source.Repository, "mesh-sdk"))] = "mesh-sdk"
+		}
+	}
+	delete(read, "")
+	return read
+}
+
+// nameOf is a recorded repository as owner/repo in lower case, empty when it names no owner.
+func nameOf(repository string) string {
+	owner, repo := sourceOwner(repository), sourceName(repository)
+	if owner == "" || repo == "" {
+		return ""
+	}
+	return strings.ToLower(owner + "/" + repo)
+}
+
+// siblingsFor is the pull request's siblings, as mesh-delivery's groups say them (ADR 0382 §1): the other members of
+// the group its head branch names that are open, unmerged and into a base of its own base's name, in a repository the
+// check reads beside it (beside: the directories the ask already names). The second answer is why they could not be
+// learned, empty when they could: the group's members carry no head or base — a mesh-delivery from before the rule.
+func siblingsFor(p link.PullUpdated, entries []inventory.Entry, beside map[string]link.CheckedOut,
+	lines []groupsLine) ([]link.CheckSibling, string) {
+	if p.Head == "" {
+		return nil, ""
+	}
+	var group *groupsLine
+	for i := range lines {
+		if lines[i].ID == p.Head {
+			group = &lines[i]
+		}
+	}
+	if group == nil {
+		return nil, ""
+	}
+	own := strings.ToLower(p.Owner + "/" + p.Repo)
+	if len(group.Details) == 0 && len(group.Members) > 0 {
+		return nil, "mesh-delivery named the group's members without their heads and bases (a mesh-delivery from before novox/hq ADR 0382)"
+	}
+	read := besideRepositories(entries)
+	var siblings []link.CheckSibling
+	for _, m := range group.Details {
+		repository := strings.ToLower(m.Repository)
+		if repository == own {
+			continue
+		}
+		if !m.Open {
+			continue
+		}
+		if m.Head == "" || m.Base == "" {
+			return nil, "mesh-delivery named " + m.ID + " without its head or base (a mesh-delivery from before novox/hq ADR 0382)"
+		}
+		dir, readBeside := read[repository]
+		if m.Base != p.Base || !readBeside || dir == "mesh-lab" {
+			continue
+		}
+		if _, there := beside[dir]; !there {
+			continue
+		}
+		head := strings.ToLower(m.Head)
+		if !wholeCommit.MatchString(head) {
+			return nil, fmt.Sprintf("mesh-delivery named %s with a head that is not a whole commit (%q)", m.ID, m.Head)
+		}
+		siblings = append(siblings, link.CheckSibling{Repository: m.Repository, Number: m.Number, Head: head, Base: m.Base, Dir: dir})
+	}
+	sort.Slice(siblings, func(i, j int) bool { return siblings[i].Dir < siblings[j].Dir })
+	return siblings, ""
+}
+
+// withSiblings asks mesh-delivery's `groups` once and says in the request the pull request's siblings, or why they
+// could not be learned (ADR 0382 §1): a check never waits on mesh-delivery past groupAskWithin and never fails for it,
+// so a fix to mesh-delivery is still checked without it.
+func withSiblings(ctx context.Context, request *link.BuildRequest, p link.PullUpdated, entries []inventory.Entry) {
+	if request.Check == nil {
+		return
+	}
+	lines, err := groupsAsked(ctx, deliverySeatHeld(entries))
+	if err != nil {
+		request.Check.SiblingsUnknown = fmt.Sprintf("mesh-delivery did not say the group's pull requests (%v): "+
+			"the check reads no siblings", err)
+		return
+	}
+	request.Check.Siblings, request.Check.SiblingsUnknown = siblingsFor(p, entries, request.Check.Beside, lines)
+}

cmd/mesh-controller/check_siblings_test.go

@@ -0,0 +1,233 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// **A delivery group's member is checked beside the other members' heads** (novox/hq ADR 0382 §1, §7, issue 867): the
+// controller asks mesh-delivery's `groups` once for every check it asks, and names in the ask the group's other open
+// pull requests into a base of the same name, in a repository the build seat reads beside it — mesh-lab never.
+
+const (
+	headHost       = "1111111111111111111111111111111111111111"
+	headController = "2222222222222222222222222222222222222222"
+	headSDK        = "3333333333333333333333333333333333333333"
+	headLab        = "4444444444444444444444444444444444444444"
+	headHq         = "5555555555555555555555555555555555555555"
+)
+
+func theCoreOnTheGitSeat() []inventory.Entry {
+	onSeat := func(module, repository string) inventory.Entry {
+		e := fromRepo(module, repository, "")
+		e.Source.Seat = "git"
+		return e
+	}
+	nats := onSeat("nats", "novox/mesh-catalog")
+	nats.Source.Path = "modules/nats"
+	held := catalogue.Manifest{Module: "mesh-delivery", Claims: []catalogue.Claim{{Name: catalogue.DeliverySeat, Scope: catalogue.ScopeMesh}}}
+	return []inventory.Entry{onSeat("mesh-controller", "novox/mesh-controller"), onSeat("mesh-host", "novox/mesh-host"),
+		onSeat("node-tools", "novox/mesh-tools"), nats, {Manifest: held, On: []string{"anchor"}}}
+}
+
+func besideTheCore() map[string]link.CheckedOut {
+	return map[string]link.CheckedOut{"mesh-controller": {Repository: "c"}, "mesh-host": {Repository: "h"},
+		"mesh-tools": {Repository: "t"}, "mesh-catalog": {Repository: "k"}, "mesh-sdk": {Repository: "s"}, "mesh-lab": {Repository: "l"}}
+}
+
+func member(repository string, number int, head, base string, open bool) memberLine {
+	return memberLine{ID: repository + "@" + head[:12], Repository: repository, State: "checked", Number: number, Head: head,
+		Base: base, Open: open}
+}
+
+func group(id string, members ...memberLine) groupsLine {
+	line := groupsLine{ID: id, Details: members}
+	for _, m := range members {
+		line.Members = append(line.Members, m.ID+" ("+m.State+")")
+	}
+	return line
+}
+
+func TestASiblingIsTheGroupsOtherOpenPullRequestIntoABaseOfTheSameName(t *testing.T) {
+	entries := theCoreOnTheGitSeat()
+	pull := link.PullUpdated{Owner: "novox", Repo: "mesh-host", Number: 114, Base: "main", Head: "feat/x", Commit: headHost}
+	for _, c := range []struct {
+		what    string
+		lines   []groupsLine
+		want    []string
+		unknown string
+	}{
+		{"the other member, open, same base", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", true))},
+			[]string{"mesh-controller=novox/mesh-controller#346@" + headController + " onto main"}, ""},
+		{"a member into a base of another name is not one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "release", true))},
+			nil, ""},
+		{"a member not open (merged or closed) is not one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", false))},
+			nil, ""},
+		{"mesh-lab is never one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-lab", 5, headLab, "main", true))},
+			nil, ""},
+		{"a repository the check reads nothing of is not one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/hq", 9, headHq, "main", true))},
+			nil, ""},
+		{"mesh-sdk, read beside the controller, is one", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-sdk", 7, headSDK, "main", true))},
+			[]string{"mesh-sdk=novox/mesh-sdk#7@" + headSDK + " onto main"}, ""},
+		{"another group is none of its business", []groupsLine{group("feat/y",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "main", true))},
+			nil, ""},
+		{"a group of its own alone has none", []groupsLine{group("feat/x", member("novox/mesh-host", 114, headHost, "main", true))},
+			nil, ""},
+		{"an older mesh-delivery names no heads", []groupsLine{{ID: "feat/x",
+			Members: []string{"novox/mesh-host@111111111111 (checked)", "novox/mesh-controller@222222222222 (checked)"}}},
+			nil, "without their heads and bases"},
+		{"a member without its base", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController, "", true))},
+			nil, "without its head or base"},
+		{"a head that is no commit", []groupsLine{group("feat/x",
+			member("novox/mesh-host", 114, headHost, "main", true), member("novox/mesh-controller", 346, headController[:12]+"zzzzzzzzzzzzzzzzzzzzzzzzzzzz", "main", true))},
+			nil, "not a whole commit"},
+	} {
+		got, unknown := siblingsFor(pull, entries, besideTheCore(), c.lines)
+		var said []string
+		for _, s := range got {
+			said = append(said, s.Dir+"="+s.Repository+"#"+itoa(s.Number)+"@"+s.Head+" onto "+s.Base)
+		}
+		if strings.Join(said, ";") != strings.Join(c.want, ";") {
+			t.Errorf("%s: siblings %v, wanted %v", c.what, said, c.want)
+		}
+		if (c.unknown == "") != (unknown == "") || !strings.Contains(unknown, c.unknown) {
+			t.Errorf("%s: could not learn %q, wanted %q", c.what, unknown, c.unknown)
+		}
+	}
+	// A pull request into a release branch has siblings into the release branch of the same name (ADR 0358 §1).
+	release := pull
+	release.Base = "feat/57"
+	lines := []groupsLine{group("feat/x", member("novox/mesh-host", 114, headHost, "feat/57", true),
+		member("novox/mesh-controller", 346, headController, "feat/57", true), member("novox/mesh-tools", 8, headLab, "main", true))}
+	if got, _ := siblingsFor(release, entries, besideTheCore(), lines); len(got) != 1 || got[0].Dir != "mesh-controller" {
+		t.Errorf("into a release branch: %+v", got)
+	}
+	// A pull request on no head branch is in no group.
+	pull.Head = ""
+	if got, unknown := siblingsFor(pull, entries, besideTheCore(), lines); got != nil || unknown != "" {
+		t.Errorf("no head branch: %+v %q", got, unknown)
+	}
+}
+
+func itoa(n int) string { b, _ := json.Marshal(n); return string(b) }
+
+// Every check asks mesh-delivery's `groups` once; the ask names the sibling's repository, head and base.
+func TestEveryCheckAsksMeshDeliveryOnceAndNamesItsSiblings(t *testing.T) {
+	entries := theCoreOnTheGitSeat()
+	asked := 0
+	was := groupsAsked
+	t.Cleanup(func() { groupsAsked = was })
+	groupsAsked = func(_ context.Context, held bool) ([]groupsLine, error) {
+		asked++
+		if !held {
+			t.Error("the seat is held, yet it was asked as not held")
+		}
+		return []groupsLine{group("feat/x", member("novox/mesh-host", 114, headHost, "main", true),
+			member("novox/mesh-controller", 346, headController, "main", true))}, nil
+	}
+	request := link.BuildRequest{Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Base: "main", Beside: besideTheCore()}}
+	withSiblings(t.Context(), &request, link.PullUpdated{Owner: "novox", Repo: "mesh-host", Base: "main", Head: "feat/x"}, entries)
+	if asked != 1 {
+		t.Fatalf("mesh-delivery was asked %d times for one check", asked)
+	}
+	want := link.CheckSibling{Repository: "novox/mesh-controller", Number: 346, Head: headController, Base: "main", Dir: "mesh-controller"}
+	if got := request.Check.Siblings; len(got) != 1 || got[0] != want || request.Check.SiblingsUnknown != "" {
+		t.Fatalf("the ask names siblings %+v, unknown %q", got, request.Check.SiblingsUnknown)
+	}
+	body, _ := json.Marshal(request.Check)
+	if !strings.Contains(string(body), `"siblings":[{"repository":"novox/mesh-controller","number":346,"head":"`+headController+
+		`","base":"main","dir":"mesh-controller"}]`) {
+		t.Fatalf("on the wire: %s", body)
+	}
+}
+
+// When mesh-delivery does not answer in time (or is not held, or answered without the fields), the check reads no
+// sibling and its request says it could not learn them, so a fix to mesh-delivery is still checked without it.
+func TestWhenMeshDeliveryDoesNotAnswerTheCheckReadsNoSiblingAndSaysSo(t *testing.T) {
+	was := groupsAsked
+	t.Cleanup(func() { groupsAsked = was })
+	for _, c := range []struct {
+		what string
+		err  error
+		held bool
+	}{{"it did not answer", context.DeadlineExceeded, true}, {"nothing serves it", errors.New("nothing serves mesh-delivery.groups"), true},
+		{"no holder on record", errors.New("no holder of mesh-delivery is on record to say it"), false}} {
+		entries := theCoreOnTheGitSeat()
+		if !c.held {
+			entries = entries[:4]
+		}
+		groupsAsked = func(_ context.Context, held bool) ([]groupsLine, error) {
+			if held != c.held {
+				t.Errorf("%s: held %v", c.what, held)
+			}
+			return nil, c.err
+		}
+		request := link.BuildRequest{Check: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Base: "main", Beside: besideTheCore()}}
+		withSiblings(t.Context(), &request, link.PullUpdated{Owner: "novox", Repo: "mesh-host", Base: "main", Head: "feat/x"}, entries)
+		if len(request.Check.Siblings) != 0 || !strings.Contains(request.Check.SiblingsUnknown, c.err.Error()) ||
+			!strings.Contains(request.Check.SiblingsUnknown, "reads no siblings") {
+			t.Errorf("%s: siblings %+v, unknown %q", c.what, request.Check.Siblings, request.Check.SiblingsUnknown)
+		}
+	}
+}
+
+// **A pull request for which mesh-delivery answered and named no sibling is asked exactly as before** (ADR 0382 §7):
+// byte for byte the request it was without the rule.
+func TestAPullRequestWithNoSiblingIsAskedByteForByteAsBefore(t *testing.T) {
+	entries := theCoreOnTheGitSeat()
+	was := groupsAsked
+	t.Cleanup(func() { groupsAsked = was })
+	for _, answer := range [][]groupsLine{nil, {group("feat/other", member("novox/mesh-controller", 346, headController, "main", true))},
+		{group("feat/x", member("novox/mesh-host", 114, headHost, "main", true), member("novox/hq", 3, headHq, "main", true))}} {
+		groupsAsked = func(context.Context, bool) ([]groupsLine, error) { return answer, nil }
+		build := func() link.BuildRequest {
+			return link.BuildRequest{ID: "build-1", Repository: "r", Ref: headHost, Check: &link.CheckRequest{Owner: "novox",
+				Repo: "mesh-host", Number: 114, Base: "main", Beside: besideTheCore(), Modules: []string{"mesh-host"}, Judge: "validator"}}
+		}
+		before, _ := json.Marshal(build())
+		after := build()
+		withSiblings(t.Context(), &after, link.PullUpdated{Owner: "novox", Repo: "mesh-host", Base: "main", Head: "feat/x"}, entries)
+		got, _ := json.Marshal(after)
+		if string(before) != string(got) {
+			t.Fatalf("the request changed:\nbefore %s\nafter  %s", before, got)
+		}
+	}
+}
+
+// What the build seat's verdict says of its siblings reaches the forge's holder in the controller's `checked`.
+func TestTheVerdictCarriesTheSiblingsAndWhereTheJudgeCameFrom(t *testing.T) {
+	read := []link.CheckSibling{{Repository: "novox/mesh-controller", Number: 346, Head: headController, Base: "main", BaseCommit: headHost}}
+	c := checkedOf(link.BuildResult{ID: "b", Ref: headHost, Checked: &link.CheckRequest{Owner: "novox", Repo: "mesh-host", Number: 114},
+		Check: &link.CheckOutcome{Verdict: "pass", Summary: "ok", Siblings: read, JudgeFrom: "sibling novox/mesh-controller#346 merge abc",
+			Validator: "the change's own validator"}})
+	if len(c.Siblings) != 1 || c.Siblings[0] != read[0] || c.JudgeFrom == "" || c.Validator == "" {
+		t.Fatalf("the verdict says %+v", c)
+	}
+	body, _ := json.Marshal(c)
+	for _, want := range []string{`"siblings":[{"repository":"novox/mesh-controller","number":346,"head":"` + headController +
+		`","base":"main","base_commit":"` + headHost + `"}]`, `"judge_from":"sibling novox/mesh-controller#346 merge abc"`} {
+		if !strings.Contains(string(body), want) {
+			t.Fatalf("the verdict lacks %s:\n%s", want, body)
+		}
+	}
+	unknown := checkedOf(link.BuildResult{ID: "b", Check: &link.CheckOutcome{Verdict: "pass", SiblingsUnknown: "mesh-delivery did not answer"}})
+	if body, _ := json.Marshal(unknown); !strings.Contains(string(body), `"siblings_unknown":"mesh-delivery did not answer"`) ||
+		strings.Contains(string(body), `"siblings":`) {
+		t.Fatalf("the verdict that could not learn them says %s", body)
+	}
+}

cmd/mesh-controller/checks.go

@@ -180,6 +180,8 @@ func (f following) PullUpdated(ctx context.Context, p link.PullUpdated) error {
 		return err
 	}
 	request.Check.Plan = &plan
+	// **The group's other open pull requests are read beside it** (novox/hq ADR 0382 §1).
+	withSiblings(ctx, &request, p, entries)
 	seat := buildSeatHeld(ctx)
 	ask, err := askOverOn(seat)
 	if err != nil {
@@ -600,6 +602,7 @@ func checkedOf(result link.BuildResult) link.Checked {
 		c.Built = result.Check.Built
 		c.Release, c.JudgedBy, c.BesideAt = result.Check.Release, result.Check.JudgedBy, result.Check.BesideAt
 		c.Validator = result.Check.Validator
+		c.Siblings, c.SiblingsUnknown, c.JudgeFrom = result.Check.Siblings, result.Check.SiblingsUnknown, result.Check.JudgeFrom
 		if c.Gate == nil {
 			// A build seat from before the layers: its verdict is the gate's.
 			c.Gate = &link.CheckLayer{Verdict: c.Verdict, Summary: c.Summary}

cmd/mesh-controller/group_wait.go

@@ -34,31 +34,58 @@ type groupMember struct {
 	Repository, State string
 }
 
-// deliveryGroupOf is what mesh-delivery says of the group a head names: its members, and whether the head names a
-// group at all; an error when it cannot be asked or did not answer. A seam a test replaces.
-var deliveryGroupOf = func(ctx context.Context, held bool, head string) ([]groupMember, bool, error) {
+// groupsLine is one group as mesh-delivery's `groups` says it: its id (the head branch name), its members as text and,
+// from a mesh-delivery that knows novox/hq ADR 0382, each member again as an object (`member_details`) naming its pull
+// request's number, whole head, base branch and whether it is open.
+type groupsLine struct {
+	ID      string       `json:"id"`
+	Members []string     `json:"members"`
+	Details []memberLine `json:"member_details,omitempty"`
+}
+
+// memberLine is one member of a group, as `groups` says it beside its text.
+type memberLine struct {
+	ID         string `json:"id"`
+	Repository string `json:"repository"`
+	State      string `json:"state"`
+	Number     int    `json:"number"`
+	Head       string `json:"head"`
+	Base       string `json:"base"`
+	Open       bool   `json:"open"`
+}
+
+// groupsAsked is mesh-delivery's `groups`: every group it keeps, or an error when it cannot be asked or did not
+// answer within groupAskWithin. A seam a test replaces.
+var groupsAsked = func(ctx context.Context, held bool) ([]groupsLine, error) {
 	if !held {
-		return nil, false, fmt.Errorf("no holder of %s is on record to say it", catalogue.DeliverySeat)
+		return nil, fmt.Errorf("no holder of %s is on record to say it", catalogue.DeliverySeat)
 	}
 	serving := servingBus.Load()
 	if serving == nil {
-		return nil, false, errors.New("this controller is not on the bus")
+		return nil, errors.New("this controller is not on the bus")
 	}
 	asking, cancel := context.WithTimeout(ctx, groupAskWithin)
 	defer cancel()
 	raw, err := askDeliveryOwner(asking, serving.Conn(), "groups", map[string]any{})
 	if err != nil {
 		if errors.Is(err, link.ErrNothingServes) {
-			return nil, false, fmt.Errorf("nothing serves %s.groups", catalogue.DeliverySeat)
+			return nil, fmt.Errorf("nothing serves %s.groups", catalogue.DeliverySeat)
 		}
-		return nil, false, err
-	}
-	var lines []struct {
-		ID      string   `json:"id"`
-		Members []string `json:"members"`
+		return nil, err
 	}
+	var lines []groupsLine
 	if err := json.Unmarshal(raw, &lines); err != nil {
-		return nil, false, fmt.Errorf("%s.groups answered something unreadable: %w", catalogue.DeliverySeat, err)
+		return nil, fmt.Errorf("%s.groups answered something unreadable: %w", catalogue.DeliverySeat, err)
+	}
+	return lines, nil
+}
+
+// deliveryGroupOf is what mesh-delivery says of the group a head names: its members, and whether the head names a
+// group at all; an error when it cannot be asked or did not answer. A seam a test replaces.
+var deliveryGroupOf = func(ctx context.Context, held bool, head string) ([]groupMember, bool, error) {
+	lines, err := groupsAsked(ctx, held)
+	if err != nil {
+		return nil, false, err
 	}
 	for _, l := range lines {
 		if l.ID != head {

cmd/mesh-controller/replay867_test.go

@@ -0,0 +1,291 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-controller/internal/builder"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	meshfacts "github.com/novox/mesh-controller/internal/facts"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// TestReplay867 is the replay of novox/hq issue 867, written with only what the controller and the build seat had
+// before the fix, so mesh-lab's prover can lay it over the commit before. A mesh-host change (#114) and a
+// mesh-controller change (#346) of one delivery group need each other: the node-engine change's own check reads the
+// controller's lock beside it, which only the controller change brings; the controller change builds only with the
+// validator word only the node-engine change brings. Each was read beside the other's repository at the commit the mesh
+// runs, which holds neither change, so neither could pass its own merge check — and the pair could not merge.
+//
+// It runs the whole path: the forge announces each pull request (following.PullUpdated), the controller asks
+// mesh-delivery which pull requests the group holds, the ask is queued for the build seat, and the build seat's check
+// (builder.Check, with a container runtime that runs each container's command on this machine) judges it.
+func TestReplay867(t *testing.T) {
+	if _, err := exec.LookPath("go"); err != nil {
+		t.Skip("no Go toolchain on this machine to build a judge with")
+	}
+	r := theGroupOfIssue867(t)
+	for _, c := range []struct {
+		what, repo string
+		number     int
+		head       string
+		module     string
+	}{{"the node-engine change", "mesh-host", 114, r.hostHead, "mesh-host"},
+		{"the controller change", "mesh-controller", 346, r.controllerHead, "mesh-controller"}} {
+		v := r.checked(t, c.repo, c.number, c.head)
+		if v.Gate == nil || v.Gate.Verdict != "pass" || v.Repo == nil || v.Repo.Verdict != "pass" {
+			t.Errorf("%s (%s#%d) did not pass its own merge check beside its group: gate %+v, repository %+v\n%s",
+				c.what, c.repo, c.number, v.Gate, v.Repo, v.Report)
+		}
+	}
+}
+
+// theIssue867 is the two repositories as the trunk holds them and each pull request's head.
+type theIssue867 struct {
+	open                     *stores
+	hostHead, controllerHead string
+	js                       interface{ Conn() *nats.Conn }
+	judgeCache               string
+	registry                 string
+}
+
+func r867Git(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@example.org",
+		"GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@example.org")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v\n%s", args, err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func r867Commit(t *testing.T, dir string, files map[string]string) string {
+	t.Helper()
+	for name, body := range files {
+		if err := os.MkdirAll(filepath.Dir(filepath.Join(dir, name)), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	r867Git(t, dir, "add", "-A")
+	r867Git(t, dir, "commit", "--quiet", "-m", "x")
+	return r867Git(t, dir, "rev-parse", "HEAD")
+}
+
+// r867Controller is a controller whose judge says who it is and the validator word it was built with.
+func r867Controller(who, extra string) map[string]string {
+	return map[string]string{
+		"go.mod":             "module example.org/judge\n\ngo 1.22\n\nrequire github.com/novox/mesh-host v0.0.0\n",
+		"vendor/modules.txt": "# github.com/novox/mesh-host v0.0.0\n## explicit; go 1.22\ngithub.com/novox/mesh-host/validate\n",
+		"vendor/github.com/novox/mesh-host/validate/v.go":             "package validate\n\nconst Word = \"the vendored validator\"\n",
+		"vendor/github.com/novox/mesh-host/internal/declaration/d.go": "package declaration\n",
+		"cmd/mesh-controller/main.go": `package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/novox/mesh-host/validate"
+)
+
+func main() {
+	if len(os.Args) == 2 && os.Args[1] == "merge-gate" {
+		fmt.Println("usage: merge-gate --facts <file> --store <postgres>")
+		os.Exit(2)
+	}
+	fmt.Printf("{\"verdict\":\"pass\",\"summary\":\"%s with %s\"}\n", "` + who + `", validate.Word` + extra + `)
+}
+`,
+	}
+}
+
+func theGroupOfIssue867(t *testing.T) *theIssue867 {
+	t.Helper()
+	open := aMesh(t)
+	r := &theIssue867{open: open, judgeCache: t.TempDir()}
+	root := filepath.Join(t.TempDir(), "novox")
+	controller, host := filepath.Join(root, "mesh-controller"), filepath.Join(root, "mesh-host")
+	for _, d := range []string{controller, host} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		r867Git(t, d, "init", "--quiet", "-b", "main")
+	}
+	// The trunks.
+	files := r867Controller("the controller", "")
+	files["lock.txt"] = "foundation: old\n"
+	files["module.json"] = `{"module":"mesh-controller"}`
+	files[builder.CheckScript] = "true\n"
+	r867Commit(t, controller, files)
+	r867Commit(t, host, map[string]string{"validate/v.go": "package validate\n\nconst Word = \"the trunk's validator\"\n",
+		"internal/declaration/d.go": "package declaration\n", "module.json": `{"module":"mesh-host"}`,
+		builder.CheckScript: "set -e\ngrep -q 'foundation: new' \"$MESH_CHECK_BESIDE/mesh-controller/lock.txt\"\n"})
+	// The two pull requests of one group, feat/867.
+	r867Git(t, controller, "checkout", "--quiet", "-b", "feat/867", "main")
+	change := r867Controller("the controller", "+validate.More")
+	change["lock.txt"] = "foundation: new\n"
+	r.controllerHead = r867Commit(t, controller, change)
+	r867Git(t, controller, "checkout", "--quiet", "main")
+	r867Git(t, host, "checkout", "--quiet", "-b", "feat/867", "main")
+	r.hostHead = r867Commit(t, host, map[string]string{"validate/more.go": "package validate\n\nconst More = \" and more\"\n"})
+	r867Git(t, host, "checkout", "--quiet", "main")
+
+	for _, m := range []struct{ module, dir string }{{"mesh-controller", controller}, {"mesh-host", host}} {
+		// The mesh runs each at its trunk's head, the commit a check reads it at beside another repository's change.
+		running := r867Git(t, m.dir, "rev-parse", "main")
+		if err := open.inventory.RegisterModule(t.Context(), catalogue.Manifest{Module: m.module, Version: "1"},
+			inventory.Source{Repository: m.dir, Ref: "main", BuiltFrom: running, Head: running}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	holdTheDeliverySeat(t, open)
+
+	// mesh-delivery says the group: two open pull requests into main, each with its head.
+	was := askDeliveryOwner
+	t.Cleanup(func() { askDeliveryOwner = was })
+	askDeliveryOwner = func(_ context.Context, _ *nats.Conn, verb string, _ map[string]any) (json.RawMessage, error) {
+		if verb != "groups" {
+			t.Fatalf("asked the owner %s", verb)
+		}
+		return json.RawMessage(`[{"id":"feat/867","members":["` + root + `/mesh-host@` + r.hostHead[:12] + ` (checked)","` +
+			root + `/mesh-controller@` + r.controllerHead[:12] + ` (checked)"],"member_details":[` +
+			`{"id":"novox/mesh-host@` + r.hostHead[:12] + `","repository":"novox/mesh-host","state":"checked","number":114,"head":"` +
+			r.hostHead + `","base":"main","open":true},` +
+			`{"id":"novox/mesh-controller@` + r.controllerHead[:12] + `","repository":"novox/mesh-controller","state":"checked","number":346,"head":"` +
+			r.controllerHead + `","base":"main","open":true}]}]`), nil
+	}
+	r.registry = r867Registry(t)
+	r867Runtime(t)
+	return r
+}
+
+// checked is a pull request announced by the forge, asked of the build seat by the controller, and checked there.
+func (r *theIssue867) checked(t *testing.T, repo string, number int, head string) builderVerdict {
+	t.Helper()
+	js, ask := aBuildQueue(t)
+	_ = ask
+	servingBus.Store(js)
+	t.Cleanup(func() { servingBus.Store(nil) })
+	p := link.PullUpdated{Owner: "novox", Repo: repo, Number: number, Base: "main", Head: "feat/867", Commit: head,
+		Paths: []string{"lock.txt", "validate/more.go", "cmd/mesh-controller/main.go"}, ModuleDirsSaid: true,
+		MergeCheck: true, MergeCheckSaid: true}
+	if err := (following{open: r.open, oneShot: true}).PullUpdated(t.Context(), p); err != nil {
+		t.Fatal(err)
+	}
+	q, err := link.ReadQueue(t.Context(), js, link.TheBuildMachine)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(q.Asks) == 0 {
+		t.Fatalf("%s#%d: nothing was asked of the build seat", repo, number)
+	}
+	request := q.Asks[len(q.Asks)-1].Request
+	// What the build seat makes of the ask: the fields the two share, by name.
+	var spec builder.CheckSpec
+	body, _ := json.Marshal(request.Check)
+	if err := json.Unmarshal(body, &spec); err != nil {
+		t.Fatal(err)
+	}
+	spec.ID, spec.Repository, spec.Ref = request.ID, request.Repository, request.Ref
+	spec.Toolchain, spec.JudgeCache = "golang", r.judgeCache
+	v, err := builder.Check(t.Context(), builder.Command, spec, t.TempDir(), r.registry, builder.GitCredential{}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return v
+}
+
+type builderVerdict = builder.CheckVerdict
+
+func r867Registry(t *testing.T) string {
+	t.Helper()
+	body, err := json.Marshal(meshfacts.Facts{Format: meshfacts.Format, Taken: time.Now().UTC(),
+		Versions: meshfacts.Versions{Bus: "2.11.17", Store: "17.11"}, Machines: []meshfacts.Machine{{Name: "abcdef", Length: 6}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sum := sha256.Sum256(body)
+	digest := "sha256:" + hex.EncodeToString(sum[:])
+	manifest, _ := json.Marshal(map[string]any{"schemaVersion": 2, "layers": []map[string]any{
+		{"mediaType": meshfacts.MediaType, "digest": digest, "size": len(body)}}})
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		switch {
+		case strings.Contains(req.URL.Path, "/manifests/"):
+			w.Write(manifest)
+		case strings.HasSuffix(req.URL.Path, "/blobs/"+digest):
+			w.Write(body)
+		default:
+			http.NotFound(w, req)
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return strings.TrimPrefix(srv.URL, "http://")
+}
+
+// r867Runtime puts a container runtime on PATH that runs every container's command on this machine, in the directory
+// and with the environment the check gives it, and a store and a bus that answer.
+func r867Runtime(t *testing.T) {
+	t.Helper()
+	bus, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { bus.Close() })
+	go func() {
+		for {
+			c, err := bus.Accept()
+			if err != nil {
+				return
+			}
+			c.Close()
+		}
+	}()
+	dir := t.TempDir()
+	script := `#!/bin/sh
+cmd="$1"; shift
+case "$cmd" in
+ps|rm|exec) exit 0 ;;
+port) echo "` + bus.Addr().String() + `"; exit 0 ;;
+run)
+  workdir=""; detached=""
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      -d) detached=1; shift ;;
+      --rm) shift ;;
+      --workdir) workdir="$2"; shift 2 ;;
+      --env) export "$2"; shift 2 ;;
+      --network|--volume|--user|--label|--name|-p|-e) shift 2 ;;
+      *) break ;;
+    esac
+  done
+  if [ -n "$detached" ]; then echo a-container; exit 0; fi
+  shift
+  cd "$workdir" && exec "$@" ;;
+esac
+exit 1
+`
+	if err := os.WriteFile(filepath.Join(dir, "docker"), []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
+	t.Setenv("GOTOOLCHAIN", "local")
+}