The builder announces what it built, and what it was built on top of

Answering and announcing are different acts. The reply goes to whoever asked and
is correlated to their request; the announcement says to the whole mesh that a
module now exists at a commit, which is what the catalogue places in the module
graph (novox/hq ADR 0072). A build nobody asked for still has to be announced, or
the graph knows less than the registry does.

What it was built on top of is read out of the build's own inputs rather than
declared, because a declared list drifts from what the code actually uses
(ADR 0009). These are artifact references, which is what a build input names;
resolving them to module-versions is the catalogue's work, since it is what knows
which module-version published which artifact.

Events ride the topic exchange, not the direct one nodes speak over, so the
builder's account is granted both: it must be able to answer and to announce.
The envelope is the sdk's, reproduced exactly — a second shape would be a second
thing for consumers to handle, and they are written against the first.

Announcing is not allowed to fail a build. The work was done and was answered; a
build reported as failed because saying so failed is a lie about it.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/broker/management.go

@@ -242,11 +242,14 @@ func (m *Management) CreateBuilderAccount(ctx context.Context, name, password st
 		// and a queue nobody may declare is a queue that exists only if the control plane has
 		// already run, which makes the order they start in matter.
 		"configure": "^" + builds + "$",
-		// The exchange, and nothing else. **Not the default exchange**: permission there is
+		// Two exchanges, and nothing else. **Not the default exchange**: permission there is
 		// granted per exchange rather than per queue, so a builder allowed to use it could
 		// publish into any node's queue — the privilege a build machine most obviously should
-		// not have. Answers go through the exchange, which is why they can.
-		"write": "^" + regexp.QuoteMeta(ExchangeName) + "$",
+		// not have. Answers go through the node exchange; announcing what was built goes through
+		// the events exchange, which is a different act with a different audience (novox/hq
+		// ADR 0072). A builder that could answer and not announce would leave the module graph
+		// knowing less than the registry does.
+		"write": "^(" + regexp.QuoteMeta(ExchangeName) + "|" + regexp.QuoteMeta(EventsExchangeName) + ")$",
 		// The build queue and nothing else. Not another machine's declarations.
 		"read": "^" + builds + "$",
 	}); err != nil {

internal/builder/builder.go

@@ -11,6 +11,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 
@@ -42,6 +43,15 @@ type Publisher interface {
 
 // Result is everything one build produced.
 type Result struct {
+	// Against is every pinned image this build was built on top of, read out of its own inputs.
+	//
+	// **Derived, not declared** (novox/hq ADR 0009): a declared list of dependencies drifts from
+	// what the code actually uses, and an artifact is out of date when anything it was built
+	// against moved. These are artifact references rather than module-versions, because that is
+	// what a build input names; resolving them to modules is the catalogue's work, since it is
+	// what knows which module-version published which artifact.
+	Against []string
+
 	// Manifest is the module as the mesh should hold it: artifacts resolved to digests.
 	Manifest catalogue.Manifest
 	// Commit is what was built, so "is this current?" is answerable without building again.
@@ -124,7 +134,8 @@ func Build(ctx context.Context, run Runner, publish Publisher,
 	if err != nil {
 		return Result{}, err
 	}
-	return Result{Manifest: resolved, Commit: commit, Built: built}, nil
+	return Result{Manifest: resolved, Commit: commit, Built: built,
+		Against: against(within, manifest)}, nil
 }
 
 // inside resolves a module's path within a clone, and refuses one that leaves it.
@@ -157,6 +168,39 @@ func describe(path string) string {
 	return path
 }
 
+// pinnedImage matches an image reference pinned by digest, which is the only kind a build input is
+// allowed to name — a tag is something somebody else can move under you.
+var pinnedImage = regexp.MustCompile(`[A-Za-z0-9][A-Za-z0-9._/:-]*@sha256:[0-9a-f]{64}`)
+
+// against reads what this module's image artifacts are built on top of, out of the files that
+// build them. Nothing is guessed: a reference that is not written down is not reported.
+func against(within string, manifest catalogue.Manifest) []string {
+	if manifest.Build == nil {
+		return nil
+	}
+	seen := map[string]bool{}
+	var out []string
+	for _, a := range manifest.Build.Artifacts {
+		if a.Kind != catalogue.ArtifactImage || a.From == "" {
+			continue
+		}
+		body, err := os.ReadFile(filepath.Join(within, a.From))
+		if err != nil {
+			// Not fatal: the build itself already failed if this file was needed and missing, and
+			// reporting no edges is honest where inventing them would not be.
+			continue
+		}
+		for _, found := range pinnedImage.FindAllString(string(body), -1) {
+			if !seen[found] {
+				seen[found] = true
+				out = append(out, found)
+			}
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
 // ManifestName is the one file a module repository must have.
 //
 // At the root, and named the same in every repository. A convention somebody can look for beats a

internal/link/build.go

@@ -82,6 +82,10 @@ type BuildResult struct {
 	// Made is each artifact, for reporting.
 	Made []MadeArtifact `json:"made,omitempty"`
 
+	// Against is every pinned image this was built on top of, read out of the build's own inputs
+	// (novox/hq ADR 0009). The catalogue turns these into edges; nothing else need care.
+	Against []string `json:"against,omitempty"`
+
 	// Failed is why, when it did.
 	Failed string `json:"failed,omitempty"`
 }

internal/link/events.go

@@ -0,0 +1,72 @@
+package link
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	amqp "github.com/rabbitmq/amqp091-go"
+)
+
+// Emitting a module event from Go.
+//
+// **Every event rides one topic exchange** (novox/hq ADR 0042), which is not the direct exchange
+// nodes and the control plane speak over. A module that announces something publishes here, and
+// consumers bind their own durable queue to a pattern over it.
+//
+// This exists because the builder is a module written in Go while every other emitter is
+// TypeScript on the sdk. The envelope is the sdk's, reproduced exactly: the body is the payload
+// alone and everything about the event travels as headers. A second shape would be a second thing
+// for consumers to handle, and they are written against the first.
+const (
+	// EventsExchange is where every event rides. Named here rather than imported from the broker
+	// package for the same reason BuildQueueName is duplicated there — one direction of dependency.
+	EventsExchange = "mesh.events"
+)
+
+// EmitEvent publishes one module event, in the envelope the sdk's consumers expect.
+//
+// Persistent, because an event that a broker restart loses is not an announcement. The publish is
+// not confirmed here: the caller has already done the work the event describes, and a build that
+// succeeded must not be reported as failed because saying so failed.
+func EmitEvent(ctx context.Context, channel *amqp.Channel, eventType, source, node string, body any) error {
+	payload, err := json.Marshal(body)
+	if err != nil {
+		return fmt.Errorf("cannot serialise a %s event: %w", eventType, err)
+	}
+	id, err := eventID()
+	if err != nil {
+		return err
+	}
+	return channel.PublishWithContext(ctx, EventsExchange, eventType, false, false, amqp.Publishing{
+		ContentType:  "application/json",
+		DeliveryMode: amqp.Persistent,
+		MessageId:    id,
+		Timestamp:    time.Now().UTC(),
+		Body:         payload,
+		Headers: amqp.Table{
+			"x-event-id":   id,
+			"x-source":     source,
+			"x-node":       node,
+			"x-time":       time.Now().UTC().Format(time.RFC3339),
+			"content-type": "application/json",
+		},
+	})
+}
+
+// eventID is what a consumer deduplicates on: delivery is at-least-once, so a handler must be able
+// to tell a redelivery from a second event, and only the emitter can say which it is.
+func eventID() (string, error) {
+	raw := make([]byte, 16)
+	if _, err := rand.Read(raw); err != nil {
+		return "", fmt.Errorf("cannot make an event id: %w", err)
+	}
+	return hex.EncodeToString(raw), nil
+}
+
+// KeyModuleBuilt is what the builder announces when it has built something. The catalogue places
+// it in the module graph; nothing else need care.
+const KeyModuleBuilt = "module.builder.built"