The builder announces what it built, and what it was built on top of

Answering and announcing are different acts. The reply goes to whoever asked and
is correlated to their request; the announcement says to the whole mesh that a
module now exists at a commit, which is what the catalogue places in the module
graph (novox/hq ADR 0072). A build nobody asked for still has to be announced, or
the graph knows less than the registry does.

What it was built on top of is read out of the build's own inputs rather than
declared, because a declared list drifts from what the code actually uses
(ADR 0009). These are artifact references, which is what a build input names;
resolving them to module-versions is the catalogue's work, since it is what knows
which module-version published which artifact.

Events ride the topic exchange, not the direct one nodes speak over, so the
builder's account is granted both: it must be able to answer and to announce.
The envelope is the sdk's, reproduced exactly — a second shape would be a second
thing for consumers to handle, and they are written against the first.

Announcing is not allowed to fail a build. The work was done and was answered; a
build reported as failed because saying so failed is a lie about it.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/broker/management.go

@@ -242,11 +242,14 @@ func (m *Management) CreateBuilderAccount(ctx context.Context, name, password st
 		// and a queue nobody may declare is a queue that exists only if the control plane has
 		// already run, which makes the order they start in matter.
 		"configure": "^" + builds + "$",
-		// The exchange, and nothing else. **Not the default exchange**: permission there is
+		// Two exchanges, and nothing else. **Not the default exchange**: permission there is
 		// granted per exchange rather than per queue, so a builder allowed to use it could
 		// publish into any node's queue — the privilege a build machine most obviously should
-		// not have. Answers go through the exchange, which is why they can.
-		"write": "^" + regexp.QuoteMeta(ExchangeName) + "$",
+		// not have. Answers go through the node exchange; announcing what was built goes through
+		// the events exchange, which is a different act with a different audience (novox/hq
+		// ADR 0072). A builder that could answer and not announce would leave the module graph
+		// knowing less than the registry does.
+		"write": "^(" + regexp.QuoteMeta(ExchangeName) + "|" + regexp.QuoteMeta(EventsExchangeName) + ")$",
 		// The build queue and nothing else. Not another machine's declarations.
 		"read": "^" + builds + "$",
 	}); err != nil {