Keep mesh-lab at its trunk and build the release judge with a cache of its own

Review of #329: mesh-lab's replays run with the container runtime's socket, so
a same-named branch must never be what runs there; the shared Go cache and HOME
are writable by a pull request's own script, so the judge kept for a head must
not be built from them (issue 704, issue 482). A forge answer naming no branch
is an error, and a trunk is the branch a repository follows, not a name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/builder/check.go

@@ -429,6 +429,11 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 		if dir == name || !safeName.MatchString(dir) {
 			continue
 		}
+		if dir == "mesh-lab" && b.Else != "" {
+			// **mesh-lab is read at its trunk, always** (novox/hq ADR 0358): its replays run with the container
+			// runtime's socket, so a branch of a release's name — which anyone may create — is never what runs there.
+			b.Ref, b.Else = b.Else, ""
+		}
 		if err := cloneAt(b.Repository, b.Ref, b.Else, dir); err != nil {
 			return CheckVerdict{}, fmt.Errorf("beside it, %w", err)
 		}
@@ -1130,8 +1135,12 @@ func releaseJudge(ctx context.Context, run, plain Runner, spec CheckSpec, root s
 			}
 		}
 	}
+	// **Built with a cache of its own, never the workspace's** (novox/hq issue 482): the workspace's Go cache and HOME are
+	// written by every pull request's own script, so a poisoned cache entry or Go environment file would otherwise be
+	// built into the judge kept for this head. A fresh cache under this check's root, made before anything of the
+	// change runs, and no Go environment file.
 	if _, err := run(ctx, root, "docker", inToolchain(filepath.Join(root, dir),
-		[]string{"CGO_ENABLED=0", "GOFLAGS=-mod=vendor", "GOPROXY=off", "GOCACHE=" + filepath.Join(filepath.Dir(root), "go-cache")},
+		[]string{"CGO_ENABLED=0", "GOFLAGS=-mod=vendor", "GOPROXY=off", "GOENV=off", "GOCACHE=" + judgeGoCache(root)},
 		"go", "build", "-o", bin, "./cmd/mesh-controller")...); err != nil {
 		return "", "", fmt.Errorf("the controller of %s does not build%s: %w", spec.Release, with, err)
 	}
@@ -1141,6 +1150,10 @@ func releaseJudge(ctx context.Context, run, plain Runner, spec CheckSpec, root s
 	return bin, dir, nil
 }
 
+// judgeGoCache is the Go cache a release branch's judge is built with: fresh for each check, under its root, which is
+// emptied before the check clones anything — never the workspace's shared cache.
+func judgeGoCache(root string) string { return filepath.Join(root, "judge-go-cache") }
+
 // judgesKept is how many release-branch judges a judge cache keeps: a head moved past is not built from again.
 const judgesKept = 4
 

internal/builder/release_branch_test.go

@@ -143,7 +143,7 @@ run)
   done
   if [ -n "$detached" ]; then echo a-container; exit 0; fi
   shift
-  if [ "$1" = go ]; then echo "$*" >> "` + built + `"; fi
+  if [ "$1" = go ]; then echo "GOCACHE=$GOCACHE GOENV=$GOENV $*" >> "` + built + `"; fi
   cd "$workdir" && exec "$@" ;;
 esac
 exit 1
@@ -255,6 +255,13 @@ func TestACataloguePullRequestIntoAReleaseBranchIsJudgedByThatBranchsController(
 	if n := builds(t, built); n != 1 {
 		t.Fatalf("the judge was built %d times for one check", n)
 	}
+	// **The judge is built with a cache no pull request's script can write** (issue 482): a fresh one under the
+	// check's own root, never the workspace's shared go-cache, and no Go environment file from the workspace's HOME.
+	said, _ := os.ReadFile(built)
+	if !strings.Contains(string(said), "/check/judge-go-cache GOENV=off go build") ||
+		strings.Contains(string(said), "/go-cache GOENV") {
+		t.Fatalf("the release judge was built with the workspace's cache or Go environment:\n%s", said)
+	}
 
 	// **Built once per release-branch head**: a second check while that head stands takes the judge kept.
 	v = check("check-704-catalogue-again")
@@ -381,3 +388,27 @@ func TestAReleaseBranchsPullRequestIntoItsTrunkIsJudgedByTheControllerTheMeshRun
 		t.Fatalf("beside it were read %v, not the trunk's %s and %s", v.Beside, controllerMain[:12], hostMain[:12])
 	}
 }
+
+// **mesh-lab is read at its trunk, always** (ADR 0358): its replays run with the container runtime's socket, so a
+// branch of the release's name in mesh-lab — which anyone may create — is never what a check reads.
+func TestAReleaseBranchCheckReadsMeshLabAtItsTrunkEvenWhenItHasThatBranch(t *testing.T) {
+	aRuntimeThatBuildsTheJudge(t)
+	registry := aFactsRegistry(t)
+	beside, _, _, _ := theReleasedMesh(t)
+	lab, labMain, labRelease := aRepositoryWithARelease(t, map[string]string{"README": "the lab"},
+		map[string]string{"README": "a branch anyone could push"})
+	beside["mesh-lab"] = Beside{Repository: lab, Ref: releaseBranch, Else: "main"}
+	catalogue, head := aPullRequestInto(t, map[string]string{"modules/gitea/module.json": `{"module":"gitea"}`,
+		CheckScript: "true\n"}, releaseBranch, map[string]string{"modules/gitea/index.ts": "x"})
+	v, err := Check(t.Context(), Command, CheckSpec{ID: "check-704-lab", Repository: catalogue, Ref: head,
+		Owner: "novox", Repo: "mesh-catalog", Number: 286, Base: releaseBranch, Release: releaseBranch,
+		JudgeCache: t.TempDir(), Paths: []string{"modules/gitea/index.ts"}, Modules: []string{"gitea"}, Beside: beside,
+		Toolchain: "golang"}, t.TempDir(), registry, GitCredential{}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if v.BesideAt["mesh-lab"] != "main" || v.Beside["mesh-lab"] != labMain[:12] || v.Beside["mesh-lab"] == labRelease[:12] {
+		t.Fatalf("mesh-lab was read at %q (%s), not its trunk main at %s", v.BesideAt["mesh-lab"], v.Beside["mesh-lab"],
+			labMain[:12])
+	}
+}