Derive a worker per kind for the build seats and grant their users to put asks, so a build node pulls delivery, check and recheck in order and a session cannot ask (issue 1887 A6, ADR 0525 §2)

internal/inventory/busrecords.go

@@ -356,6 +356,11 @@ func asSeat(s catalogue.SeatDeclaration, declarer string) broker.Seat {
 	seat := broker.Seat{Name: s.Name, Scope: s.Scope, Accepts: s.Accepts, Emits: s.Emits,
 		Serves: catalogue.VerbNames(s.Serves), Kinded: s.Kinded, ByCaller: s.ByCaller, Proofs: s.Proofs,
 		DeclaredBy: declarer}
+	// A build seat's kinds are each a worker of its own, pulled in their order (novox/hq ADR 0525 §2; issue 1887 A6): the
+	// mesh's definition of the role, compiled, never stored.
+	if own, ok := catalogue.SeatNamed(s.Name); ok && own.PulledByKind {
+		seat.PulledByKind = true
+	}
 	// A seat's records are its declaring module's buckets, named as the bus holds them (ADR 0259 §3).
 	for _, r := range s.Records {
 		if declarer != "" {
@@ -371,7 +376,7 @@ func MeshSeats() []broker.DeclaredSeat {
 	var out []broker.DeclaredSeat
 	for _, s := range catalogue.SeatsWithAProtocol() {
 		out = append(out, broker.DeclaredSeat{
-			Name: s.Name, Accepts: s.Accepts, Emits: s.Emits, Serves: catalogue.VerbNames(s.Serves),
+			Name: s.Name, Accepts: s.Accepts, Emits: s.Emits, Serves: catalogue.VerbNames(s.Serves), PulledByKind: s.PulledByKind,
 		})
 	}
 	return out