Judge every pull request against the mesh that runs, before it merges (hq ADR 0237, to-be 45 §9)

Every check the mesh had ran after a merge, on a machine: a manifest the node-engine refused
(236), an identity a real machine's name made too long (263). merge-gate raises the mesh as the
facts snapshot says it is and the mesh with the change, each in a throwaway store through the
controller's own records, composes every machine twice and validates it with the node-engine's
validator, and fails what the change breaks, naming the machine's roles and the module - plus a
manifest the judging controller cannot read, a consumer left out of its grant, a module removed
while a machine runs it, a new module the node-engine would refuse; it warns on a wide rebuild.

The forge's new head of a pull request becomes a check the controller asks of the build seat:
the head and, beside it, the controller the mesh runs, the catalogue, the host and the lab; a
throwaway store and bus of the versions the mesh runs; the repository's merge-check.sh in the
mesh's Go toolchain with no container runtime socket; then mesh-lab's replays. The verdict is
said as checked, an error never a pass, and nothing is recorded or registered.

cmd/mesh-builder/main.go

@@ -237,7 +237,21 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 
 	npmrc, err := packagesFrom()
 	var built builder.Result
-	if err == nil {
+	if request.Check != nil {
+		// **A pull request's merge check, not a build** (novox/hq to-be 45 §9): nothing is built,
+		// published or registered; the verdict is the outcome.
+		result.Checked = request.Check
+		registry := ""
+		if r, ok := publisher.(builder.Registry); ok {
+			registry = r.Address
+		}
+		var v builder.CheckVerdict
+		v, err = builder.Check(building, builder.Command, checkSpecOf(request), workspace, registry, forgeFrom(), say)
+		if err == nil {
+			result.Check = &link.CheckOutcome{Verdict: v.Verdict, Summary: v.Summary, Report: v.Report,
+				Took: v.Took.Round(time.Second).String()}
+		}
+	} else if err == nil {
 		// The package-registry credential is a build input, so it is resolved before the clone: a
 		// build that could not have resolved its dependencies is refused in front of the reason, not
 		// after a clone that then fails at npm ci.
@@ -263,6 +277,8 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 		// builder that is not running, and those want completely different responses.
 		result.Failed = err.Error()
 		say("failed", err.Error())
+	} else if request.Check != nil {
+		say("checked", result.Check.Verdict+": "+result.Check.Summary)
 	} else {
 		manifest, marshalErr := json.Marshal(built.Manifest)
 		if marshalErr != nil {
@@ -312,6 +328,18 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 	}
 }
 
+// checkSpecOf is a check request as the builder runs it.
+func checkSpecOf(request link.BuildRequest) builder.CheckSpec {
+	c := request.Check
+	spec := builder.CheckSpec{ID: request.ID, Repository: request.Repository, Ref: request.Ref,
+		Owner: c.Owner, Repo: c.Repo, Number: c.Number, Paths: c.Paths, Beside: map[string]builder.Beside{},
+		Toolchain: builder.ToolchainOf(request.Held)}
+	for dir, b := range c.Beside {
+		spec.Beside[dir] = builder.Beside{Repository: b.Repository, Ref: b.Ref}
+	}
+	return spec
+}
+
 // packagesFrom is where a build resolves the mesh's own published packages — the SDK above all
 // (novox/hq ADR 0076, issue 053).
 //

cmd/mesh-controller/checks.go

@@ -0,0 +1,198 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A pull request's merge check (novox/hq to-be 45 §9): the forge announces a pull request's new head,
+// the controller asks the build seat to check it, and says the verdict as `checked`, which the forge's
+// holder sets as the pull request's status. **Before merge, never after**: every check the mesh had ran
+// after a merge, on a machine.
+//
+// What is checked is decided here and run there. Here: whether the mesh builds anything from the
+// repository into that branch — a repository it builds nothing from is not its to judge — and what the
+// check reads beside it: the controller the mesh runs (its judge, for a catalogue change: a manifest
+// that controller cannot read fails, which is version skew caught), the catalogue the mesh holds, the
+// host it runs. There: the repository's own merge-check.sh, or the merge gate alone for a repository
+// that declares none (internal/builder/check.go).
+
+// checkTimeout is how long one check may run on the build seat. Said here so the ask's watchdog (S6)
+// and the builder agree on what late means.
+const checkTimeout = 45 * time.Minute
+
+// PullUpdated asks for a pull request's merge check.
+func (f following) PullUpdated(ctx context.Context, p link.PullUpdated) error {
+	inv := f.open.inventory
+	entries, err := inv.Catalogued(ctx)
+	if err != nil {
+		return err
+	}
+	moved := link.SourceMoved{Owner: p.Owner, Repo: p.Repo, Base: p.Base, CloneURL: p.CloneURL}
+	var from *inventory.Entry
+	for i, e := range entries {
+		if !e.Provided && sourceIs(e.Source, moved) {
+			from = &entries[i]
+			break
+		}
+	}
+	if from == nil {
+		fmt.Printf("%s/%s#%d (%.8s): the mesh builds nothing from it into %s, so it is not the mesh's to check\n",
+			p.Owner, p.Repo, p.Number, p.Commit, p.Base)
+		return nil
+	}
+	request, err := checkRequestFor(ctx, f.open, p, *from, entries)
+	if err != nil {
+		return err
+	}
+	seat := buildSeatHeld(ctx)
+	ask, err := askOverOn(seat)
+	if err != nil {
+		return err
+	}
+	defer ask.Close()
+	if err := ask.Ask(ctx, request); err != nil {
+		return err
+	}
+	fmt.Printf("%s/%s#%d (%.8s): asked %s to check it before it merges, as %s\n", p.Owner, p.Repo, p.Number,
+		p.Commit, seat, request.ID)
+	return nil
+}
+
+// checkRequestFor is the ask for one pull request's head: the repository as the mesh clones it, the head,
+// and what is read beside it.
+func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, from inventory.Entry,
+	entries []inventory.Entry) (link.BuildRequest, error) {
+	shelf := map[string]catalogue.Manifest{}
+	for _, e := range entries {
+		shelf[e.Manifest.Module] = e.Manifest
+	}
+	world, err := theRestOfTheMesh(ctx, open.inventory, shelf, "")
+	if err != nil {
+		return link.BuildRequest{}, err
+	}
+	clone := func(s inventory.Source) (string, error) {
+		if s.Seat == "" {
+			return s.Repository, nil
+		}
+		return clonedFromSeat(world, s.Seat, s.Repository)
+	}
+	repository, err := clone(from.Source)
+	if err != nil {
+		return link.BuildRequest{}, err
+	}
+	current, err := open.inventory.CurrentBuilds(ctx)
+	if err != nil {
+		return link.BuildRequest{}, err
+	}
+	// Beside it, at what the mesh runs: each core repository by the module the mesh builds from it.
+	beside := map[string]link.CheckedOut{}
+	byModule := map[string]string{"mesh-controller": "mesh-controller", "mesh-host": "mesh-host",
+		"node-tools": "mesh-tools", "nats": "mesh-catalog"}
+	for _, e := range entries {
+		dir, core := byModule[e.Manifest.Module]
+		if !core || e.Provided || e.Source.Repository == "" {
+			continue
+		}
+		url, err := clone(e.Source)
+		if err != nil {
+			return link.BuildRequest{}, err
+		}
+		ref := current[e.Manifest.Module].Commit
+		if dir == "mesh-catalog" {
+			// The catalogue the mesh runs is in the snapshot, every manifest as it holds it; its checkout
+			// beside is what tests read its files from, so its main — what the next merge builds from.
+			ref = "main"
+		}
+		beside[dir] = link.CheckedOut{Repository: url, Ref: ref}
+		if dir == "mesh-controller" {
+			// And its main, for a judge the running controller predates (Phase 5 rolling out).
+			beside["mesh-controller-main"] = link.CheckedOut{Repository: url, Ref: "main"}
+			// And the lab, whose replays of what the mesh runs every check runs; on the same forge.
+			if e.Source.Seat != "" {
+				if lab, err := clone(inventory.Source{Seat: e.Source.Seat, Repository: siblingOf(e.Source.Repository,
+					"mesh-lab")}); err == nil {
+					beside["mesh-lab"] = link.CheckedOut{Repository: lab, Ref: "main"}
+				}
+			}
+		}
+	}
+	return link.BuildRequest{
+		ID:         link.NewBuildID(time.Now()),
+		Repository: repository,
+		Ref:        p.Commit,
+		Held:       heldBy(ctx),
+		Seats:      seatBases(ctx),
+		Source:     sourceOnSeat(from.Source),
+		Check: &link.CheckRequest{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Base: p.Base,
+			Paths: p.Paths, Beside: beside},
+	}, nil
+}
+
+// siblingOf is another repository of the same owner: novox/mesh-controller → novox/mesh-lab.
+func siblingOf(repository, name string) string {
+	if cut := strings.LastIndex(repository, "/"); cut >= 0 {
+		return repository[:cut+1] + name
+	}
+	return name
+}
+
+// sourceOnSeat is a source's seat form, nil for one on no seat.
+func sourceOnSeat(s inventory.Source) *link.SourceOnSeat {
+	if s.Seat == "" {
+		return nil
+	}
+	return &link.SourceOnSeat{Seat: s.Seat, Repository: s.Repository}
+}
+
+// checkEvents is where the serving controller says a check's verdict; nil in a command.
+var checkEvents link.Bus
+
+// maxCheckReport is how much of a check's report travels in its verdict: enough for the failures and
+// the machines, never a log.
+const maxCheckReport = 60 << 10
+
+// checked says a merge check's verdict as the controller's `checked`. Nothing is recorded or
+// registered: a check builds nothing (issue 240's rule for a dry run, kept for a check).
+func checked(ctx context.Context, result link.BuildResult) {
+	c := link.Checked{ID: result.ID, On: result.On, Commit: result.Ref}
+	if result.Checked != nil {
+		c.Owner, c.Repo, c.Number = result.Checked.Owner, result.Checked.Repo, result.Checked.Number
+	}
+	switch {
+	case result.Check != nil:
+		c.Verdict, c.Summary, c.Report = result.Check.Verdict, result.Check.Summary, result.Check.Report
+	case result.Failed != "":
+		// The check could not run: an error, never read as a pass.
+		c.Verdict, c.Summary = "error", "the check could not run: "+firstLine(result.Failed)
+	default:
+		c.Verdict, c.Summary = "error", "the build seat answered the check with no verdict"
+	}
+	if c.Verdict == "" {
+		c.Verdict = "error"
+	}
+	if len(c.Report) > maxCheckReport {
+		c.Report = "…" + c.Report[len(c.Report)-maxCheckReport:]
+	}
+	fmt.Printf("%s: %s/%s#%d at %.8s checked on %s: %s — %s\n", result.ID, c.Owner, c.Repo, c.Number, c.Commit,
+		orSomewhere(c.On), strings.ToUpper(c.Verdict), c.Summary)
+	if checkEvents == nil {
+		return
+	}
+	body, err := json.Marshal(c)
+	if err != nil {
+		return
+	}
+	stating, stop := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+	defer stop()
+	if err := checkEvents.PublishSeatEvent(stating, link.MeshControllerSeat, link.KeyChecked, body); err != nil {
+		fmt.Printf("%s: the verdict could not be said, so the pull request is not told it: %v\n", result.ID, err)
+	}
+}

cmd/mesh-controller/main.go

@@ -117,6 +117,9 @@ func run() error {
 	// The facts snapshot a merge check is fed (novox/hq to-be 45 §9).
 	case "facts":
 		return factsCommand(ctx, args[1:])
+	// The merge gate: every machine of the snapshot composed with a change (novox/hq to-be 45 §9).
+	case "merge-gate":
+		return mergeGateCommand(ctx, args[1:])
 	case "upgrade":
 		return upgradeCommand(ctx, args[1:])
 	// The bus as a planned step (novox/hq to-be 45 §8, ADR 0236).
@@ -335,6 +338,12 @@ func parseAround(set *flag.FlagSet, args []string) ([]string, error) {
 // registered, the same as the waiting command does. Said either way, so the daemon's log tells what
 // became of a build nobody was watching.
 func (b builds) Built(ctx context.Context, result link.BuildResult) error {
+	// **A merge check builds nothing** (novox/hq to-be 45 §9): its verdict is said, and nothing of it is
+	// recorded or registered.
+	if result.Check != nil || result.Checked != nil {
+		checked(ctx, result)
+		return nil
+	}
 	// **A dry run is looked at, never taken in** (novox/hq issue 240). On 2026-10-04 a dry run of an
 	// unmerged branch was heard here like any build, registered, and its definition reached a machine
 	// before anyone had reviewed it.

cmd/mesh-controller/merge_gate_test.go

@@ -0,0 +1,208 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	snapshot "github.com/novox/mesh-controller/internal/facts"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The merge gate (novox/hq to-be 45 §9): a change judged against every machine of the snapshot, by the
+// incidents it is written from. Each case raises a mesh, takes its snapshot, and judges a pull request's
+// tree against it in throwaway stores of its own.
+
+// catalogueMesh is two machines and a catalogue repository: a resolver and an object store on the
+// anchor, and on the laptop a network manager requiring the resolver, an album requiring the object
+// store, and a login manager. Every module is registered from novox/mesh-catalog, as the mesh's are.
+func catalogueMesh(t *testing.T) (snapshot.Facts, map[string]string) {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	manifests := map[string]string{
+		"objects": `{"module":"objects","version":"1",
+			"provides":[{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"}}],
+			"receives":{"s3-bucket":"/var/lib/mesh/objects/mesh.json"}}`,
+		"resolver": `{"module":"resolver","version":"1",
+			"provides":[{"name":"wildcard-resolution","scope":"mesh","identity":false}]}`,
+		"networkmanager": `{"module":"networkmanager","version":"1","requires":["wildcard-resolution"]}`,
+		"album":          `{"module":"album","version":"1","requires":["s3-bucket"]}`,
+		"lemurs": `{"module":"lemurs","version":"1","capabilities":["systemd"],
+			"resources":[{"id":"service","type":"service","unit":"lemurs.service","state":"running","boot":"enabled"}]}`,
+	}
+	for name, raw := range manifests {
+		m, err := catalogue.ParseManifest([]byte(raw))
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		if err := open.inventory.RegisterModule(ctx, m, inventory.Source{Repository: "novox/mesh-catalog",
+			Path: "modules/" + name, BuiltFrom: "c0ffee"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, a := range [][2]string{{"anchor", "objects"}, {"anchor", "resolver"}, {"laptop", "networkmanager"},
+		{"laptop", "album"}, {"laptop", "lemurs"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+	f, err := gatherFacts(ctx, open, "2.11.17")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return f, manifests
+}
+
+// aTree is a checkout of the catalogue repository holding these manifests.
+func aTree(t *testing.T, manifests map[string]string) string {
+	t.Helper()
+	dir := t.TempDir()
+	for name, raw := range manifests {
+		at := filepath.Join(dir, "modules", name)
+		if err := os.MkdirAll(at, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(at, "module.json"), []byte(raw), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return dir
+}
+
+func gateJudged(t *testing.T, f snapshot.Facts, tree string, changed ...string) mergeVerdict {
+	t.Helper()
+	admin := os.Getenv("MESH_TEST_POSTGRES")
+	in := mergeCheckInput{facts: f, admin: admin, changed: changed}
+	if tree != "" {
+		in.repository, in.tree = "novox/mesh-catalog", tree
+	}
+	v, err := judgeChange(t.Context(), in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return v
+}
+
+func withEdit(manifests map[string]string, name, raw string) map[string]string {
+	out := map[string]string{}
+	for k, v := range manifests {
+		out[k] = v
+	}
+	if raw == "" {
+		delete(out, name)
+	} else {
+		out[name] = raw
+	}
+	return out
+}
+
+// The mesh as it is passes: every machine composes in the gate's store as the controller composed it.
+func TestTheMeshAsItIsPassesTheGate(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	for _, m := range f.Machines {
+		if !m.Declaration.Composes {
+			t.Fatalf("the mesh itself does not compose: %+v", m.Declaration)
+		}
+	}
+	v := gateJudged(t, f, aTree(t, manifests))
+	if v.Verdict != "pass" {
+		t.Fatalf("an unchanged catalogue does not pass:\n%s", v.Report())
+	}
+	for _, m := range v.Machines {
+		if !m.Base.Composes || !m.Change.Composes {
+			t.Errorf("%s does not compose in the gate's store as it does on the mesh: %+v / %+v", m.Described, m.Base, m.Change)
+		}
+	}
+}
+
+// **Issue 263**: a change makes the network manager require the object store's provision; on a machine
+// whose name is six characters its identity is 26 against a bound of 20. Refused in the pull request,
+// naming the module, and not on the anchor after it merged.
+func TestIssue263AnIdentityARealMachineNameOverflowsFailsThePullRequest(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	tree := aTree(t, withEdit(manifests, "networkmanager",
+		`{"module":"networkmanager","version":"1","requires":["wildcard-resolution","s3-bucket"]}`))
+	v := gateJudged(t, f, tree)
+	if v.Verdict != "fail" {
+		t.Fatalf("the overflow passed the gate:\n%s", v.Report())
+	}
+	report := v.Report()
+	if !strings.Contains(report, "networkmanager") || !strings.Contains(report, "s3-bucket") {
+		t.Errorf("the refusal does not name the module and the provision:\n%s", report)
+	}
+}
+
+// **Issue 236**: a login manager's service that omits its state passed the catalogue check and was
+// refused whole by the node-engine on the first machine. A change to a module a machine runs, and a
+// module nobody runs yet, are both refused before merge, naming the machine and the module.
+func TestIssue236AManifestTheNodeEngineRefusesFailsThePullRequest(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	broken := `{"module":"lemurs","version":"1","capabilities":["systemd"],
+		"resources":[{"id":"service","type":"service","unit":"lemurs.service","boot":"enabled"}]}`
+	v := gateJudged(t, f, aTree(t, withEdit(manifests, "lemurs", broken)))
+	if v.Verdict != "fail" || !strings.Contains(v.Report(), "lemurs") {
+		t.Fatalf("a service the node-engine refuses passed the gate:\n%s", v.Report())
+	}
+	laptop := snapshot.Pseudonym("machine", "laptop")
+	if !strings.Contains(v.Report(), laptop) {
+		t.Errorf("the refusal does not name the machine it would be refused on:\n%s", v.Report())
+	}
+
+	// And as a new module, which no machine runs: tried on one that could.
+	newcomer := strings.ReplaceAll(broken, `"lemurs"`, `"greeter"`)
+	newcomer = strings.ReplaceAll(newcomer, "lemurs.service", "greeter.service")
+	v = gateJudged(t, f, aTree(t, withEdit(manifests, "greeter", newcomer)))
+	if v.Verdict != "fail" || !strings.Contains(v.Report(), "greeter, assigned to") {
+		t.Fatalf("a new module the node-engine would refuse passed the gate:\n%s", v.Report())
+	}
+}
+
+// **Version skew**: a manifest the controller judging it cannot read — the one the mesh runs, for a
+// catalogue change — fails here, not at registration after the merge.
+func TestAManifestTheRunningControllerCannotReadFailsThePullRequest(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	v := gateJudged(t, f, aTree(t, withEdit(manifests, "album",
+		`{"module":"album","version":"1","requires":["s3-bucket"],"a-field-of-a-newer-controller":true}`)))
+	if v.Verdict != "fail" || !strings.Contains(v.Report(), "refuses it") {
+		t.Fatalf("a manifest this controller cannot read passed:\n%s", v.Report())
+	}
+}
+
+// A module a machine runs, removed from its source, fails until it is unassigned (ADR 0236).
+func TestAModuleAMachineRunsRemovedFromItsSourceFails(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	v := gateJudged(t, f, aTree(t, withEdit(manifests, "album", "")))
+	if v.Verdict != "fail" || !strings.Contains(v.Report(), "album is removed") {
+		t.Fatalf("removing a module a machine runs passed:\n%s", v.Report())
+	}
+}
+
+// **Issue 278**: a file of a module nobody holds read as shared code, and the merge rebuilt the
+// catalogue. The gate says how wide a merge's rebuild is, and warns when shared code makes it wide.
+func TestIssue278AWideRebuildIsSaidBeforeTheMerge(t *testing.T) {
+	f, manifests := catalogueMesh(t)
+	was := wideRebuild
+	wideRebuild = 2
+	t.Cleanup(func() { wideRebuild = was })
+	v := gateJudged(t, f, aTree(t, manifests), "modules/showcase/index.ts")
+	if v.Width == nil || len(v.Width.Modules) < 5 || len(v.Width.Shared) != 1 {
+		t.Fatalf("the width reads %+v", v.Width)
+	}
+	if v.Verdict != "warning" || !strings.Contains(v.Report(), "shared") {
+		t.Fatalf("a rebuild of everything for one shared file is not said:\n%s", v.Report())
+	}
+	// The same file, with the reference module's definition in the tree: its directory is a module, held
+	// or not, and the file is its business alone (the fix of 278, read from the tree as the announcer does).
+	withShowcase := withEdit(manifests, "showcase", `{"module":"showcase","version":"1"}`)
+	v = gateJudged(t, f, aTree(t, withShowcase), "modules/showcase/index.ts")
+	if v.Width == nil || len(v.Width.Modules) != 0 || len(v.Width.Shared) != 0 {
+		t.Fatalf("a file of a module nobody holds still reads as shared: %+v", v.Width)
+	}
+	v = gateJudged(t, f, aTree(t, manifests), "modules/album/module.json")
+	if v.Width == nil || strings.Join(v.Width.Modules, ",") != "album" || v.Verdict != "pass" {
+		t.Fatalf("a change to one module's directory reads %+v, %s", v.Width, v.Verdict)
+	}
+}

cmd/mesh-controller/push.go

@@ -210,6 +210,12 @@ func serve(ctx context.Context) (err error) {
 	handActConn = bus.Conn
 	// And says when it replaced a value given by hand (novox/hq ADR 0228).
 	givenEvents = bus
+	// And a pull request's merge check, asked when the forge announces its head and said when judged
+	// (novox/hq to-be 45 §9).
+	checkEvents = bus
+	if err := server.Checks(following{open}); err != nil {
+		return err
+	}
 	// Composed now and kept current, before the verb that answers from it is served.
 	go statusFrom.keep(ctx)
 	// The facts snapshot a merge check is fed (novox/hq to-be 45 §9): kept current while this