Judge every manifest against the list of predefined keys of its tree, and carry the list from a build

Mesh and node config may hold values only for keys on a fixed, reviewed list (hq ADR 0348 clause 7, design 57 package K2, issue 661). A build reads predefined.json at the root of the repository at the commit it builds and carries it with the commit's generation; module check and the merge gate read it from the tree. (Part 1 of 2: the changes to existing files.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/mesh-builder/main.go

@@ -418,6 +418,11 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 			for _, s := range built.Sources {
 				result.Sources = append(result.Sources, link.BuildSource{Repository: s.Repository, Ref: s.Ref, Paths: s.Paths})
 			}
+			// The list of predefined keys the manifest was judged against, for the controller to publish
+			// (novox/hq ADR 0348 §7).
+			if p := built.Predefined; p != nil {
+				result.Predefined = &link.PredefinedList{Keys: p.Keys, Generation: p.Generation}
+			}
 			say("built", built.Manifest.Module+" from "+short(built.Commit))
 		}
 	}

cmd/mesh-controller/build.go

@@ -183,8 +183,10 @@ func buildFrom(result link.BuildResult) inventory.Build {
 	kept.Manifest = recordedManifest(result.Manifest, announced)
 	// The module name comes from the manifest, which only exists when the build got that far.
 	if len(kept.Manifest) > 0 {
-		if m, err := catalogue.ParseManifest(kept.Manifest); err == nil {
-			kept.Module = m.Module
+		if list, err := judgedWith(result); err == nil {
+			if m, err := catalogue.ParseManifestWith(kept.Manifest, list); err == nil {
+				kept.Module = m.Module
+			}
 		}
 	}
 	return kept
@@ -603,6 +605,11 @@ func saysWhenThePolicyActs(ctx context.Context, inv *inventory.Inventory, module
 // written with the same values.
 func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResult) (
 	catalogue.Manifest, inventory.Build, error) {
+	// The list of predefined keys as the store keeps it now: another controller process may have kept a newer one.
+	if err := loadPredefined(ctx, inv); err != nil {
+		return catalogue.Manifest{}, inventory.Build{}, fmt.Errorf("the list of predefined keys kept cannot be "+
+			"read: %w", err)
+	}
 	kept := buildFrom(result)
 	if err := inv.RecordBuild(ctx, kept); err != nil {
 		return catalogue.Manifest{}, kept, err
@@ -613,7 +620,15 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 		return catalogue.Manifest{}, kept, fmt.Errorf("%s could not build %s:\n%s",
 			result.On, result.Repository, result.Failed)
 	}
-	manifest, err := catalogue.ParseManifest(kept.Manifest)
+	// Judged first against the list the build was judged against: the catalogue's at the commit built (novox/hq
+	// ADR 0348 §7), so a module naming a key its own commit adds is read; and again below against the list the
+	// mesh publishes, before it is registered.
+	list, err := judgedWith(result)
+	if err != nil {
+		return catalogue.Manifest{}, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: %w", result.On,
+			result.Repository, short(result.Commit), err)
+	}
+	manifest, err := catalogue.ParseManifestWith(kept.Manifest, list)
 	if err != nil {
 		return catalogue.Manifest{}, kept, fmt.Errorf("%s built %s and what came back is not a manifest: %w",
 			result.On, result.Repository, err)
@@ -687,6 +702,23 @@ func takeIn(ctx context.Context, inv *inventory.Inventory, result link.BuildResu
 			"back: it is recorded and not registered again — a newer build is", result.On, manifest.Module,
 			short(result.Commit))
 	}
+	// **The newest trunk build's list of predefined keys is published** (novox/hq ADR 0348 §7): a build of the
+	// catalogue that may be registered keeps its list when its commit is newer than the one kept. Then the module
+	// is judged against the list the mesh publishes, as every manifest read again is: one naming a key that list
+	// does not hold, or of another type, is refused here and never enters the catalogue.
+	if carried, err := carriedList(result); err != nil {
+		return manifest, kept, err
+	} else if carried != nil {
+		if err := publishPredefined(ctx, inv, result, carried); err != nil {
+			fmt.Printf("%s: the list of predefined keys it carried is not published: %v\n", result.ID, err)
+		}
+	}
+	if manifest.NamesPredefined() {
+		if _, err := catalogue.ParseManifest(kept.Manifest); err != nil {
+			return manifest, kept, fmt.Errorf("%s built %s (%s), recorded and not registered: judged against the "+
+				"list of predefined keys the mesh publishes, %w", result.On, manifest.Module, short(result.Commit), err)
+		}
+	}
 	// **A build whose source is unchanged is never a move** (novox/hq issue 280): a rebuild made from
 	// what the build the mesh stands on was made from registers that build's artifacts at the new
 	// commit, so no machine is sent a new digest for a source nobody changed — an image is not

cmd/mesh-controller/check.go

@@ -47,6 +47,24 @@ func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 	shelf := catalogue.Shelf{}
 	faulted := map[string]bool{}
 	failed := 0
+	// The list of predefined keys at the root of the repository above each manifest (novox/hq ADR 0348 §7), read
+	// once per repository: a manifest naming a key is judged against the list its own tree holds.
+	lists := map[string]catalogue.PredefinedList{}
+	listOf := func(path string) (catalogue.PredefinedList, error) {
+		root := catalogue.RepositoryRoot(filepath.Dir(path))
+		if root == "" {
+			return nil, nil
+		}
+		if list, read := lists[root]; read {
+			return list, nil
+		}
+		list, err := catalogue.ReadPredefined(root)
+		if err != nil {
+			return nil, err
+		}
+		lists[root] = list
+		return list, nil
+	}
 	for _, path := range paths {
 		raw, err := os.ReadFile(path)
 		if err != nil {
@@ -54,7 +72,13 @@ func moduleCheckFor(paths []string, longestMachine int, out io.Writer) error {
 			failed++
 			continue
 		}
-		m, err := catalogue.ParseManifest(raw)
+		list, err := listOf(path)
+		if err != nil {
+			fmt.Fprintf(out, "%s: %v\n", path, err)
+			failed++
+			continue
+		}
+		m, err := catalogue.ParseManifestWith(raw, list)
 		if err == nil {
 			// Each template's text read from the tree beside the manifest, and judged as inline content is
 			// (novox/hq ADR 0349 §2): a missing template is refused by name.

cmd/mesh-controller/merge_gate.go

@@ -550,8 +550,17 @@ func shelfWithChange(base map[string]catalogue.Manifest, sources map[string]inve
 		out[k] = m
 	}
 	var failures []string
+	// The list of predefined keys at the tree's root (novox/hq ADR 0348 §7): what the build of this tree judges each
+	// manifest against and registration publishes, so what the gate judges each against too. A list that is
+	// wrong is refused by name, and every manifest is then judged against none.
+	predefined, err := catalogue.ReadPredefined(tree)
+	if err != nil {
+		failures = append(failures, fmt.Sprintf("%s: the controller judging this (%s) refuses it — %s",
+			catalogue.PredefinedFile, version, oneLine(err.Error())))
+		predefined = nil
+	}
 	found := map[string]string{} // module → its directory in the tree
-	err := filepath.WalkDir(tree, func(path string, d fs.DirEntry, err error) error {
+	err = filepath.WalkDir(tree, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
@@ -575,7 +584,7 @@ func shelfWithChange(base map[string]catalogue.Manifest, sources map[string]inve
 		if err != nil {
 			return err
 		}
-		m, err := catalogue.ParseManifest(raw)
+		m, err := catalogue.ParseManifestWith(raw, predefined)
 		if err == nil {
 			// Each template's text from the tree beside the manifest, as the build reads it back from the archive it
 			// packs (novox/hq ADR 0349 §2): so a change to a template alone is a change to its module.
@@ -610,7 +619,7 @@ func shelfWithChange(base map[string]catalogue.Manifest, sources map[string]inve
 			// As registration reads a built manifest: strictly, again (takeIn).
 			var raw []byte
 			if raw, err = json.Marshal(resolved); err == nil {
-				resolved, err = catalogue.ParseManifest(raw)
+				resolved, err = catalogue.ParseManifestWith(raw, predefined)
 			}
 		}
 		if err == nil {

cmd/mesh-controller/stores.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"os"
 	"time"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -124,6 +125,11 @@ func openInventory(ctx context.Context) (*inventory.Inventory, error) {
 	if aliases, err := inv.Aliases(ctx); err == nil {
 		catalogue.UseAliases(aliases)
 	}
+	// And the list of predefined keys the mesh publishes (novox/hq ADR 0348 §7), which every manifest read again
+	// is judged against. A store a migration has not reached yet keeps none, and nothing names a key then.
+	if err := loadPredefined(ctx, inv); err != nil {
+		fmt.Fprintf(os.Stderr, "the list of predefined keys kept cannot be read: %v\n", err)
+	}
 	return inv, nil
 }