Judge every manifest against the list of predefined keys of its tree, and carry the list from a build

Mesh and node config may hold values only for keys on a fixed, reviewed list (hq ADR 0348 clause 7, design 57 package K2, issue 661). A build reads predefined.json at the root of the repository at the commit it builds and carries it with the commit's generation; module check and the merge gate read it from the tree. (Part 1 of 2: the changes to existing files.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/builder/builder.go

@@ -108,6 +108,17 @@ type Result struct {
 	// recipe and the package it compiles; for any other, nothing is said and the whole of what the build
 	// sees stays its source, as before.
 	Sources []BuildSource
+
+	// Predefined is the list of predefined keys at the root of the repository at the commit built (novox/hq ADR
+	// 0348 §7), which the manifest was judged against; nil for a repository that holds none.
+	Predefined *Predefined
+}
+
+// Predefined is the list of predefined keys a build read: its text, canonical (catalogue.PredefinedList), and
+// the generation of the commit built — how many commits it stands on, which orders two builds of one trunk.
+type Predefined struct {
+	Keys       []byte
+	Generation int
 }
 
 // BuildSource is the build source a build read in one repository (novox/hq ADR 0267).
@@ -261,11 +272,28 @@ func build(ctx context.Context, run Runner, publish Publisher,
 			"%s has no %s at %s, so there is nothing saying what it is: %w",
 			repository, ManifestName, describe(path), err)
 	}
-	manifest, err := catalogue.ParseManifest(raw)
+	// **The list of predefined keys at the commit built** (novox/hq ADR 0348 §7): predefined.json at the
+	// repository's root, read strictly; a list that is wrong fails the build, and the manifest is judged against
+	// the list of its own tree, never against one the mesh published from another commit.
+	predefined, err := catalogue.ReadPredefined(tree)
+	if err != nil {
+		say("predefined", "INVALID: %v", err)
+		return Result{}, err
+	}
+	manifest, err := catalogue.ParseManifestWith(raw, predefined)
 	if err != nil {
 		say("manifest", "INVALID: %v", err)
 		return Result{}, err
 	}
+	var listed *Predefined
+	if predefined != nil {
+		text, err := predefined.Canonical()
+		if err != nil {
+			return Result{}, err
+		}
+		listed = &Predefined{Keys: text, Generation: generationOf(ctx, run, tree, commit)}
+		say("predefined", "%d key(s) at %s, generation %d", len(predefined), short(commit), listed.Generation)
+	}
 	// What is judged only where a definition is written (novox/hq ADR 0326 §3, issue 574): a build is
 	// where a changed definition is first read, so it is refused here before anything is made of it.
 	// Judged with each template's text in its file, as written in the tree (novox/hq ADR 0349 §2): a template the
@@ -291,6 +319,11 @@ func build(ctx context.Context, run Runner, publish Publisher,
 	if src.tree, err = gitTree(ctx, run, tree, path); err != nil {
 		src.notPinned("its tree could not be named: " + err.Error())
 	}
+	// A module falling back to a predefined key was judged against the list, so a change to the list is a change
+	// to it: the planner rebuilds it, and its build publishes the list (ADR 0348 §7).
+	if predefined != nil && manifest.NamesPredefined() {
+		src.rootHas(catalogue.PredefinedFile)
+	}
 
 	// A build-time credential, written into the build context as .npmrc, but ONLY for a module that
 	// asks for it: a `package` artifact (which publishes), or an image whose Dockerfile COPYs .npmrc.
@@ -451,7 +484,23 @@ func build(ctx context.Context, run Runner, publish Publisher,
 	return Result{Manifest: resolved, Commit: commit, Built: built,
 		Against: against(within, manifest, stoodOn), Read: readBy(manifest), Source: fingerprint,
 		Trunk: trunk, OnTrunk: onTrunk, Branches: branches, Sources: sources,
-		ReuseKey: key.Key, ReuseParts: key.Parts, NoKey: key.Why, Reused: reused, Why: builtWhy}, nil
+		ReuseKey: key.Key, ReuseParts: key.Parts, NoKey: key.Why, Reused: reused, Why: builtWhy,
+		Predefined: listed}, nil
+}
+
+// generationOf is how many commits the commit built stands on, itself included: of two commits on one trunk the
+// later has more, so the controller keeps the list of the newer one whatever order it hears them in (ADR 0348
+// §7). 0 when git could not say.
+func generationOf(ctx context.Context, run Runner, tree, commit string) int {
+	out, err := run(ctx, tree, "git", "rev-list", "--count", commit)
+	if err != nil {
+		return 0
+	}
+	n, err := strconv.Atoi(strings.TrimSpace(out))
+	if err != nil || n < 0 {
+		return 0
+	}
+	return n
 }
 
 // takeACheckBuild is the walk's look for a check build of its key (novox/hq ADR 0350 §2, §3): the key taken by

internal/builder/builder_test.go

@@ -83,6 +83,8 @@ func (r *recorded) run(_ context.Context, dir, name string, args ...string) (str
 		return r.tree + "\n", nil
 	case name == "git" && len(args) > 0 && args[0] == "rev-parse":
 		return "c0ffeec0ffeec0ffeec0ffeec0ffeec0ffeec0ff\n", nil
+	case name == "git" && len(args) > 1 && args[0] == "rev-list" && args[1] == "--count":
+		return "42\n", nil
 	}
 	return "", nil
 }

internal/builder/source.go

@@ -58,6 +58,9 @@ type sourceInputs struct {
 	// whole when an artifact's is not known (novox/hq ADR 0267).
 	own      map[string]bool
 	ownIsAll bool
+	// root is the module's build source in its own repository outside its directory, relative to the
+	// repository's root: the list of predefined keys a manifest naming one was judged against (ADR 0348 §7).
+	root map[string]bool
 	// read is, per context (repository and ref), the build source read there; nil for one read whole.
 	read   map[string]map[string]bool
 	readAs map[string]catalogue.ArtifactContext
@@ -86,6 +89,9 @@ func (s *sourceInputs) copy() *sourceInputs {
 	for k, v := range s.own {
 		c.own[k] = v
 	}
+	for k, v := range s.root {
+		c.root[k] = v
+	}
 	for k, v := range s.read {
 		if v == nil {
 			c.read[k] = nil
@@ -112,7 +118,7 @@ func (s *sourceInputs) contextOffHead() {
 
 func newSourceInputs(module string) *sourceInputs {
 	return &sourceInputs{module: module, contexts: map[string]string{}, toolchains: map[string]string{},
-		own: map[string]bool{}, read: map[string]map[string]bool{}, readAs: map[string]catalogue.ArtifactContext{},
+		own: map[string]bool{}, root: map[string]bool{}, read: map[string]map[string]bool{}, readAs: map[string]catalogue.ArtifactContext{},
 		contextsAtHead: true}
 }
 
@@ -126,6 +132,16 @@ func (s *sourceInputs) ownHas(entries ...string) {
 	}
 }
 
+// rootHas adds entries, relative to the repository's root, to the module's build source in its own repository.
+func (s *sourceInputs) rootHas(entries ...string) {
+	if s == nil {
+		return
+	}
+	for _, e := range entries {
+		s.root[e] = true
+	}
+}
+
 // ownWhole says an artifact's build source in the module's own repository is not known: the module's
 // whole directory is its source, as it was before.
 func (s *sourceInputs) ownWhole() {
@@ -178,6 +194,9 @@ func (s *sourceInputs) buildSources() []BuildSource {
 		for e := range s.own {
 			own = append(own, withPrefix(s.prefix, e))
 		}
+		for e := range s.root {
+			own = append(own, e)
+		}
 		sort.Strings(own)
 		out = append(out, BuildSource{Paths: compactSorted(own)})
 	}