Say which validator judged a release-branch check, and prove clause 5

ADR 0358 version 4 asks the verdict to say whether mesh-host's release-branch
validator or the vendored one judged, and checks that a release branch's own
pull request into its trunk is judged as any trunk pull request (issue 704).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/builder/check.go

@@ -198,6 +198,10 @@ type CheckVerdict struct {
 	Release  string
 	JudgedBy string
 	BesideAt map[string]string
+	// Validator says which node-engine validator the judge of a release-branch check was built with (ADR 0358 §2):
+	// mesh-host's of the release branch with its commit, the one the release branch's controller vendors, the
+	// change's own, or the one the change's own controller vendors. Empty for a check of any other base.
+	Validator string
 }
 
 // Layer is one layer of a check, judged.
@@ -384,7 +388,7 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 	}
 	named := func(v CheckVerdict) CheckVerdict {
 		v.Head, v.Trunk, v.Merge, v.Beside, v.Members = judged.Head, judged.Trunk, judged.Merge, judged.Beside, judged.Members
-		v.Release, v.JudgedBy, v.BesideAt = spec.Release, judged.JudgedBy, judged.BesideAt
+		v.Release, v.JudgedBy, v.BesideAt, v.Validator = spec.Release, judged.JudgedBy, judged.BesideAt, judged.Validator
 		return v
 	}
 	// **What the merge would move is built from a checkout nothing of the check touches** (novox/hq issue 703): the
@@ -594,8 +598,10 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 			judgedBy = tree
 		}
 		judged.JudgedBy = headAt(ctx, run, judgedBy)
-		fmt.Fprintf(&out, "--- %s\n", releaseWords(spec.Release, judged.JudgedBy, judged.BesideAt, judged.Beside))
-		say("check", "%s", releaseWords(spec.Release, judged.JudgedBy, judged.BesideAt, judged.Beside))
+		judged.Validator = releaseValidator(spec, judged.BesideAt, judged.Beside)
+		said := releaseWords(spec.Release, judged.JudgedBy, judged.Validator, judged.BesideAt, judged.Beside)
+		fmt.Fprintf(&out, "--- %s\n", said)
+		say("check", "%s", said)
 	}
 	verdictFile := filepath.Join(root, "verdict.json")
 	env := []string{EnvFacts + "=" + factsFile, EnvGate + "=" + gate, EnvGateStore + "=" + storeURL,
@@ -1209,13 +1215,27 @@ func fullHeadAt(ctx context.Context, run Runner, tree string) string {
 	return strings.TrimSpace(out)
 }
 
+// releaseValidator says which node-engine validator a release-branch check's judge is built with (novox/hq ADR 0358
+// §2), by the rule judgeFor builds it by.
+func releaseValidator(spec CheckSpec, at, commits map[string]string) string {
+	switch {
+	case spec.Judge == "self":
+		return "the validator the change's own controller vendors"
+	case spec.Judge == "validator":
+		return "the change's own validator"
+	case at["mesh-host"] == spec.Release:
+		return fmt.Sprintf("mesh-host's validator of %s at %s", spec.Release, commits["mesh-host"])
+	}
+	return fmt.Sprintf("the validator %s's controller vendors (mesh-host has no branch %s)", spec.Release, spec.Release)
+}
+
 // releaseWords is how a release-branch check says what judged it and what it read (novox/hq ADR 0358 §4).
-func releaseWords(release, judgedBy string, at, commits map[string]string) string {
+func releaseWords(release, judgedBy, validator string, at, commits map[string]string) string {
 	var read []string
 	for _, dir := range sortedKeys(at) {
 		read = append(read, fmt.Sprintf("%s %s at %s", dir, refWords(at[dir]), commits[dir]))
 	}
-	said := fmt.Sprintf("judged for the release branch %s by its controller at %s", release, judgedBy)
+	said := fmt.Sprintf("judged for the release branch %s by its controller at %s, with %s", release, judgedBy, validator)
 	if len(read) > 0 {
 		said += "; read beside it: " + strings.Join(read, ", ")
 	}