mesh-delivery-contracts: the artifact reference forms move to the registry seats' client and the fingerprint key part to a new client of mesh-catalog; mesh-delivery-sdk serves Delivery modules only (ruling 3, ADR 0634 §1, §2; issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

contracts/go/clients/containerimageregistryclient/reference/reference.go

@@ -1,6 +1,6 @@
 // Package reference holds the form of an artifact's reference once a registry seat published it: `<seat>/<module>/<artifact>@<digest>`
-// (novox/hq ADR 0605 §9), and the older `artifact-store://<path>` form read beside it. It is the Delivery domain's rule over
-// the names of the two registry seats that front the artifact store; it names no seat itself (ADR 0634 §4, ADR 0635 §4): the
+// (novox/hq ADR 0605 §9), and the older `artifact-store://<path>` form read beside it. It is the rule the holders and callers of the two
+// registry seats that front the artifact store share (the seats' client, novox/hq ADR 0625 §4, ADR 0634 §2); it names no seat itself (ADR 0634 §4, ADR 0635 §4): the
 // caller gives the seats' names from their contracts (Seats), so a package here cannot drift from a contract.
 package reference
 

contracts/go/clients/meshcatalogclient/fingerprint.go

@@ -1,11 +1,14 @@
-// Package fingerprint holds the form of a module's source fingerprint, `src2:` and 64 lowercase hex digits (novox/hq ADR 0593
-// §2): the indexer computes it alone, in its own package; every part that keys a state by it reads this form. It is the
-// Delivery domain's rule, over the `fp2` field of mesh-catalog's `modules` value (ADR 0634 §1).
-package fingerprint
+// Package meshcatalogclient holds the logic the holders and callers of the seat mesh-catalog share over its contract (novox/hq
+// ADR 0625 §4, ADR 0634 §2): the form of a module's source fingerprint, `src2:` and 64 lowercase hex digits (ADR 0593 §2),
+// over the `fp2` field of the seat's `modules` value. The indexer computes a fingerprint alone, in its own package; every part
+// that keys a state by it, the node-engine among them, reads this form here.
+package meshcatalogclient
 
 import (
 	"fmt"
 	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/keys"
 )
 
 // SourcePrefix2 opens every source fingerprint of the form.
@@ -23,7 +26,7 @@ type Toolchain2 struct {
 // refuses a value that is not `src2:` and 64 lowercase hex digits, a src1 fingerprint included, naming it.
 func KeyPart(fp string) (string, error) {
 	part, ok := strings.CutPrefix(fp, SourcePrefix2)
-	if !ok || !isHex64(part) {
+	if !ok || !keys.IsHex64(part) {
 		return "", fmt.Errorf("fingerprint: %q is not a fingerprint of the form, %s and 64 lowercase hex digits", fp, SourcePrefix2)
 	}
 	return part, nil
@@ -31,12 +34,8 @@ func KeyPart(fp string) (string, error) {
 
 // ParseKeyPart is the inverse of KeyPart. It refuses a part that is not 64 lowercase hex digits, naming it.
 func ParseKeyPart(part string) (string, error) {
-	if !isHex64(part) {
+	if !keys.IsHex64(part) {
 		return "", fmt.Errorf("fingerprint: %q is not the key part of a fingerprint, 64 lowercase hex digits", part)
 	}
 	return SourcePrefix2 + part, nil
 }
-
-func isHex64(s string) bool {
-	return len(s) == 64 && strings.Trim(s, "0123456789abcdef") == ""
-}

contracts/go/clients/meshcatalogclient/fingerprint_test.go

@@ -1,4 +1,4 @@
-package fingerprint
+package meshcatalogclient
 
 import (
 	"strings"

contracts/go/clients/meshcatalogclient/go.mod

@@ -0,0 +1,14 @@
+module git.novox.be/novox/mesh-delivery/contracts/go/clients/meshcatalogclient
+
+go 1.26.0
+
+require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261104174118-f94abb95aaef
+
+require (
+	github.com/klauspost/compress v1.20.1 // indirect
+	github.com/nats-io/nats.go v1.54.0 // indirect
+	github.com/nats-io/nkeys v0.4.16 // indirect
+	github.com/nats-io/nuid v1.0.1 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+)

contracts/go/clients/meshcatalogclient/go.sum

@@ -0,0 +1,18 @@
+git.novox.be/novox/mesh-contracts/go v0.0.0-20261104172218-347a3053580a h1:E9ERPqR4uZXypudHGxv2/wNIOYcder9torVqJwJq/DI=
+git.novox.be/novox/mesh-contracts/go v0.0.0-20261104172218-347a3053580a/go.mod h1:0dD1XEJBJ0G5UYDQxSZI84nuujb6m3tOpJl4C8rQVvg=
+git.novox.be/novox/mesh-delivery/contracts/go/seats/containerimageregistry v0.0.0-20261105000000-000000000000 h1:BTqpa7dCCTQH9m08Jle8KVFwyIHiHPSUbwWxuqSg2yA=
+git.novox.be/novox/mesh-delivery/contracts/go/seats/containerimageregistry v0.0.0-20261105000000-000000000000/go.mod h1:pPxwhTMb3hIk7UUrBicJnGQCqfTEoBGJvNFspEK2U18=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261104174118-f94abb95aaef h1:/Jic5ho0xz32Z9DH2NSUqVxCF1KyfIOWuRTrX1aLjus=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261104174118-f94abb95aaef/go.mod h1:2wHG7ntLCG8Tpm/SCfgp524a5emUJm1gAC4KrRYsU9s=
+github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
+github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/nats-io/nats.go v1.54.0 h1:vsXoOxjHp/GmPUN+EcI7uOf/uB+iAP+kEsAFNQN0yzA=
+github.com/nats-io/nats.go v1.54.0/go.mod h1:y+DZoD1oBOYfZTU681eTUiUjI0vbqYGixNVFHcjHJ0k=
+github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
+github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
+github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
+github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=

contracts/module.json

@@ -112,6 +112,15 @@
         ],
         "series": "0.1"
       },
+      {
+        "name": "go-meshcatalogclient",
+        "kind": "package",
+        "language": "go",
+        "paths": [
+          "go/clients/meshcatalogclient"
+        ],
+        "series": "0.1"
+      },
       {
         "name": "go-meshdeliverycheckerclient",
         "kind": "package",

modules/mesh-delivery-builder/builds/builds.go

@@ -11,12 +11,12 @@ import (
 	"slices"
 	"strings"
 
+	"git.novox.be/novox/mesh-delivery/contracts/go/clients/containerimageregistryclient/reference"
+	"git.novox.be/novox/mesh-delivery/contracts/go/clients/meshcatalogclient"
 	"git.novox.be/novox/mesh-delivery/contracts/go/seats/containerimageregistry"
 	"git.novox.be/novox/mesh-delivery/contracts/go/seats/ociartifactregistry"
 	"git.novox.be/novox/mesh-delivery/sdk/buildstep"
-	"git.novox.be/novox/mesh-delivery/sdk/fingerprint"
 	"git.novox.be/novox/mesh-delivery/sdk/kept"
-	"git.novox.be/novox/mesh-delivery/sdk/reference"
 	"git.novox.be/novox/mesh-delivery/sdk/trunk"
 	"git.novox.be/novox/mesh-sdk/go/keys"
 )
@@ -62,13 +62,13 @@ const (
 )
 
 // BuilderBuildKey is the key, in BuilderBuildsBucket, of a module's build at a fingerprint: `<module>.<hex>`, the hex
-// being the fingerprint's key part (fingerprint.KeyPart), since a bus key may not hold ':'. A module holding a dot or a
+// being the fingerprint's key part (meshcatalogclient.KeyPart), since a bus key may not hold ':'. A module holding a dot or a
 // character a key refuses, and a fingerprint not of the new form, are refused, naming them.
 func BuilderBuildKey(module, fp string) (string, error) {
 	if err := keys.CheckName("module", module); err != nil {
 		return "", err
 	}
-	part, err := fingerprint.KeyPart(fp)
+	part, err := meshcatalogclient.KeyPart(fp)
 	if err != nil {
 		return "", err
 	}
@@ -84,7 +84,7 @@ func ParseBuilderBuildKey(key string) (module, fp string, err error) {
 	if err := keys.CheckName("module", module); err != nil {
 		return "", "", fmt.Errorf("builds: %q is not a builder build key: %w", key, err)
 	}
-	if fp, err = fingerprint.ParseKeyPart(part); err != nil {
+	if fp, err = meshcatalogclient.ParseKeyPart(part); err != nil {
 		return "", "", fmt.Errorf("builds: %q is not a builder build key: %w", key, err)
 	}
 	return module, fp, nil

modules/mesh-delivery-builder/builds/go.mod

@@ -3,6 +3,8 @@ module git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/builds
 go 1.26.0
 
 require (
+	git.novox.be/novox/mesh-delivery/contracts/go/clients/containerimageregistryclient v0.0.0
+	git.novox.be/novox/mesh-delivery/contracts/go/clients/meshcatalogclient v0.0.0
 	git.novox.be/novox/mesh-delivery/contracts/go/seats/containerimageregistry v0.0.0
 	git.novox.be/novox/mesh-delivery/contracts/go/seats/ociartifactregistry v0.0.0
 	git.novox.be/novox/mesh-delivery/sdk v0.0.0