Merge branch 'b6/registry' into feat/registry-milestone

cmd/mesh-compose/main_test.go

@@ -3,6 +3,9 @@ package main
 import (
 	"bytes"
 	"encoding/json"
+	"git.novox.be/novox/mesh-delivery/contracts/go/clients/meshcatalogclient"
+	"git.novox.be/novox/mesh-delivery/contracts/go/seats/meshcatalog"
+	"github.com/novox/mesh-host/internal/buckets/bucketstest"
 	"go/build"
 	"os"
 	"os/exec"
@@ -14,7 +17,6 @@ import (
 	"testing"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/novox/mesh-host/internal/beside"
 	"github.com/novox/mesh-host/internal/compose"
 	"github.com/novox/mesh-host/internal/composer"
@@ -94,7 +96,7 @@ func TestTheCommandWritesOneVerdictPerManifestAndMachine(t *testing.T) {
 	r := request(t, composer.DepthResolve)
 	r.Cases[0].Manifests["later"] = composer.Manifest{Raw: json.RawMessage(`{"module":"later","version":"1","shares":["x"]}`)}
 	r.Cases[0].Manifests["refused"] = composer.Manifest{Raw: json.RawMessage(`{"module":"refused","version":"1"}`)}
-	r.Cases[0].Verdicts = map[string]delivery.ManifestVerdict{"refused": {State: delivery.VerdictRefused, Problems: []string{"it is wrong"}}}
+	r.Cases[0].Verdicts = bucketstest.Raw(map[string]meshcatalog.VerdictsByDigestValue{"refused": {V: 1, Module: "refused", Judge: "src2:j", State: meshcatalogclient.VerdictRefused, Problems: []string{"it is wrong"}}})
 	code, v, stderr := runJSON(t, nil, encode(t, r))
 	if code != 0 {
 		t.Fatalf("exit %d: %s", code, stderr)
@@ -280,7 +282,7 @@ func ownPackages(t *testing.T) map[string][]string {
 }
 
 // 1621/AC2 and AC4: the command imports, through every package of this repository it reaches, only the standard
-// library, mesh-sdk, the contracts modules' pure packages (seats' types, clients' codecs), the private network's overlay package (mesh-wireguard's own pure package: names, graph and
+// library, mesh-sdk, the contracts modules' pure packages (seats' types, clients' codecs), the delivery SDK's composer (the command's own request and verdict types), the builder's builds package (a build's value and its keys), the private network's overlay package (mesh-wireguard's own pure package: names, graph and
 // generator, no bus) and this repository's own packages, and none that reaches a bus, a store, a network service or
 // another process.
 func TestTheCommandImportsNoBusStoreNetworkOrProcess(t *testing.T) {
@@ -292,7 +294,7 @@ func TestTheCommandImportsNoBusStoreNetworkOrProcess(t *testing.T) {
 	for path, imports := range own {
 		for _, imp := range imports {
 			std := !strings.Contains(strings.SplitN(imp, "/", 2)[0], ".")
-			if !std && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-networking/modules/mesh-wireguard/go/overlay") && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-sdk/go") && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-contracts/") && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-delivery/contracts/") && !strings.HasPrefix(imp, "github.com/novox/mesh-host/") {
+			if !std && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-networking/modules/mesh-wireguard/go/overlay") && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-sdk/go") && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-contracts/") && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-delivery/contracts/") && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-delivery/sdk/composer") && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/builds") && !strings.HasPrefix(imp, "github.com/novox/mesh-host/") {
 				t.Errorf("%s imports %s, which is neither the standard library, mesh-sdk nor this repository", path, imp)
 			}
 			for _, f := range forbidden {

cmd/mesh-host/authority_test.go

@@ -7,6 +7,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"encoding/pem"
+	"git.novox.be/novox/mesh-contracts/identity-and-access/go/clients/meshvaultclient"
 	engcomp "github.com/novox/mesh-host/internal/compositions"
 	"os"
 	"path/filepath"
@@ -16,7 +17,6 @@ import (
 
 	"git.novox.be/novox/mesh-contracts/identity-and-access/go/seats/meshvault"
 	"git.novox.be/novox/mesh-networking/modules/mesh-wireguard/go/overlay"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"github.com/novox/mesh-host/internal/identity"
 )
@@ -52,38 +52,38 @@ func TestTheAppliedAuthorityIsKeptForTheRecord(t *testing.T) {
 	told := 0
 	trust.onChange(func() { told++ })
 	keys := recordKeys(state, trust.Trusts)
-	ctrlFP, vaultFP := delivery.SignerFingerprint(controllerPub), delivery.SignerFingerprint(vaultPub)
-	enrol, _ := delivery.SignContext(delivery.KindEnrolment)
+	ctrlFP, vaultFP := meshvaultclient.SignerFingerprint(controllerPub), meshvaultclient.SignerFingerprint(vaultPub)
+	enrol, _ := meshvaultclient.SignContext(meshvaultclient.KindEnrolment)
 	msg := []byte("a reply")
 	if got := keys().Trusts; len(got) != 0 {
 		t.Errorf("before the signers are read the record trusts %v", got)
 	}
-	if _, err := trust.Verify(delivery.KindEnrolment, msg, delivery.SignMessage(controller, enrol, msg)); err == nil {
+	if _, err := trust.Verify(meshvaultclient.KindEnrolment, msg, meshvaultclient.SignMessage(controller, enrol, msg)); err == nil {
 		t.Error("a controller-signed message is accepted")
 	}
-	if _, err := trust.Verify(delivery.KindEnrolment, msg, delivery.SignMessage(vault, enrol, msg)); err == nil {
+	if _, err := trust.Verify(meshvaultclient.KindEnrolment, msg, meshvaultclient.SignMessage(vault, enrol, msg)); err == nil {
 		t.Error("a vault-signed message is accepted before the vault's key is read")
 	}
 	vaultCA := testAuthority(t, vaultPub, vault)
-	keyValue, _ := json.Marshal(delivery.NewSignerKey(vaultPub, time.Now()))
-	fp, _ := delivery.AuthorityFingerprint(vaultCA)
-	authValue, _ := json.Marshal(delivery.SignerAuthority{Certificate: vaultCA, Fingerprint: fp, Made: time.Now()})
-	trust.heardSigner(delivery.SignersKeyKey, keyValue, false, func(string) {})
-	trust.heardSigner(delivery.SignersAuthorityKey, authValue, false, func(string) {})
-	if s, err := trust.Verify(delivery.KindEnrolment, msg, delivery.SignMessage(vault, enrol, msg)); err != nil || s.Name != delivery.SignerVault {
+	keyValue, _ := json.Marshal(meshvaultclient.NewSignerKey(vaultPub, time.Now()))
+	fp, _ := meshvaultclient.AuthorityFingerprint(vaultCA)
+	authValue, _ := json.Marshal(meshvault.SignersByAuthorityValue{Certificate: vaultCA, Fingerprint: fp, Made: time.Now()})
+	trust.heardSigner(meshvault.SignersByKeyKey(), keyValue, false, func(string) {})
+	trust.heardSigner(meshvault.SignersByAuthorityKey(), authValue, false, func(string) {})
+	if s, err := trust.Verify(meshvaultclient.KindEnrolment, msg, meshvaultclient.SignMessage(vault, enrol, msg)); err != nil || s.Name != meshvaultclient.SignerVault {
 		t.Errorf("a vault-signed message on a node that read signers: %+v, %v", s, err)
 	}
-	if _, err := trust.Verify(delivery.KindEnrolment, msg, delivery.SignMessage(controller, enrol, msg)); err == nil {
+	if _, err := trust.Verify(meshvaultclient.KindEnrolment, msg, meshvaultclient.SignMessage(controller, enrol, msg)); err == nil {
 		t.Error("a controller-signed message is accepted once the vault's key is read")
 	}
-	if got := keys().Trusts; strings.Contains(strings.Join(got, " "), ctrlFP) || !delivery.TrustsKey(got, delivery.SignerVault, vaultFP) ||
+	if got := keys().Trusts; strings.Contains(strings.Join(got, " "), ctrlFP) || !meshvaultclient.TrustsKey(got, meshvaultclient.SignerVault, vaultFP) ||
 		trust.VaultAuthority() != vaultCA || told != 2 {
 		t.Errorf("after the signers are read the record trusts %v (told %d)", got, told)
 	}
 	// A signers' key naming another fingerprint is not trusted.
-	bad, _ := json.Marshal(delivery.SignerKey{Key: base64.StdEncoding.EncodeToString(controllerPub), Fingerprint: vaultFP})
-	trust.heardSigner(delivery.SignersKeyKey, bad, false, func(string) {})
-	if !delivery.TrustsKey(keys().Trusts, delivery.SignerVault, vaultFP) {
+	bad, _ := json.Marshal(meshvault.SignersByKeyValue{Key: base64.StdEncoding.EncodeToString(controllerPub), Fingerprint: vaultFP})
+	trust.heardSigner(meshvault.SignersByKeyKey(), bad, false, func(string) {})
+	if !meshvaultclient.TrustsKey(keys().Trusts, meshvaultclient.SignerVault, vaultFP) {
 		t.Error("a signers' key that does not check replaced the vault's")
 	}
 
@@ -98,8 +98,8 @@ func TestTheAppliedAuthorityIsKeptForTheRecord(t *testing.T) {
 	}
 	servingPub, _ := base64.StdEncoding.DecodeString(serving.Public)
 	signedBy := func(ca string, key ed25519.PrivateKey) string {
-		parent, _ := delivery.ParseCertificate(ca)
-		der, err := x509.CreateCertificate(nil, delivery.NodeCertificateTemplate(overlay.InternalName("n1"), servingPub, time.Now().Add(-time.Hour)),
+		parent, _ := meshvaultclient.ParseCertificate(ca)
+		der, err := x509.CreateCertificate(nil, meshvaultclient.NodeCertificateTemplate(overlay.InternalName("n1"), servingPub, time.Now().Add(-time.Hour)),
 			parent, ed25519.PublicKey(servingPub), key)
 		if err != nil {
 			t.Fatal(err)
@@ -110,7 +110,7 @@ func TestTheAppliedAuthorityIsKeptForTheRecord(t *testing.T) {
 	answer := signedBy(vaultCA, vault)
 	ask := func(_ context.Context, verb string, args any) (json.RawMessage, error) {
 		asked = append(asked, verb, args)
-		return json.Marshal(meshvault.SignAnswer{Kind: delivery.KindNodeCertificate, Node: "n1", Certificate: answer})
+		return json.Marshal(meshvault.SignAnswer{Kind: meshvaultclient.KindNodeCertificate, Node: "n1", Certificate: answer})
 	}
 	written := 0
 	if err := certifyThisNode(context.Background(), state, "n1", trust, ask, func() { written++ }); err != nil {
@@ -160,7 +160,7 @@ func TestTheAppliedAuthorityIsKeptForTheRecord(t *testing.T) {
 // testAuthority is a self-signed authority certificate for key, as the vault makes its own.
 func testAuthority(t *testing.T, pub ed25519.PublicKey, key ed25519.PrivateKey) string {
 	t.Helper()
-	tpl := delivery.AuthorityTemplate(pub, time.Now().Add(-time.Hour))
+	tpl := meshvaultclient.AuthorityTemplate(pub, time.Now().Add(-time.Hour))
 	der, err := x509.CreateCertificate(nil, tpl, tpl, pub, key)
 	if err != nil {
 		t.Fatal(err)

cmd/mesh-host/enrol_seat.go

@@ -6,10 +6,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"git.novox.be/novox/mesh-contracts/identity-and-access/go/clients/meshnodeenrollerclient"
 	"os"
 
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-
 	"github.com/novox/mesh-host/internal/identity"
 	"github.com/novox/mesh-host/internal/link"
 )
@@ -21,7 +20,7 @@ import (
 func enrolThroughSeat(ctx context.Context, opts options, token identity.Token, node string, mine identity.Identity,
 	sealing identity.SealingKey, serving identity.ServingKey, reported map[string]any, found *link.Tunnel, identityPath string) error {
 
-	req := delivery.Redeem{Node: node, PublicKey: base64.StdEncoding.EncodeToString(mine.Public), OverlayKey: mine.Overlay.Public,
+	req := meshnodeenrollerclient.Redeem{Node: node, PublicKey: base64.StdEncoding.EncodeToString(mine.Public), OverlayKey: mine.Overlay.Public,
 		SealingKey: sealing.Public, ServingKey: serving.Public, Profile: reported}
 	if found != nil {
 		var err error
@@ -29,18 +28,18 @@ func enrolThroughSeat(ctx context.Context, opts options, token identity.Token, n
 			return err
 		}
 	}
-	req.Proof = base64.StdEncoding.EncodeToString(mine.Sign(delivery.RedeemProof(node, req.PublicKey, req.OverlayKey, req.SealingKey, req.ServingKey)))
+	req.Proof = base64.StdEncoding.EncodeToString(mine.Sign(meshnodeenrollerclient.RedeemProof(node, req.PublicKey, req.OverlayKey, req.SealingKey, req.ServingKey)))
 	to := link.Approach{Address: token.Broker, Fingerprint: token.Fingerprint, Transport: link.OnNATS}
 	membership := link.Membership{Node: node, Broker: token.Broker, Fingerprint: token.Fingerprint, Transport: link.OnNATS}
 	j := link.Joining{Node: node, Signer: token.SignerKey(),
-		Redeem: func(ctx context.Context) (delivery.RedeemAnswer, error) {
+		Redeem: func(ctx context.Context) (meshnodeenrollerclient.RedeemAnswer, error) {
 			return link.Redeem(ctx, to, node, token.Secret, req, opts.timeout)
 		},
-		Open: func(a delivery.RedeemAnswer) (string, error) {
+		Open: func(a meshnodeenrollerclient.RedeemAnswer) (string, error) {
 			value, err := sealing.Open(a.Account)
 			return string(value), err
 		},
-		Keep: func(a delivery.RedeemAnswer, password string) error {
+		Keep: func(a meshnodeenrollerclient.RedeemAnswer, password string) error {
 			// The mesh's name for this node wins over what the machine called itself, as on the controller's path.
 			mine.Node = a.Node
 			mine.Membership = identity.Membership{Broker: token.Broker, Fingerprint: token.Fingerprint, Signer: token.Signer,

cmd/mesh-host/logins.go

@@ -4,12 +4,13 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"git.novox.be/novox/mesh-contracts/identity-and-access/go/clients/meshvaultclient"
+	"git.novox.be/novox/mesh-contracts/identity-and-access/go/seats/meshvault"
+	"github.com/novox/mesh-host/internal/buckets"
 	"os"
 	"path/filepath"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-
 	"github.com/novox/mesh-host/internal/identity"
 	"github.com/novox/mesh-host/internal/link"
 )
@@ -48,7 +49,7 @@ var loginsFollowAgain = 2 * time.Minute
 
 // followLogins follows this node's key of the vault's node-logins on every link, as a watch (never a poll), for as long as ctx
 // lasts, and hands each value to hear. A watch that cannot be made is said once and tried again.
-func followLogins(ctx context.Context, session *link.Session, node string, hear func(delivery.NodeLogin), say link.Announce) {
+func followLogins(ctx context.Context, session *link.Session, node string, hear func(meshvault.NodeLoginsByNodeValue), say link.Announce) {
 	said := ""
 	for ctx.Err() == nil {
 		linked, cancel, err := session.WhenLinked(ctx)
@@ -56,7 +57,7 @@ func followLogins(ctx context.Context, session *link.Session, node string, hear
 			return
 		}
 		watching, stop := context.WithCancel(linked)
-		updates, werr := session.KVWatch(watching, delivery.NodeLoginsBucket, node)
+		updates, werr := session.KVWatch(watching, buckets.NodeLogins, node)
 		if werr != nil {
 			stop()
 			if line := "this node's login is not followed yet (" + werr.Error() + "): it dials as it last did, and looks again in " + loginsFollowAgain.String(); line != said {
@@ -69,9 +70,9 @@ func followLogins(ctx context.Context, session *link.Session, node string, hear
 				if u.Caught || u.Deleted || len(u.Value) == 0 {
 					continue
 				}
-				nl, err := delivery.DecodeNodeLogin(u.Value)
+				nl, err := meshvaultclient.DecodeNodeLogin(u.Value)
 				if err != nil {
-					say("the key " + node + " of " + delivery.NodeLoginsRead + " is not read: " + err.Error())
+					say("the key " + node + " of " + buckets.NodeLoginsRead + " is not read: " + err.Error())
 					continue
 				}
 				hear(nl)

cmd/mesh-host/main.go

@@ -16,6 +16,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
+	"git.novox.be/novox/mesh-contracts/identity-and-access/go/seats/meshvault"
 	"io"
 	"net"
 	"os"
@@ -30,7 +31,6 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/declaration"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/novox/mesh-host/internal/accounts"
 	"github.com/novox/mesh-host/internal/agent"
 	"github.com/novox/mesh-host/internal/apply"
@@ -1075,7 +1075,7 @@ func runLink(ctx context.Context, opts options) error {
 	}, say)
 	// And the login it dials as, which the vault's node-logins names for this node (novox/hq ADR 0583 §1).
 	rotator := newRotator(queue, opts.state, opts.timeout, say)
-	go followLogins(aside, queue, mine.Node, func(nl delivery.NodeLogin) {
+	go followLogins(aside, queue, mine.Node, func(nl meshvault.NodeLoginsByNodeValue) {
 		if line := membership.Logins.Heard(nl); line != "" {
 			say(line)
 		}

cmd/mesh-host/nodeagent.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"git.novox.be/novox/mesh-contracts/go/clients/nodeengineclient"
 	nodeengine "git.novox.be/novox/mesh-contracts/go/seats/nodeengine"
+	"github.com/novox/mesh-host/internal/buckets"
 	"github.com/novox/mesh-host/internal/compositions"
 	"os"
 	"path/filepath"
@@ -19,7 +20,6 @@ import (
 
 	"git.novox.be/novox/mesh-networking/modules/mesh-wireguard/go/overlay"
 	"git.novox.be/novox/mesh-sdk/go/declaration"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/novox/mesh-host/internal/agent"
 	"github.com/novox/mesh-host/internal/apply"
 	"github.com/novox/mesh-host/internal/compose/frombus"
@@ -501,7 +501,7 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, trus
 		}()
 		env := agent.Env{
 			Node:     node,
-			Wants:    bucketWatch{session, delivery.AssignerWantsBucket},
+			Wants:    bucketWatch{session, buckets.Wants},
 			Composed: bucketWatch{session, composedBucket},
 			Haves:    sessionHaves{session},
 			Kept:     func() map[string][]json.RawMessage { by, _ := kept(); return by },
@@ -1017,7 +1017,7 @@ func selfComposer(session *link.Session, node string, hooks composerHooks, say f
 func composerEnv(session *link.Session, node string, say func(string), hooks composerHooks) selfcompose.Env {
 	env := selfcompose.Env{Node: node,
 		Watch: func(ctx context.Context, bucket, pattern string) (<-chan agent.Update, error) {
-			if bucket == delivery.PlacementBucket || bucket == delivery.PlacementCandidatesBucket {
+			if bucket == buckets.Placement || bucket == buckets.PlacementCandidates {
 				// The seat's states are made when their holder starts: a node-engine that starts first waits for the
 				// bus's word that the bucket was created, and the shadow and the composer say they wait.
 				return bucketWatch{session, bucket}.WatchAwait(ctx, pattern, func(err error) {

cmd/mesh-host/nodeagent_integration_test.go

@@ -8,7 +8,15 @@ import (
 	"encoding/json"
 	"errors"
 	nodeengine "git.novox.be/novox/mesh-contracts/go/seats/nodeengine"
+	"git.novox.be/novox/mesh-contracts/placement/go/clients/meshmoduleassignerclient"
+	"git.novox.be/novox/mesh-contracts/placement/go/seats/meshmoduleassigner"
+	"git.novox.be/novox/mesh-contracts/placement/go/seats/meshwants"
+	"git.novox.be/novox/mesh-delivery/contracts/go/clients/meshcatalogclient"
+	"git.novox.be/novox/mesh-delivery/contracts/go/clients/meshdeliveryclient"
+	"git.novox.be/novox/mesh-delivery/contracts/go/seats/meshcatalog"
+	builderbuilds "git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/builds"
 	"github.com/novox/mesh-host/internal/buckets"
+	"github.com/novox/mesh-host/internal/buckets/bucketstest"
 	engcomp "github.com/novox/mesh-host/internal/compositions"
 	"os"
 	"path/filepath"
@@ -21,7 +29,6 @@ import (
 	nec "git.novox.be/novox/mesh-contracts/go/clients/nodeengineclient"
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/declaration"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/seatlist"
 	"github.com/nats-io/nats-server/v2/server"
 	"github.com/nats-io/nats.go"
@@ -136,7 +143,7 @@ func newItBedAs(t *testing.T, perms nodegrant.Permissions) *itBed {
 		name    string
 		into    *nats.KeyValue
 		history uint8
-	}{{delivery.AssignerWantsBucket, &b.wants, 8}, {composedBucket, &b.composed, engcomp.History},
+	}{{buckets.Wants, &b.wants, 8}, {composedBucket, &b.composed, engcomp.History},
 		{buckets.Have, &b.haves, buckets.HaveHistory}} {
 		kv, err := b.js.CreateKeyValue(&nats.KeyValueConfig{Bucket: c.name, History: c.history})
 		if err != nil {
@@ -180,17 +187,17 @@ func (b *itBed) say(line string) {
 	b.t.Log(line)
 }
 
-func fpIt(c string) string { return delivery.SourcePrefix2 + strings.Repeat(c, 64) }
+func fpIt(c string) string { return meshcatalogclient.SourcePrefix2 + strings.Repeat(c, 64) }
 
 func fpDigest(c string) string { return "sha256:" + strings.Repeat(c, 64) }
 
 func (b *itBed) want(module, fp, digest, backup string) {
 	b.t.Helper()
-	raw, err := delivery.EncodeWant(delivery.Want{FP: fp, Composed: digest, Backup: backup})
+	raw, err := bucketstest.Want(meshwants.WantsByWantNodeModuleValue{Fp: fp, Composed: digest, Backup: backup})
 	if err != nil {
 		b.t.Fatal(err)
 	}
-	key, _ := delivery.WantKey(itNode, module)
+	key := meshwants.WantsByWantNodeModuleKey(itNode, module)
 	if _, err := b.wants.Put(key, raw); err != nil {
 		b.t.Fatal(err)
 	}
@@ -313,12 +320,12 @@ func h8once(t *testing.T, b *itBed, resolved, candidates nats.KeyValue, place []
 	if got := answering(); got != settled {
 		t.Errorf("feat-x answered %d more time(s) at the same revision, with nothing it is composed from changed", got-settled)
 	}
-	same, _ := delivery.DecodePlacement(place)
-	craw, err := delivery.EncodePlacementCandidate(delivery.PlacementCandidate{Proposal: "feat-x", Placement: &same})
+	same, _ := meshmoduleassignerclient.DecodePlacement(place)
+	craw, err := bucketstest.Candidate(meshmoduleassigner.CandidatesByProposalNodeValue{Proposal: "feat-x", Placement: &same})
 	if err != nil {
 		t.Fatal(err)
 	}
-	ckey, _ := delivery.PlacementCandidateKey("feat-x", itNode)
+	ckey := meshmoduleassigner.CandidatesByProposalNodeKey("feat-x", itNode)
 	if _, err := candidates.Put(ckey, craw); err != nil {
 		t.Fatal(err)
 	}
@@ -346,11 +353,11 @@ func h8back(t *testing.T, b *itBed, placement, resolved, candidates nats.KeyValu
 	if n := node(); n.Composes != nec.ComposesOwn {
 		t.Errorf("a node composing its own says it composes %q", n.Composes)
 	}
-	craw, err := delivery.EncodePlacementCandidate(delivery.PlacementCandidate{Proposal: "revert-x"})
+	craw, err := bucketstest.Candidate(meshmoduleassigner.CandidatesByProposalNodeValue{Proposal: "revert-x"})
 	if err != nil {
 		t.Fatal(err)
 	}
-	ckey, _ := delivery.PlacementCandidateKey("revert-x", itNode)
+	ckey := meshmoduleassigner.CandidatesByProposalNodeKey("revert-x", itNode)
 	if _, err := candidates.Put(ckey, craw); err != nil {
 		t.Fatal(err)
 	}
@@ -360,7 +367,7 @@ func h8back(t *testing.T, b *itBed, placement, resolved, candidates nats.KeyValu
 			strings.Contains(a.Refused, "composes nothing")
 	})
 	ran := b.have("web").Composed
-	pkey, _ := delivery.PlacementNodeKey(itNode)
+	pkey, _ := meshmoduleassignerclient.NodeKey(itNode)
 	// A pass in flight when the key goes (issue 1126, 2026-10-28): a config value changed starts one, and the key goes at once.
 	if _, err := resolved.Put(itNode+".web.greeting", []byte(`{"value":"salut","source":"module"}`)); err != nil {
 		t.Fatal(err)
@@ -407,42 +414,42 @@ func h8(t *testing.T, b *itBed, checkBuild bool) (func(), h8state) {
 		}
 		return kv
 	}
-	placement, modules, manifests := kvOf(delivery.PlacementBucket), kvOf(delivery.ModulesBucket), kvOf(delivery.ManifestsBucket)
+	placement, modules, manifests := kvOf(buckets.Placement), kvOf(buckets.Modules), kvOf(buckets.Manifests)
 	resolved := kvOf(selfcompose.ResolvedBucket)
-	builds := kvOf(delivery.BuilderBuildsBucket)
-	candidates := kvOf(delivery.PlacementCandidatesBucket)
+	builds := kvOf(builderbuilds.BuilderBuildsBucket)
+	candidates := kvOf(buckets.PlacementCandidates)
 	packages := kvOf(link.PackagesBucket)
 	path := filepath.Join(b.dir, "web.conf")
 	man := `{"module":"web","version":"1","config":{"greeting":{"type":"string","description":"what the file says","default":"hello"}},` +
 		`"resources":[{"id":"conf","type":"file","path":"` + path + `","mode":"0644","content":"greeting=${config:greeting}\n"},` +
 		`{"id":"tools","type":"package","package":"web-tools"}],` +
 		`"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`
-	digest := delivery.ManifestDigest([]byte(man))
-	mraw, _ := delivery.EncodeManifest(delivery.Manifest{Module: "web", JSON: man})
-	mkey, _ := delivery.ManifestsKey(digest)
+	digest := meshcatalogclient.ManifestDigest([]byte(man))
+	mraw, _ := meshcatalogclient.EncodeManifest(meshcatalog.ManifestsByDigestValue{Module: "web", Manifest: man})
+	mkey, _ := meshcatalogclient.ManifestsKey(digest)
 	fp := fpIt("a")
-	modv, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: digest, Repository: "novox/web", Commit: strings.Repeat("1", 40)})
-	place, _ := delivery.EncodePlacement(delivery.Placement{Node: itNode, Modules: []delivery.PlacedModule{{Module: "web"}}})
+	modv, _ := meshcatalogclient.EncodeModule(meshcatalog.ModulesByModuleValue{Fp2: fp, Manifest: digest, Repository: "novox/web", Commit: strings.Repeat("1", 40)})
+	place, _ := meshmoduleassignerclient.EncodePlacement(meshmoduleassigner.Placement{Node: itNode, Modules: []meshmoduleassigner.PlacedModule{{Module: "web"}}})
 	rec, _ := nec.EncodeHaveNode(nodeengine.HaveByNodeNodeValue{Record: &nodeengine.NodeRecord{Node: itNode, Capabilities: []string{"service-manager", "package-manager"}}})
 	// it1 in one key per module and node (research 072 row 37), it2 in the form before: a node reads both.
-	pkey, _ := delivery.PlacementNodeKey(itNode)
-	places, _ := delivery.PlacementValues(delivery.Placement{Node: itNode, Modules: []delivery.PlacedModule{{Module: "web"}}})
+	pkey, _ := meshmoduleassignerclient.NodeKey(itNode)
+	places, _ := meshmoduleassignerclient.PlacementValues(meshmoduleassigner.Placement{Node: itNode, Modules: []meshmoduleassigner.PlacedModule{{Module: "web"}}})
 	place = places[pkey]
 	hkey, _ := nec.HaveNodeKey(itNode)
 	// A provider on it2 serving from its own config value: a mail domain, which it1's composition settles.
 	mailer := `{"module":"mailer","version":"1","config":{"domain":{"type":"string","description":"the mail domain","required":true}},` +
 		`"provides":[{"name":"smtp","scope":"mesh"}],"serves":{"smtp":{"port":587,"domain":"${config:domain}"}}}`
-	mdigest := delivery.ManifestDigest([]byte(mailer))
-	mlraw, _ := delivery.EncodeManifest(delivery.Manifest{Module: "mailer", JSON: mailer})
-	mlkey, _ := delivery.ManifestsKey(mdigest)
-	mlmod, _ := delivery.EncodeModule(delivery.Module{FP2: fpIt("b"), Manifest: mdigest, Repository: "novox/mailer", Commit: strings.Repeat("2", 40)})
-	place2, _ := delivery.EncodePlacement(delivery.Placement{Node: "it2", Modules: []delivery.PlacedModule{{Module: "mailer"}}})
+	mdigest := meshcatalogclient.ManifestDigest([]byte(mailer))
+	mlraw, _ := meshcatalogclient.EncodeManifest(meshcatalog.ManifestsByDigestValue{Module: "mailer", Manifest: mailer})
+	mlkey, _ := meshcatalogclient.ManifestsKey(mdigest)
+	mlmod, _ := meshcatalogclient.EncodeModule(meshcatalog.ModulesByModuleValue{Fp2: fpIt("b"), Manifest: mdigest, Repository: "novox/mailer", Commit: strings.Repeat("2", 40)})
+	place2, _ := meshmoduleassignerclient.EncodePlacement(meshmoduleassigner.Placement{Node: "it2", Modules: []meshmoduleassigner.PlacedModule{{Module: "mailer"}}})
 	rec2, _ := nec.EncodeHaveNode(nodeengine.HaveByNodeNodeValue{Record: &nodeengine.NodeRecord{Node: "it2", Capabilities: []string{"service-manager"}}})
-	pkey2, _ := delivery.LegacyPlacementKey("it2")
+	pkey2, _ := meshmoduleassignerclient.LegacyKey("it2")
 	hkey2, _ := nec.HaveNodeKey("it2")
-	buildKey, _ := delivery.BuilderBuildKey("web", fp)
-	done, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, Manifest: digest,
-		Artifacts: []delivery.BuiltArtifact{{Name: "files", Kind: "archive", Reference: "artifact-store://web/files/blobs/" + fpDigest("f"), Digest: fpDigest("f")}}})
+	buildKey, _ := builderbuilds.BuilderBuildKey("web", fp)
+	done, _ := builderbuilds.EncodeBuilderBuild(builderbuilds.BuilderBuild{State: builderbuilds.BuildDone, Manifest: digest,
+		Artifacts: []builderbuilds.BuiltArtifact{{Name: "files", Kind: "archive", Reference: "artifact-store://web/files/blobs/" + fpDigest("f"), Digest: fpDigest("f")}}})
 	firstBuild := done
 	if checkBuild {
 		firstBuild = []byte(`{"v":1,"state":"no such state"}`)
@@ -459,8 +466,8 @@ func h8(t *testing.T, b *itBed, checkBuild bool) (func(), h8state) {
 			t.Fatal(err)
 		}
 	}
-	want, _ := delivery.EncodeWant(delivery.Want{FP: fp, Self: true})
-	wkey, _ := delivery.WantKey(itNode, "web")
+	want, _ := bucketstest.Want(meshwants.WantsByWantNodeModuleValue{Fp: fp, Self: true})
+	wkey := meshwants.WantsByWantNodeModuleKey(itNode, "web")
 	if _, err := b.wants.Put(wkey, want); err != nil {
 		t.Fatal(err)
 	}
@@ -536,12 +543,12 @@ func h8rest(t *testing.T, b *itBed, resolved, candidates nats.KeyValue, hkey str
 	b.session.SayFacts(context.Background(), link.Report{Profile: map[string]any{"capabilities": []any{
 		map[string]any{"name": "service-manager", "present": true}}}})
 	second := b.have("web").Composed
-	same, _ := delivery.DecodePlacement(place)
-	craw, err := delivery.EncodePlacementCandidate(delivery.PlacementCandidate{Proposal: "feat-x", Placement: &same})
+	same, _ := meshmoduleassignerclient.DecodePlacement(place)
+	craw, err := bucketstest.Candidate(meshmoduleassigner.CandidatesByProposalNodeValue{Proposal: "feat-x", Placement: &same})
 	if err != nil {
 		t.Fatal(err)
 	}
-	ckey, _ := delivery.PlacementCandidateKey("feat-x", itNode)
+	ckey := meshmoduleassigner.CandidatesByProposalNodeKey("feat-x", itNode)
 	crev, err := candidates.Put(ckey, craw)
 	if err != nil {
 		t.Fatal(err)
@@ -578,8 +585,8 @@ func h8candidate(t *testing.T, b *itBed, fp, running string) {
 		}
 		return kv
 	}
-	cands, _ := kvOf(delivery.CandidatesBucket), kvOf(delivery.VerdictsBucket)
-	manifests, err := b.js.KeyValue(delivery.ManifestsBucket)
+	cands, _ := kvOf(buckets.Candidates), kvOf(buckets.Verdicts)
+	manifests, err := b.js.KeyValue(buckets.Manifests)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -587,25 +594,25 @@ func h8candidate(t *testing.T, b *itBed, fp, running string) {
 	man := `{"module":"web","version":"2","config":{"greeting":{"type":"string","description":"what the file says","default":"hello"}},` +
 		`"resources":[{"id":"conf","type":"file","path":"` + path + `","mode":"0640","content":"greeting=${config:greeting}\n"},` +
 		`{"id":"tools","type":"package","package":"web-tools"}]}`
-	digest := delivery.ManifestDigest([]byte(man))
-	mraw, _ := delivery.EncodeManifest(delivery.Manifest{Module: "web", JSON: man})
-	mkey, _ := delivery.ManifestsKey(digest)
+	digest := meshcatalogclient.ManifestDigest([]byte(man))
+	mraw, _ := meshcatalogclient.EncodeManifest(meshcatalog.ManifestsByDigestValue{Module: "web", Manifest: man})
+	mkey, _ := meshcatalogclient.ManifestsKey(digest)
 	if _, err := manifests.Put(mkey, mraw); err != nil {
 		t.Fatal(err)
 	}
-	head := delivery.Head{Repository: "novox/web", Number: 3, Head: strings.Repeat("3", 40)}
-	heads, _ := delivery.HeadsHash([]delivery.Head{head})
-	pulls := []delivery.CandidatePull{{Head: head, Modules: []string{"web"},
-		Fps: map[string]delivery.CandidateModule{"web": {FP2: fpIt("c"), Manifest: digest}}}}
+	head := meshdeliveryclient.Head{Repository: "novox/web", Number: 3, Head: strings.Repeat("3", 40)}
+	heads, _ := meshdeliveryclient.HeadsHash([]meshdeliveryclient.Head{head})
+	pulls := []meshcatalog.CandidatesByGroupValuePullsItem{bucketstest.Pull(head, []string{"web"},
+		map[string]meshcatalog.CandidatesByGroupValuePullsItemFpsValue{"web": {Fp2: fpIt("c"), Manifest: digest}})}
 	// The indexer keys the candidate by its group (a branch name, slash allowed); the checker asks by the composition key.
 	const group = "fix/3-web"
-	craw, err := delivery.EncodeCandidate(delivery.Candidate{Group: group, HeadsHash: heads, Pulls: pulls,
-		FPSet: delivery.FingerprintSet(pulls)})
+	craw, err := bucketstest.GroupCandidate(meshcatalog.CandidatesByGroupValue{Group: group, Heads: heads, Pulls: pulls,
+		Fpset: meshcatalogclient.FingerprintSet(pulls)})
 	if err != nil {
 		t.Fatal(err)
 	}
-	ckey, _ := delivery.CandidatesKey(group)
-	key, _ := delivery.CompositionKey(group, heads)
+	ckey, _ := buckets.CandidateKey(group)
+	key, _ := nec.CompositionKey(group, heads)
 	if _, err := cands.Put(ckey, craw); err != nil {
 		t.Fatal(err)
 	}
@@ -761,10 +768,10 @@ func TestNatsTheBusServerIsTakenOverAndReplacedOnlyWhenItsBuildChangesIt(t *test
 		}
 		return kv
 	}
-	placement, modules, manifests := kvOf(delivery.PlacementBucket), kvOf(delivery.ModulesBucket), kvOf(delivery.ManifestsBucket)
+	placement, modules, manifests := kvOf(buckets.Placement), kvOf(buckets.Modules), kvOf(buckets.Manifests)
 	kvOf(selfcompose.ResolvedBucket)
-	builds := kvOf(delivery.BuilderBuildsBucket)
-	kvOf(delivery.PlacementCandidatesBucket)
+	builds := kvOf(builderbuilds.BuilderBuildsBucket)
+	kvOf(buckets.PlacementCandidates)
 	kvOf(link.PackagesBucket)
 	// The bus module at a build, done: its manifest written and the indexer's module naming it at fp.
 	publish := func(fp, env string) {
@@ -772,15 +779,15 @@ func TestNatsTheBusServerIsTakenOverAndReplacedOnlyWhenItsBuildChangesIt(t *test
 			`"data":{"own":[{"id":"jetstream","path":"` + b.dir + `","class":"valuable","why":"the bus's streams"}]},"resources":[` +
 			`{"id":"server-conf","type":"file","path":"` + conf + `","mode":"0644","content":"listen: new\n"},` +
 			`{"id":"server","type":"container","name":"` + server + `","image":"` + image + `"` + env + `}]}`
-		digest := delivery.ManifestDigest([]byte(man))
-		mraw, _ := delivery.EncodeManifest(delivery.Manifest{Module: "nats", JSON: man})
-		mkey, _ := delivery.ManifestsKey(digest)
-		modv, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: digest, Repository: "novox/mesh-catalog", Commit: strings.Repeat("3", 40)})
+		digest := meshcatalogclient.ManifestDigest([]byte(man))
+		mraw, _ := meshcatalogclient.EncodeManifest(meshcatalog.ManifestsByDigestValue{Module: "nats", Manifest: man})
+		mkey, _ := meshcatalogclient.ManifestsKey(digest)
+		modv, _ := meshcatalogclient.EncodeModule(meshcatalog.ModulesByModuleValue{Fp2: fp, Manifest: digest, Repository: "novox/mesh-catalog", Commit: strings.Repeat("3", 40)})
 		if _, err := manifests.Put(mkey, mraw); err != nil {
 			t.Fatal(err)
 		}
-		bkey, _ := delivery.BuilderBuildKey("nats", fp)
-		done, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, Manifest: digest})
+		bkey, _ := builderbuilds.BuilderBuildKey("nats", fp)
+		done, _ := builderbuilds.EncodeBuilderBuild(builderbuilds.BuilderBuild{State: builderbuilds.BuildDone, Manifest: digest})
 		if _, err := builds.Put(bkey, done); err != nil {
 			t.Fatal(err)
 		}
@@ -791,7 +798,7 @@ func TestNatsTheBusServerIsTakenOverAndReplacedOnlyWhenItsBuildChangesIt(t *test
 	rec, _ := nec.EncodeHaveNode(nodeengine.HaveByNodeNodeValue{Record: &nodeengine.NodeRecord{Node: itNode,
 		Capabilities: []string{"service-manager", "package-manager", "container-runtime"}}})
 	hkey, _ := nec.HaveNodeKey(itNode)
-	places, _ := delivery.PlacementValues(delivery.Placement{Node: itNode, Modules: []delivery.PlacedModule{{Module: "nats"}}})
+	places, _ := meshmoduleassignerclient.PlacementValues(meshmoduleassigner.Placement{Node: itNode, Modules: []meshmoduleassigner.PlacedModule{{Module: "nats"}}})
 	// The have the engine wrote of the folded bus: the old-form build, no fingerprint.
 	natsHave, _ := nec.HaveKey(itNode, "nats")
 	oldHave, _ := nec.EncodeHave(nodeengine.HaveByNodeModuleValue{Build: "build-1792674595610176744", Phase: nec.PhaseRunning, Health: nec.HealthOK})
@@ -800,12 +807,12 @@ func TestNatsTheBusServerIsTakenOverAndReplacedOnlyWhenItsBuildChangesIt(t *test
 			t.Fatal(err)
 		}
 	}
-	busWant := func(w delivery.Want) {
-		raw, err := delivery.EncodeWant(w)
+	busWant := func(w meshwants.WantsByWantNodeModuleValue) {
+		raw, err := bucketstest.Want(w)
 		if err != nil {
 			t.Fatal(err)
 		}
-		key, _ := delivery.WantKey(itNode, "nats")
+		key := meshwants.WantsByWantNodeModuleKey(itNode, "nats")
 		if _, err := b.wants.Put(key, raw); err != nil {
 			t.Fatal(err)
 		}
@@ -837,7 +844,7 @@ func TestNatsTheBusServerIsTakenOverAndReplacedOnlyWhenItsBuildChangesIt(t *test
 	}
 	first := fpIt("e")
 	publish(first, "")
-	busWant(delivery.Want{FP: first, Self: true})
+	busWant(meshwants.WantsByWantNodeModuleValue{Fp: first, Self: true})
 	stop := b.start()
 	defer stop()
 	for key, value := range places {
@@ -869,11 +876,11 @@ func TestNatsTheBusServerIsTakenOverAndReplacedOnlyWhenItsBuildChangesIt(t *test
 	// Approve for a move the node judged to recreate it (ADR 0599 §2, §4).
 	next := fpIt("f")
 	publish(next, `,"env":{"CHANGED":"1"}`)
-	busWant(delivery.Want{FP: next, Self: true})
+	busWant(meshwants.WantsByWantNodeModuleValue{Fp: next, Self: true})
 	within(t, 10*time.Second, "the build that changes the server was not applied", func() bool {
 		h := b.have("nats")
 		if h.Phase == nec.PhaseWaitingYes && h.Waits != "" {
-			busWant(delivery.Want{FP: next, Self: true, Yes: h.Waits})
+			busWant(meshwants.WantsByWantNodeModuleValue{Fp: next, Self: true, Yes: h.Waits})
 		}
 		return h.Fp == next && h.Phase == nec.PhaseRunning
 	})

cmd/mesh-host/trust.go

@@ -9,6 +9,11 @@ import (
 	"fmt"
 	"git.novox.be/novox/mesh-contracts/go/clients/nodeengineclient"
 	"git.novox.be/novox/mesh-contracts/go/seats/nodeengine"
+	"git.novox.be/novox/mesh-contracts/identity-and-access/go/clients/meshvaultclient"
+	"git.novox.be/novox/mesh-contracts/placement/go/clients/meshmoduleassignerclient"
+	"git.novox.be/novox/mesh-contracts/placement/go/seats/meshmoduleassigner"
+	"git.novox.be/novox/mesh-delivery/contracts/go/clients/meshcatalogclient"
+	"github.com/novox/mesh-host/internal/buckets"
 	"os"
 	"path/filepath"
 	"strings"
@@ -17,7 +22,6 @@ import (
 
 	"git.novox.be/novox/mesh-contracts/identity-and-access/go/seats/meshvault"
 	"git.novox.be/novox/mesh-networking/modules/mesh-wireguard/go/overlay"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"github.com/novox/mesh-host/internal/identity"
 	"github.com/novox/mesh-host/internal/link"
@@ -47,23 +51,23 @@ func (t *meshTrust) onChange(f func()) {
 }
 
 // Signers are the keys a mesh signature is verified against now: the vault's once read, and none before.
-func (t *meshTrust) Signers() []delivery.Signer {
+func (t *meshTrust) Signers() []meshvaultclient.Signer {
 	t.mu.Lock()
 	defer t.mu.Unlock()
-	var out []delivery.Signer
+	var out []meshvaultclient.Signer
 	if t.vault != nil {
-		out = append(out, delivery.Signer{Name: delivery.SignerVault, Key: t.vault})
+		out = append(out, meshvaultclient.Signer{Name: meshvaultclient.SignerVault, Key: t.vault})
 	}
 	return out
 }
 
 // Verify is the signer that signed msg as kind, or why none it trusts did.
-func (t *meshTrust) Verify(kind string, msg, sig []byte) (delivery.Signer, error) {
-	context, err := delivery.SignContext(kind)
+func (t *meshTrust) Verify(kind string, msg, sig []byte) (meshvaultclient.Signer, error) {
+	context, err := meshvaultclient.SignContext(kind)
 	if err != nil {
-		return delivery.Signer{}, err
+		return meshvaultclient.Signer{}, err
 	}
-	return delivery.VerifyBy(t.Signers(), context, msg, sig)
+	return meshvaultclient.VerifyBy(t.Signers(), context, msg, sig)
 }
 
 // VaultAuthority is the vault's authority certificate as read from `signers`, or "".
@@ -83,9 +87,9 @@ func (t *meshTrust) Trusts() []string {
 	}
 	authorities := map[string]string{}
 	if a := t.VaultAuthority(); a != "" {
-		authorities[delivery.SignerVault] = a
+		authorities[meshvaultclient.SignerVault] = a
 	}
-	return delivery.Trusts(t.Signers(), authorities)
+	return meshvaultclient.Trusts(t.Signers(), authorities)
 }
 
 // change applies f under the lock and tells who follows when Trusts differs after it.
@@ -104,25 +108,25 @@ func (t *meshTrust) change(f func()) {
 // check; a deleted key is no longer trusted.
 func (t *meshTrust) heardSigner(key string, value []byte, deleted bool, say link.Announce) {
 	switch key {
-	case delivery.SignersKeyKey:
+	case meshvault.SignersByKeyKey():
 		var pub ed25519.PublicKey
 		if !deleted && len(value) > 0 {
-			k, err := delivery.DecodeSignerKey(value)
+			k, err := meshvaultclient.DecodeSignerKey(value)
 			if err == nil {
-				pub, err = k.PublicKey()
+				pub, err = meshvaultclient.SignerPublicKey(k)
 			}
 			if err != nil {
-				say("the vault's signing key in " + delivery.SignersRead + " is not trusted: " + err.Error())
+				say("the vault's signing key in " + buckets.SignersRead + " is not trusted: " + err.Error())
 				return
 			}
 		}
 		t.change(func() { t.vault = pub })
-	case delivery.SignersAuthorityKey:
+	case meshvault.SignersByAuthorityKey():
 		pem := ""
 		if !deleted && len(value) > 0 {
-			a, err := delivery.DecodeSignerAuthority(value)
+			a, err := meshvaultclient.DecodeSignerAuthority(value)
 			if err != nil {
-				say("the vault's authority in " + delivery.SignersRead + " is not trusted: " + err.Error())
+				say("the vault's authority in " + buckets.SignersRead + " is not trusted: " + err.Error())
 				return
 			}
 			pem = a.Certificate
@@ -153,7 +157,7 @@ func followTrust(ctx context.Context, session *link.Session, trust *meshTrust, s
 			return
 		}
 		watching, stop := context.WithCancel(linked)
-		signers, serr := session.KVWatch(watching, delivery.SignersBucket, ">")
+		signers, serr := session.KVWatch(watching, buckets.Signers, ">")
 		if serr != nil {
 			stop()
 			sayOnce(fmt.Sprintf("what this node trusts a mesh signature from is not followed yet (the vault's signers: %v): "+
@@ -179,15 +183,15 @@ func followTrust(ctx context.Context, session *link.Session, trust *meshTrust, s
 // bus: then the kept declaration is read no more (keptRetired). A node the seat does not place, or whose placement or haves
 // cannot be read, keeps reading it.
 func placedAllHave(ctx context.Context, session *link.Session, node string) (bool, string) {
-	key, err := delivery.PlacementNodeKey(node)
+	key, err := meshmoduleassignerclient.NodeKey(node)
 	if err != nil {
 		return false, err.Error()
 	}
-	legacy, _ := delivery.LegacyPlacementKey(node)
+	legacy, _ := meshmoduleassignerclient.LegacyKey(node)
 	// Its node key names every module placed (research 072 row 37); before the holder converted it, its legacy key does.
 	values := map[string][]byte{}
 	for _, k := range []string{key, legacy} {
-		if h, err := session.KVHistory(ctx, delivery.PlacementBucket, k); err == nil && len(h) > 0 && !h[len(h)-1].Deleted {
+		if h, err := session.KVHistory(ctx, buckets.Placement, k); err == nil && len(h) > 0 && !h[len(h)-1].Deleted {
 			values[k] = h[len(h)-1].Value
 		}
 	}
@@ -202,25 +206,25 @@ func placedAllHave(ctx context.Context, session *link.Session, node string) (boo
 
 // placedModules is the modules node's node key names (a placement of their names alone), or its legacy key's placement
 // where it has no node key; an error when neither reads.
-func placedModules(node string, values map[string][]byte) (delivery.Placement, error) {
-	key, _ := delivery.PlacementNodeKey(node)
+func placedModules(node string, values map[string][]byte) (meshmoduleassigner.Placement, error) {
+	key, _ := meshmoduleassignerclient.NodeKey(node)
 	if raw, ok := values[key]; ok {
-		n, err := delivery.DecodePlacementNode(raw)
+		n, err := meshmoduleassignerclient.DecodeNode(raw)
 		if err != nil {
-			return delivery.Placement{}, err
+			return meshmoduleassigner.Placement{}, err
 		}
-		p := delivery.Placement{Node: node}
+		p := meshmoduleassigner.Placement{Node: node}
 		for _, r := range n.Modules {
-			p.Modules = append(p.Modules, delivery.PlacedModule{Module: r.Module})
+			p.Modules = append(p.Modules, meshmoduleassigner.PlacedModule{Module: r.Module})
 		}
 		return p, nil
 	}
-	legacy, _ := delivery.LegacyPlacementKey(node)
+	legacy, _ := meshmoduleassignerclient.LegacyKey(node)
 	raw, ok := values[legacy]
 	if !ok {
-		return delivery.Placement{}, errors.New("its placement is not read")
+		return meshmoduleassigner.Placement{}, errors.New("its placement is not read")
 	}
-	return delivery.DecodePlacement(raw)
+	return meshmoduleassignerclient.DecodePlacement(raw)
 }
 
 // allHave says whether has finds, for every module p places, a have that names a fingerprint of the new form, and why
@@ -228,7 +232,7 @@ func placedModules(node string, values map[string][]byte) (delivery.Placement, e
 // declaration is the one record of what runs of it: retired then, the node's own composed it as nothing and refused to
 // remove what runs (issue 774, 2026-10-30 19:43: systemd-resolved on shanks, nats and restic on novox, each node's own
 // apply refused from then on).
-func allHave(p delivery.Placement, has func(module string) (nodeengine.HaveByNodeModuleValue, bool, error)) (bool, string) {
+func allHave(p meshmoduleassigner.Placement, has func(module string) (nodeengine.HaveByNodeModuleValue, bool, error)) (bool, string) {
 	if len(p.Modules) == 0 {
 		return false, "the seat mesh-module-assigner places no module here"
 	}
@@ -241,8 +245,8 @@ func allHave(p delivery.Placement, has func(module string) (nodeengine.HaveByNod
 			return false, m.Module + " has no have yet"
 		}
 		// A module the mesh provides (mesh-wireguard) never has a fingerprint: the node's own composes it from the manifest
-		// mesh-sdk provides (delivery.ProvidedManifest), never from the kept declaration, so it keeps no read.
-		if h.Phase != nodeengineclient.PhaseRemoved && !strings.HasPrefix(h.Fp, delivery.SourcePrefix2) && !delivery.ProvidedByMesh(m.Module) {
+		// mesh-sdk provides (overlay.ProvidedManifest), never from the kept declaration, so it keeps no read.
+		if h.Phase != nodeengineclient.PhaseRemoved && !strings.HasPrefix(h.Fp, meshcatalogclient.SourcePrefix2) && !overlay.ProvidedByMesh(m.Module) {
 			return false, m.Module + " runs at a build of the old form (" + h.Build + "), which only the kept declaration records"
 		}
 	}
@@ -262,7 +266,7 @@ func certifyThisNode(ctx context.Context, state, node string, trust *meshTrust,
 	if err != nil || len(key) != ed25519.PublicKeySize {
 		return fmt.Errorf("this node's serving key is not an ed25519 key")
 	}
-	raw, err := ask(ctx, meshvault.VerbSign, map[string]any{"kind": delivery.KindNodeCertificate, "node": node})
+	raw, err := ask(ctx, meshvault.VerbSign, map[string]any{"kind": meshvaultclient.KindNodeCertificate, "node": node})
 	if err != nil {
 		return err
 	}
@@ -274,7 +278,7 @@ func certifyThisNode(ctx context.Context, state, node string, trust *meshTrust,
 	if trusted == "" {
 		return fmt.Errorf("this node has read no authority of the vault's to check the certificate against")
 	}
-	if err := delivery.CheckNodeCertificate(a.Certificate, []string{trusted}, overlay.InternalName(node),
+	if err := meshvaultclient.CheckNodeCertificate(a.Certificate, []string{trusted}, overlay.InternalName(node),
 		ed25519.PublicKey(key), time.Now()); err != nil {
 		return err
 	}

cmd/mesh-host/userlist.go

@@ -5,12 +5,12 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"git.novox.be/novox/mesh-delivery/modules/mesh-grants/grantsstate"
 	engcomp "github.com/novox/mesh-host/internal/compositions"
 	"os"
 	"path/filepath"
 
 	"git.novox.be/novox/mesh-sdk/go/declaration"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/seal"
 	"github.com/novox/mesh-host/internal/apply"
 	"github.com/novox/mesh-host/internal/identity"
@@ -44,7 +44,7 @@ func userListFollower(opts options, session *link.Session, running func() []engc
 		},
 		// From take-over, the grants part's list (ADR 0547 clauses 7, 8): its one key watched, its object read by name and
 		// opened with this machine's sealing key, the key's public half said in the have so the grants part seals to it.
-		Grants: bucketWatch{session, delivery.GrantsUserListBucket},
+		Grants: bucketWatch{session, grantsstate.GrantsUserListBucket},
 		Fetch: func(ctx context.Context, name string) ([]byte, error) {
 			return session.GrantsObject(ctx, name, grantsListLimit)
 		},

cmd/mesh-host/whatruns_test.go

@@ -7,6 +7,8 @@ import (
 	"errors"
 	"git.novox.be/novox/mesh-contracts/go/clients/nodeengineclient"
 	"git.novox.be/novox/mesh-contracts/go/seats/nodeengine"
+	"git.novox.be/novox/mesh-contracts/placement/go/seats/meshmoduleassigner"
+	"git.novox.be/novox/mesh-delivery/contracts/go/clients/meshcatalogclient"
 	engcomp "github.com/novox/mesh-host/internal/compositions"
 	"path/filepath"
 	"sort"
@@ -15,7 +17,6 @@ import (
 
 	"git.novox.be/novox/mesh-networking/modules/mesh-wireguard/go/overlay"
 	"git.novox.be/novox/mesh-sdk/go/declaration"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"github.com/novox/mesh-host/internal/agent"
 	"github.com/novox/mesh-host/internal/liveness"
@@ -119,10 +120,10 @@ func TestDeclaredNowReadsWhatRunsWhenTheAgentIsRunning(t *testing.T) {
 	if d, err := keptDeclaration(state, nil); err != nil || len(d.Resources) != 1 {
 		t.Fatalf("before the read is retired: %+v, %v", d, err)
 	}
-	placed := delivery.Placement{Node: "n1", Modules: []delivery.PlacedModule{{Module: "zsh"}, {Module: "lemurs"}}}
+	placed := meshmoduleassigner.Placement{Node: "n1", Modules: []meshmoduleassigner.PlacedModule{{Module: "zsh"}, {Module: "lemurs"}}}
 	// Issue 774, 2026-10-30 19:43: a have naming only a build of the old form (systemd-resolved on shanks, folded in the
 	// node's own) keeps the kept declaration read, since it is the one record of what runs of it.
-	newForm := nodeengine.HaveByNodeModuleValue{Fp: delivery.SourcePrefix2 + strings.Repeat("a", 64), Phase: nodeengineclient.PhaseRunning}
+	newForm := nodeengine.HaveByNodeModuleValue{Fp: meshcatalogclient.SourcePrefix2 + strings.Repeat("a", 64), Phase: nodeengineclient.PhaseRunning}
 	oldForm := nodeengine.HaveByNodeModuleValue{Build: "build-1791404191702719760", Phase: nodeengineclient.PhaseRunning}
 	for _, row := range []struct {
 		name string
@@ -138,7 +139,7 @@ func TestDeclaredNowReadsWhatRunsWhenTheAgentIsRunning(t *testing.T) {
 		}
 	}
 	// The module the mesh provides never has a fingerprint, and keeps no read (review of issue 774).
-	withWireguard := delivery.Placement{Node: "n1", Modules: []delivery.PlacedModule{{Module: "zsh"}, {Module: overlay.Name}}}
+	withWireguard := meshmoduleassigner.Placement{Node: "n1", Modules: []meshmoduleassigner.PlacedModule{{Module: "zsh"}, {Module: overlay.Name}}}
 	if got, why := allHave(withWireguard, func(m string) (nodeengine.HaveByNodeModuleValue, bool, error) {
 		if m == overlay.Name {
 			return oldForm, true, nil
@@ -147,7 +148,7 @@ func TestDeclaredNowReadsWhatRunsWhenTheAgentIsRunning(t *testing.T) {
 	}); !got {
 		t.Errorf("%s without a fingerprint beside zsh at the new form keeps the read: %s", overlay.Name, why)
 	}
-	if got, _ := allHave(delivery.Placement{Node: "n1"}, nil); got {
+	if got, _ := allHave(meshmoduleassigner.Placement{Node: "n1"}, nil); got {
 		t.Error("a node with nothing placed retires the read")
 	}
 	keptRetired.Store(true)