From ba3aa8f9074df47204859905ceaf21766af44ca0 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 19 Oct 2026 22:04:53 +0200
Subject: [PATCH] Check mesh-sdk's Go binding without a vendor directory:
 resolve by go.sum (issue 1304, step 1 of 2)

---
 go/merge-check.sh | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/go/merge-check.sh b/go/merge-check.sh
index eeb845a..92e9d9c 100644
--- a/go/merge-check.sh
+++ b/go/merge-check.sh
@@ -17,14 +17,19 @@
 # its file; a file that held both kinds is two files (`<name>_integration_test.go` beside `<name>_test.go`).
 # Each level says its test count and its time.
 #
-# Every dependency this binding takes (none yet; nats.go and an embedded nats-server with issue 1171) is
-# vendored into go/vendor, so a run with the network off fetches nothing; `go mod vendor` after a `go.mod` or
-# `go.sum` change keeps it so. gofmt reads only the binding's own files, never go/vendor.
+# No dependency is committed (no vendor directory: .gitignore; the operator, 2026-10-19; issue 1304). Every dependency
+# is resolved by the version and checksum go.sum names (novox/hq ADR 0405 §5), from its public source: this binding
+# requires nothing of the mesh's own forge. `go mod verify` fails by module name when a downloaded dependency does not
+# match go.sum, and -mod=readonly fails a build whose go.sum lacks an entry instead of writing it. gofmt reads only
+# the binding's own files.
 #
 # Exit 0 is a pass; anything else fails `mesh/repo-check` with the last line printed.
 set -eu
 cd "$(dirname "$0")"
-export GOFLAGS=-mod=vendor GOPROXY=off
+# The toolchain the check runs in sets -mod=vendor; there is no vendor directory, so it is replaced.
+GOFLAGS="$(printf '%s' "${GOFLAGS:-}" | sed 's/-mod=[a-z]*//g') -mod=readonly"
+export GOFLAGS
+export GOPRIVATE=git.novox.be
 
 # **The unit level's bound, in seconds** (issue 895): the slowest package's own test time of the untagged run,
 # the compile not counted. A run over it fails the check and names the slowest tests. The SDK's unit suite is
@@ -75,6 +80,15 @@ if [ "${1:-}" = judge-unit-run ]; then
 	exit
 fi
 
+if ! fetched=$(go mod download 2>&1); then
+	echo "FAILED: the dependencies cannot be fetched: $(printf '%s\n' "$fetched" | tail -n 1)"
+	exit 1
+fi
+if ! verified=$(go mod verify 2>&1); then
+	echo "FAILED: a dependency does not match go.sum: $verified"
+	exit 1
+fi
+
 unformatted=$(find . -name '*.go' -not -path './vendor/*' | xargs gofmt -l)
 if [ -n "$unformatted" ]; then
 	echo "not gofmt'd:"