spec + runtime: a package export carries no namespace and no dependencies, so a reinstalled .custom pair lands under the wrong namespace without its base edge; declare both on PackageExportManifestSchema and emit them

domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS

Filing gate: ① the measured blocker of the #28914 server slice (os-dev-report 6589329364, class b), anticipated by the #28914 spec slice's open question 3 (hand-off 6588925516, option A). Filed by domain:server seat 4. ⛔ Not a claim. No grade: triage sets it (it blocks a p1).

What happens

Measured on origin/main 81cd9eb0 through the real door (HttpDispatcher + protocol + ObjectQL on SQLite, the #29563 harness): a runtime holds a code base com.example.showcase and its pair com.example.showcase.custom, installed with namespace: showcase_custom and dependencies: { com.example.showcase: ^1 }, one dashboard override published.

GET /packages/com.example.showcase.custom/export answers only dashboards, id, name, version. namespace, dependencies and type are absent; the registry row on the same runtime holds all of them.
assemblePackageManifest (packages/runtime/src/domains/packages.ts) does not emit them, and PackageExportManifestSchema (packages/spec/src/api/package-lifecycle.zod.ts L183: id, name, version, label + catchall) does not declare them.
Reinstall loses both: install-local falls back to deriveNamespaceFromPackageId (gives custom) and reads manifest.dependencies for the ADR-0141 D5 install order and the ADR-0146 D2 override gate. POST /packages refuses the export outright (400: no type, flat collection keys).

So the whole-ontology export (#28914) cannot promise "installable packages" until each entry carries both.

Wanted

PackageExportManifestSchema declares namespace and dependencies as optional fixed keys (shapes as the install manifest's), and assemblePackageManifest emits them from the registry row in the same change, so neither key is declared and not produced.
A round-trip pin: export a .custom pair, reinstall it through install-local, read back the same namespace and the base edge.
type and the flat-collection refusal of POST /packages are out of scope (that door is not a reinstall door; adding type alone would not make it one). Name them in the PR as out of scope.
Cross-domain (spec + runtime) in one PR, per the option the spec slice recorded; triage confirms the lane.

Serial: PR-level, beside #29373 (open, same schema, withheldMaps). #28914's server slice resumes on top of this card.

Dedupe: searched PackageExportManifestSchema namespace dependencies, export manifest namespace dependencies reinstall, assemblePackageManifest namespace; nearest #28914 (the consumer), #29373 (same schema, another key), #28404 (the pairing constants, closed). New.

Links back: #28914, PR #29100, #29373, #29563.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: p1 · `domain:spec` · `pm:queue` · cross-domain single PR · 2026-11-02T21:54Z

⛔ Not a claim.

Read fresh. Measured through the real door: a package export carries no namespace and no dependencies, so a reinstalled .custom pair lands under the wrong namespace (custom) and without its base edge, which breaks the ADR-0141 install order and the ADR-0146 override gate. Declaring both on PackageExportManifestSchema is a protocol addition, so p1. ⛔ The key names wait for the maintainer's approval, and the PR body quotes it before entering the queue. The declaration and assemblePackageManifest's emission are one fix, so this runs as a cross-domain single PR led by domain:spec. Its claim declares packages/runtime/src/domains/packages.ts on its surface.

Generated by Claude Code

domain:spec#5 · os-warren · session_01JQwxbWR3K3h7i1ytwycVg1

Claim: PM loop round 1
Session: session_01JQwxbWR3K3h7i1ytwycVg1
Account: os-warren
Branch: the card thread's own claude/project-thread-* branch, named in the hand-back (a measured platform exception to claude/issue-29617-…)
Worktree: objectstack-issue-29617
Domain: domain:spec (cross-domain single PR led by spec, per triage 6589442304)
Seat: domain:spec#5
File surface: packages/spec/src/api/package-lifecycle.zod.ts (PackageExportManifestSchema: optional fixed namespace and dependencies, shapes as the install manifest's, with describes), packages/runtime/src/domains/packages.ts (assemblePackageManifest emits both from the registry row), a round-trip test (export a .custom pair, reinstall through install-local, read back the namespace and the base edge), the api-surface / authorable-surface / liveness / dropped-refinements ledgers and generated content/docs/references/** rows the keys move, .changeset/29617-package-export-namespace-dependencies.md
Container & model: M, mode:thread, model: TIER_DEFAULT build; CONTRACT_REVIEW_TIER review owed (packages/spec/src/** widening of a published schema)
Clause-②: yes (widening)
Metadata-protocol: added
Responsibility: a package export carries no namespace and no dependencies, so a reinstalled .custom pair lands under namespace custom without its base edge | none, first shipped this way | installers reinstalling an exported package, and the #28914 whole-ontology export, today
Thread-read: 6589442304
Premise: holds. On origin/main (5bd615e), PackageExportManifestSchema (L183) declares id, name, version, label and a catchall, with no namespace or dependencies. assemblePackageManifest (L3345) emits neither. The filer measured both through the real door on 81cd9eb0.
Serial constraints cleared: none. ⛔ PR #29521 (#29373, withheldMaps on the same schema) is open and touches package-lifecycle.zod.ts, so this PR lands after it and merges main once #29521 has merged. ⛔ Merge gate: the maintainer approves the two key names, and the PR body quotes that approval before the queue. ⛔ The protocol.ts freeze holds until 2026-11-03 06:00Z at the latest, so there is no edit to api/protocol.zod.ts, identity/protocol.ts or packages/metadata-protocol/src/protocol.ts. Out of scope and named in the PR: type and the flat-collection refusal of POST /packages.

domain:spec#5 · os-warren · session_01JQwxbWPCwHb9Zxnf7ou79C
os-dev-report

{
  "issue": 29617,
  "status": "done",
  "branch": "claude/project-thread-f8jiyr",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29651",
  "session": "session_01JQwxbWPCwHb9Zxnf7ou79C",
  "premise_still_valid": true,
  "summary": "PackageExportManifestSchema declares optional fixed keys namespace and dependencies, each ManifestSchema.shape's own declaration re-described; assemblePackageManifest writes both from the registry row's manifest (absent when the row declares none; dependencies copied). Round trip pinned on two real showcase boots in packages/qa/dogfood: ensure the showcase pair, publish a dashboard override, export, reinstall through install-local on a fresh boot, read back namespace showcase_custom and the base edge. main merged at d280265b (carries #29521 withheldMaps); generated artifacts regenerated from the merged tree, docblock now counts seven fixed keys. Head 3d93d712732f2ee47fc2566e072cc6fd2c1d3ce6.",
  "tests": "Ablation (fix committed, ablation-replace.mjs, runtime rebuilt, dist preflight --absent ok): dogfood round trip 3/3 red (export lacks namespace; install 403 NOT_OVERRIDABLE declared_package_outside_closure; target row 404), door pin 2/3 red; restore blob == HEAD, porcelain empty, rebuilt, preflight marker present, 3/3 green. At 3d93d712: dogfood round trip Tests 3 passed; runtime export pins 4 files Tests 12 passed; spec test Test Files 801 passed, Tests 23734 passed 1 todo; typecheck spec+runtime+dogfood exit 0. Runtime full suite at 6d249e4f (pre-merge): Test Files 530 passed, Tests 8515 passed 19 skipped; re-run at 3d93d712 still running at report time (merge brought no runtime source). eslint --no-inline-config on the 5 changed .ts files exit 0.",
  "gates": "dispatch-gates --commands at 6d249e4f: 105 derived, 100 ran, 97 exit 0; NOT MEASURED exit 3: check-plugin-teardown-shape --self-test (fixture commit outside shallow clone), check:dual-build-cjs-loads (needs every dist), check:skill-examples (client-react unbuilt; after build exit 0); last 5 stopped by the merge. At 3d93d712: 104 derived, re-run in progress, 50 ran, 49 exit 0, teardown self-test exit 3. check:generated at 3d93d712: all 14 current. CI check-runs: in_progress at report time.",
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2: fleet-write pr_create (PR 29651, read-back identical 9837 bytes); this os-dev-report comment via post-stamped",
  "open_questions": [
    {
      "question": "Approve the two key names on PackageExportManifestSchema: namespace and dependencies (the install manifest's own names for the same values)?",
      "options": [
        "A approve namespace and dependencies",
        "B name other keys"
      ],
      "recommendation": "A, because the install door reads ManifestSchema's keys, so the same names need no translation and the shapes are reused verbatim"
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed: type and the flat-collection refusal of POST /packages stay out of scope as ordered, named in the PR"
  ]
}

domain:spec#5 · os-warren · session_01JQwxbWR3K3h7i1ytwycVg1

Release: claim 6590026420 (session session_01JQwxbWR3K3h7i1ytwycVg1), on the seat's stand-down. Order: Warren, 「spec 当前任务处理完，走下班流程」, project chat (relayed by the coordinator).
Resume-from: claude/project-thread-f8jiyr@3d93d712732f2ee47fc2566e072cc6fd2c1d3ce6

State for the next seat:

Draft PR feat(spec,runtime): a package export carries its namespace and dependencies, so a reinstalled .custom pair keeps both (#29617) #29651 (dev report 6591604566): PackageExportManifestSchema declares namespace and dependencies, and assemblePackageManifest emits both. A dogfood round-trip goes green, and goes red when the emission is ablated. origin/main was merged at d280265b, after feat(spec): the package export manifest declares withheldMaps, classified door for the unmanaged import #29521, so the serial constraint is cleared.
Not finished at hand-back: the runtime full suite and the dispatch-gates sweep at this head (50/104 so far, 49 exit 0). CI was still in progress. Read the check-runs first.
Owed before landing:
- the at-tier contract review (a packages/spec/src/** widening; Metadata-protocol: added, spec and runtime minor);
- an ACCEPT;
- the maintainer's approval of the two key names namespace and dependencies, quoted in the PR body before the queue.
Out of scope, named in the PR: type, and the flat-collection refusal of POST /packages.

The order was written at 2026-11-02T23:52Z.

domain:spec#5 · os-warren · session_01JQwxbWR3K3h7i1ytwycVg1

Pointer for the next seat: the maintainer has approved the key names namespace and dependencies on PackageExportManifestSchema as named. Warren chose 「全部批准」 on decision card cmsg_01U5RdnAAmkSQmZbqh6FtqZ8Rr7w8AxYJLZP6jP9v41T4n (question 「六个命名/措辞全部按推荐批准吗？」, item 6) in the project thread "Decide pending spec name approvals". Quote this in the body of PR #29651 before the queue. The contract review and the ACCEPT are still owed (Release 6591624931).

The approval was given at 2026-11-03T00:08Z.

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Claim: PM loop round 1
Session: session_01WGufzfgvGexKn9vLHsy89K
Account: os-support-ai
Branch: claude/project-thread-f8jiyr (the released branch, resumed; no new dev work is ordered)
Worktree: none (landing only: the seat reviews PR #29651 and lands it; no code is written)
Domain: domain:spec (cross-domain single PR led by spec, per triage 6589442304)
Seat: domain:spec#3
File surface: as PR #29651's eight files: packages/spec/src/api/package-lifecycle.zod.ts (+ test), packages/runtime/src/domains/packages.ts (+ packages-export-registry-row-keys.test.ts), packages/qa/dogfood/test/package-export-reinstall-custom-pair.dogfood.test.ts, packages/spec/authorable-surface/api.json, content/docs/references/api/package-lifecycle.mdx, .changeset/29617-package-export-namespace-dependencies.md
Container & model: M, landing only, model: TIER_DEFAULT (seat review); the at-tier contract review is triage's record 6592043758 (PASS, head 3d93d712)
Clause-②: yes (widening)
Metadata-protocol: added
Responsibility: a package export carries no namespace and no dependencies, so a reinstalled .custom pair lands under namespace custom without its base edge | none, first shipped this way | installers reinstalling an exported package, and the #28914 whole-ontology export, today
Thread-read: 6591852561
Premise: holds. PR #29651 at 3d93d712 is the fix; 65 check-runs, 57 success and 8 skipped, none red.
Serial constraints cleared: PR #29521 merged and is in the head; no protocol.ts file is touched (freeze until 2026-11-03 06:00Z); authorable-surface/api.json is also #29342's surface, which has no open PR yet, so this lands first.
Resume-from: claude/project-thread-f8jiyr@3d93d712732f2ee47fc2566e072cc6fd2c1d3ce6

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

ACCEPT → PR #29651 comment 6592402677 (head 3d93d712; contract review PASS 6592043758; name approval quoted in the body). Readied and auto-merge armed; the seat follows it to MERGED.

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Landed: PR #29651 merged as a6a369efae (2026-11-03T01:32Z). PackageExportManifestSchema declares namespace and dependencies, and assemblePackageManifest emits both from the registry row. The #28914 server slice can resume on top of main. pm:dispatched and pm:blocking come off with this note.

test(dogfood): the export header names namespace and dependencies after

Navigation Menu

Repository navigation

spec + runtime: a package export carries no namespace and no dependencies, so a reinstalled .custom pair lands under the wrong namespace without its base edge; declare both on PackageExportManifestSchema and emit them #29617

What happens

Wanted

Triage: p1 · `domain:spec` · `pm:queue` · cross-domain single PR · 2026-11-02T21:54Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec + runtime: a package export carries no namespace and no dependencies, so a reinstalled .custom pair lands under the wrong namespace without its base edge; declare both on PackageExportManifestSchema and emit them #29617

Description

What happens

Wanted

Activity

objectstack-fleet commented on Nov 2, 2026

Triage: p1 · domain:spec · pm:queue · cross-domain single PR · 2026-11-02T21:54Z

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p1 · `domain:spec` · `pm:queue` · cross-domain single PR · 2026-11-02T21:54Z