ADR-0048 addendum Phase A1: `namespace` travels on the publish payload (PackageSchema / CreatePackageRequestSchema + CLI publish)

[os-zhuang]

Part of #1825 (maintainer ruling 2026-08-08, recorded in #1825 comment 5226117769: ADR-0048 addendum ACCEPTED as drafted, incl. D2 and D3 rule 2; addendum landed via PR #6671, merged). Filed by the triage seat per the ruling's own assignment: "Phase A1 … is the first implementation card; it changes the spec acceptance face, so it belongs to the domain:spec lane via triage."

What

The enterprise-side publish-time namespace exclusivity gate (Phases A2/A3, bound by §A.5's hard activation precondition) can check nothing until the namespace actually leaves the artifact. Today it does not:

• PackageSchema (packages/spec/src/cloud/package.zod.ts:157) has no namespace field at all;
• CreatePackageRequestSchema (same file, :252) does not accept one;
• packages/cli/src/commands/package/publish.ts transmits manifest_id only (:338).

(All three measured on origin/main @ 3172831, re-confirming the #1825 dev report's measurement at f123670.)

The work (open side, this repo — per the addendum's Phase A1)

• PackageSchema and CreatePackageRequestSchema gain a namespace field (shape per the addendum: bare-namespace granularity, no version-range);
• the CLI publish command reads the namespace off the artifact's manifest and sends it on the publish payload;
• conformance/pin coverage for the new acceptance face per spec-lane conventions.

Out of scope, per the ruling: A2/A3 (enterprise-side registry + uniqueness enforcement — separate cards when cut, bound by §A.5), A4 (rename/transfer, stays deferred and is explicitly not a precondition), and any change to the install-time gate (NamespaceConflictError, packages/objectql/src/registry.ts).

Acceptance

A published artifact's namespace is present on the publish request accepted by CreatePackageRequestSchema, and PackageSchema declares it — so the enterprise gate has an input to check when A2 lands.

Refs: ADR-0048 addendum (PR #6671, §A.2 phasing / §A.5 activation precondition), #1825, #1810 (install-time gate).

[os-zhuang]

Claim: PM loop round 2 (domain:spec seat, #6017; maintainer directive: concurrency raised to 5)
Session: session_011sGk4SKHqGRgmmqUok1P8M
Branch: claude/issue-6760-namespace-publish-payload
Worktree: objectstack-issue-6760
Domain: domain:spec
File surface: packages/spec/src/cloud/package.zod.ts (PackageSchema + CreatePackageRequestSchema gain namespace); packages/cli/src/commands/package/publish.ts (send namespace off the manifest); conformance/pin coverage; regenerated api-surface/references; changeset. ⛔ Out of scope per the ruling: A2/A3 (enterprise side), A4, and the install-time gate (NamespaceConflictError, packages/objectql/src/registry.ts). (Stop on breach; explain in the report.)
Serial constraints cleared: no in-flight claim touches cloud/package.zod.ts or the CLI publish command (in-flight this lane: #6735 / #5384+#5227 / #6361 / #6748 — all disjoint). Generated trees shared ⇒ serial landing relay by this seat.
Container assessment: M, mode:subagent shared container.
Ruling anchor: #1825 comment 5226117769 (maintainer 2026-08-08, ADR-0048 addendum accepted as drafted; addendum landed via PR #6671) — this card is its Phase A1, filed by triage per the ruling's own lane assignment.

---

Generated by Claude Code

[os-zhuang]

ACCEPT → PR #6864 (ESLint + TypeScript Type Check verified success by this seat, 24/25 + 1 conditional skip). Arming auto-merge now — not queued behind the relay: this PR's generated footprint is the cloud shard (authorable-surface/cloud.json, authorable-defaults/cloud.json, references/cloud/package.mdx) and it touches neither spec-changes.json, the upgrade guide, nor migrations/registry.ts, so it is disjoint from #6840/#6862's shared surfaces. Serialization applies to overlap, not to the lane.

Load-bearing points: Phase A1 implemented per §A.2/§A.6 with optionality settled by the addendum's own algorithm (if (namespace is absent) -> allow) rather than guessed; namespace read from the compiled artifact's manifest.namespace (same site as deriveManifestId), not overridable by flag or on-disk descriptor — argued from the reservation's meaning, which is the right reason; TemplateManifestSchema deliberately kept from becoming a second authoring surface; malformed values refused before any network call with coded issues at paths (not toThrow()); reverse verification predicted-then-red on both pins, with the "absent namespace" cases honestly reported as structurally un-reddenable rather than papered over; one real gate catch (check:docs stale reference page) fixed by regeneration.

A2 gate input contract (recorded here so the enterprise/cloud seats price A2/A3 without re-deriving it): field namespace, same spelling both sides; string, /^[a-z][a-z0-9_]{1,19}$/, byte-identical to ManifestSchema.shape.namespace and pinned against it; optional on both schemas, omitted entirely when absent (never null/empty); provenance = artifact manifest.namespace, verbatim on POST /cloud/packages; malformed input cannot reach A2 (CLI exits 1 pre-network, schema rejects invalid_format at ['namespace']); no ADR-0112 codes / reservation store / publisher-tier plumbing — those land with the gate that raises them.

Out-of-scope finding #6861 filed (objectstack.manifest.json ships a live namespace key TemplateManifestSchema never declares) — held for triage.

---

Generated by Claude Code