RFC #406 follow-up: close six contract gaps found in #409's post-merge review #411

Codex reviewed #409's final commit (28ae6d4) after it merged. #409 had used its three review-fix rounds, so these six findings are collected here. Each is a gap in docs/rfc-package-commands.md to close before implementation starts.

P1: gaps in the contract

1. Consent for default packages supplied by the index (RFC line ~56). labelle init adds whatever the index's defaults list names, and a provider pinned in the project is then trusted to run its build.zig without a prompt. A compromised index could inject a provider. Fix: init shows the index defaults and asks for confirmation before pinning them, or takes the defaults from release-authenticated data such as the stamped scaffold template.

2. One executable per build_step (line ~88). A named Zig step may run an artifact, install several, or produce none (compare build.zig:40-47, where installation and the generate run step are separate). Fix: each command/hook declares one installed host executable at a deterministic path, or the RFC defines a strict single-artifact step convention.

3. One wire format for the command context (line ~99). "Arguments or a small JSON file" leaves providers guessing. Fix: one convention, e.g. LABELLE_CONTEXT=<path> pointing to a JSON file, with an exact versioned schema: target, output dir, progress handles, credentials helper, and the null rules for projectless runs.

4. Where provider-specific project settings live (line ~181). Android/iOS settings (bundle id, signing, orientation, SDK options) are hardcoded fields in the strict project schema (src/cli/project_config.zig:100-102 and 449-453). Removing them for the guard makes them unparsable. Fix: a generic namespaced config block in project.labelle (e.g. .providers = .{ .android = .{ … } }, parsed and validated by the provider), or a provider-owned file, plus the migration.

5. Backend names also block the guard (line ~189). The migration moves the ASTC table and SDL provisioning, but backend identities stay in core:

   • the raylib/sokol/sdl/bgfx/wgpu enum in src/cli/project_config.zig:31-33;
   • the branches in src/cli/pipeline.zig:515-525;
   • the branches in src/cli/compatibility.zig:10-13.

   Fix: add a migration step making backends manifest-declared too (to line up with labelle-assembler#378), or narrow the mandate and guard to platform and store names until then.

P2

6. Publish which package provides each target in the index (line ~160). The index is specified for namespace lookup only, so --platform=wasm without the provider can't name the package to add, even though the acceptance checks require it. Fix: the index publishes target ownership, with lookup by target.

Found on #409 after merge. Part of #406.

https://claude.ai/code/session_01R2K5sJDL5Msn1uRTkybiDP