DD-404 — Marketplace artifact taxonomy + add-on packaging

[piersdd]

Tracking issue (epic) for DD-404. Execution state lives here; design rationale lives in the vault — decisions/DD-404.md (+ DD-404-status.md).

State: building — taxonomy/schema/dist-sync shipped; harness Grok tile shipped v0.99.161.0. Next: harness installer sync, Marketplace IA ratification, bundle install-unit support.

Sub-issues are added as phases become active.

---

This was generated by AI during triage.

Acceptance criteria

Epic-level completion criteria for the DD-404 tracking issue. This is not a single dispatchable unit — the atomic, ≤10-file work lives in per-phase sub-issues (added as phases activate). This section records epic done-ness and clears the /flow acceptance-criteria linter; do not dispatch this issue as one SVD unit (it would breach the scope ceiling).

• Taxonomy / schema / dist-sync shipped.
• Harness Grok tile shipped (v0.99.161.0).
• Harness installer sync shipped.
• Marketplace IA ratified.
• Bundle install-unit support shipped.
• All DD-404 phase sub-issues opened, shipped, and closed.
• DD-404-status.md reflects the epic complete and DD-404 moves off building.

Blocked by

None - can start immediately (epic; remaining phases carry their own blockers).

[piersdd]

State: Read-only pre-merge sanity pass on PR #33 (branch feat/add-on-provisions-scopes) complete. The add-on admission gate enforcement matches the PR description — no discrepancies found.

Attempted: Ran git diff origin/main...HEAD --stat (3 files, +196/-161), then read the full diffs of scripts/build-catalog.js, schemas/stallari-add-on.schema.json, and schemas/catalog-entry.schema.json against origin/main, plus the PR body via gh pr view.

Evidence:

• scripts/build-catalog.js: assertAddOnAdmission() (new, ~55 lines) enforces first-party-only (author_type !== "first-party" fails), scope format + membership in REVIEWED_ADDON_SCOPES (workload.trigger, hitl.approve, status.read, inference.invoke), and a subset check that every provisions_auth[].scopes entry is present in provisions_scopes. Wired into main() right after schema validation, scoped to type === "add_on", throws on violation (fails the build before R2 upload) — matches the PR's "CI fail-fast mirror of the registry worker" claim.
• addOnToCatalogEntry() now carries provisions_scopes through into the served catalog entry (build-catalog.js:666-669).
• schemas/stallari-add-on.schema.json: provisions_scopes added to required (line 7) and defined (line 107) with a description documenting the identical subset invariant; schemas/catalog-entry.schema.json gained a matching provisions_scopes array property. The bulk of the add-on schema's 288-line diff is pure key-reordering/restructuring noise, not a second behavioral change.
• No test/build run performed — this was a read-only diff review only, not an execution check.

Risk: None identified in the diff itself. The one gap is that this pass didn't execute the catalog build or its test add-on fixtures (the PR body claims these were run manually — "Clean build = 70 entries" — but that wasn't independently re-verified here).

Decision: Diff review supports merging PR #33 as-is — does the maintainer want CI to run first (build/tests), or is this sanity check sufficient to proceed straight to merge?

[piersdd]

① State: Read-only housekeeping review of origin/main's 3 newest commits — no source files modified this session.

② Attempted: Ran git log --stat -3 origin/main and reviewed the diffs of 4b21440 (#38, "backfill catalog domain scope", closes #35), 23ec368 (#37, "tighten catalog entry schema", closes #36), and ecd8776 (schema mirror of pack-spec 4.14.0's fleet-operator → fabric-operator rename, ADR-0096/DD-390).

③ Evidence:

• 4b21440 — touches schemas/catalog-entry.schema.json, scripts/build-catalog.js, scripts/domain-scope.test.js, scripts/catalog-entry.schema.test.js, and backfills granularity.domain_scope on 5 catalog entries: gmail-blade-mcp.json, home-assistant-blade-mcp.json, mastodon-blade-mcp.json, syncthing-blade-mcp.json, tailscale-blade-mcp.json.
• 23ec368 — schema tightening touching 61 files, mostly one-line additions across plugins/tools/*.json.
• ecd8776 — pack-spec 4.14.0 rename mirror, unrelated to the catalog-entry schema work.

④ Risk: None from this session (no writes). Residual note on the repo state: #38's linked issue (#35, "Backfill granularity.domain_scope across 158 catalog tools (5 blade catalogs)") is Done and its own title already scopes the work to "5 blade catalogs," so the 5-entry backfill appears complete by design, not partial — flagging only because it wasn't independently re-verified this session.

Decision: No action needed against #32 itself — this session's investigation didn't touch DD-404/marketplace-taxonomy scope. Posting here per the CONV-42/DD-434 driving-issue resolution ladder (no branch-embedded issue ref, no open PR on wip/catalog-notes, single in-progress board card = #32) for continuity rather than opening a separate issue. If a full-catalog domain_scope coverage audit is wanted beyond the 5 backfilled entries, that would be a new ready-for-triage issue, not a #32 follow-up.