client: show "elsewhere" owners and owner verification

orion commented

2026-10-12 16:27:07 +00:00

Collaborator

Context

The client side of "elsewhere" owners and verified domains (RELEASE.md 7.1, 7.6, 7.13): when torb add or a resolution asks the public registry for a package of an owner that publishes elsewhere, the user should read "acme publishes at ; bind it with registry "acme", url: ..." instead of "no such package", and torb add should print the owner, its verification and its age for a package it has never seen (7.6, Typosquatting row). Follows #19.

What exists today (main `787f63f`)

The client reads <registry>/index/<owner>/<name>.trb; a 404 is "the registry does not have it" (7.13). compiler/src/package/registry.trb fetches and caches index files, pins keys, checks every record's signature (7.14); torb add prints deprecation notices from the index it read (compiler/src/package/audit.trb, docs/tooling/torb-add.md).
owner.trb is never fetched or read. torb owner list shows members only.

Source

Design record point

7.1 "Elsewhere" row and 7.6 (dependency confusion; typosquatting: "torb add printing the owner, its verification and its age for a package it has never seen").

Design (decided by the loop, see the comment of 2026-10-12)

On a 404 of a package file from a registry that serves index/config.trb, the client fetches index/<owner>/owner.trb, verifies its signature with the keys it trusts (7.14), and if it has elsewhere: fails with that message. No owner file (404) or a registry without keys: the usual "not found". A bad signature is a refusal, never trusted. The URL is only printed, never bound or fetched automatically; when its host is under the owner's verified domain: the line adds "(verified domain acme.com)", otherwise nothing is claimed.
torb add <owner/name> for a package not yet in the lock prints one line after success: owner acme (organisation, 3 years old, verified domain acme.com); a person owner prints (person, ...); unverified prints no domain. Read from the same signed file; absent file prints nothing. --offline uses the cached copy.
torb owner list also prints kind, elsewhere and domain from the API's OwnerView.
File layout and cache: <cache>/index/<registry>/ like index files.

Acceptance criteria

compiler/tests / tools/registry/tests/client.test.trb: against the registry's files over HTTP, torb add of a package of an elsewhere owner fails with the message naming the URL and the registry "acme", url: line; a tampered or unsigned owner.trb is a refusal; no owner.trb leaves the old "not found" text
A first torb add prints the owner line (kind, age in years or days, verified domain when present) and a second one for a package already locked does not; --offline works from the cache
torb owner list shows kind, elsewhere and domain
docs/tooling/torb-add.md, torb-owner.md, RELEASE.md 7.13 "as built" and generated skills/ in step; sh tools/gates.sh a green in forge CI

Seed impact

No: TorbScript in compiler/src/package, no new native, no driver flag.

Size

One PR, two Conventional Commits: (1) feat(compiler): owner file fetch and the elsewhere message; (2) feat(compiler): owner line of torb add, torb owner list, docs. Worker: sonnet/medium is enough only for docs; implement with opus/high (compiler/src).

Dependencies

Needs #19 (record format, reader, signature). Prints a domain only if #341 has landed; works without it. Definition of ready is met; the label ready follows when #19 has landed.

## Context The client side of "elsewhere" owners and verified domains (RELEASE.md 7.1, 7.6, 7.13): when `torb add` or a resolution asks the public registry for a package of an owner that publishes elsewhere, the user should read "`acme` publishes at <url>; bind it with `registry "acme", url: ...`" instead of "no such package", and `torb add` should print the owner, its verification and its age for a package it has never seen (7.6, Typosquatting row). Follows #19. ## What exists today (main `787f63f`) - The client reads `<registry>/index/<owner>/<name>.trb`; a 404 is "the registry does not have it" (7.13). `compiler/src/package/registry.trb` fetches and caches index files, pins keys, checks every record's signature (7.14); `torb add` prints deprecation notices from the index it read (`compiler/src/package/audit.trb`, `docs/tooling/torb-add.md`). - `owner.trb` is never fetched or read. `torb owner list` shows members only. ## Source - [RELEASE.md section 7.1](https://git.torb.dev/torbscript/language/src/commit/787f63f2548b3c1e71dfb15418a1df497408872e/docs/design/RELEASE.md#L866), [7.6 Typosquatting](https://git.torb.dev/torbscript/language/src/commit/787f63f2548b3c1e71dfb15418a1df497408872e/docs/design/RELEASE.md#L1076), [7.13](https://git.torb.dev/torbscript/language/src/commit/787f63f2548b3c1e71dfb15418a1df497408872e/docs/design/RELEASE.md#L1497) - [ROADMAP.md, the package manager](https://git.torb.dev/torbscript/language/src/commit/787f63f2548b3c1e71dfb15418a1df497408872e/docs/ROADMAP.md#L96) ## Design record point 7.1 "Elsewhere" row and 7.6 (dependency confusion; typosquatting: "`torb add` printing the owner, its verification and its age for a package it has never seen"). ## Design (decided by the loop, see the comment of 2026-10-12) - **On a 404 of a package file** from a registry that serves `index/config.trb`, the client fetches `index/<owner>/owner.trb`, verifies its signature with the keys it trusts (7.14), and if it has `elsewhere:` fails with that message. No owner file (404) or a registry without keys: the usual "not found". A bad signature is a refusal, never trusted. The URL is **only printed**, never bound or fetched automatically; when its host is under the owner's verified `domain:` the line adds "(verified domain acme.com)", otherwise nothing is claimed. - **`torb add <owner/name>` for a package not yet in the lock** prints one line after success: `owner acme (organisation, 3 years old, verified domain acme.com)`; a person owner prints `(person, ...)`; unverified prints no domain. Read from the same signed file; absent file prints nothing. `--offline` uses the cached copy. - `torb owner list` also prints kind, `elsewhere` and `domain` from the API's `OwnerView`. - File layout and cache: `<cache>/index/<registry>/` like index files. ## Acceptance criteria - [ ] `compiler/tests` / `tools/registry/tests/client.test.trb`: against the registry's files over HTTP, `torb add` of a package of an elsewhere owner fails with the message naming the URL and the `registry "acme", url:` line; a tampered or unsigned `owner.trb` is a refusal; no `owner.trb` leaves the old "not found" text - [ ] A first `torb add` prints the owner line (kind, age in years or days, verified domain when present) and a second one for a package already locked does not; `--offline` works from the cache - [ ] `torb owner list` shows kind, elsewhere and domain - [ ] `docs/tooling/torb-add.md`, `torb-owner.md`, RELEASE.md 7.13 "as built" and generated `skills/` in step; `sh tools/gates.sh a` green in forge CI ## Seed impact No: TorbScript in `compiler/src/package`, no new native, no driver flag. ## Size One PR, two Conventional Commits: (1) `feat(compiler)`: owner file fetch and the elsewhere message; (2) `feat(compiler)`: owner line of `torb add`, `torb owner list`, docs. Worker: sonnet/medium is enough only for docs; implement with opus/high (`compiler/src`). ## Dependencies Needs #19 (record format, reader, signature). Prints a domain only if #341 has landed; works without it. Definition of ready is met; the label `ready` follows when #19 has landed.

orion added the

loop

label

2026-10-12 16:27:07 +00:00

orion referenced this issue

2026-10-12 16:27:14 +00:00

registry: "elsewhere" owners and the signed owner file #19

orion added a new dependency

2026-10-12 16:27:15 +00:00

#19 registry: "elsewhere" owners and the signed owner file

orion commented

2026-10-12 16:27:30 +00:00

Author

Collaborator

[loop:torbscript] refine: split from #19 (see the decision comment there). Definition of ready met in content (state of main, design record point, testable criteria, seed impact: no, size); depends on #19, so the label ready follows when it has landed, next: waiting (depends on #19)

[loop:torbscript] refine: split from #19 (see the decision comment there). Definition of ready met in content (state of main, design record point, testable criteria, seed impact: no, size); depends on #19, so the label `ready` follows when it has landed, next: waiting (depends on #19)

orion referenced this issue

2026-10-12 16:27:31 +00:00

registry: "elsewhere" owners and the signed owner file #19

orion referenced this issue

2026-10-12 16:27:32 +00:00

registry: "elsewhere" owners and the signed owner file #19

orion referenced this issue

2026-10-12 17:15:38 +00:00

feat(registry): organisations that publish elsewhere, and the signed owner file #347

orion added the

ready

label

2026-10-12 21:34:15 +00:00

orion commented

2026-10-12 21:34:16 +00:00

Author

Collaborator

[loop:torbscript] refine: dependency #19 landed (PR #347), label ready set, next: implement

[loop:torbscript] refine: dependency #19 landed (PR #347), label `ready` set, next: implement

orion commented

2026-10-12 22:03:21 +00:00

Author

Collaborator

[loop:torbscript] claim implement by session:loop-torbscript-20261013 until 2026-10-13T04:03Z

orion referenced this issue from a commit

2026-10-12 22:18:37 +00:00

feat(compiler): owner file fetch and the elsewhere message

orion referenced this issue from a commit

2026-10-12 22:18:37 +00:00

feat(compiler): owner line of torb add, torb owner list, docs

orion referenced this issue from a pull request that will close it,

2026-10-12 22:18:53 +00:00

feat(compiler): show elsewhere owners and owner verification #354

orion referenced this issue from a commit

2026-10-12 23:00:10 +00:00

feat(compiler): owner line of torb add, torb owner list, docs

orion referenced this issue from a commit

2026-10-12 23:05:46 +00:00

feat(compiler): owner file fetch and the elsewhere message

orion referenced this issue from a commit

2026-10-12 23:05:46 +00:00

feat(compiler): owner line of torb add, torb owner list, docs

orion commented

2026-10-13 03:42:29 +00:00

Author

Collaborator

[loop:torbscript] implement: the worker ended on a session limit after opening PR #354 (head 4de33d0d); all required forge CI jobs are green and the merge gate's review is requested, next: waiting (merge gate review of PR #354)

[loop:torbscript] implement: the worker ended on a session limit after opening PR https://git.torb.dev/torbscript/language/pulls/354 (head 4de33d0d); all required forge CI jobs are green and the merge gate's review is requested, next: waiting (merge gate review of PR #354)

orion referenced this issue from a commit

2026-10-13 04:28:46 +00:00

feat(compiler): owner file fetch and the elsewhere message

orion referenced this issue from a commit

2026-10-13 04:28:46 +00:00

feat(compiler): owner line of torb add, torb owner list, docs

orion referenced this issue from a commit

2026-10-13 04:29:29 +00:00

feat(compiler): owner file fetch and the elsewhere message

orion referenced this issue from a commit

2026-10-13 04:29:29 +00:00

feat(compiler): owner line of torb add, torb owner list, docs