feat(oci): set OCI manifest annotations so wasm.directory listings aren't bare - #328
Merged
Merged
Conversation
…en't bare
Comparing our listing against a rich one showed the gap plainly:
wasm.directory/pulseengine/falcon-mixer/1.130.0 -> "No description
available", no license, no repository link, no authors.
wasm.directory/autostamp/amadeus/0.5.0... -> description, license,
source link, publication date.
Root cause, and it corrects an assumption of mine: the listing renders STANDARD
OCI MANIFEST ANNOTATIONS, not the wasm's embedded package-metadata section.
Our manifests carried NO annotations ({}), so the crate metadata added in #313/
#324 never reached the page. amadeus's manifest carries
org.opencontainers.image.{description,licenses,source,title,version,created}.
Push those annotations explicitly (`wkg oci push --annotation KEY=value`, which
wkg supports), for both the version and :latest refs: title, description,
version, licenses, source, documentation, vendor, revision (the release SHA) and
created (RFC-3339). Descriptions are read from each component crate's
Cargo.toml at push time rather than duplicated into the workflow, so there is
one source of truth; verified the extraction resolves for all six slugs
including the mixer -> falcon-mixer directory mismatch, with a fallback if a
crate ever lacks one.
Docs corrected in the same commit — the previous text asserted the embedded
package-metadata drove the listing, which the evidence above disproves.
Takes effect on the next release; no code or component change.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG
avrabe
enabled auto-merge (squash)
August 5, 2026 06:12
avrabe
added a commit
that referenced
this pull request
Aug 5, 2026
…P06 (#331) * verify(oci): record the v1.131 no-grow + annotations evidence; defer P06 to v1.132 Code-free. Records three follow-on defects found and fixed since v1.130, each measured on the artifact rather than argued, against the requirement they strengthen (SWREQ-FALCON-OCI-P01, already verified): (v) NO-GROW (#327) — the v1.130 cabi_realloc fix satisfied the ABI with a GROWING allocator, so the shipped component carried `memory.grow`: precisely what makes `meld fuse --memory shared --address-rebase` reject a component (gale#89, meld#299). The fix partly re-blocked the MCU lowering it exists to serve. Replaced with a bounded static work-memory arena; memory.grow 1 -> 0. (vi) ROOT CAUSE — TARGET (#329) — `target_env = "p2"` is the wasip2 RUST TARGET, which links wasi-libc, whose cabi_realloc goes through malloc. A component does not need that target to be a valid P2 component. no_std components now build wasm32-unknown-unknown. (vii) LISTING METADATA (#328) — wasm.directory renders standard OCI MANIFEST ANNOTATIONS, not the embedded package-metadata. Our manifests carried none, so falcon-mixer:1.130.0 listed as "No description available" despite complete crate metadata. Also corrects an explicit claim in docs/OCI-DISTRIBUTION.md. Scope move, explicit: SWREQ-FALCON-MATHF32-P06 (Cody-Waite argument reduction) v1.131 -> v1.132. It is the hardest of the four proofs and is not ready; v1.131 is a fix release whose job is publishing the no-grow components and non-bare listings. Deferring is a decision, not a silent slip. rivet validate: PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG * chore: re-trigger CI to pick up the Verify-Filter scope The gate reads `github.event.pull_request.body` from the EVENT PAYLOAD, not a live fetch, so editing the PR body does not change what a re-run sees — only a new pull_request event does. Empty commit to emit one. Scoping this PR with `Verify-Filter: (has-tag "oci")`: the unscoped ~370-step sweep timed out at 90 minutes TWICE on this two-file artifact change (263 PASS / 0 FAIL both times — out of clock, not out of correctness). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HvusAXYbHLyv3uTzfBcMbG --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gap, seen by comparison
pulseengine/falcon-mixer/1.130.0autostamp/amadeus/0.5.0…Root cause — and it corrects an assumption of mine
The listing page renders standard OCI manifest annotations, not the wasm's embedded
package-metadatasection. Our manifests carried no annotations at all ({}), so the crate metadata added in #313/#324 never reached the page. amadeus's manifest carries:I'd previously documented the opposite; the doc is corrected in this commit.
The fix
wkg oci pushsupports--annotation KEY=value, so the release now sets them on both the version and:latestrefs:title·description·version·licenses(Apache-2.0) ·source·documentation·vendor·revision(release SHA) ·created(RFC-3339)Descriptions are read from each component crate's
Cargo.tomlat push time rather than duplicated into the workflow — one source of truth, and those descriptions were already written for an outside reader. Verified the extraction resolves for all six slugs, including themixer→falcon-mixerdirectory mismatch, with a fallback if a crate ever lacks one.Takes effect on the next release. No code or component change — annotations are manifest-level, so the payloads (and their component headers) are untouched.
🤖 Generated with Claude Code