Context
ADR-0048 v1 shipped the install-time namespace gate (#1810): SchemaRegistry.installPackage throws NamespaceConflictError when a package's namespace is already owned by a different installed package (shareable base/system/sys exempt; same-package reinstall allowed; OS_METADATA_COLLISION=warn downgrades to a warning).
That protects a single environment at install time. The original ADR discussion also raised a publish-time / marketplace half that was deferred: when a vendor publishes a package to the platform/marketplace, the platform should register and exclusively reserve its namespace globally, so two vendors can't both ship crm and collide on a tenant that installs both.
Why install-time alone isn't enough
- Install-time only catches a conflict after both packages reach the same env. The marketplace can prevent the conflict before distribution.
- Local dev can't be policed (no central authority) — that's accepted. The marketplace IS the central authority, so it can enforce.
- Reverse-domain package ids are globally unique (route/identity key, ADR-0048 option A); namespaces (object table prefixes) are not, and a namespace collision is what actually breaks the DB/table layer.
Scope (open-source vs enterprise)
This is enterprise/marketplace surface. The open-source repo keeps the install-time gate + federation hooks; the registration/exclusivity service likely lives in the private marketplace backend. Define the contract here, implement enforcement in the enterprise tier.
Proposed direction (needs ADR-0048 addendum)
- Publish API: on publish, reserve
(namespace → owning package id / vendor) in a platform registry; reject a publish whose namespace is owned by a different vendor.
- Rename / transfer flow: deferred in the original ADR ("暂不考虑"); revisit whether a vendor can rename a namespace or transfer ownership.
- Install-time cross-check: optionally consult the platform registry at install so a sideloaded package whose namespace is reserved by another vendor is flagged.
- Tenant override / alias: per the ADR, namespace may carry a per-tenant friendly alias distinct from the global reservation — confirm how that interacts with exclusivity.
Open questions
- Granularity of reservation: namespace only, or
(namespace, version-range)?
- What about shareable namespaces (
base/system/sys) and platform-owned ones?
- Grandfathering already-published packages with colliding namespaces.
Acceptance
- Publishing two different vendors' packages that claim the same namespace is rejected at publish time with a clear error.
- Documented contract so the open-source install-time gate and the enterprise publish-time gate compose without drift.
Related: ADR-0048, #1810 (install-time gate).
Context
ADR-0048 v1 shipped the install-time namespace gate (#1810):
SchemaRegistry.installPackagethrowsNamespaceConflictErrorwhen a package's namespace is already owned by a different installed package (shareablebase/system/sysexempt; same-package reinstall allowed;OS_METADATA_COLLISION=warndowngrades to a warning).That protects a single environment at install time. The original ADR discussion also raised a publish-time / marketplace half that was deferred: when a vendor publishes a package to the platform/marketplace, the platform should register and exclusively reserve its namespace globally, so two vendors can't both ship
crmand collide on a tenant that installs both.Why install-time alone isn't enough
Scope (open-source vs enterprise)
This is enterprise/marketplace surface. The open-source repo keeps the install-time gate + federation hooks; the registration/exclusivity service likely lives in the private marketplace backend. Define the contract here, implement enforcement in the enterprise tier.
Proposed direction (needs ADR-0048 addendum)
(namespace → owning package id / vendor)in a platform registry; reject a publish whose namespace is owned by a different vendor.Open questions
(namespace, version-range)?base/system/sys) and platform-owned ones?Acceptance
Related: ADR-0048, #1810 (install-time gate).