genesis-stack 1.1.5 → 1.2.0

package/README.md

@@ -68,3 +68,43 @@ project's complete reviewed section wins; a catalog upgrade never rewrites it.
 Projects with different output ids or commands must review the proposal during
 preparation. A project can omit estimates and use its host's generic starting
 policy. Neither the catalog nor the project stores host observations or limits.
+
+## Connected package defaults
+
+Each package-ecosystem language piece proposes Vibe64's opaque
+`Connected development` section containing only
+`- Default package type: \`<type>\``:
+
+| Piece | Default |
+| --- | --- |
+| `nodejs` | `npm` |
+| `php` | `composer` |
+| `python` | `pip` |
+| `ruby` | `bundler` |
+| `go` | `gomod` |
+| `rust` | `cargo` |
+| `java` | `maven` |
+| `kotlin` | `gradle` |
+| `csharp` | `nuget` |
+| `laravel` | `composer` |
+
+Laravel requires `php` and `nodejs`, so its proposal supersedes theirs; npm
+front-end repositories can still declare an explicit `npm` type per connection.
+`cpp` and `shell` propose no default: their connections use an explicit
+`custom` type with a project script. Selecting several unrelated languages
+leaves the section as a project decision: `genesis stack add` succeeds, reports
+`STACK_SECTION_AMBIGUOUS` with each proposal, and the project authors one
+section choosing its default.
+
+Vibe64 can inspect this default without treating it as a prepared development
+recipe. The project must add its real source-map, preparation and verification
+declarations before connected development can run; no repositories or commands
+are inferred from selecting a language. A project-owned section wins unchanged,
+including an explicit different default.
+
+For an existing current-format project whose selected catalog gains this
+proposal, Genesis reports `STACK_PROJECT_CONTRACTS_INCOMPLETE` if the project
+section is missing. Explicitly reconcile the already-selected Stack with
+`genesis stack add <component>`, then review the materialized contract. Older project
+formats use the normal `genesis migrate` workflow. Catalog updates never install
+a hidden runtime default or rewrite an existing project section.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-stack",
-  "version": "1.1.5",
+  "version": "1.2.0",
   "description": "The optional curated technology Stack catalog for Genesis projects.",
   "type": "module",
   "repository": {

package/stacks/pieces/cpp.md

@@ -38,6 +38,19 @@ C and C++ translation-unit, header, callable, ownership, build, and test convent
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- This component has no package-ecosystem default and proposes no
+  `## Connected development` section. A connection it consumes should use an
+  explicit `custom` type with a project-defined script, for example a CMake
+  build that uses the connected source. When a project selects several
+  languages, its own complete `## Connected development` section chooses the
+  one default.
+- A proven custom treatment for CMake FetchContent: the project script
+  configures an untracked build tree with
+  `-DFETCHCONTENT_SOURCE_DIR_<UPPERNAME>=<source root>`, so `CMakeLists.txt`
+  stays unchanged, and verifies from `compile_commands.json` that the
+  dependency's sources come from the connected checkout rather than a
+  `_deps/*-src` download. The project owns the repository-to-dependency name
+  mapping.
 
 ## Adoption
 

package/stacks/pieces/csharp.md

@@ -28,6 +28,25 @@ C# namespace, public type, dependency, lifecycle, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `nuget`. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `nuget` treatment. Do not invent a
+  working recipe from the component name.
+- A proven NuGet treatment: Prepare writes an untracked, Git-excluded
+  `Directory.Build.targets` beside each consuming project that replaces the
+  connected `PackageReference` with a `ProjectReference` to the checkout's
+  project and moves the restore lock under `obj/`, so project files,
+  `nuget.config` and `packages.lock.json` stay unchanged and no shadow package
+  enters a NuGet cache. Do not restore in locked mode while connected. Verify
+  that `obj/project.assets.json` resolves each package as a project at its
+  source root.
+
+## Connected development
+
+- Default package type: `nuget`
 
 ## Deslop
 

package/stacks/pieces/go.md

@@ -28,6 +28,23 @@ Go package, exported callable, interface, concurrency, resource, and test conven
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `gomod`. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `gomod` treatment. Do not invent a
+  working recipe from the component name.
+- A proven Go modules treatment: Prepare writes an untracked, ignored `go.work`
+  at the module root with `use . <source root>...` (also ignore
+  `go.work.sum`). Workspace modules replace the required versions, so `go.mod`
+  and `go.sum` stay unchanged. Verify `go env GOWORK` and that
+  `go list -deps ./...` loads each connected module from its source root, then
+  `go build ./...`. Do not set `-mod=mod` or run `go work sync` while connected.
+
+## Connected development
+
+- Default package type: `gomod`
 
 ## Deslop
 

package/stacks/pieces/java.md

@@ -28,6 +28,26 @@ Java package, public type, dependency, lifecycle, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `maven`. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `maven` treatment. Do not invent a
+  working recipe from the component name.
+- A proven Maven treatment (Maven 3.9.3+): Prepare installs each connected
+  checkout into an untracked project-local repository chained in front of the
+  user's, `mvn -f <source root> install -Dmaven.repo.local=<project
+  repository> -Dmaven.repo.local.tail=<user repository>`, and writes the same
+  two arguments to an ignored `.mvn/maven.config`, so ordinary `mvn` commands
+  resolve the connected build under unchanged coordinates and `pom.xml` stays
+  unchanged. Verify resolves the classpath through Maven and requires the jar
+  to match the checkout's freshly built one. Run Prepare again after editing
+  connected source.
+
+## Connected development
+
+- Default package type: `maven`
 
 ## Deslop
 

package/stacks/pieces/kotlin.md

@@ -28,6 +28,24 @@ Kotlin package, public callable, coroutine, nullability, build, and test convent
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `gradle`. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `gradle` treatment. Do not invent a
+  working recipe from the component name.
+- A proven Gradle treatment: Prepare writes an ignored init script, such as
+  `.development/connected.init.gradle.kts`, containing
+  `settingsEvaluated { includeBuild("<source root>") }`, and connected launches
+  pass `-I <init script>`; Gradle substitutes the matching `group:name` with
+  the included build from source, so no tracked settings or lockfiles change.
+  Verify resolves `runtimeClasspath` and requires each connected artifact to
+  come from an included build inside its source root.
+
+## Connected development
+
+- Default package type: `gradle`
 
 ## Deslop
 

package/stacks/pieces/laravel.md

@@ -46,6 +46,22 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
   never accept an administrator flag from JSON. Keep commands usable from an
   ordinary CLI outside the editor. Verify with native tests and controlled
   provider fixtures; no Node or JSKIT runtime is required for integrations.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `composer`; because Laravel requires `php` and
+  `nodejs`, it supersedes their proposals. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An npm front-end repository can
+  set an explicit `npm` type for its connection, and an explicit `custom`
+  connection uses its project-defined script. Do not invent a working recipe
+  from the component name.
+- A proven Composer treatment: Prepare writes an untracked derived manifest,
+  such as `composer.connected.json`, that adds a first `path` repository
+  (`symlink: true`, locked version pinned) for each connected source, copies
+  `composer.lock` to the matching derived lock and runs
+  `COMPOSER=<derived manifest> composer update <connected packages>`. The
+  tracked `composer.json` and `composer.lock` stay unchanged. Verify checks
+  `InstalledVersions::getInstallPath()` against each source root.
 
 ## Adoption
 
@@ -88,6 +104,10 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
 
 - Verify `application`: `php` `artisan` `test`
 
+## Connected development
+
+- Default package type: `composer`
+
 ## Deslop
 
 - Preserve Laravel's container, providers, middleware, policies, requests,

package/stacks/pieces/nodejs.md

@@ -28,6 +28,19 @@ Node.js package, command, module, dependency, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `npm`. It does not declare repositories or executable
+  preparation. When connected development is needed, preserve that default in
+  the complete project-owned section and declare the application's real source
+  map, preparation and verification commands. An explicit `custom` connection
+  uses its project-defined script instead of npm treatment. Do not invent a
+  working recipe from the component name.
+- A proven npm treatment: Prepare runs
+  `npm install --no-save --install-links=false <source root>...` for the
+  connected dependencies, which links each checkout into `node_modules` while
+  `package.json` and `package-lock.json` stay unchanged; Verify resolves each
+  package from the application root and fails unless it resolves to its
+  connected source root. An ordinary `npm ci` restores the published packages.
 
 ## Adoption
 
@@ -63,6 +76,10 @@ Node.js package, command, module, dependency, and test conventions.
   estimate for the same process tree. Host measurements and owner limits stay
   in runtime-local state, not in this source contract.
 
+## Connected development
+
+- Default package type: `npm`
+
 ## Deslop
 
 - Preserve the package's existing module system, package manager, public

package/stacks/pieces/php.md

@@ -28,6 +28,24 @@ PHP package, namespace, callable, dependency, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `composer`. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `composer` treatment. Do not invent
+  a working recipe from the component name.
+- A proven Composer treatment: Prepare writes an untracked derived manifest,
+  such as `composer.connected.json`, that adds a first `path` repository
+  (`symlink: true`, locked version pinned) for each connected source, copies
+  `composer.lock` to the matching derived lock and runs
+  `COMPOSER=<derived manifest> composer update <connected packages>`. The
+  tracked `composer.json` and `composer.lock` stay unchanged. Verify checks
+  `InstalledVersions::getInstallPath()` against each source root.
+
+## Connected development
+
+- Default package type: `composer`
 
 ## Deslop
 

package/stacks/pieces/python.md

@@ -28,6 +28,24 @@ Python package, module, callable, dependency, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `pip`. It does not declare repositories or executable
+  preparation. When connected development is needed, preserve that default in
+  the complete project-owned section and declare the application's real Sources
+  file and Prepare/Verify commands. An explicit `custom` connection uses its
+  project-defined script instead of `pip` treatment. Do not invent a working
+  recipe from the component name.
+- A proven pip treatment: install into an untracked virtual environment in one
+  resolution, `pip install -r <requirements> -e <source root>...` (or uv's
+  `uv pip install --python .venv/bin/python ...`), so each editable checkout
+  satisfies the application's own requirement. Verify that each package's
+  PEP 610 `direct_url.json` is editable with the source root's `file:` URL and
+  that its modules import from there. Do not use `uv sync`, which needs tracked
+  `[tool.uv.sources]` and lockfile changes.
+
+## Connected development
+
+- Default package type: `pip`
 
 ## Deslop
 

package/stacks/pieces/ruby.md

@@ -28,6 +28,25 @@ Ruby module, class, callable, dependency, lifecycle, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `bundler`. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `bundler` treatment. Do not invent
+  a working recipe from the component name.
+- A proven Bundler treatment: Prepare writes an untracked `Gemfile.connected`
+  that switches each connected gem to `path: <source root>` and then
+  `eval_gemfile`s the tracked Gemfile, seeds `Gemfile.connected.lock` from
+  `Gemfile.lock`, and selects it with `bundle config set --local gemfile
+  Gemfile.connected`. The tracked `Gemfile` and `Gemfile.lock` stay unchanged.
+  Launch through `bundle exec` or export `BUNDLE_GEMFILE`: a plain
+  `require "bundler/setup"` launch ignores that setting. `local.<gem>` covers
+  only git sources. Verify that each spec loads from its source root.
+
+## Connected development
+
+- Default package type: `bundler`
 
 ## Deslop
 

package/stacks/pieces/rust.md

@@ -28,6 +28,24 @@ Rust module, public item, ownership, error, async, Cargo, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed `## Connected development` section declares Vibe64's default
+  connected package type, `cargo`. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `cargo` treatment. Do not invent a
+  working recipe from the component name.
+- A proven Cargo treatment: Prepare writes an untracked, ignored
+  `.cargo/config.toml` with `[patch.crates-io]` (or `[patch."<git url>"]`)
+  `<crate> = { path = "<source root>" }` and `resolver.lockfile-path` pointing
+  at an untracked copy of `Cargo.lock`; a patch otherwise rewrites the tracked
+  lockfile. This requires Cargo 1.97 or later. Verify with
+  `cargo metadata --locked` that each crate resolves from its source root with
+  no registry source, then `cargo build --locked`.
+
+## Connected development
+
+- Default package type: `cargo`
 
 ## Deslop
 

package/stacks/pieces/shell.md

@@ -28,6 +28,11 @@ Shell script function, process, environment, portability, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- This component has no package-ecosystem default and proposes no
+  `## Connected development` section. A connection it consumes should use an
+  explicit `custom` type with a project-defined script. When a project selects
+  several languages, its own complete `## Connected development` section
+  chooses the one default.
 
 ## Deslop