npm publish --provenance failed with E422: the registry compares
package.json repository.url against the OIDC provenance claim
BYTE-FOR-BYTE. "holetron-lab" vs GitHub-canonical "Holetron-lab"
is a hard reject, not cosmetics. Do not lowercase these again.
Also drops the "./" from bin — npm rewrites it on publish anyway
and prints a warning that reads like the bin was dropped.
- name: io.github.holetron-lab/fleet-memory -> ai.rcll/fleet-memory
DNS-verified namespace on a domain we renew ourselves. The io.github.*
namespace is authorised by a GitHub account; io.github.holetron died with
a suspended account and is unrecoverable. Do not repeat that exposure.
- description: 176 -> 95 chars. ServerDetail.description has maxLength 100;
the previous value would have been rejected at publish time.
- repository.id: pinned to GitHub repo id 1344503808 (resurrection-attack
guard - the id changes if a repo is deleted and recreated).
- repository.url stays on github.com: the registry validator hard-matches
^https?://(www\.)?github\.com/... or gitlab.com and rejects anything
else, so the canonical forge URL cannot go in this field. rcll.ai carries
it instead (websiteUrl), and the site names the forge as canonical.
- mcp-server/package.json mcpName must equal the server name exactly; the
registry reads it from the PUBLISHED npm version metadata, so this had to
change before the first publish, not after.
Published package metadata cannot be changed without shipping another
version, so this has to land before 0.1.0 goes out, not after.
- repository/homepage/bugs were all missing: the npm page would have
rendered with no link back to the source at all. repository names the
GitHub mirror deliberately — npm tooling and the --provenance
attestation are keyed to the repo the workflow builds in; the canonical
repository is stated in the README instead.
- README is the npm page body. Its Quick Start opened with `cd
mcp-server && npm install`, which is the from-a-clone path — the one
instruction that cannot work for somebody who just installed the
package. `npx fleet-memory-mcp` first, clone path kept below it, and a
line saying this package is the client half and does not start a store.
- LICENSE was not in the tarball. MIT text now ships with the artifact,
Vectorize AI copyright intact.
- engines and an explicit files list, so the tarball contents are stated
rather than inferred.
The repository, the npm package and the container image are now
fleet-memory; RCLL stays the product and documentation brand (rcll.ai).
- server.json / package.json: io.github.holetron-lab/fleet-memory,
npm identifier fleet-memory-mcp
- env chain is two names, not three: FLEET_URL/FLEET_BANK with the
pre-rebrand HINDSIGHT_URL/MEMPALACE_BANK still read as a fallback.
RCLL_URL/RCLL_BANK and bank rcll-main never shipped — nothing was
published under rcll-mcp — so they are dropped rather than carried.
- default bank is fleet-main; hindsight-mempalace-mcp@1.0.0 users are
told on stderr that their memory is in mempalace-main
- rooms are described as topic scoping over one shared store, not
per-agent isolation: the read path filters on the room list the
caller passes and has no notion of caller identity
