Split out of #18058's dispatch round (report 5711356635) rather than folded in — #18058 is now a decision card and this is a separate, independently actionable contract violation. ⛔ Not filed by the dev (devs do not POST issues); filed by the domain:spec seat.
Measured
Driven against the real HttpDispatcher over a real SchemaRegistry, same dispatcher and same run:
POST /api/v1/packages/install -> handled=false status=undefined body=undefined
POST /api/v1/packages -> handled=true status=201
Seat-side confirmation, independent of the report: the literal packages/install resolves in exactly two files under packages/, and both are the declaration and its own pin — packages/spec/src/api/package-api.zod.ts and packages/spec/src/api/package-api.test.ts. Nothing mounts it. packages/rest's registrar mounts only /packages/publish.
- Lit control:
packages/publish resolves in 6 files including real source (packages/client/src/index.ts) — so the grep does reach mount sites.
- Dark control:
packages/zzznosuch = 0.
Why it is class (b)
A machine-readable surface states something untrue: the contract declares a route binding for a path that does not exist, while the path that DOES exist carries no declared request contract at all. AGENTS.md's 「Route and surface ownership」 rule 4 and Prime Directive #10 both name this shape.
⚠️ The consequence is not cosmetic. Anything generated from or validated against the route ledger — docs, clients, conformance — inherits a route that answers nothing.
⛔ Scope fence
This card records the phantom binding. It does ⛔ not decide whether the remedy is to rebind the contract to the live path or to remove it — that is #18058's question and it is in the decision box with a 四棱 analysis. Whoever takes this card should check #18058's state first; if it has been ruled, execute that ruling here rather than re-opening it.
Dedupe words: PackageApiContracts installPackage, packages/install phantom route, route-ledger path nothing mounts, POST /api/v1/packages no declared contract, machine-readable surface must not lie.
Generated by Claude Code
Split out of #18058's dispatch round (report
5711356635) rather than folded in — #18058 is now a decision card and this is a separate, independently actionable contract violation. ⛔ Not filed by the dev (devs do not POST issues); filed by thedomain:specseat.Measured
Driven against the real
HttpDispatcherover a realSchemaRegistry, same dispatcher and same run:Seat-side confirmation, independent of the report: the literal
packages/installresolves in exactly two files underpackages/, and both are the declaration and its own pin —packages/spec/src/api/package-api.zod.tsandpackages/spec/src/api/package-api.test.ts. Nothing mounts it.packages/rest's registrar mounts only/packages/publish.packages/publishresolves in 6 files including real source (packages/client/src/index.ts) — so the grep does reach mount sites.packages/zzznosuch= 0.Why it is class (b)
A machine-readable surface states something untrue: the contract declares a route binding for a path that does not exist, while the path that DOES exist carries no declared request contract at all.
AGENTS.md's 「Route and surface ownership」 rule 4 and Prime Directive #10 both name this shape.⛔ Scope fence
This card records the phantom binding. It does ⛔ not decide whether the remedy is to rebind the contract to the live path or to remove it — that is #18058's question and it is in the decision box with a 四棱 analysis. Whoever takes this card should check #18058's state first; if it has been ruled, execute that ruling here rather than re-opening it.
Dedupe words:
PackageApiContracts installPackage,packages/install phantom route,route-ledger path nothing mounts,POST /api/v1/packages no declared contract,machine-readable surface must not lie.Generated by Claude Code