fix(npm): follow the registry identifier to the bytefolk namespace - #162
Merged
Merged
Conversation
This was referenced Sep 3, 2026
The repository moved to `bytefolk`, and the official MCP Registry derives an entry's namespace from the repository owner. `mcpName` still named the organization this repository used to belong to, so a submission carrying it either resolves to a namespace we do not control or is rejected outright. That is the whole of why the registry listing has never appeared: nothing else about the server was missing. `mcpName` becomes `io.github.bytefolk/mem-mcp` in both manifests that carry it (`npm/server.json`, `npm/package.json`). Deliberately unchanged: - The npm package stays `@fullstack-ai-infra/mem-mcp`. A registry identifier and an npm package identifier are different namespaces, and moving the package would break every existing `"args": ["-y", "@fullstack-ai-infra/mem-mcp"]` client config and every cached install path for no registry-side gain. - The installer's cache directory, which is also keyed on the old name, keeps its path. Renaming it would discard working caches to change a folder name. - The version stays 0.1.1 here. `scripts/validate_release_version.sh` pins `npm/server.json` to the tagged version, so the bump belongs to the release that carries it, not to this change. `npm/registry-identity.test.js` is added because the failure was a stale string in a manifest, and a rename is exactly the event that makes a manifest stale. It derives the expected namespace from the repository coordinate the installer itself downloads from, so it follows a future rename instead of asserting one particular spelling, and it pins the two manifests against each other. Verified by mutation: leaving `mcpName` on the old organization fails two of the three cases, and renaming only the repository coordinate fails the third. Refs #153 for the registry half only. That issue's title and scope ask for the npm package to move to `@bytefolk/mem-mcp` as well, and the 2026-09-03 decision is to keep the published scope. #153 should be rewritten to say so: as long as it reads "migrate mem-mcp to @bytefolk/mem-mcp", the next person who picks it up will move the scope and undo the part that is not up for grabs.
waterbro-8
force-pushed
the
feat/153-registry-namespace-mem-mcp
branch
from
September 6, 2026 01:52
9ab0db4 to
e7fdc03
Compare
PeterGuy326
approved these changes
Sep 6, 2026
PeterGuy326
left a comment
PeterGuy326
left a comment
Collaborator
There was a problem hiding this comment.
Independent review: the change keeps the published npm scope and only aligns both MCP Registry manifests with the current bytefolk/mem repository owner, adding a regression test for both manifests and the unscoped server name. The npm test suite passed locally (44 pass, 1 platform skip); required CI is green. This is safe to merge as the registry-identity half, while the separate npm-scope decision remains open. Approving for squash auto-merge.
PeterGuy326
enabled auto-merge (squash)
September 6, 2026 03:13
Local Verification Summary for Issue #104 (MCP Registry Listing)Branch tested: Issue #104 ContextIssue #104 tracks listing mem-mcp on MCP hubs (official MCP Registry, Smithery, Glama, PulseMCP). This PR addresses G5 (official MCP Registry) by fixing the stale Changes Verified
Test Results
Key Registry Identity Tests
Manifest Values Verified// npm/server.json
{
"mcpName": "io.github.bytefolk/mem-mcp",
"name": "mem-mcp",
"version": "0.1.1",
"repo": "https://github.com/bytefolk/mem"
}
// npm/package.json
{
"name": "@fullstack-ai-infra/mem-mcp",
"mcpName": "io.github.bytefolk/mem-mcp"
}Deliberate Non-Changes (Correct)
Mutation Testing (from PR description)
Next Steps for Issue #104 G5After this PR merges, the remaining step is running |
This was referenced Sep 6, 2026
PeterGuy326
disabled auto-merge
September 10, 2026 03:55
Collaborator
|
Decision update: #153 (comment) The npm target is now @bytefolk/mem-mcp@0.1.2. This PR's MCP Registry identity fix remains relevant, but its intentional old npm scope is no longer the selected release shape. It will be integrated with the full migration under #153. Auto-merge has been disabled and verified; this is not a merge or a new approval. |
Collaborator
|
Current-main implementation candidate: #193, head Independent source preflight passed after reproducing and fixing a legacy-cache alias/data-loss edge case. The exact tested file tree was verified after upload. Fresh GitHub CI and human review are separate gates; #193 remains draft. No tag, release, npm publish or main merge has occurred. RC alignment/bootstrap and npm owner authentication/Trusted Publisher proof remain required. The previous candidates remain open pending review of this replacement; their historical green tests are not reused as current-head evidence. |
waterbro-8
added a commit
that referenced
this pull request
Sep 14, 2026
Resolves the only collision, in CHANGELOG.md's [Unreleased] "Fixed" list, by keeping both entries: this branch's CI Web bullet and main's #165 bullet about withholding unverifiable URL credentials. No duplicate "### Fixed" heading was introduced. main's "### Changed" side won on its own: the branch's "retaining the published npm scope, MCP identity, and existing cache paths" wording is false after #162 changed mcpName to io.github.bytefolk/mem-mcp, and the merged text no longer carries that clause. GOVERNANCE.md arrived from main without conflict because this branch never added one. This commit is the conflict resolution only; the CI evidence fixes follow.
waterbro-8
added a commit
that referenced
this pull request
Sep 17, 2026
## Canonical requirement Refs bytefolk/.github#32 - Canonical Issue URL: bytefolk/.github#32 - Consumed revision: R1 - No automatic close keywords: acknowledged Decision reference: the initial R1 Issue body. It explicitly records that local candidates preceded this prospective publication record; no retrospective approval is claimed. ## Requirement trace | REQ/AC IDs | Changed files / domain | Tests or review evidence | |---|---|---| | REQ-001 / AC-001 | 4 exact-pinned version annotations | Exact expected-byte replacement PASS | | REQ-002 / AC-002 | 2 files in bytefolk/mem | Repository inventory PASS; aggregate 7 repositories, 13 files, 21 lines | | REQ-003 / AC-003 | Existing workflow content and modes | Parsed YAML and comment-stripped bytes identical | | REQ-004 / AC-004 | Current-head CI and independent review | Local independent replay recorded in the canonical R1 Issue linked above; hosted CI collected on head `f464f686` (19 of 20 checks succeed, see Validation); independent human review requested and still pending | ## File domains `.github/workflows/bytefolk-scorecard.yml` (47); `.github/workflows/bytefolk-security.yml` (58, 65, 68). Prepared parent / merge base: `2986fe38175f54d99f15dd38a498708c6ecd88cd` PR base at publication: `87db0dfe0507be2190fe2fdcce0e267be8224f4d`. Since that baseline `main` advanced by six commits through `3c13f04e` (#162, #160, #165, #188, #158, #204) — not only `web/package-lock.json` as previously stated here. None of them touched `.github/workflows/`, so the F9 workflow blobs and the PR diff are unchanged. The reviewed commit and original parent are preserved. Head: `f464f68636adc6bb5295c3818aa6654c46a3caad` — `d2a9ec5` plus one non-forced `Merge branch 'main'` commit (`f464f686`) that brought the branch up to `3c13f04e` so it is no longer `BEHIND`. Verified: `git rev-parse d2a9ec5:.github/workflows/bytefolk-scorecard.yml` and `...:bytefolk-security.yml` return the same blobs (`2058126c`, `48a507e0`) as at `f464f686`, and `git diff main...f464f68` is still exactly these 2 files, `+4/-4`. The comment-only payload is therefore byte-identical to the reviewed commit and the equality proof above holds on the current head. ## Scope and non-goals Correct only `# v4.37.4` to `# v4.37.9` on CodeQL uses-lines pinned to `cdf488f595d80d6e07e03d4674febd5ab45fa938`. The [official tag object](https://api.github.com/repos/github/codeql-action/git/tags/a35ac6e6798d72df5475948b28efb89edc2e19ca) resolves to that existing pin. Action SHAs, permissions, triggers, steps, matrices, other pins, and runtime code are unchanged. ## Validation - Exact commands: `ruby evidence/verify.rb --baseline` and `ruby evidence/verify.rb --committed` from the retained review packet; `git diff --check 2986fe3 d2a9ec5` from this repository. - Observed counts/results: PASS 2/2 files and 4/4 replacements here; aggregate PASS 13/13 files and 21/21 replacements. Baseline intentionally exits 1 after detecting all 21 stale annotations; committed verification exits 0. - Check URLs: collected on head `f464f686` — 19 of 20 checks succeed. The single failure is [`HTTP, CLI and MCP lifecycle`](https://github.com/bytefolk/mem/actions/runs/34807101354/job/103861020551), whose log is `pull access denied for minio/minio` at ~13s: a container-image pull failure in an unrelated job. The same workflow was green on `main` at `3c13f04e`, and the identical failure is present on #198 and #199, so it is not caused by this comment-only change. Root-cause tracking is separate and open. The strict verifier checks the changed-file allowlist; exact old blobs and line inventory; complete expected-byte replacement; absence of stale target annotations; parsed YAML equality; comment-stripped byte equality and SHA-256 digests; whitespace and unchanged modes; one commit with the exact parent; and clean worktrees with no untracked files. All passed. The independent replay is recorded in canonical R1. The verifier and inventory are retained outside repository commits. | ID | REQ/AC | Observable acceptance criterion | Command or manual steps | Environment | Expected | Observed | Status | |---|---|---|---|---|---|---|---| | V1 | AC-001, AC-002, AC-003 | Exact annotations with executable YAML unchanged | `ruby evidence/verify.rb --committed` | Ruby 2.6.10, Psych 3.1.0, isolated review packet | Exact scoped replacements and equality | 2/2 files; 4/4 lines; all invariants pass | PASS | | V2 | AC-004 | Hosted checks on this exact head | Inspect this PR's checks at `f464f686` | GitHub Actions | Applicable checks succeed | 19 of 20 succeed; `HTTP, CLI and MCP lifecycle` fails on `pull access denied for minio/minio` (infra, unrelated job, also failing on #198/#199, green on `main`) | PARTIAL | ## Security and compatibility Documentation annotation only. No dependencies, permissions, credentials, data flows, or runtime behavior change. The diff and commit identity were inspected for public-safe content. No CHANGELOG entry or behavior-documentation update is needed because only explanatory comments change. ## Known limitations Runtime suites, build, coverage, and dependency audits were not rerun for this comment-only change; no runtime test result is claimed. Hosted CI is separate from local equality proof. Two limits now apply: (1) the strict verifier's `one commit with the exact parent` invariant describes the reviewed payload commit `d2a9ec5`, not the current branch shape, which carries two additional `Merge branch 'main'` commits; (2) this PR is **not merge-ready yet** — repository `AGENTS.md` step 6 requires passing CI *and* an approval from someone other than the author, and `HTTP, CLI and MCP lifecycle` is red on the unrelated `minio` pull, so the green-CI half is unmet until that infrastructure failure is fixed. ## Risk and rollback Low-risk annotation correction. Roll back through an ordinary revert of this single commit. There is no migration or release action. ## Product review handoff - Implementation/publication owner: @PeterGuy326 - Automated pre-review result: independent local replay recorded in R1; no human approval implied. - Human final review: PENDING; no human review requested by this publication. - Merge ledger owner: @PeterGuy326 - Product reviewer: @PeterGuy326 - Milestone or release packet: N/A: bounded documentation annotation maintenance - Merge, CI, release, and model judgment do not accept or close the Issue: acknowledged ## Maintenance update (2026-09-14, @waterbro-8) Records written by the maintainer account, not by the implementation owner: - `f464f686 Merge branch 'main'` was pushed to this head branch (non-forced, `main` at `3c13f04e` is an ancestor of the head) to clear the `BEHIND` state this PR's own body said blocked merging. No workflow file content changed: both blobs are identical to `d2a9ec5`. - The stale facts above were corrected in place: the recorded head SHA, the "Main advanced only `web/package-lock.json` in PR #192" claim, the `NOT VERIFIED` hosted-CI rows, and the "this is a draft, not merge-ready" note. - This PR was marked ready for review and an independent review was requested. The maintainer account that pushed the merge commit did **not** approve it: `AGENTS.md` step 6 requires an approval from someone other than the author, and a commit author on the head cannot supply that approval for their own push. `@PeterGuy326` remains implementation and merge-ledger owner. Co-authored-by: 勒布朗-詹姆斯 <2986253039@qq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
mcpNamebecomesio.github.bytefolk/mem-mcpinnpm/server.jsonandnpm/package.json. This implements the registry half of the 2026-09-03 decision that G5 does not wait on an npm scope migration.The official MCP Registry derives an entry's namespace from the repository owner. The value on
mainstill namesfullstack-ai-infra, which this repository no longer is, so a submission carrying it either points into a namespace we do not control or is rejected by namespace validation. That single stale string is why the registry listing never appeared — readingsearch=io.github.fullstack-ai-infraandsearch=bytefolkagainst the public registry API both returncount: 0, so there is no prior record to migrate over.What is deliberately not changed
@fullstack-ai-infra/mem-mcp"args": ["-y", "@fullstack-ai-infra/mem-mcp"]client config and every cached install for no registry-side gain.…/fullstack-ai-infra/mem-mcp0.1.1scripts/validate_release_version.sh:39pinsnpm/server.json's version to the tag, so the bump belongs to the release commit, not here.The resulting shape — npm scope
@fullstack-ai-infra, registry namespaceio.github.bytefolk— is intentional and is what the new test encodes, so it does not read as a half-finished migration.The guard
The defect was a stale string in a manifest, and a rename is precisely the event that makes a manifest stale, so
npm/registry-identity.test.jsnow asserts the identifier against the repository coordinatenpm/install.jsalready downloads from. It derives the expected namespace rather than hardcodingbytefolk, so a future rename moves the assertion instead of breaking it.mcpNameleft onfullstack-ai-infra(the shipped state)npm testmain@1332bf46Added to the
testscript's file list, so it runs in thenpm-wrapperCI job rather than only when named directly.Two things to know before reviewing
npm run test:tarballfails on this branch and identically onmain. It is annpm install --offlineof the locally packed tarball against this host's npm cache, not something this change touched. CI invokes it asnpx --yes npm@12.0.2 run test:tarball, which this host cannot reproduce, so treat that leg as CI-covered only.@bytefolk/mem-mcp; the decision is to keep the scope. I linked withRefs #153, notCloses, because only the registry half is done here. [Release] Migrate mem-mcp to @bytefolk/mem-mcp v0.1.2 #153 should be rewritten, or the next person to pick it up will move the scope and undo the part that was never in question.Not in this PR
Running
mcp-publisherand the OAuth / organization verification are assigned to @PeterGuy326, and the registry record is created by that submission, not by merging this.README.md:11also still points its Smithery badge at@fullstack-ai-infra/mem-mcp; that slug needs verifying against what Smithery actually resolves before it is edited, so it is left alone here rather than repointed to something possibly equally wrong.Merging this PR is not a claim that it is merge-ready, and no review has been requested or recorded.