registry/v0 package

Package registry is an open, on-chain map from a deployed gno package path back to the source that produced it: repository, commit, directory.

It is the realm half of gno.land/p/nym-moultest123/gnopm/v0, which holds the domain model and the whole of the reasoning; this file is wiring. Every exported mutation is a crossing function that resolves the caller, forwards to the library, aborts on error (the only way to revert state in gno) and emits an event for indexers.

It cannot promise, and does not pretend to

Nothing here is verified and nothing here can be. A realm cannot clone a repository, so it cannot check that the bytes at the claimed commit are the bytes deployed at the claimed path. What it stores is testimony under a signature: this address says this package came from that source.

That is still worth storing, for two reasons.

First, it is testimony in the exact shape a verifier needs. Path, repository, commit and directory are precisely the four inputs to "hash the addpkg payload of that directory and compare it with what the chain hands back", which gnopm already does against a local tree (`gnopm verify -deployed`). The registry does not answer the question; it makes the question answerable by anything that can clone.

Second, the chain knows who signed. A claim from the address that owns the package path's namespace comes from the party that controls the path, and OwnedBy reports that. It is computed on every read, never stored, because a name can be transferred and a stored answer would rot into exactly the kind of stale claim this realm exists to distinguish from a live one.

Open, and tagged

Anyone may claim any path, including one they had nothing to do with. That is deliberate: gating registration on namespace ownership would leave the map empty on day one, when almost nothing has been registered by its own deployer, and an empty registry teaches nobody anything. A stranger's claim is not suppressed, it is labelled and ranked below the owner's, and Render never presents an unverified claim as a fact.

A claimant may always withdraw their own claim, and may never touch anyone else's.