Adom Wiki

Root cause found, two wiki bugs fixed and live on prod, and one decision left for the cosmiic org.

Why this happened

cosmiic/implantables is public with public releases, but its four molecule-library dependencies are genuinely org-private on the registry (visibility: private, org cosmiic, no public-release override):

• cosmiic/pm1-frame-mol-refined-library
• cosmiic/cosmocoil-mol-library
• cosmiic/adipose-molecule-library
• cosmiic/pm-coil-molecule-library

So the refusal itself is the access model working as designed: those are required dependencies, and skipping a required dependency would deliver a broken install, so resolve refuses instead. Optional dependencies DO degrade gracefully (they downgrade to warnings), which is the right home for a dep that is genuinely skippable.

What was broken on our side, both fixed

1. "private to undefined": an earlier security fix stopped disclosing the owning org in these errors (a non-member should not be able to map private packages to tenants), but the message template still interpolated the removed field. Worse, the "Set ADOMPKG_TOKEN" advice was unreachable-by-construction for the people who saw it: that branch only fires for callers who already sent a token. The error is now a single 403 that names the blocked packages, never the org, and points at the real remedies (org membership, or the owner making the release public).

2. Nothing warned the publisher. A package that presents as installable to everyone but declares org-private required deps is guaranteed to brick for every outside installer, and the publisher had no way to know. Publishing such a package now returns a PRIVATE_DEP_UNINSTALLABLE warning naming the blocking deps and the three ways out (public releases on the deps, optionalDependencies, or making the app private too). It fires precisely: a private dep whose releases ARE public does not trigger it, and optional deps never do.

The remaining decision (cosmiic org)

If the four molecule libraries are meant to be publicly installable, an org member (or admin) flips them, either fully public or install-only:

adom-wiki page visibility cosmiic/<slug> --preset public       # page + source + installs
adom-wiki page visibility cosmiic/<slug> --public-releases     # page stays private, installs work

The second form is the "look-but-page-stays-hidden" option if the repos contain anything not meant for public eyes. Until one of those happens, implantables installs only for cosmiic members, by design.

Status check from the wiki side: the resolution parked here (the private -library dependency pages being retired by their owners) is still pending; the seven pages remain. No pressure and no wiki action outstanding; this is just keeping the thread honest about what unblocks it. If retiring them is no longer the plan, say so and we will revisit the resolver behavior instead.

Closing as parked, not as fixed: the wiki side was corrected in July (two resolver bugs), and what remains is the cosmiic org's choice about its four private molecule-library pages that cosmiic/implantables requires. The resolver refusing a required private dependency for a caller who cannot read it is the access model working; skipping it would deliver a broken install. If cosmiic wants those libraries public, or wants the resolver to treat them as optional for this package, reopen with that decision and it is a small change.