docs(agent-context): bring fit-assessment capability sheet up to 1.2.0

README.md

@@ -187,7 +187,7 @@ first-week wedge plan — and `meta init` picks up from there.
 | Capability requirements (`requirement.*`) | `meta verify` gate + authoring lint; `requirementTests()` stubs | `mvn metaobjects:verify` gate; JUnit Jupiter `requirement-tests` | Gate via the Java Maven goal; JUnit Jupiter `requirement-tests` | `dotnet meta verify` gate; xUnit `requirement-tests` | `metaobjects verify` gate; pytest `requirement-tests` |
 | Reporting vocabulary (`dimension` / `measure` / `segment` / `object.report`, FR-044) | Registered; a view-backed report becomes a SQL view in `meta migrate`, is read by `ObjectManager`, and gets generated read-only list routes and a TanStack list hook (no grid or form); the `cube-model` generator writes the vocabulary as Cube data-model files | Registered; OMDB reads a view-backed report; generates a read-only Spring controller, DTO, repository and filter allowlist | Registered (via Java); generates an Exposed table object, a row data class, a filter allowlist and a read-only Spring controller per view-backed report | Registered; generates a keyless EF Core row type, read-only routes and a filter allowlist per view-backed report | Registered; `ObjectManager` reads a view-backed report; generates a Pydantic row model, a read-only FastAPI router and a filter allowlist |
 | Libraries (`libraries: [...]`) | Yes | Yes | Yes (via Java) | Yes | Yes |
-| Metadata dependencies (`dependencies`) | Yes (`meta deps sync`: `path`, `npm` and `python` transports) | Phase 2 | Phase 2 | Phase 2 | Yes (loads the synced snapshot) |
+| Metadata dependencies (`dependencies`) | Yes (`meta deps sync`: `path`, `npm` and `python` transports) | Yes (loads the synced snapshot; `meta deps sync` is Node) | Yes (via Java) | Yes (loads the synced snapshot) | Yes (loads the synced snapshot) |
 | Runtime metadata (ObjectManager-style) | Yes (`runtime-ts`) | Yes (OMDB) | Yes (via Java OMDB + Exposed) | Roadmap | Yes (ObjectManager) |
 | React / Angular UI client (browser) | React: **published** (`@metaobjectsdev/react` + `@metaobjectsdev/tanstack`), codegen + runtime. Angular 18: **source-only by decision** ([ADR-0048](spec/decisions/ADR-0048-angular-tier-source-only.md)) — `@metaobjectsdev/angular` + `@metaobjectsdev/codegen-ts-angular` build in-repo on their own `0.6.x` line but are deliberately not on npm (`npm i @metaobjectsdev/angular` will 404) until they meet the ADR's promotion bar. Consume them from source. | Consumes TS client via REST | Consumes TS client via REST | Consumes TS client via REST | Consumes TS client via REST |
 | Own a generator (`eject`) | Yes (`meta eject`) | Yes (`mvn metaobjects:eject`) | Yes (`mvn metaobjects:eject`) | Yes (`dotnet meta eject`) | Yes (`metaobjects eject`) |

agent-context/skills/metaobjects-fit-assessment/SKILL.md

@@ -8,7 +8,7 @@ metadata:
 # MetaObjects Fit & Migration Assessment
 
 _Assessment prompt v2. The § Capability sheet was last checked against the MetaObjects source
-on 2026-10-28 (1.1.4 / Maven 8.1.4). A later release may add capabilities the sheet does not
+on 2026-10-30 (1.2.0 / Maven 8.2.0). A later release may add capabilities the sheet does not
 list yet: check anything load-bearing against the published sources named in M3._
 
 <!-- skill-form-only:start -->
@@ -458,7 +458,7 @@ Read `references/json-contract.md` before you write `fit-assessment.json`, and k
 
 ---
 
-## Capability sheet — what each port ships at 1.1.4 (never promise across these lines)
+## Capability sheet — what each port ships at 1.2.0 / Maven 8.2.0 (never promise across these lines)
 
 Read `references/capability-sheet.md` before you state what any port can do; every capability claim in the assessment traces to it or to a published source (M3). <!-- inline: references/capability-sheet.md -->
 

agent-context/skills/metaobjects-fit-assessment/references/capability-sheet.md

@@ -1,4 +1,4 @@
-# Capability sheet — what each port ships at 1.1.4 / Maven 8.1.4 (never promise across these lines)
+# Capability sheet — what each port ships at 1.2.0 / Maven 8.2.0 (never promise across these lines)
 
 ## Contents
 - Contract-only generation, per port
@@ -26,18 +26,26 @@ building block. Every generator is a reference helper an adopter selects, ejects
   A TypeScript model of only value objects and sourceless projections needs no `dialect`
   (`server/typescript/packages/codegen-ts/src/db-emitting.ts`).
 - **The drift gate per port** — regenerate into a temp tree and diff: `meta verify --codegen`
-  (TS); `mvn metaobjects:verify` (Java/Kotlin; `codegen` is the default mode); `dotnet meta
+  (TS); `mvn metaobjects:verify` (Java/Kotlin; unset `meta.verify.mode` runs both the codegen and the template gate); `dotnet meta
   verify --codegen` (C#; bare `verify` runs it when `csharp.outDir` (or `--out`) and `codegen/Generators.cs` are present);
-  `metaobjects verify` (Python; `--codegen` is part of the default). Source: `docs/features/cli.md`.
+  `metaobjects verify` (Python; `--codegen` is part of the default). Since 1.2 a bare `verify` runs
+  codegen drift, prompt templates and the requirement ledger in every port, and skips with a note
+  a gate it has no configuration for. Source: `docs/features/cli.md`.
 - **Generated code compiles**: a codegen-compile gate compiles every port's emitted model tier
   with its real compiler in CI (`docs/CONFORMANCE.md`, "Split coverage").
 - **Sharing a model** (`docs/features/metadata-dependencies.md`): in one repository, every port
   reads the same metadata directory (`sources`), so a TS service and a Java, C# or Python
   service can generate from one declaration today. **Across repositories**, a published model
-  with a hash-locked snapshot and `meta verify --deps` works for **TypeScript publishers and
-  TypeScript/Python consumers only**; Java, Kotlin and C# neither publish nor consume one yet
-  (Phase 2) and must share by monorepo or a vendored copy (`docs/features/metadata-sources.md`,
-  "Vendoring"), which carries no upstream hash check.
+  with a hash-locked snapshot works for **TypeScript publishers only**; **TypeScript, Python,
+  Java, Kotlin and C# consume** it at build time (a committed `.metaobjects/deps/` snapshot loaded
+  ahead of the project's own files; `extends`/overlay onto a dependency's node resolves; imported
+  nodes are not generated unless `scope.include` names their package). The Node `meta deps sync`
+  is the only writer of the lock and snapshot, so a Java, Kotlin or C# consumer needs Node to
+  sync. Dependencies come from a `path`, an npm package or a Python package; the Maven and NuGet
+  transports are design only. Java, Kotlin, Python and C# cannot publish; the Spring runtime does
+  not yet auto-load the snapshot, and the Java/Kotlin `verify` does not yet check dependency
+  drift. Plain vendoring (`docs/features/metadata-sources.md`, "Vendoring") still works and
+  carries no upstream hash check. Source: `docs/features/metadata-dependencies.md`, "Phase 2".
 - **Libraries** (`docs/features/libraries.md`): `iam` (preview) and `ai` (stable) ship as
   declared designs; the core layer is sourceless and adds no tables. Mention one only when the
   target is hand-building the same design.
@@ -72,7 +80,8 @@ code from the shapes.
   `measure.*`, `segment.filter` and `object.report` load and validate in all five ports. A report with
   a read-only `source.rdb @kind: view` is lowered to a SQL view by `meta migrate` (Postgres, SQLite,
   D1; MySQL SQL from `buildReportViews`) and every port's generators serve it as one read-only list
-  route (rows past a 10,000 cap answer `report_too_large`). The TypeScript `cube-model` reference
+  route (rows past a 10,000 cap answer `report_too_large`); the `report-export` generator adds
+  `?format=csv|json|xml` in every port (`docs/features/reporting.md`, "Exporting a report"). The TypeScript `cube-model` reference
   generator exports it to Cube. TanStack gets a list hook only: no grid or form for a report.
 - **Requirements** (`docs/features/requirements.md`): `requirement.functional` / `.architectural`
   load in all five ports and the `verify` gate runs in each. The strict form is
@@ -88,7 +97,15 @@ code from the shapes.
 
 **Full-stack caps per port:**
 - **Schema pillar** (`meta migrate`, `verify --db`): Node `meta` CLI only; Postgres, SQLite, D1
-  only. Any other database: out for that database; data access unaffected.
+  only. Any other database: out for that database; data access unaffected. On Postgres, drift is
+  decided by applying the model to a scratch (shadow) database and diffing catalogs
+  (`--shadow-db`, `SHADOW_DATABASE_URL` or `migrate.shadowDatabaseUrl`; else a database `CREATE`d
+  on the server when the role may, else a rolled-back probe); SQLite, D1 and offline plans compare
+  by text (`docs/features/migrations-and-drift.md`).
+- **Credentials and excluded fields** (`docs/features/api-contract.md`, "Credentials and excluded
+  fields"): in every port the generated create/PATCH/PUT ignore a `@formExclude` field or a
+  `view.password` credential, and a credential is never returned; your own code still reads and
+  writes it. A `@required` field with either mark makes the generated create fail.
 - **TS**: Drizzle/Zod + Fastify or Hono routes with the filter-operator grammar, TanStack/React UI
   codegen + runtime, migrations. The only port with UI codegen + runtime.
 - **Java/Spring**: DTO records, controllers (full filter grammar via the generated allowlist +
@@ -98,12 +115,16 @@ code from the shapes.
 - **Kotlin/JVM**: entity + Exposed table + Spring controller + payload + relations + filter
   allowlist + a startup validator that checks the Exposed tables against the model (not field validation) + output parsers.
 - **C#**: EF Core entities + `AppDbContext` + CRUD minimal-API routes + render/payload/verify via
-  `dotnet meta`; no metadata-driven runtime tier; no migrate surface.
+  `dotnet meta`; no metadata-driven runtime tier; no migrate surface. Namespaces come from the
+  metadata package bindings; with none set, each type takes its own package (`acme::billing` is
+  `Acme.Billing`), and `csharp.namespace` forces one flat namespace (`docs/ports/csharp.md`).
 - **Python**: Pydantic + router + payload/parsers + `ObjectManager` runtime; the consumer wires the
   FastAPI router and repository; `metaobjects gen`/`verify` (no migrate).
 - **Prompt pillar** (all five ports): render + payload codegen + `verify` templates + the reply
   parser for a responding `template.prompt` (`@responseRef`) + the output-format fragment and
-  tolerant `extract`. `template.output` emits no parser. MCP exposure of declared prompts/tools
+  tolerant `extract`. `template.output` emits no parser. A template body may be Jinja (`.jinja`,
+  `.j2`, `.jinja2`) in Python and TypeScript only; Java, Kotlin and C# render Mustache and refuse
+  a Jinja-only body with `ERR_TEMPLATE_ENGINE_UNSUPPORTED`. MCP exposure of declared prompts/tools
   is not shipped.
 - **Not shipped, never promise**: the `api.*`/`operation.*`/`binding.*` declared-API surface;
   the cut `byte`/`short`/`class` field stubs; `index.fulltext`/`vector`/`spatial`; native PG enums

docs/llms/llms-full.txt

@@ -117,7 +117,7 @@ A library is **layered, and its core layer is inert**: the core declares no `sou
 
 ### Sharing a model across your own projects
 
-Today the TypeScript toolchain publishes and TypeScript and Python projects consume, from an installed npm or Python package or over a `path` dependency (a sibling checkout or submodule); Java, Kotlin and C# arrive in Phase 2. One project publishes part of its model with the `sharedModelFile()` generator; another declares it under `dependencies` in `.metaobjects/config.json`, runs `meta deps sync` to commit a hash-locked snapshot, and builds on it with `extends`, overlays and references. When the publisher's model moves, `meta verify --deps` reports it instead of two copies drifting apart. See docs/features/metadata-dependencies.md.
+Today only the TypeScript toolchain publishes; TypeScript, Python, Java, Kotlin and C# projects consume, from an installed npm or Python package or over a `path` dependency (a sibling checkout or submodule). Maven and NuGet transports are design only. One project publishes part of its model with the `sharedModelFile()` generator; another declares it under `dependencies` in `.metaobjects/config.json`, runs `meta deps sync` to commit a hash-locked snapshot, and builds on it with `extends`, overlays and references. When the publisher's model moves, `meta verify --deps` reports it instead of two copies drifting apart. See docs/features/metadata-dependencies.md.
 
 ---
 

docs/llms/llms.txt

@@ -63,7 +63,7 @@ MetaObjects pillars are capabilities of one metadata model, not separate product
 - **Requirements and testing** — declare what the software is supposed to *do* in the same model as the entities, so a capability claim is checkable instead of prose. `requirement.functional` / `requirement.architectural` are registered vocabulary in all five ports, and the loader enforces the closed `@status` enum. `@implementedBy` is checked against the model, not taken on faith: it must name a real member of the real model, so a claim whose implementation was renamed or deleted fails the build instead of going quietly stale. `meta verify` reports the ledger on every run — unresolved links, entities no claim covers, gaps recorded versus gaps nobody has ruled on — and lints the authoring; the documentation generators render it for humans and for agents (`requirementsFile()`, `agentDocsFile()` and their counterparts in the other ports). A live claim naming nothing is a warning; a green run proves the references resolve, never that an implementation is correct. **Every port ships a `requirement-tests` generator.** It scaffolds a test per claim, carrying the statement and counterexample in: a stub you fill in for TypeScript, a test that calls a witness you own in the other four. The vocabulary and the `verify` checks are in every port too. Only the authoring lint is TypeScript-only. A project that declares no `requirement.*` nodes sees no change at all.
 - **Libraries** — reusable declared design you opt into by name (`"libraries": ["iam"]` in `.metaobjects/config.json`): entities, the requirements they promise and the generators they imply, as one drift-gated artifact. A library is layered and its core layer is inert: it declares no source, so it adds no tables until you also opt into its `/db` layer (`["iam", "iam/db"]`). `meta eject <library>` copies one into your repo to own. `ai` (the LLM-call trace envelope) is `stable`; `iam` (users, nestable groups, roles, grants) is `preview`.
 
-**Sharing a model across your own projects** — today the TypeScript toolchain publishes and TypeScript and Python projects consume, from an installed npm or Python package or over a `path` dependency (a sibling checkout or submodule); Java, Kotlin and C# arrive in Phase 2. One project publishes part of its model with the `sharedModelFile()` generator; another declares it under `dependencies` in `.metaobjects/config.json`, runs `meta deps sync` to commit a hash-locked snapshot, and builds on it with `extends` and references. When the publisher's model moves, `meta verify --deps` reports it instead of two copies drifting apart.
+**Sharing a model across your own projects** — today only the TypeScript toolchain publishes; TypeScript, Python, Java, Kotlin and C# projects consume, from an installed npm or Python package or over a `path` dependency (a sibling checkout or submodule). Maven and NuGet transports are design only. One project publishes part of its model with the `sharedModelFile()` generator; another declares it under `dependencies` in `.metaobjects/config.json`, runs `meta deps sync` to commit a hash-locked snapshot, and builds on it with `extends` and references. When the publisher's model moves, `meta verify --deps` reports it instead of two copies drifting apart.
 
 ## Implementations (npm `1.2.0` / Maven Central `8.2.0`)