Koder Hub — Publication Coverage Registry

Tracks which Koder Stack components are reachable via the Hub publication API GET https://hub.koder.dev/api/v1/apps/<slug>. Source of registered components: registries/component-names.md.

The audit probes three name variants per row of the source registry (type ∈ {product, service, engine} — meta and umbrella types are non-publishable and excluded):

1. <slug> — the canonical registry slug
2. <aliases[0]> — the first coloquial alias, if any
3. koder-<aliases[0]> — the registry-noncompliant compound form

A row passes when (1) returns HTTP 200. The other variants are auxiliary: a 200 on (2) or (3) without (1) means the package was published under a non-canonical name and should be re-published under <slug> (the registry is authoritative; release engineering should align with it).

Status values

Last audit: 2026-06-03 (Kodix release spot probe)

Spot probe 2026-06-03 (kodix#063 release v0.18.0): GET https://hub.koder.dev/api/v1/apps/kodix → HTTP 200 (canonical slug). Old GET .../apps/koder-distro → HTTP 404 (rebrand #054 — old slug gone, not dual). Classified OK_CANONICAL for kodix. ISO download itself is served from kodix.koder.dev/releases/latest (jet static), not the Hub apps API; the Hub row tracks the catalog entry only.

Previous audit: 2026-05-20 (Kruze + Box spot probes)

Spot probe 2026-05-20: GET https://hub.koder.dev/api/v1/apps/koder-kruze → HTTP 200, slug=koder-kruze, version 1.0.20 (Flow has v1.0.23). Aliased kruze → HTTP 404. Classified OK_CANONICAL; row added under that section. Hub-side version drift tracked in products/horizontal/kruze/app/backlog/pending/157. Kruze had been absent from component-names.md until this commit landed the row.

Spot probe 2026-05-20: GET https://hub.koder.dev/api/v1/apps/koder-box → HTTP 404; kbox alias → HTTP 404. Classified MISSING; row added below. Follow-up to publish tracked in infra/net/kbox/backlog/pending/107.

Previous audit: 2026-05-14 (post #119 data fix)

Probed via curl -sS https://hub.koder.dev/api/v1/apps/<name> with 0.3s between requests + exponential backoff on 429.

Total publishable components (product+service+engine from component-names.md): 115

#119 data fix — completed 2026-05-14

All 5 non-aligned publications resolved. The 4 DRIFT cases were renamed via PATCH /api/v1/publish/<old-slug>/rename (#107 primitive: atomically updates apps.slug to canonical AND records old_slug in slug_reservations AND prepends to previous_slugs). Old URLs continue resolving to the canonical record by app_id — verified post-rename: GET /apps/<old-slug> and GET /apps/<canonical-slug> return the same id. The DUAL case (kmail + koder-mail) was deduplicated by archiving the kmail record (soft delete; hard delete is gated by KODER_HUB_DEV_DESTRUCTIVE=1 and not enabled in production — acceptable since kmail v1.0.0 was a placeholder seed with no real downloads).

Bonus alias-resolution behavior

After rename, GET /api/v1/apps/<old-slug> returns HTTP 200 with the canonical record in the body (not 301 as the handler intends via ResolveSlug → http.Redirect path). Cause: kdbnext keeps the stale idxAppBySlug secondary index entry pointing the old slug at the app row, so GetAppBySlug(old) still succeeds and ResolveSlug returns redirected=false. This is friendlier than 301 for clients (no extra round-trip) but indicates the index update should be investigated as a follow-up — see products/dev/hub/backlog/pending/ for the index-cleanup ticket if/when one is opened. Functionally the outcome matches the #119 acceptance criterion: alias and canonical resolve to the same id.

OK_CANONICAL (28)

MISSING (89)

Most of these are aspirational components — registered in component-names.md for naming reservation but not yet shipped a first release. No action needed until the component has artifacts to publish.

…and 69 others (full list regenerable from the probe script below).

Refresh procedure

# Extract (type, slug, alias) from registry
awk -F'|' '
  /^\| (product|service|engine|meta|umbrella) \|/ {
    type=$2; slug=$5; alias=$7
    gsub(/^[ \t]+|[ \t]+$/, "", type); gsub(/^[ \t]+|[ \t]+$/, "", slug); gsub(/^[ \t]+|[ \t]+$/, "", alias)
    n=split(alias, parts, ";"); first=parts[1]
    gsub(/^[ \t]+|[ \t]+$/, "", first)
    print type "\t" slug "\t" first
  }
' meta/docs/stack/registries/component-names.md > /tmp/registry-slugs.tsv

# Probe Hub (Python script, rate-limited with 0.3s + backoff on 429)
python3 - <<'PY'
import urllib.request, json, time
from urllib.error import HTTPError, URLError
def probe(s, retries=3):
    for a in range(retries):
        try:
            with urllib.request.urlopen(f"https://hub.koder.dev/api/v1/apps/{s}", timeout=10) as r:
                d = json.load(r); return 200, d.get('version','?')
        except HTTPError as e:
            if e.code == 429 and a < retries-1: time.sleep(2*(a+1)); continue
            return e.code, '-'
        except (URLError, Exception) as e: return -1, str(e)[:30]
with open('/tmp/registry-slugs.tsv') as f:
    for line in f:
        t, s, al = (line.rstrip().split('\t') + ['',''])[:3]
        if t not in ('product','service','engine'): continue
        sc, sv = probe(s); time.sleep(0.3)
        ac, av = probe(al) if al else ('', '');  time.sleep(0.3) if al else None
        ka = f"koder-{al}" if al and not al.startswith("koder-") else al
        kc, kv = (probe(ka) if (al and ka != s) else ('', ''))
        print(f"{t}\t{s}\t{al}\t{sc}({sv})\t{ac}({av})\t{kc}({kv})")
PY

Related

• registries/component-names.md — source of truth for slugs (authoritative)
• specs/naming/forms.kmd — naming rules (R1-R6, T1-T11)
• specs/binaries-and-cli/naming.kmd — binary name derivation (aliases[0] || slug)

Audit cadence

• Refresh on every Hub publication/unpublication.
• Drift cases block release engineering for affected components until

  the publication is re-aligned with component-names.md.

• MISSING rows are informational only; not a block.

Companion CI workflow

.gitea/workflows/audit-hub-coverage.yml runs the probe automatically:

• Schedule: daily at 04:17 BRT
• Triggers: push touching component-names.md,

  koder-hub-coverage.md, or the workflow file itself; manual via workflow_dispatch

• Output: state counts in workflow summary + drift/dual table

  attached as artifact (hub-coverage-tsv, 30-day retention)

• Gate: soft-fails if DRIFT_AS + DUAL exceeds baseline (5) + 1,

  catching new drift without false-flagging the documented state. Tighten to "any drift = fail" once the 5 known cases are resolved.

Manual refresh of this document remains a human task — the workflow exposes regressions but does not auto-edit the prose.