The pico-package repo was the spec written a day before this implementation
started; it never shared history with it and stopped in Feb 2025. Most of it
is superseded by README.md and the notes here, but a few questions were only
ever recorded there, and its README had diverged into two versions -- one
local and uncommitted, one edited in the Gitea web UI.
Adds, as open questions: the missing GitLab/Gitea snippet providers; why
test_method is blocked behind signing; the spec's answer that a picopackage
holds text, not necessarily code; and the name collision on source_url, which
the pinning proposal wants for a third distinct meaning.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- Split the monolith into package/provider/fetch/merge/cache modules with
the Resolver deciding install/adopt/update/merge/conflict outcomes
- Three-way merges via git merge-file/diff3 against a content-addressed
merge-base cache; conflicts go to a .picopackage-merge sibling
- Tests for package, provider, resolver, merge, and cache
- notes.md: update UX and signing design — diff-by-default, SSH signature
identity pinning (TOFU), key changes as a hard stop, exit-code contract
- Add CLAUDE.md; remove the pre-refactor exe/pppkg monolith and scratch files
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EiyJC73Mz8xZyCTvCEY8qn
