docs: close out separate-repo model sharing (FR-023 Phase 2)

CHANGELOG.md

@@ -292,6 +292,13 @@ loading. A port that reports `1.2` does not know that vocabulary; upgrade every
   `docs/features/extending-with-providers.md` now has a worked example per language, and the
   `metaobjects-authoring` skill teaches it, with a reference file per language.
 
+### Documentation
+
+- **Separate-repo model sharing (FR-023 Phase 2) close-out.** The feature page's Phase 2 section is now
+  the shipped per-port matrix (consume, check, publish, runtime load, transports), the deferred list
+  names what is still not built, and the verify, codegen, authoring, audit and capability-sheet skills
+  teach the Java, Kotlin and C# publish paths, the `deps` checks and the `maven` and `nuget` transports.
+
 ### Changed
 
 - **`docsSiteFile()` builds the model explorer by default.** A project that lists

agent-context/skills/metaobjects-audit/references/csharp.md

@@ -42,8 +42,15 @@ dotnet meta gen metaobjects --out Generated --generators entity   # narrow to de
 
 dotnet meta verify --codegen    # regenerate to temp, diff vs committed output
 dotnet meta verify --templates  # check {{field}} refs vs payload VO (bare default)
+dotnet meta verify --deps       # shared-model dependencies vs deps.lock.json (opt-in)
 ```
 
+`verify --deps` applies when the project declares `dependencies` in `.metaobjects/config.json`: it
+hashes each `path` dependency against the lock and fails with `ERR_DEPENDENCY_UPSTREAM_DRIFT` on
+`drifted` or `unresolved` (a `maven`, `nuget`, `npm` or `python` dependency reports `unresolved`;
+run the Node `meta deps check` for those). A project that publishes a model wires the
+`SharedModelGenerator` in `codegen/Generators.cs`; `verify --codegen` drift-gates its output.
+
 Schema migration + live-DB drift run through the **Node `meta` CLI** regardless of
 server language — see the migration reference. `dotnet meta verify --db` is
 rejected (exit 2).

agent-context/skills/metaobjects-audit/references/java.md

@@ -40,6 +40,13 @@ mvn metaobjects:verify -Dmeta.verify.mode=codegen     # regen to temp, diff vs c
 mvn metaobjects:verify -Dmeta.verify.mode=templates   # {{field}} refs vs payload VO
 ```
 
+If the project declares `dependencies` in `.metaobjects/config.json` (a model shared from another
+repository), also run `mvn metaobjects:verify -Dmeta.verify.mode=deps`: it hashes each `path`
+dependency against `.metaobjects/deps.lock.json` and fails with `ERR_DEPENDENCY_UPSTREAM_DRIFT` on
+`drifted` or `unresolved` (a `maven`, `nuget`, `npm` or `python` dependency reports `unresolved`;
+run the Node `meta deps check` for those). A project that publishes a model wires the
+`shared-model` generator; `verify --codegen` drift-gates its output.
+
 Schema migration + live-DB drift run through the **Node `meta` CLI** regardless of
 server language — see the migration reference. `mvn metaobjects:verify -Dmeta.verify.mode=db`
 is rejected (exit 2).

agent-context/skills/metaobjects-audit/references/kotlin.md

@@ -44,6 +44,13 @@ mvn metaobjects:verify -Dmeta.verify.mode=codegen     # regen to temp, diff vs c
 mvn metaobjects:verify -Dmeta.verify.mode=templates   # {{field}} refs vs payload VO
 ```
 
+If the project declares `dependencies` in `.metaobjects/config.json` (a model shared from another
+repository), also run `mvn metaobjects:verify -Dmeta.verify.mode=deps`: it hashes each `path`
+dependency against `.metaobjects/deps.lock.json` and fails with `ERR_DEPENDENCY_UPSTREAM_DRIFT` on
+`drifted` or `unresolved` (a `maven`, `nuget`, `npm` or `python` dependency reports `unresolved`;
+run the Node `meta deps check` for those). A project that publishes a model wires the
+`shared-model` generator; `verify --codegen` drift-gates its output.
+
 Kotlin generators run through the **same Maven plugin goal** as Java generators —
 both are SPI-discovered by the `metaobjects-maven-plugin`. Schema migration + live-DB
 drift run through the **Node `meta` CLI** regardless of server language — see the

agent-context/skills/metaobjects-audit/references/python.md

@@ -40,8 +40,14 @@ metaobjects gen                       # run every target's generators (metaobjec
 metaobjects gen --generators entity   # narrow to declared entries
 metaobjects verify --codegen    # regenerate to temp, diff vs each committed outDir (bare default)
 metaobjects verify --templates  # {{field}} refs vs payload VO
+metaobjects deps check          # shared-model dependencies vs deps.lock.json (also: verify --deps)
 ```
 
+`deps check` applies when the project declares `dependencies` in `.metaobjects/config.json`: it
+hashes each `path` dependency against the lock and fails with `ERR_DEPENDENCY_UPSTREAM_DRIFT` on
+`drifted` or `unresolved` (a `maven`, `nuget`, `npm` or `python` dependency reports `unresolved`;
+run the Node `meta deps check` for those). Python consumes a shared model but cannot publish one.
+
 With no `metaobjects.config.yaml`, `gen` exits 2 and generates nothing. A target's
 `generators` takes stable generator names: `entity`, `routes`, `filter-allowlist`,
 `names`, `output-parser`, `extractor`, `output-prompt`, `render-helper`, `trace-helper`,

agent-context/skills/metaobjects-authoring/references/metadata-dependencies.md

@@ -9,10 +9,14 @@ committed snapshot — that snapshot loads BEFORE your own files, so a foreign
 abstract resolves via `extends` and a foreign node re-opens via `overlay: true`
 exactly like a local one. A dependency names one transport: `path` (a directory
 relative to the directory holding `.metaobjects/`), `npm` (an installed npm
-package, e.g. `{ "name": "acme-model", "npm": "@acme/model", "dir": "metaobjects" }`)
-or `python` (an installed Python package by its import name, e.g.
-`{ "name": "acme-model", "python": "acme_model", "dir": "metaobjects" }`). For
-`npm`/`python`, install the package with the project's package manager first;
+package, e.g. `{ "name": "acme-model", "npm": "@acme/model", "dir": "metaobjects" }`),
+`python` (an installed Python package by its import name, e.g.
+`{ "name": "acme-model", "python": "acme_model", "dir": "metaobjects" }`), `maven`
+(`{ "name": "acme-model", "maven": "com.acme:acme-model", "version": "1.0.0" }`, a JAR in the
+local Maven repository) or `nuget`
+(`{ "name": "acme-model", "nuget": "Acme.Model", "version": "1.0.0" }`, a package in the NuGet
+global packages folder). For
+`npm`/`python`/`maven`/`nuget`, install or restore the package with the project's package manager first;
 `meta deps sync` locates it, copies its shared model into the snapshot, and says
 what to install when it is missing. Prefer the package transport over a `path` into
 someone else's checkout when the publisher releases a package. Two rules are

agent-context/skills/metaobjects-codegen/references/dependencies-and-shared-models.md

@@ -41,10 +41,19 @@ replace those calls: an unmodified copy publishes the same bytes as the packaged
 generator. To publish through a package, point its `target` inside the package
 (an npm package's directory listed in `files`; a Python package's directory shipped
 as package data), run `meta gen`, then release the package as usual; consumers
-declare an `npm` or `python` dependency on it. With no `version` option the
+declare an `npm`, `python`, `maven` or `nuget` dependency on it. With no `version` option the
 manifest takes the nearest `package.json` version, else a `pyproject.toml`
 `[project]` version — pass `version` when neither is the package consumers install.
-Only TypeScript can run it in Phase 1a. TypeScript, Python, Java, Kotlin (through
-Java's loader and Maven plugin) and C# can *consume* a dependency, and only the
-TypeScript toolchain can *publish* one.
+TypeScript, Java, Kotlin and C# can *publish* with byte-identical output: the Java and Kotlin
+`shared-model` generator runs through `mvn metaobjects:generate` (`SharedModelGenerator` /
+`KotlinSharedModelGenerator`, args `name`, `include`, `exclude`, `files`, `version`; the version
+defaults to the module `<version>`); the C# one is `new SharedModelGenerator { ModelName, Include,
+Files, OutDir }` in `codegen/Generators.cs` through `dotnet meta gen` (version from the project
+`<Version>`). Eject with `mvn metaobjects:eject -Dnames=shared-model -Dport=java|kotlin` or `dotnet
+meta eject shared-model`. A JVM publisher ships the pair as the JAR's `metaobjects/` resources and a
+C# publisher as the NuGet package's `metaobjects/` content; consumers declare
+`{ "name": "x", "maven": "com.acme:model", "version": "1.0.0" }` or
+`{ "name": "x", "nuget": "Acme.Model", "version": "1.0.0" }` (also `npm`/`python`/`path`).
+TypeScript, Python, Java, Kotlin and C# *consume*; Python cannot publish. Node `meta deps sync`
+remains the only writer of the lock and snapshot in every port.
 Full detail: `docs/features/metadata-dependencies.md`.

agent-context/skills/metaobjects-fit-assessment/references/capability-sheet.md

@@ -36,15 +36,18 @@ building block. Every generator is a reference helper an adopter selects, ejects
 - **Sharing a model** (`docs/features/metadata-dependencies.md`): in one repository, every port
   reads the same metadata directory (`sources`), so a TS service and a Java, C# or Python
   service can generate from one declaration today. **Across repositories**, a published model
-  with a hash-locked snapshot works for **TypeScript publishers only**; **TypeScript, Python,
-  Java, Kotlin and C# consume** it at build time (a committed `.metaobjects/deps/` snapshot loaded
-  ahead of the project's own files; `extends`/overlay onto a dependency's node resolves; imported
-  nodes are not generated unless `scope.include` names their package). The Node `meta deps sync`
-  is the only writer of the lock and snapshot, so a Java, Kotlin or C# consumer needs Node to
-  sync. Dependencies come from a `path`, an npm package or a Python package; the Maven and NuGet
-  transports are design only. Java, Kotlin, Python and C# cannot publish; the Spring runtime does
-  not yet auto-load the snapshot, and the Java/Kotlin `verify` does not yet check dependency
-  drift. Plain vendoring (`docs/features/metadata-sources.md`, "Vendoring") still works and
+  with a hash-locked snapshot works in every port: **TypeScript, Java, Kotlin and C# publish** it
+  (`sharedModelFile()`, or the `shared-model` generator through `metaobjects:generate` and
+  `dotnet meta gen`, all ejectable); **TypeScript, Python, Java, Kotlin and C# consume** it at
+  build time (a committed `.metaobjects/deps/` snapshot loaded ahead of the project's own files;
+  `extends`/overlay onto a dependency's node resolves; imported nodes are not generated unless
+  `scope.include` names their package), and the Spring runtime auto-loads the snapshot. Every port
+  can check drift (`meta deps check`, `metaobjects deps check`, `mvn metaobjects:verify
+  -Dmeta.verify.mode=deps`, `dotnet meta verify --deps`). The Node `meta deps sync` is the only
+  writer of the lock and snapshot, so a Java, Kotlin, C# or Python consumer needs Node to sync.
+  Dependencies come from a `path`, an npm or Python package, a Maven artifact (a JAR in the local
+  repository) or a NuGet package; only Node resolves the package transports in `check`. Python
+  cannot publish, and a JVM classpath read with no committed snapshot is not built. Plain vendoring (`docs/features/metadata-sources.md`, "Vendoring") still works and
   carries no upstream hash check. Source: `docs/features/metadata-dependencies.md`, "Phase 2".
 - **Libraries** (`docs/features/libraries.md`): `iam` (preview) and `ai` (stable) ship as
   declared designs; the core layer is sourceless and adds no tables. Mention one only when the

agent-context/skills/metaobjects-verify/SKILL.md

@@ -166,15 +166,14 @@ with `ERR_DEPENDENCY_SNAPSHOT_STALE` naming the fix: run `meta deps sync`.
   if any reference isn't on the payload VO. This is the build-time gate for the
   prompt-construction pillar.
 
-- **`--deps`** — dependency drift (FR-023, **Node `meta` only** — but **any
-  backend**, like `--db`: the check reads only `.metaobjects/config.json` and has
-  no backend dependency of its own). Re-resolves each declared dependency's `path`
+- **`--deps`** — dependency drift (FR-023). Re-resolves each declared dependency
   right now and compares its installed artifact's hash against
-  `.metaobjects/deps.lock.json` — the same comparison `meta deps check` runs. Only
-  TypeScript and Python additionally LOAD the resulting snapshot and honour the
-  default-exclusion it implies — a Java/Kotlin/C# project can run this gate today
-  even though its own codegen can't yet consume a dependency. Never part of the
-  bare-`verify` default: it
+  `.metaobjects/deps.lock.json` — the same comparison `meta deps check` runs. Node
+  `meta` resolves every transport (`path`, `npm`, `python`, `maven`, `nuget`); the
+  Python, Java/Kotlin and C# checks resolve `path` only and report any other
+  transport `unresolved`, naming Node `meta deps check` (a check that cannot check
+  must not pass). Every port also loads the committed snapshot and honours the
+  default-exclusion it implies. Never part of the bare-`verify` default: it
   needs the publisher's `path` reachable, which CI checking out only your own repo
   may not have. Reports `current` / `drifted` / `unresolved` per dependency;
   `drifted` or `unresolved` fails with `ERR_DEPENDENCY_UPSTREAM_DRIFT`, fix is
@@ -188,7 +187,16 @@ port's own build tool, not the Node `meta`:
 | TS | `meta verify --codegen` | `meta verify --templates` | `meta verify --db <url>` |
 | Java / Kotlin | `mvn metaobjects:verify -Dmeta.verify.mode=codegen` | `mvn metaobjects:verify -Dmeta.verify.mode=templates` | Node `meta verify --db` only |
 | C# | `dotnet meta verify --codegen` | `dotnet meta verify --templates` | Node `meta verify --db` only |
-| Python | `metaobjects verify --codegen` | `metaobjects verify --templates` | Node `meta verify --db` only |
+| Python | `metaobjects verify` (`--codegen` is in the default) | n/a | Node `meta verify --db` only |
+
+Dependency drift (`--deps`) per port:
+
+| Port | Dependency drift |
+|---|---|
+| TS | `meta deps check`, `meta verify --deps` |
+| Python | `metaobjects deps check`, `metaobjects verify --deps` |
+| Java / Kotlin | `mvn metaobjects:verify -Dmeta.verify.mode=deps` |
+| C# | `dotnet meta verify --deps` |
 
 Every non-TS port's `verify` rejects `--db` outright (exit 2, "schema verify is the
 migrate engine") — schema drift always runs through the Node `meta verify --db`,

docs/CONFORMANCE.md

@@ -485,7 +485,7 @@ above: one committed `cases.json`, no per-port fixture, no ledger. The corpus ha
   Kotlin runs the same goal), by **Python**, in `tests/conformance/test_dependency_conformance.py`
   (`metaobjects deps check` and `verify --deps`), and by **C#**, in `DependencyConformanceTests`
   (`dotnet meta verify --deps`). The arm exists so that each port's check is written against the
-  same edge cases (Phase 2, #482).
+  same edge cases (FR-023 Phase 2, #482, shipped).
 - **Transport (32 cases, `transport-cases.json`).** The `npm`, `python`, `maven` and `nuget` transports
   `meta deps sync` uses to find an installed package: npm packages under a temp `node_modules`, Python
   packages on a temp import path, jars in a temp local Maven repository, packages in a temp NuGet cache,