# What is built

| Feature | Status |
|---|---|
| The package format, names and the lock | Built. |
| The surface, `jadpo package show` and `jadpo package check` with the publishing bar | Built. |
| Installing: `add` from a folder or git, `update`, `remove`, `link` and `unlink` | Built. |
| Connections to packages and the network report | Built. |
| Lazy loading, the package cache and two versions side by side | Built. |
| The OpenAPI importer, and the scoped review of an import's types | Built. |
| Provider calls, decoding, `wire_parts:` and retries | Built. |
| Walking a list operation's pages with `batches.each` ([Pages of results](/docs/calling.md#pages-of-results)) | Not built yet: a provider's list operation as `batches.each`'s `from:` is `toolchain.not_built_yet` where it is written ([Jobs and events](/docs/batches-work-over-many-items.md#walking-records-or-a-providers-list-batcheseach)). |
| No transaction open during a call, and several changing calls in one action | Built. |
| Fakes, recordings and provider calls faked in development | Built. |
| The `email` capability with SMTP and Resend | Built. |
| Package actions, subscribers, recipes and polls | Built. |
| Webhooks as events, replies, handshakes, queues through a package and the Cloudflare Queues driver | Built. |
| Services (`runs:`) | Not built yet, nor is `jadpo services`. |
| OAuth grants | Not built yet: the application's `grants:` is `toolchain.not_built_yet` where it is written, and `jadpo dev grants add` isn't a command yet. |
| A release's facts and change record in `jadpo package check` and `show`, the previous release's examples and tests run against the new code, and `jadpo package verify` with the fingerprints ([How they are worked out](/docs/how-a-releases-facts-change-record-and-fingerprints-are-worked-out.md)) | Built. |
| [The verifier](/docs/the-verifier.md): `jadpo package verify --serve`, its sandbox, the check of a commit's files and size, its container image and Fly.io configuration | Built. Not deployed yet: its image is published, and it runs on Fly.io, once a maintainer has switched them on. |
| Publisher trust for third-party git packages | Built: a package from a git repository under none of `packages:`'s `own_sources:` needs an [acceptance](/docs/acceptances.md), as does adding or widening an entry; an entry is `package.own_source_invalid` unless it is a host and a path ending in `/`. |
| The registry protocol: its requests and answers, the log and its proofs, a local registry and the conformance test | Built (`jadpo-registry`). |
| The `jadpo` tool's side of the public registry: `add` and `update` checked against the log, `search`, `audit`, `publish` and `preview` ([How the registry commands work](/docs/how-the-registry-commands-work.md)) | Built, against the local registry. |
| A package's publisher ([Names and publishers](/docs/the-public-registry.md#names-and-publishers)): `publisher:` in the index, on its surface and in its facts, the bar's `publisher` row, `jadpo package publish` and `verify --publisher`, the verifier's request and the local registry's check of a release | Built, against the local registry. |
| [Starting a package](/docs/developing-and-publishing-a-package.md): `jadpo package new`, and the bar's `licence` row refusing `Licence.proprietary` for `verify` and `publish` | Built. |
| The registry at jadpo.dev: publishing, search, advisories and compatibility runs | Not built yet: `jadpo package add <name>`, `search` and `publish` stop with `registry.unreachable`. |
| Importers other than OpenAPI | Not built yet. |
| Choosing a provider when deploying | Not built yet. |
| Erasure at providers | Partly built: the package's and the connection's `erasure:` are read and checked, and a connection that can't erase what it receives needs an `ErasureNotPossible` acceptance ([Erasure at providers](/docs/erasure-at-providers.md)). Not built yet: calling the provider. |

## Mistakes not reported yet

These mistakes are specified but not reported yet:

| Mistake | Reported by |
|---|---|
| An operation whose scope the grant does not request; a call to a grant connection without `on_behalf_of:` | `jadpo check` |
| A service image not yet accepted; an `asks:` host not granted by `outbound:` | `jadpo check`, naming the line that grants it |
| A capability's connection whose package does not provide it, or a function call or expression in a `provide` mapping, for a capability other than `receiving` and `email` | `jadpo check` |

The rest of the page's mistakes have examples under
[Errors](/docs/external-services.md): the digest and the lock, an `emails/` folder, the
index's keys, `provider.jadpo`'s keys, `hosts:` with `runs:`, reserved
and taken names, a resource and an action of one name and a public
action that emits (`package.action_invalid`), and subscribing to a
non-public event (`package.not_public`) under "Package errors"; a
surface that differs at install and a link in CI under "Installing
errors"; a decoder that fails on a recording and a field's `decode:` and
`encode:` that don't round-trip under "Recording errors"; a connection's
keys under "Connection errors". The rule that nothing public reaches
something private is `visibility.public_reaches_private`
([Project layout and modules](/docs/project-layout-and-modules.md)), and
several changing calls in the wrong place are the `step.` errors of
[Background work](/docs/jobs-and-events.md) and `effect.call_in_loop`
([Logic](/docs/logic.md)).