Tracking: dispatch vendored backends through one per-ecosystem table instead of string matches in core and the CLI #959

[agent] Filed by the scheduled architecture audit routine (ecosystems and formats). Register: discussion #560 register.

Kind: tracking. Source: review §2.1, Part 5.2 and 5.8; register E21.

Problem (verified on 9c43dfc)

Vendored mode has no backend abstraction. The eight vendor ecosystems are a string vocabulary that is re-matched wherever a per-ecosystem decision is made, and backends are uniform only by naming convention (service_preflight, vendor_*, revert_*_opts, vendored_entry_in_use). Production sites that enumerate the ecosystems include:

• Core:
  • path.rs ECOSYSTEM_DIRS;
  • leaf_to_purl (8 arms);
  • vendor::service_preflight (7 arms; gem alone takes source_path, pypi two caches);
  • redownload.rs and lock_inventory/recover.rs;``
  • prestage.rs PRESTAGED_ECOSYSTEMS;
  • ledger_snapshots.rs WHOLE_FILE_KINDS;
  • the format registry's per-ecosystem roles and VENDORED_WRITES_UNMARKED;
  • hosted/memory/types.rs ECOSYSTEMS.
• CLI (commands/vendor.rs#L130-L297):
  • the SERVICE_ECOSYSTEMS list (its refusal can never fire, Replace the single-variant vendor PackageSource with &Path and delete the scaffolding it props up #800);
  • the forward dispatch through the vend! / vend_installed! macros;
  • the revert dispatch;
  • the in-use dispatch.

Ecosystem identity has an alias. JVM entries are re-tagged "jvm" (maven_repo.rs#L1344). That forces "maven" | "jvm" handling at the CLI revert match, in path.rs#L92 and in redownload.rs#L71-L88.

The lists drift. #832 (NuGet and Maven) and #958 (Hatch) are both a per-ecosystem fact ("which files carry my references") kept in a table apart from the backend that writes those files.

Target design

One per-ecosystem dispatch point in core, keyed by the existing Ecosystem enum (minus Deno). The CLI and the core helpers ask it instead of matching strings:

// vendor/backend.rs
pub enum VendorBackend { Npm, Pypi, Gem, Cargo, Golang, Composer, Nuget, Maven }
impl VendorBackend {
    pub const ALL: [Self; 8];
    pub fn dir(self) -> &'static str;                  // ECOSYSTEM_DIRS derives from ALL
    pub fn of_entry(e: &VendorEntry) -> Option<Self>;  // owns the "jvm" alias
    pub async fn revert(self, e, root, opts) -> RevertOutcome;
    pub async fn in_use(self, e, root) -> Option<bool>;
    pub async fn preflight(self, ..) -> Option<PlannedDownload>;
    pub async fn vendor(self, ..) -> VendorOutcome;
    pub fn leaf_to_purl(self, leaf) -> Option<String>;
    pub fn wiring_files(self) -> &'static [&'static str];
}

This is an enum with match arms that call the existing backend functions, not a trait object: async dispatch stays static, and each step is mechanical. Part 5.8's batched plan/materialize trait is the later step, after the revert engine (E24) and the batched planners (E27).

Checklist (one PR each, in order)

• Route vendored revert and in-use dispatch through one core VendorBackend enum instead of CLI string matches #960: VendorBackend enum with ALL/dir/of_entry, and route revert and in-use dispatch through it. This deletes the two CLI matches and the CLI's "maven" | "jvm" arm.
• Forward dispatch and service_preflight through VendorBackend::{vendor, preflight}, normalizing the backend signatures (one VendorCall argument struct). Delete vend!, vend_installed! and the vendor::service_preflight match. Blocked by Replace the single-variant vendor PackageSource with &Path and delete the scaffolding it props up #800, which removes PackageSource, vend_installed! and SERVICE_ECOSYSTEMS.
• Per-ecosystem helpers become methods: leaf_to_purl, the redownload and recover arms, PRESTAGED_ECOSYSTEMS. ECOSYSTEM_DIRS and the in-memory ECOSYSTEMS derive from ALL.
• wiring_files() per backend replaces the registry's VENDORED / VENDORED_WRITES_UNMARKED split for the reference scan (after Vendored-reference scan never sees NuGet or Maven wiring, so the orphan sweep deletes a still-wired unit #832 and Vendored-reference scan never reads hatch.toml, so the orphan sweep deletes a wheel that a Hatch environment still installs #958).
• Stop re-tagging JVM entries as "jvm" for new ledgers, and keep reading the alias at load (of_entry), with legacy-ledger fixtures.

Acceptance (for the tracking issue)

• No production match on a vendor ecosystem string outside vendor/backend.rs and the ledger-load adapter. Enforce it with a source-scan architecture test like crawlers::architecture_tests.
• The legacy-ledgers fixtures and the e2e_vendor_* suites stay green at every step.

Dependencies

• Child 2 is blocked by Replace the single-variant vendor PackageSource with &Path and delete the scaffolding it props up #800.
• Related: Tracking: drive the seven npm-family vendor backends through one generic driver #920 (the npm-family driver inside the Npm arm), Share the single-lock wire and revert envelope across the Poetry, PDM and Pipenv vendored backends #937 (the PyPI envelope inside the Pypi arm), Stage prebuilt service archives through one shared helper instead of four per-backend service-copy pipelines #906 (the service-copy pipeline), Move canonicalize_pypi_name and the PEP 508 name scanner out of crawlers and vendor into one PyPI name module #883 and --ecosystems rejects NPM and npm, pypi, which socket.yml patches.ecosystems accepts: the ecosystem name parser is written three times #773 (where Ecosystem lives).

Consolidated work — backlog review, 2026-10-08

The following standalone issues are now tracked here. Their closure consolidates scheduling; it does not mean their implementation is complete. Original reports and discussion remain linked below.

#960: Route vendored revert and in-use dispatch through one core VendorBackend enum instead of CLI string matches

• Track the remaining scope from Route vendored revert and in-use dispatch through one core VendorBackend enum instead of CLI string matches #960 in this issue. Explicit backend-dispatch child of the shared vendor-backend tracker; fold the implementation step into its parent.

#1012: Move the bounded archive extractors out of vendor::registry_fetch into utils::archive

• Track the remaining scope from Move the bounded archive extractors out of vendor::registry_fetch into utils::archive #1012 in this issue. The archive-extractor file move is supporting layering work. Link this proposal from the backend/formats trackers and close the separate scheduling item.

Coordinate this single archive-extractor move between #959 (vendor backend) and #833 (neutral formats/types); the cross-reference does not require two implementations.