feat: declare runtime backing and hold the artifact to the manifest - #2
Closed
lr00rl wants to merge 1 commit into
Closed
feat: declare runtime backing and hold the artifact to the manifest#2lr00rl wants to merge 1 commit into
lr00rl wants to merge 1 commit into
Conversation
This plugin genuinely serves its own methods, but nothing proved it. Elsewhere in the fleet a manifest could declare interface methods its artifact could not answer, with lattice-server quietly answering them from an in-core handler instead — a contract that lied, invisible to CI because every suite covered what the artifact DOES, never what the manifest CLAIMS. The service now says `"backing": "runtime"` in the signed manifest, so who serves a method is a declared fact rather than something the host infers. The conformance test walks every declared method and probes the artifact: a runtime-backed method must be answerable here, and a core-backed one must not be. It is the one test a plugin cannot satisfy by lying about itself. The artifact is untouched: bundle digest and version are unchanged, and only the manifest's signed metadata differs. Requires a server that understands `backing` — an older one rejects the manifest outright with unknown field "backing".
4 tasks
Contributor
Author
|
[ack] — zeus review, Olympus TASK-0007 backing family (2026-07-26): |
lr00rl
added a commit
that referenced
this pull request
Jul 27, 2026
The old backing-declaration PRs carried the right regression test, but the integration merges only preserved the manifest surface. Add the SDK-era conformance test directly on integration lineage so runtime-backed methods must answer and core-backed methods must remain unserved by the subprocess. Constraint: Zeus verification requested that the #2 backing PR conformance tests make it across before stale PR closure. Constraint: Test-only change must not alter bundle bytes or require signing. Rejected: Merge the stale #2 branch | its request envelope predates the SDK runtime loop and would reintroduce old manifest edits. Confidence: high Scope-risk: narrow Directive: Keep this test aligned with lattice.plugin.call envelope changes. Tested: focused conformance test; go vet ./...; go test -race -cover -count=1 ./... Not-tested: pluginpack/UI, unaffected by _test.go-only change
lr00rl
added a commit
that referenced
this pull request
Jul 27, 2026
The stale backing PR carried coverage that integration still needed after the content merges. Land the SDK-era conformance test so runtime-backed manifest methods must be served by the artifact and core-backed methods must stay unserved by the subprocess. Constraint: Zeus requested verification that #2 backing PR conformance tests made it across before stale PR closure. Constraint: This is test-only and must not change signed artifact bytes. Rejected: Merge the stale #2 branch directly | it uses the pre-SDK request envelope and would replay obsolete manifest edits. Confidence: high Scope-risk: narrow Directive: Keep this test aligned with lattice.plugin.call envelope changes. Tested: pending merge-head system-go gate Not-tested: pluginpack/UI, unaffected by _test.go-only change
Contributor
Author
|
Closing as superseded by integration. Manifest backing is present on integration, and the missing conformance test has now been carried forward in test-only merge eff0bc4. Verified on merge head: focused TestManifestInterfacesAreServedAsDeclared, go vet ./..., go test -race -cover -count=1 ./... (system-go 74.2%). No digest/signature fields changed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
This plugin's service now carries
"backing": "runtime"in its re-signed manifest, and a newconformance_test.goholds the artifact to what the manifest promises.Why
This plugin genuinely serves its own methods — but nothing proved it. Elsewhere in the fleet, a manifest could declare interface methods its artifact could not answer, with lattice-server quietly answering them from an in-core handler instead. A contract that lied, invisible to CI, because every suite covered what the artifact does and never what the manifest claims.
Declaring
runtimeexplicitly means who serves a method is a signed fact, not something the host infers from a publisher string.The conformance test is the real deliverable
It walks every declared method and probes the artifact:
backing: runtime→ the artifact must answer it. A payload-validation error counts as an answer;unsupported methoddoes not.backing: core→ the artifact must not answer it (the engine lives in lattice-server).The probe uses an empty payload, which is rejected before any host call, and a stub host that fails the test if the dispatcher reaches for the broker or network — so checking which methods exist can never have a side effect.
On the three façade plugins, flipping their declarations to
runtimeturns the build red on every declared method. That is the gap this gate exists to catch.Safety of this change
bundle.digest_sha256andversionare unchanged — only the manifest's signed metadata differs, so CI's rebuild-and-compare digest gate still passes without a rebuild.backingisomitemptyand does not perturb existing signed manifests.Deploy the server first. The loader uses
DisallowUnknownFields, so a server withoutbackingsupport rejects this manifest outright:decode manifest: json: unknown field "backing". It fails closed (the plugin does not load) rather than degrading.Requires: LatticeNet/lattice-server#8.
Test plan
go test ./... -race -count=1insystem-go— greengofmtcleanPart of the 2026-07-14 plugin-boundary architecture review (§4.1).
https://claude.ai/code/session_01FzYExyy6G7Cb7QpXoUEY78