feat(resources): align built-in provider components

[schickling-assistant]

Problem

The built-in GitHub PR, GitHub Issue, PTY, and Vista components did not implement the resource contracts used by current catalogs. GitHub identities and observations were incomplete, while PTY and Vista still pinned resource identity in host capability configuration instead of deriving it from each canonical URI.

The live catalog still contains the retired runtime { argv ... } profile grammar. Raw-preimage snapshot/apply parsed that incumbent through the full current catalog schema, making the invalid declaration impossible to capture and atomically replace.

Goal

Make the four built-in WASI components the authoritative provider implementation for dynamic GitHub, PTY, and Vista resources, and let raw-preimage transactions safely migrate the legacy live catalog to those typed component profiles.

Decisions

• Keep resource identity in canonical URIs and selectors attention-only.
• Keep credentials and executable authority host-side through typed catalog capabilities.
• Resolve GitHub authentication through one exact catalog-declared gh executable; retain the token only in a sensitive host header.
• Apply one absolute deadline across each PTY operation and bounded GitHub credential discovery.
• Preserve source-derived snapshots, topics, and facts independently of binding selectors.
• Parse only the incumbent catalog envelope during raw-preimage snapshot/apply. Profiles remain opaque there, while KDL syntax, catalog multiplicity, explicit external PTY root, unchanged effective PTY root, link safety, and CAS remain enforced.

Verification

• nix develop -c cargo test --test catalog_apply raw_preimage — 7 passed, 0 failed; covers legacy argv capture/repair plus malformed envelopes, effective PTY-root changes, hard links, wrong CAS, mutable-state preservation, and resume.
• nix develop -c cargo test -p st2-resource-providers --lib — 24 passed, 0 failed, 2 subprocess fixture helpers ignored.
• nix develop -c cargo check --workspace --all-targets --all-features passed in the earlier provider validation.
• nix build .#checks.x86_64-linux.wasip2-resource-providers --no-link passed in the earlier provider validation; it runs both GitHub component integration tests and the supervisor/provider E2E suites with all four built components.
• nix flake check passed in the earlier provider validation: all 22 x86_64-linux checks.

Complexity

No new dependency. The narrow envelope parser reuses the catalog node semantics without admitting legacy profile data. The additional process ownership code is required to enforce bounded credential discovery without leaking tokens or child processes.

Concerns

The GitHub modules resolve authentication when the module is constructed. A missing credential keeps public Issue reads anonymous, while authenticated PR reads fail through the existing typed error path.

Friction & bottlenecks

• The shared Nix trace sink was unwritable during local commands; the commands continued.
• Component integration tests require their built WASI component paths from the focused Nix check; a bare Cargo package invocation does not supply those environment variables.
• The earlier full flake check took 13m59s and hit an unrelated millisecond-timestamp test flake. An unchanged rerun completed in 10m26s with all checks green.

Follow-ups

The consuming catalog change must pin commit 66e7751 until the PR merges, then advance its lock back to main. No manually maintained fixed-output hash is required: st2 packages Rust dependencies directly from Cargo.lock, and the downstream source is a flake input.

References

Downstream catalog migration follows in the dependent dotfiles stack.

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.5wtg9j4p
session	dev3.5wtg9j4p
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.0.11
agent_runtime	OMP 18.0.11
tooling_profile	dotfiles@2161b9c