Skip to content

feat(core): connect installed contract intent pipeline#368

Merged
flyingrobots merged 11 commits into
mainfrom
stack/installed-contract-intent-pipeline
May 21, 2026
Merged

feat(core): connect installed contract intent pipeline#368
flyingrobots merged 11 commits into
mainfrom
stack/installed-contract-intent-pipeline

Conversation

@flyingrobots
Copy link
Copy Markdown
Owner

@flyingrobots flyingrobots commented May 21, 2026

Summary

This PR pushes the installed-contract intent pipeline through the next five slices:

  1. Package-supported installed contract mutations can stage into runtime only through witnessed submission plus ticketed runtime ingress.
  2. observe_intent_outcome(...) now reports typed receipt decisions for decided submissions.
  3. Footprint conflict is locked as a final tick outcome with blocker attribution and no hidden retry ingress.
  4. Witnessed submission history can be exported/imported as deterministic replay records without staging runtime ingress.
  5. A local installed-contract pipeline replay proof converges to the same step record, receipt correlation, and observed outcome.

Docs and backlog status now reflect that local installed mutation dispatch is complete and the next work moves outward toward external consumer proof / contract-aware receipts and readings.

Validation

  • cargo test -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests
  • cargo test -p warp-core --features host_test --test inbox ticketed_submission_outcome_observation_is_decided_after_scheduler_tick
  • cargo fmt --check
  • git diff --check origin/main...HEAD
  • pnpm exec markdownlint-cli2 CHANGELOG.md docs/BEARING.md docs/method/backlog/asap/PLATFORM_installed-wesley-contract-host-dispatch.md docs/method/backlog/asap/PLATFORM_contract-queryview-observer-bridge.md
  • cargo xtask lint-dead-refs --file docs/BEARING.md --file docs/method/backlog/asap/PLATFORM_installed-wesley-contract-host-dispatch.md --file docs/method/backlog/asap/PLATFORM_contract-queryview-observer-bridge.md

Note: pre-push also ran the narrow hook suite successfully. Its inferred exact command for installed_contract_intent_pipeline_tests omitted native_rule_bootstrap,host_test, so Cargo reported 0 tests for that hook slice; the feature-bearing command above is the authoritative local witness for this new integration test file.

Summary by CodeRabbit

  • New Features

    • Installed-contract package boundary integrated into the intent pipeline: staged gating, scheduler-owned execution, deterministic outcome decisions with receipt correlation and rejection reasons, and replay convergence.
  • Documentation

    • Roadmap and platform cards updated to reflect progress on contract dispatch proof and the query-view observer bridge.
  • Tests

    • End-to-end integration tests added to validate installed-contract intent pipeline, conflict handling, replay determinism, and outcome correlation.

Review Change Stack

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 21, 2026

Warning

Rate limit exceeded

@flyingrobots has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 44 minutes and 20 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 235f2f33-c875-4484-b0a9-354ff71afaf3

📥 Commits

Reviewing files that changed from the base of the PR and between 0c50a29 and 95a94c3.

📒 Files selected for processing (6)
  • .github/workflows/ci.yml
  • .github/workflows/macos-local.yml
  • crates/warp-core/Cargo.toml
  • crates/warp-core/src/coordinator.rs
  • crates/warp-core/tests/installed_contract_intent_pipeline_tests.rs
  • scripts/verify-local.sh
📝 Walkthrough

Walkthrough

This PR extends the warp-core coordinator with typed intent outcome derivation from tick receipts, feature-gated installed-contract op-id parsing and pre-staging validation, deterministic witnessed-submission replay/import, scheduler-ticketed staging/dispatch plumbing, comprehensive integration tests, and corresponding docs updates.

Changes

Installed Contract Intent Pipeline

Layer / File(s) Summary
Intent outcome decision & observation
crates/warp-core/src/coordinator.rs, crates/warp-core/tests/inbox.rs
Adds IntentOutcomeDecision (Applied/Rejected/NoMatchingReceiptEntry), changes IntentOutcomeObservation::Decided to include boxed ReceiptCorrelationRecord and the computed decision, and implements intent_outcome_decision with receipt-index verification and disposition mapping; adapts tests to boxed correlation.
Runtime errors, fault scoping & hashing
crates/warp-core/src/coordinator.rs
Adds RuntimeError::IntentSubmissionReplayMismatch(Hash), MalformedInstalledContractIntent, and UnsupportedInstalledContractMutation { op_id }; classifies them under scheduler runtime faults and extends scheduler error cause digest hashing to include these variants and op-id data.
Witnessed submission replay & records
crates/warp-core/src/coordinator.rs
witnessed_submission_replay_records returns deterministic (generation,id)-sorted records; replay_witnessed_submissions imports them with canonical-id validation, duplicate/conflict detection, routing map population, and advances next_submission_generation.
Installed-contract ingress staging & op-id parsing
crates/warp-core/src/coordinator.rs
Feature-gated ingest_installed_contract_invocation extracts mutation op id from envelope, rejects unsupported op ids before staging, translates parse failures to MalformedInstalledContractIntent, and delegates supported cases to ticketed ingress.
Public exports formatting
crates/warp-core/src/lib.rs
Reformats pub use coordinator::{...} across lines; no API symbol changes.
Integration test suite
crates/warp-core/tests/installed_contract_intent_pipeline_tests.rs
Adds gated integration tests with a toy contract package covering no-execute-at-submission, correct staging, scheduler super-tick execution, applied/rejected receipts with blocking attribution, unsupported-op rejection without staging, replay restoring witnessed history, generation continuity, and replay determinism.

Documentation & Roadmap Status

Layer / File(s) Summary
CHANGELOG feature & API docs
CHANGELOG.md
Add warp-core Unreleased bullet describing the installed-contract package boundary’s connection to witnessed intent pipeline and expand observe_intent_outcome(...)::Decided wording to include scheduler-owned receipt correlation and typed receipt decision with applied/rejected entries and reasons/blockers.
BEARING roadmap & next slice
docs/BEARING.md
Update roadmap table rows and rewrite "Immediate Next Slice" to claim scheduler-owned handler dispatch and replay convergence for the local installed-contract intent pipeline; shift next proof boundary toward contract-aware receipt/consumer-proof.
Platform task cards
docs/method/backlog/asap/PLATFORM_contract-queryview-observer-bridge.md, docs/method/backlog/asap/PLATFORM_installed-wesley-contract-host-dispatch.md
Expand QueryView Observer Bridge status and rewrite Installed Wesley Host Dispatch card to claim local dispatch proof, enumerate verification checklist, and replace RED/GREEN with concrete test-driven steps and green items for op-id lookup and receipt/outcome observation.

Sequence Diagram

sequenceDiagram
  participant SubmissionClient
  participant ingest_installed_contract_invocation
  participant RuntimeValidation
  participant TicketedIngress
  participant SchedulerCoordinator
  participant IntentOutcome
  SubmissionClient->>ingest_installed_contract_invocation: installed-contract envelope
  ingest_installed_contract_invocation->>ingest_installed_contract_invocation: extract op_id
  ingest_installed_contract_invocation->>RuntimeValidation: lookup package op_id support
  alt unsupported op_id
    RuntimeValidation-->>ingest_installed_contract_invocation: UnsupportedInstalledContractMutation
    ingest_installed_contract_invocation-->>SubmissionClient: Err
  else op_id supported
    ingest_installed_contract_invocation->>TicketedIngress: delegate ticketed invocation
    TicketedIngress-->>ingest_installed_contract_invocation: TicketedRuntimeIngressDisposition
    ingest_installed_contract_invocation-->>SubmissionClient: Ok(disposition)
  end
  SchedulerCoordinator->>SchedulerCoordinator: super_tick executes staged mutations -> receipts
  SubmissionClient->>IntentOutcome: observe_intent_outcome(correlation)
  IntentOutcome->>IntentOutcome: intent_outcome_decision(receipt, worldline)
  IntentOutcome-->>SubmissionClient: Decided{correlation, IntentOutcomeDecision}
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

  • flyingrobots/echo#360: Related coordinator-level receipt-correlation and Decided decision typing changes.
  • flyingrobots/echo#148: Related tick-receipt blocked_by blocker-causality metadata consumed by the new decision mapping.
  • flyingrobots/echo#145: Related TickReceipt and commit_with_receipt plumbing that produces deterministic receipt digests used for correlation/decision.

Poem

📜 Staged mutations wait, the scheduler keeps the beat,
Receipts decide applied or blocked with reason neat,
Replay rewinds the worldline, matches steps once more,
Tests lock down conflicts, no hidden retry door,
Determinism ticks along — predictable and neat.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'feat(core): connect installed contract intent pipeline' directly matches the PR's primary objective of advancing the installed-contract intent pipeline through staged implementation.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch stack/installed-contract-intent-pipeline

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d024f24e63

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread crates/warp-core/src/coordinator.rs Outdated
@flyingrobots
Copy link
Copy Markdown
Owner Author

Resolved the replay-generation continuity review in 0c50a29.

  • Added regression witness witnessed_submission_replay_preserves_generation_continuity.
  • Changed replay import to retain the imported max generation rather than pre-incrementing it.
  • Updated the changelog note.

Verified with:

cargo test -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests witnessed_submission_replay_preserves_generation_continuity
cargo test -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/warp-core/src/coordinator.rs`:
- Around line 1336-1337: The code currently only updates
self.next_submission_generation to the max seen value and does not reject
records whose submission_generation is <= self.next_submission_generation;
modify the import/replay handling in the coordinator method containing the
snippet so that when record.submission_generation <=
self.next_submission_generation you immediately return an
IntentSubmissionReplayMismatch error (before mutating any state), otherwise
proceed to set self.next_submission_generation = record.submission_generation;
ensure the check uses the same symbols (record.submission_generation and
self.next_submission_generation) and that the IntentSubmissionReplayMismatch
return happens prior to any state updates to prevent duplicate or backward
generations.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 10e80fd5-f7dc-47c5-b622-2a2b234d533d

📥 Commits

Reviewing files that changed from the base of the PR and between d024f24 and 0c50a29.

📒 Files selected for processing (3)
  • CHANGELOG.md
  • crates/warp-core/src/coordinator.rs
  • crates/warp-core/tests/installed_contract_intent_pipeline_tests.rs

Comment thread crates/warp-core/src/coordinator.rs Outdated
@flyingrobots
Copy link
Copy Markdown
Owner Author

@codex Self-review findings for PR #368:

Severity File Lines Issue Recommended mitigation
P1 crates/warp-core/src/coordinator.rs 1307-1342 replay_witnessed_submissions mutates the runtime ledger while it is still validating the batch. If an earlier record imports successfully and a later record fails, the method returns Err after leaving partial replay state behind. Replay import should be failure-atomic. Add a deterministic regression such as replay_witnessed_submissions_rejects_invalid_batch_without_partial_import, then validate/build temporary submission maps and generation posture before committing the batch to runtime state.
P1 .github/workflows/ci.yml, scripts/verify-local.sh, crates/warp-core/tests/installed_contract_intent_pipeline_tests.rs ci.yml 208-213; verify-local 1130-1142, 1387-1394; test line 4 The new installed intent pipeline tests are gated behind native_rule_bootstrap,host_test, but the default command runs zero tests and CI/pre-push do not appear to invoke this target with those features. The branch's primary regression witness can silently fall out of automation. Add [[test]] required-features for installed_contract_intent_pipeline_tests, add verify-local feature mapping, and add an explicit CI command such as cargo test -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests.
P2 crates/warp-core/src/coordinator.rs 1304-1342 Replay import accepts impossible submission-generation histories, including ZERO or duplicate non-zero generations for distinct records. The live path only creates strictly incremented generations, so accepting impossible replay records can corrupt audit ordering and continuity. Add regressions for zero and duplicate replay generations, then reject IngressSubmissionGeneration::ZERO and enforce strict non-zero generation uniqueness within the imported replay batch and against existing replay posture.

I recommend addressing these before merge. The first two are merge-blocking for structural integrity: one affects replay atomicity, and the other affects whether the new pipeline witnesses are enforced by automation.

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0c50a29b08

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread crates/warp-core/src/coordinator.rs Outdated
Comment on lines +1339 to +1342
self.submission_by_target
.insert((record.head_key, record.ingress_id), record.submission_id);
self.witnessed_submissions
.insert(record.submission_id, record);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Make replay import failure-atomic

replay_witnessed_submissions mutates runtime state while still validating the batch, so if an earlier record is inserted and a later record fails validation (for example UnknownHead or IntentSubmissionReplayMismatch), the function returns Err after leaving partial replay state behind. That breaks deterministic recovery because callers cannot rely on all-or-nothing import semantics for a replay batch.

Useful? React with 👍 / 👎.

// SPDX-License-Identifier: Apache-2.0
// © James Ross Ω FLYING•ROBOTS <https://github.com/flyingrobots>
//! Installed contract intent pipeline tests.
#![cfg(all(feature = "native_rule_bootstrap", feature = "host_test"))]
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Wire feature-gated pipeline test into automation

This new integration test file is crate-gated behind native_rule_bootstrap and host_test, but the automation in this commit does not include a feature-mapped invocation for this target (checked .github/workflows/ci.yml test-warp-core commands and scripts/verify-local.sh test-feature mapping), so standard runs can pass while executing zero tests from this file. That allows the primary regression witness added here to silently drop out of CI/pre-push coverage.

Useful? React with 👍 / 👎.

Comment thread crates/warp-core/src/coordinator.rs Outdated
Comment on lines +1336 to +1337
if record.submission_generation > self.next_submission_generation {
self.next_submission_generation = record.submission_generation;
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject impossible replay submission generations

Replay currently accepts any submission_generation and only tracks the max value, so ZERO or duplicate non-zero generations pass validation both within a batch and against existing replay state. The live submit path allocates strictly increasing generations, so importing impossible generation histories can break continuity assumptions and audit ordering derived from submission generations.

Useful? React with 👍 / 👎.

@flyingrobots
Copy link
Copy Markdown
Owner Author

Self-review findings addressed in commits:

Severity Issue Addressed by Regression / verification
P1 Witnessed submission replay could partially import a batch before rejecting a later invalid record. dbc86de replay_witnessed_submissions_rejects_invalid_batch_without_partial_import; cargo test -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests
P1 Installed contract intent pipeline tests were feature-gated but not enforced by automation. b0abe3d cargo test -p warp-core --test installed_contract_intent_pipeline_tests now fails without required features; pre-push now runs cargo test -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests
P2 Replay import accepted impossible zero or duplicate submission generations. 5e73043 replay_witnessed_submissions_rejects_zero_generation; replay_witnessed_submissions_rejects_duplicate_generations
P3 Strict clippy on the installed pipeline test target exposed local test-harness lint posture and redundant clones. 95a94c3 cargo clippy -p warp-core --features native_rule_bootstrap,host_test --test installed_contract_intent_pipeline_tests -- -D warnings -D missing_docs

Additional local checks passed: cargo fmt --check, git diff --check origin/main...HEAD, and the branch pre-push hook.

@flyingrobots flyingrobots merged commit 1d4a22d into main May 21, 2026
36 checks passed
@flyingrobots flyingrobots deleted the stack/installed-contract-intent-pipeline branch May 21, 2026 22:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant