nexum-runtime: reject colliding extension claims at boot#529
Merged
Conversation
One boot-time uniqueness pass fails fast on a service namespace, subscription kind, or manifest section two wired extensions both claim, each of which silently dedupes downstream.
mfw78
force-pushed
the
feat/517-extension-collision-reject
branch
from
July 23, 2026 14:15
136c365 to
b3a0e57
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add a single boot-time uniqueness pass,
enforce_extension_uniqueness(crates/nexum-runtime/src/supervisor.rs), that fails fast when two wired extensions both claim any string in one of three collision classes: service namespace, subscription kind, or manifest section. The pass runs as the first statement of both boot paths,Supervisor::bootandSupervisor::boot_single, beforecapability_registryandHostServices::from_extensions. The pre-existing duplicate-namespace bail inHostServices::from_extensionsis left in place. A new test,supervisor::tests::extension_claims_must_be_unique, boots a non-colliding set and then asserts a rejection on a duplicate subscription kind and on a duplicate manifest section.Why
Each of the three classes dedupes silently downstream: namespace via a map, subscription kind via a
BTreeSet, manifest section via an.any()scan. An unchecked collision therefore routes to whichever extension the map or scan hits first, rather than surfacing the misconfiguration. Enforcing uniqueness up front turns that silent mis-route into a fail-fast boot error. Scope is held to the minimal fix; the richer enum-seam / sha256 integrity-tag design and a second consumer are deferred to #528 and not built here.Testing
All commands run from the worktree root inside
nix develop --command, against the shared warm/code/nxm/runtime/target.cargo fmt --all -- --check— clean, no diff.cargo clean -p nexum-runtimethencargo clippy -p nexum-runtime --all-targets --all-features -- -D warnings— clean from a cold crate, no warnings.cargo test -p nexum-runtime --all-features— 309 passed, 0 failed, plus 1 doctest passed. The newsupervisor::tests::extension_claims_must_be_uniqueand the pre-existingextension_sections_must_be_claimedboth pass.AI Assistance
Implemented, reviewed and verified with Claude Code (Opus).
Closes #517