diff --git a/CHANGELOG.md b/CHANGELOG.md index 5aaf77f..adf1d3e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,9 +12,12 @@ All notable changes to the published WIP Rust crates are documented here. local names, with coherent provider-attested scope Object binding for fetch and dispatch. Supplied scope_ref is checked at membership precedence; scope deletion retires retained tokens, while ordinary Object state updates preserve lifetime. -- Migrates FS root publication and public-example self-scopes to the Host API, - including coherent backend observations and explicit built-in names. Non-root - FS semantics and Client cache recovery remain follow-up work. See +- Integrates scoped references across filesystem and public consumers and the TUI. + External FS scopes bind to visible current connected lineage, not retained + registry artifacts. TUI labels use absolute safely quoted `::`/`#` notation; + structured selection and Client scope invalidation prevent stale UI dispatch. + The public example carries fetched scope refs and includes real HTTP lifetime, + visibility and validator-precedence conformance tests with optional refs. See [MIGRATION.md](MIGRATION.md) for API/wire examples and provider responsibilities. ## 0.1.0 diff --git a/MIGRATION.md b/MIGRATION.md index 8063aa4..389461e 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -46,9 +46,11 @@ still contains only format, documentation, types and operations, not identity. field `scope_ref: Option` in struct literals. Use `None` when omitted, not an invented identity. This is an opaque scope Object ref observation/call precondition, **not** a third Interface identity component or a validator. -Host now enforces scope publication lifetimes and optional scope-ref identity -inside the provider boundary (T-21). Client cache-recovery semantics remain -follow-up work (T-22); do not mistake registry artifact retention for publication. +Host enforces scope publication lifetimes and optional scope-ref identity +inside the provider boundary. Client caches keep the complete structured reference +and optional fetched scope binding; confirmed scope deletion or ref replacement +invalidates bound observations, while local eviction is not deletion evidence. +Do not mistake registry artifact retention for publication. ## Validation boundaries @@ -176,17 +178,31 @@ the latter also validates compatible live scope associations and response shape. ## Downstream status -The filesystem consumer registers `file.read`, `symlink.inspect` and `file.write` -at its deployment-pinned root Scope. It binds that lifetime from the refreshed -retained root lineage inside the backend execution boundary for calls, generic -Object observations and fetch. A textual Linux root rename/replacement does not -substitute the pinned root Object. The root has no Object ref, so fetch omits -scope_ref; the private lifetime check still applies. Non-root FS registrations -fail closed pending broader FS/TUI semantics integration (T-23). +The filesystem default registers local names `file.read`, `symlink.inspect` and +`file.write` at its deployment-pinned root Scope, displayed as `/::file.read` etc. +External compositions choose explicit Scope/local names and implement +`Composition::scope` to attest a non-root lifetime from the exact refreshed backend +entry in its connected lineage. The engine never independently resolves a scope +path during dispatch. Default composition remains root-scoped; exposing non-root +registrations requires the application's current lifetime attestation, not merely +an artifact or matching ref/validator. All bindings are formed inside backend +execution, with current principal lineage visibility and publication metadata. +Retire/recreate Scope handles on deletion, replacement or movement; a pinned leaf +alone is not evidence that a self-scope Object remains published at that path. +The Linux deployment root remains pinned across textual root rename/replacement, +and its ref-less default publication continues to omit scope_ref. The public API example self-scopes `catalog`, `audit` and `diagnostics` at -`/article-service`, fetches through its provider, and carries the observed scope -ref in calls. Client keys use structured values; scope deletion/replacement -cache recovery remains T-22. This Host change does not modify TUI formatting; -canonical Text View work is tracked separately in T-24. Interface authoring/macros remain -descriptor-only and need no identity fields or declaration changes. +`/article-service`, fetches through its provider, and constructs call metadata +from the fetched structured reference and scope_ref. External-style conformance +tests also cross real TCP HTTP for root/self-scopes, same names in different +scopes, optional refs, stale refs, deletion/republication and validator precedence. + +The TUI stores structured references in cache keys, selections, actions, editors +and in-flight subjects. Normal screens reuse the canonical absolute scoped +formatter (`/scope::name#operation`, with JSON component quoting when needed). +Labels are never parsed to reconstruct identity, and scope_ref/validators are not +normal-screen reference labels. Client invalidation is synchronized back into UI +observations before dispatch; re-observation is not automatic execution. Typed +result entries are still fetched on selection, not all at once, and do not create +inferred indexable edges. Interface authoring/macros remain descriptor-only. diff --git a/README.md b/README.md index b4ad209..c00b741 100644 --- a/README.md +++ b/README.md @@ -85,6 +85,13 @@ The unreleased Protocol/HTTP API uses explicit `InterfaceReference { scope, name }` records and optional `scope_ref` observation/precondition metadata. Legacy opaque-string wire references are rejected. See [MIGRATION.md](MIGRATION.md) for construction examples, validation boundaries and downstream migration status. +The filesystem default publishes `/::file.read`, `/::symlink.inspect` and +`/::file.write`; external compositions explicitly choose Scope/local names. +The TUI retains structured references for selection and dispatch, while normal +screens use absolute `scope::name#operation` labels with safely quoted components. +These labels are display-only: they are never parsed as cache keys or call targets, +and scope refs/validators remain runtime metadata rather than normal-screen labels. +Client scope invalidation is reflected in the UI before another explicit call. ## End-to-end example diff --git a/crates/wip-public-api-example/src/lib.rs b/crates/wip-public-api-example/src/lib.rs index 44a8ccf..a76d6d7 100644 --- a/crates/wip-public-api-example/src/lib.rs +++ b/crates/wip-public-api-example/src/lib.rs @@ -10,7 +10,10 @@ //! request-scoped implementation, backend handle, authorization policy, and //! publication wiring remain host-private. A transport binding would translate //! its own wire routes and envelopes to the protocol call DTOs; no HTTP type is -//! part of an application trait or interface descriptor. +//! part of an application trait or interface descriptor. Its dev-only conformance +//! suite also uses the public Client and HTTP crates over real TCP HTTP to test +//! scope replacement/deletion, optional refs, principal visibility and precondition +//! precedence. Those dependencies are not required by the example executable. //! //! # Breaking migration exercised here //!