docs: describe scoped consumer API and wire migration

Document FS lifetime attestation and explicit names, structured TUI identity versus qualified display, optional scope refs and real HTTP conformance coverage. Acceptance suite passes including workspace docs with -D warnings.

CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to the published WIP Rust crates are documented here.
+
+## Unreleased
+
+- Breaking Protocol/HTTP migration from opaque Interface reference strings to
+  exact `(scope, name)` records in Objects, fetches and calls, with optional
+  opaque `scope_ref` metadata. Adds shape and placement-aware scope validation
+  without changing routes, validators or the wire error-code set.
+- Breaking Host registration migration to explicit Scope publication lifetimes and
+  local names, with coherent provider-attested scope Object binding for fetch and
+  dispatch. Supplied scope_ref is checked at membership precedence; scope deletion
+  retires retained tokens, while ordinary Object state updates preserve lifetime.
+- Integrates scoped references across filesystem and public consumers and the TUI.
+  External FS scopes bind to visible current connected lineage, not retained
+  registry artifacts. TUI labels use absolute safely quoted `::`/`#` notation;
+  structured selection and Client scope invalidation prevent stale UI dispatch.
+  The public example carries fetched scope refs and includes real HTTP lifetime,
+  visibility and validator-precedence conformance tests with optional refs. See
+  [MIGRATION.md](MIGRATION.md) for API/wire examples and provider responsibilities.
+
+## 0.1.0
+
+Initial public release of:
+
+- `wip-protocol`: transport-independent WIP logical model and validation.
+- `wip-interface-macros`: procedural-macro implementation for interface and DTO declarations.
+- `wip-interface`: public Rust interface-authoring facade and typed value codecs.
+- `wip-host`: request-scoped publication, precondition validation, and qualified operation dispatch.
+- `wip-http`: framework-independent WIP over HTTP v1 routes, strict JSON codecs, and failure classification.
+- `wip-client`: stateful Known Space, interest-driven acquisition, request ownership, and operation lifecycle.
+
+The repository also contains non-published filesystem server, terminal client, and public-API conformance packages.

Cargo.toml

@@ -1,11 +1,19 @@
 [workspace]
-members = [".", "crates/wip-protocol"]
+members = ["crates/*"]
 resolver = "3"
 
-[package]
-name = "wip-rs"
+[workspace.package]
 version = "0.1.0"
 edition = "2024"
+rust-version = "1.88"
+license = "MIT OR Apache-2.0"
+repository = "https://gitea.hareworks.net/Hare/wip-rs"
 
-[dependencies]
-wip-protocol = { path = "crates/wip-protocol" }
+[workspace.dependencies]
+wip-client = { version = "0.1.0", path = "crates/wip-client" }
+wip-fs-server = { version = "0.1.0", path = "crates/wip-fs-server" }
+wip-host = { version = "0.1.0", path = "crates/wip-host" }
+wip-http = { version = "0.1.0", path = "crates/wip-http" }
+wip-interface = { version = "0.1.0", path = "crates/wip-interface" }
+wip-interface-macros = { version = "0.1.0", path = "crates/wip-interface-macros" }
+wip-protocol = { version = "0.1.0", path = "crates/wip-protocol" }

LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

MIGRATION.md

@@ -0,0 +1,208 @@
+# Structured Interface reference and scope publication migration
+
+This unreleased API/wire change follows `wip-reference` canonical Core Model,
+Protocol and WIP over HTTP at `6086f3c5ef10aa1464ce9c824750d7f667217bfd`.
+It replaces the earlier opaque Interface reference contract; HTTP routes and
+error codes have **not** changed. Peers must upgrade together: the codec does
+not accept legacy strings or display shorthand as Protocol references.
+
+## Rust API
+
+`Object.interfaces` is now `Vec<InterfaceReference>`.
+`FetchInterfaceRequest.interface`, `FetchInterfaceResponse.interface`, and
+`InterfaceTarget.reference` all use the same record:
+
+```rust
+use wip_protocol::{FetchInterfaceRequest, InterfaceReference, InterfaceTarget};
+
+let reference = InterfaceReference {
+    scope: "/github".into(),
+    name: "issue.read".into(),
+};
+reference.validate()?; // reference shape, no target Object path needed
+let fetch = FetchInterfaceRequest { interface: reference.clone() };
+let target = InterfaceTarget {
+    reference,
+    scope_ref: Some("opaque-scope-object-ref".into()),
+    validator: None,
+};
+# Ok::<(), wip_protocol::ValidationError>(())
+```
+
+Construct scope and name explicitly from your Worldspace publication context.
+There is no implicit conversion from a string, delimiter parser, normalization,
+case folding, or URL decoding. A name may contain `/`, `.`, `::`, `#`, or Unicode;
+only an empty name is invalid. Scope must be a canonical absolute Worldspace
+path: `/`, or nonempty slash-separated segments other than `.` and `..`, with
+no empty segments or trailing slash. `%2F` is ordinary field text, not an escape
+for a Worldspace path separator.
+
+Equality, hashing and ordering operate on both fields, independent of member
+order/JSON escape spelling. Use the record itself as a membership/cache key;
+identical names in different scopes are different references. The descriptor
+still contains only format, documentation, types and operations, not identity.
+
+`FetchInterfaceResponse` and `InterfaceTarget` additionally require the Rust
+field `scope_ref: Option<String>` in struct literals. Use `None` when omitted,
+not an invented identity. This is an opaque scope Object ref observation/call
+precondition, **not** a third Interface identity component or a validator.
+Host enforces scope publication lifetimes and optional scope-ref identity
+inside the provider boundary. Client caches keep the complete structured reference
+and optional fetched scope binding; confirmed scope deletion or ref replacement
+invalidates bound observations, while local eviction is not deletion evidence.
+Do not mistake registry artifact retention for publication.
+
+## Validation boundaries
+
+- `InterfaceReference::validate()` and `FetchInterfaceRequest::validate()`
+  check reference shape independently of a target Object path.
+- `Object::validate()` checks shape and duplicate `(scope, name)` pairs;
+  `Object::validate_at_path()` additionally checks placement, including scope.
+  `ObserveRequest::validate_response()` checks every derived node path,
+  including the depth boundary. Invalid success responses are Client-local
+  `InvalidResponse`, not Host-returned Protocol errors.
+- `InterfaceReference::validate_for_path(path)` checks ancestor-or-self scope
+  compatibility by path segments. Root and self scope are valid; `/a` is not
+  an ancestor of `/ab`. This has no indexability dependency.
+- `CallOperationRequest::validate()` checks descriptor-independent shape.
+  `validate_with()` adds operation/argument checks but does not replace Host
+  publication lookup. Host interface selection checks scope compatibility and
+  exact membership **after** target lookup: invalid reference shape is
+  `InvalidRequest`, but a valid reference outside the target's scope is
+  `InterfaceMismatch`, with `NotFound` retaining precedence.
+
+## HTTP wire
+
+All four reference positions use an exact object with required string fields:
+
+```json
+{"scope":"/github","name":"issue.read"}
+```
+
+For example:
+
+```json
+{
+  "interface": {"scope":"/github","name":"issue.read"},
+  "scope_ref": "opaque-scope-object-ref",
+  "descriptor": {"format":"wip-interface/1","types":[],"operations":[]}
+}
+```
+
+A call uses:
+
+```json
+{
+  "target": {"path":"/github/issues/123"},
+  "interface": {
+    "reference": {"scope":"/github","name":"issue.read"},
+    "scope_ref": "opaque-scope-object-ref"
+  },
+  "operation":"refresh",
+  "arguments":{}
+}
+```
+
+Unknown/duplicate members, missing fields, null fields, relative scopes, empty
+names, legacy `"interface-v1"` and shorthand `"/github::issue.read"` strings
+are rejected. Field order and JSON escaping do not affect decoded identity.
+`scope_ref` is a normal opaque string, **not Base64**; omission is allowed but
+explicit null and nonstrings are invalid. An empty string is a valid opaque
+ref. Validators remain canonical padded standard Base64.
+
+Descriptor-independent HTTP call metadata decoding enforces reference shape
+and the same strict JSON rules without turning scope compatibility into early
+`InvalidRequest`. Normal descriptor-bound encode/decode uses the same reference
+codec. Request violations retain the existing `400 invalid_request` boundary;
+malformed success responses retain Client-local `InvalidResponse`. Standard
+`POST v1/observe`, `v1/fetch_interface`, `v1/call_operation`, error-code/status
+mapping and Transport failure classification are unchanged.
+
+## Host registration and provider migration
+
+Registration now requires an explicit canonical Scope and local name:
+
+```rust,ignore
+let mut registry = wip_host::InterfaceRegistry::new();
+let scope = wip_host::Scope::new("/service")?;
+let api = registry.register(&scope, "catalog", CatalogDefinition, None)?;
+
+// INSIDE the backend transaction/lock/stable-handle boundary:
+let current = wip_host::ScopeObservation::new(&scope, &current_scope_object);
+let publication = wip_host::PublishedObject::new(current_target_object)
+    .expose(&api)?
+    .bind_scope(current);
+```
+
+Collision keys are exact `(scope, name)` coordinates, not Rust Definition TypeId.
+The same Definition can be registered in different scopes or under different
+names. Root, self and ancestor scopes are valid, but ancestor compatibility and
+explicit target membership remain independent checks. Descriptors still have
+no publication identity fields.
+
+A Scope carries a private publication lifetime, not a generated Protocol ref.
+Clone it only while the same scope Object remains published: ordinary Object
+state/validator updates do not retire it. Deletion, replacement or movement
+requires retiring the old lifetime with `registry.remove_scope(&scope)` and
+creating a fresh Scope before republication, even at the same path or ref.
+Retained registration tokens cannot fetch or start calls after retirement.
+Ref-less replacement cannot be tracked by a Client identity precondition; refs
+and scope_ref remain optional, not forcibly generated.
+
+`ScopeObservation::new(&scope, &object)` is a provider attestation that this
+lifetime currently belongs to the Object at the scope path. Construct and attach
+it with `PublishedObject::bind_scope` inside the same coherent boundary as target
+resolution, membership, Descriptor/validator selection, implementation and
+backend handles, through dispatch and commit/rollback. A matching ref or an
+independent scope prelookup is not sufficient. The scope Object need not expose
+any interfaces. Providers own atomicity and external-writer limitations; the
+runtime checks the attached lifetime and optional scope_ref, and validates both
+arguments and results against the same frozen Descriptor. A supplied scope_ref
+mismatch, including a missing current ref, is `InterfaceMismatch` at membership
+precedence, after target existence and a supplied Object validator mismatch.
+Omission applies no scope identity precondition.
+
+Artifact-only `registry.fetch_interface(reference)` is removed. Prefer
+`ObjectProvider::fetch_interface(&provider, &registry, &reference)`, which resolves
+the visible scope Object with `with_object` and uses its attached current binding.
+Low-level `registry.fetch_interface(&reference, &current_observation)` requires
+the same coherent current attestation, not a cached snapshot. Fetch returns
+Descriptor, Interface validator and optional scope Object ref together; Clients
+need not additionally fetch an ancestor Object. `registry.scopes()` may repeat
+a handle for several names; do not treat it as a unique-scope iterator.
+
+`PublishedObject::protocol_object()` is a path-free composition projection, not
+publication authority. For current observations use `ObjectProvider::observe_object`
+or `publication.protocol_object_at(path)` inside the coherent provider boundary;
+the latter also validates compatible live scope associations and response shape.
+
+## Downstream status
+
+The filesystem default registers local names `file.read`, `symlink.inspect` and
+`file.write` at its deployment-pinned root Scope, displayed as `/::file.read` etc.
+External compositions choose explicit Scope/local names and implement
+`Composition::scope` to attest a non-root lifetime from the exact refreshed backend
+entry in its connected lineage. The engine never independently resolves a scope
+path during dispatch. Default composition remains root-scoped; exposing non-root
+registrations requires the application's current lifetime attestation, not merely
+an artifact or matching ref/validator. All bindings are formed inside backend
+execution, with current principal lineage visibility and publication metadata.
+Retire/recreate Scope handles on deletion, replacement or movement; a pinned leaf
+alone is not evidence that a self-scope Object remains published at that path.
+The Linux deployment root remains pinned across textual root rename/replacement,
+and its ref-less default publication continues to omit scope_ref.
+
+The public API example self-scopes `catalog`, `audit` and `diagnostics` at
+`/article-service`, fetches through its provider, and constructs call metadata
+from the fetched structured reference and scope_ref. External-style conformance
+tests also cross real TCP HTTP for root/self-scopes, same names in different
+scopes, optional refs, stale refs, deletion/republication and validator precedence.
+
+The TUI stores structured references in cache keys, selections, actions, editors
+and in-flight subjects. Normal screens reuse the canonical absolute scoped
+formatter (`/scope::name#operation`, with JSON component quoting when needed).
+Labels are never parsed to reconstruct identity, and scope_ref/validators are not
+normal-screen reference labels. Client invalidation is synchronized back into UI
+observations before dispatch; re-observation is not automatic execution. Typed
+result entries are still fetched on selection, not all at once, and do not create
+inferred indexable edges. Interface authoring/macros remain descriptor-only.

README.md

@@ -0,0 +1,360 @@
+# wip-rs
+
+Rust building blocks for the Web Interface Protocol (WIP).
+
+The repository is a resolver-3 virtual Cargo workspace whose packages all live
+under `crates/*`. It provides a transport-independent protocol model, the
+standard framework-independent WIP over HTTP v1 binding, a stateful
+presentation-independent client runtime, a Rust interface-authoring facade, a
+request-scoped host runtime, a bounded Linux filesystem projection server, an
+interactive terminal client, and a private public-API conformance consumer. The
+repository root is not itself a package.
+
+## Crate graph and responsibilities
+
+```text
+Published libraries
+
+wip-client
+├── wip-http
+│   └── wip-protocol
+└── wip-protocol
+
+wip-host
+├── wip-interface
+│   ├── wip-interface-macros
+│   └── wip-protocol
+└── wip-protocol
+
+Workspace-only applications and conformance consumers
+
+wip-tui
+├── wip-client
+├── wip-http
+└── wip-protocol
+
+wip-fs-server
+├── wip-host
+├── wip-http
+├── wip-interface
+└── wip-protocol
+
+wip-public-api-example
+├── wip-host
+├── wip-interface
+└── wip-protocol
+```
+
+| Crate | Responsibility | Does not own |
+| --- | --- | --- |
+| `wip-protocol` | Transport-independent descriptors, object/call/result types, logical `Value`s, validation, and stable protocol error categories. | Application DTOs, implementations, persistence, or wire encoding. |
+| `wip-http` | Standard WIP over HTTP v1 endpoint/route derivation, UTF-8 JSON codecs, direct success bodies, and error/status classification. | HTTP I/O, URL scheme or TLS policy, authentication schemes, server frameworks, filesystem projection, or client presentation/cache policy. |
+| `wip-client` | Endpoint/security-context-isolated Known Space, normalized object and interface observations, intent-driven object and descriptor coverage with bounded request deduplication, immutable operation call contexts, stale transitions, and bounded histories. | HTTP I/O, credentials, persistent cache, automatic operation retries, or presentation widgets/events. |
+| `wip-tui` | Keyboard-only interactive Worldspace tree, selected Entry and qualified operation panes, descriptor-driven argument editing, bounded result/diagnostic rendering, terminal lifecycle, and HTTP I/O workers over `wip-client`. | Independent cache/validator semantics, automatic operation retries, Host internals, backend paths, or persistent state. |
+| `wip-interface` | The public `WipType`/`interface` authoring API, Rust-to-protocol codecs, generated descriptors, and typed implementation dispatch. | Object publication, backend lifetime, or transport policy. |
+| `wip-interface-macros` | Procedural-macro expansion used by `wip-interface`. It is not an application dependency. | A supported direct user API. |
+| `wip-host` | Opaque interface registration, explicit object membership, validator checks, interface-qualified dispatch against one host-owned instance, and descriptor-guided argument decoding inside that same resolution boundary. | Backend atomicity, global object lookup, or network serving. |
+| `wip-fs-server` | Linux directory-handle-confined request-time projection, complete depth-bounded observations and bounded file operations, standard `wip-http` dispatch, and a loopback HTTP binary. | A new wire profile, implicit symlink following, non-loopback cleartext, authentication policy, TLS termination, or filesystem-wide preregistration. |
+| `wip-public-api-example` | An independently compiled consumer of the protocol, authoring, and host public crates. Its DTOs and traits are application-owned; its implementation and backend handle remain host-private. | Reusable library API or a production server. |
+
+## Published crates
+
+The `0.1.0` release consists of these six crates:
+
+- `wip-protocol`
+- `wip-interface-macros` — implementation dependency re-exported by `wip-interface`
+- `wip-interface`
+- `wip-host`
+- `wip-http`
+- `wip-client`
+
+The filesystem server, terminal client, and public-API example are workspace-only packages and set `publish = false`. All workspace packages require Rust 1.88 or newer and are licensed under either Apache-2.0 or MIT at your option.
+
+See [RELEASING.md](RELEASING.md) for the dependency-ordered crates.io procedure and [CHANGELOG.md](CHANGELOG.md) for release contents.
+
+The boundary is intentional: protocol types describe what can cross a
+transport; application DTOs opt into that model with `WipType`; a host-private
+implementation owns credentials, handles, and backend state; and `wip-http`
+maps standard routes/envelopes to `CallOperationRequest` and
+`CallOperationResponse` without placing transport-specific types in descriptors
+or application traits.
+
+## Structured Interface references
+
+The unreleased Protocol/HTTP API uses explicit `InterfaceReference { scope,
+name }` records and optional `scope_ref` observation/precondition metadata.
+Legacy opaque-string wire references are rejected. See [MIGRATION.md](MIGRATION.md)
+for construction examples, validation boundaries and downstream migration status.
+The filesystem default publishes `/::file.read`, `/::symlink.inspect` and
+`/::file.write`; external compositions explicitly choose Scope/local names.
+The TUI retains structured references for selection and dispatch, while normal
+screens use absolute `scope::name#operation` labels with safely quoted components.
+These labels are display-only: they are never parsed as cache keys or call targets,
+and scope refs/validators remain runtime metadata rather than normal-screen labels.
+Client scope invalidation is reflected in the UI before another explicit call.
+
+## End-to-end example
+
+[`crates/wip-public-api-example/src/lib.rs`](crates/wip-public-api-example/src/lib.rs)
+is the complete public-API example and
+[`crates/wip-public-api-example/src/main.rs`](crates/wip-public-api-example/src/main.rs)
+runs it. It demonstrates all of the following:
+
+1. public application DTOs derived as `WipType` records, enums, and unions,
+   including canonical entry paths and schema-opaque JSON;
+2. two public traits declared with `#[wip::interface]`;
+3. a private host struct implementing both traits;
+4. explicit publication of both interfaces as an ordered set on one object;
+5. separate observation of structured interface references, descriptors, and
+   descriptor validators;
+6. calls qualified by `target.path`, object validator, interface reference and
+   validator, operation, and schema-neutral `Value` arguments;
+7. validated result values decoded back to the typed application result;
+8. independent dispatch of the same `status` operation name on both interfaces;
+9. distinct domain rejection, rollback-confirmed and outcome-unknown
+   host/backend failures, `PermissionDenied`, stale validator recovery, interface
+   membership, and lookup failure codes; and
+10. canonical failure precedence when several request fields are invalid.
+
+Run it inside the development shell:
+
+```console
+nix develop
+cargo run --package wip-public-api-example
+```
+
+The public-only conformance suite is in
+[`crates/wip-public-api-example/tests/end_to_end.rs`](crates/wip-public-api-example/tests/end_to_end.rs).
+It covers canonical object/descriptor shape, ordered interfaces,
+schema-neutral record/enum/union/entry/JSON values, fully qualified calls, and
+the distinct domain, host, authorization, validator-recovery, and interface
+failure classes. Exhaustive public type construction and matching make legacy
+ObjectId, descriptor `name`, and semantic `Value` variants compile-time
+regressions. Unit tests in the public crates additionally cover every host
+dispatch failure, `InvalidRequest` versus descriptor-bound `InvalidArguments`,
+invalid local responses, validators, same-named operations, and exhaustive
+per-interaction protocol error-code sets.
+
+## Interface authoring
+
+Applications depend on `wip-interface`, normally imported as `wip`:
+
+```rust
+use wip_interface as wip;
+
+#[derive(wip::WipType)]
+struct Message {
+    /// Message body.
+    text: String,
+}
+
+#[wip::interface]
+pub trait Messenger {
+    /// Sends a message.
+    ///
+    /// # Returns
+    /// Whether the application accepted the message.
+    fn send(
+        &self,
+        /// Message to send.
+        message: Message,
+    ) -> wip::OperationResult<bool>;
+}
+```
+
+The `interface` attribute and `WipType` derive are re-exported by the facade;
+users do not import `wip-interface-macros` or generated private support symbols.
+The generated `MessengerDefinition` constructs an `InterfaceDescriptor`,
+decodes named arguments, encodes results, validates both boundaries, and
+provides typed dispatch for any `T: Messenger`.
+
+### Supported Rust syntax
+
+A supported interface is a public, non-generic trait containing methods with:
+
+- exactly an immutable `&self` receiver;
+- simple named, owned parameters;
+- an explicit `wip::OperationResult<T>` return;
+- `()` only as the application return when no value is produced; and
+- direct `Option<T>` only for an omittable parameter.
+
+`WipType` derives support named-field structs, all-unit enums, and unions whose
+cases may be unit variants or variants containing exactly one unnamed payload.
+The macros reject private,
+generic, inherited, unsafe, auto, or associated-item traits; const, async,
+unsafe, extern, variadic, generic, default-bodied, or non-`&self` methods;
+borrowed/custom-lifetime values; tuple/unit/generic structs; Rust unions;
+named-field/multi-field enum variants; explicit discriminants; nested `Option`; and
+`Option` in returns, collections, entries, or union payloads. These diagnostics
+are compile-fail tested under `crates/wip-interface/tests/ui`.
+
+### Rust type mapping
+
+| Rust | Protocol |
+| --- | --- |
+| `()` | unit / `Value::Unit` |
+| `bool` | boolean |
+| integer primitives | JavaScript-lossless integer |
+| `f32`, `f64` | finite number |
+| `String` | string |
+| `wip::Bytes` | bytes |
+| `wip::JsonValue` | JSON interpreted over the schema-neutral `Value` tree |
+| `wip::Entry` | canonical absolute Worldspace path encoded as a string |
+| `Vec<T>` | list |
+| named-field `#[derive(wip::WipType)]` struct | named record |
+| all-unit `#[derive(wip::WipType)]` enum | named enum encoded as a string |
+| mixed unit/newtype or all-newtype enum | named union encoded as a discriminator record |
+
+`Option<T>` means that a direct DTO field or operation parameter may be
+omitted; it is not protocol null. JSON null remains available inside
+`wip::JsonValue`.
+
+#### Migration from the pre-canonical value API
+
+The old generic `wip::Entry<K, V>` represented an application key/value pair
+and is no longer available. Use `wip::Entry::new("/canonical/path")` for a
+Worldspace entry path and place any associated application data in a record.
+`Entry` encodes as `Value::String` and validates the canonical absolute path.
+
+The semantic `Value::Json`, `Value::Entry`, `Value::Enum`, and `Value::Union`
+variants have also been removed. JSON recursively uses `Unit`, primitive,
+`List`, and `Record` values and rejects `Bytes`; enums use `String`; unions use
+a `Record` containing `$case` and, for payload-bearing cases, `value`. Unit
+operation results are represented explicitly as `Value::Unit`.
+
+Rust doc comments become descriptor metadata. For an operation, a `# Returns`
+section documents the return declaration; text before that section documents
+the operation itself.
+
+## Host publication and dispatch
+
+Applications use `wip-host` to register generated definitions and explicitly
+choose the ordered interface set for each object publication:
+
+```rust,ignore
+let mut interfaces = wip_host::InterfaceRegistry::new();
+let scope = wip_host::Scope::new("/service")?;
+let messenger = interfaces.register(&scope, "messenger", MessengerDefinition, None)?;
+
+// Inside the provider coherent backend boundary, not a stale scope prelookup:
+let current = wip_host::ScopeObservation::new(&scope, &current_scope_object);
+
+let published = wip_host::PublishedObject::new(request_scoped_object)
+    .expose(&messenger)?
+    .bind_scope(current);
+let protocol_object = published.protocol_object_at("/service/item")?;
+```
+
+`expose` compiles only when the object implements the generated definition's
+interface trait. Implementing a trait does not expose it automatically, empty
+interface sets are valid, insertion order is preserved, and duplicate
+references are rejected. Registry collisions use exact `(scope, name)` pairs,
+not Rust Definition identity; the same Definition may be registered at multiple
+coordinates. Structured references remain outside the Descriptor.
+
+`Scope` carries a private Object publication lifetime. Keep it for ordinary state
+updates; retire it with `remove_scope` and create a fresh Scope on deletion,
+replacement or movement, even at the same path. Providers attach a current
+`ScopeObservation` from the scope Object inside the coherent target/backend
+boundary, never from a separate prelookup. The scope Object need not expose any
+interfaces. Fetch uses `ObjectProvider::fetch_interface(&provider, &registry,
+&reference)` to observe the visible scope Object and return its optional ref,
+Descriptor and Interface validator together; retained artifacts alone are not
+publication. Calls require the current attached lifetime and check supplied
+`scope_ref` at membership precedence; omission adds no identity precondition.
+Refs, Object validators and Interface validators retain distinct responsibilities.
+See [MIGRATION.md](MIGRATION.md) for the provider atomicity and lifecycle contract.
+
+Dispatch is qualified by interface reference and operation name and targets a
+canonical Worldspace path. An `ObjectProvider` validates that path before
+resolution, maps malformed paths to `InvalidRequest`, then resolves a valid path
+exactly once inside `with_object`; the host checks the supplied object validator,
+current scope lifetime/optional scope_ref and interface membership, Interface
+validator, Descriptor operation,
+operation-specific object-validator policy, arguments, and authorization in
+canonical precedence. Path and children remain provider resolution context and
+are never projected by `WipObject`; host-private fields and backend handles are
+also excluded.
+
+Application domain failures belong in a derived result union and are returned
+through `Ok`. `wip::HostError` is reserved for runtime/backend failures. A
+structurally malformed call is `InvalidRequest`; only argument values checked
+after the current Interface Descriptor is fixed are `InvalidArguments`. A Host
+must never return a wire `InvalidResult`: Clients keep invalid Object,
+Descriptor, operation-result, and error responses as local `InvalidResponse`
+failures, while unsupported descriptor formats remain local
+`UnsupportedDescriptorFormat` failures.
+
+For operation calls, `Internal` and `ResourceLimitExceeded` guarantee that the
+operation did not run or that its effects were rolled back.
+`OperationOutcomeUnknown` is the only protocol code that makes no such
+guarantee, so Clients must not automatically retry it. `wip::HostError`
+therefore requires both a `HostErrorKind` and an `EffectGuarantee`; implementation
+panic, result encoding, and result validation default to an unknown outcome.
+Host-private diagnostics are bounded locally but never copied into protocol
+messages.
+
+`ExecutionContext` carries a runtime-neutral cancellation token, monotonic
+deadline, and optional Host-defined resource budget through resolution and
+execution. Cancellation and deadlines are cooperative: the runtime checks them
+immediately before typed invocation, while providers enforce them during backend
+work. A pre-invocation limit failure is `ResourceLimitExceeded`; after invocation
+it is safe to use that code only when non-commit or rollback is confirmed.
+
+Providers remain responsible for backend atomicity. `with_object` returns a typed
+`ProviderResult`, and `execute_operation` receives an `OperationAttempt` that
+separates `NotStarted` from `Started`. A transactional provider holds its
+transaction across the callback, commits successful attempts, and may call
+`OperationAttempt::confirm_rollback` only after every operation effect has been
+rolled back. Without that proof, post-invocation failures remain
+`OperationOutcomeUnknown`. Mutable operations must still make validator
+comparison and backend commit atomic and return a validator describing the state
+that becomes committed.
+
+## Interactive terminal client
+
+[`crates/wip-tui`](crates/wip-tui) provides the `wip-tui` executable. It starts
+from Worldspace `/`, lazily expands materialized tree nodes, displays current
+object/interface/operation metadata, validates all canonical descriptor types in
+a field editor, and requires a separate confirmation action before every call.
+It uses the stateful `wip-client` runtime for request correlation, observed
+validators, stale transitions, and unknown outcomes. One canonical `http` or
+`https` endpoint is used unchanged for request construction, transport, and
+cache partitioning. Scheme, TLS, certificates, authentication, and proxy policy
+belong to the HTTP implementation and deployment. Full startup, key binding,
+layout, validator, and filesystem-operation examples are in the
+[package README](crates/wip-tui/README.md).
+
+## Filesystem projection server
+
+[`crates/wip-fs-server`](crates/wip-fs-server) contains the practical server
+binary and its full security model, configuration, curl walkthrough, and
+resource/failure semantics. It resolves every object from current filesystem
+state, uses pinned directory-relative handles without following symlinks, omits
+non-UTF-8 backend names, returns complete recursive observations through the
+requested depth or a resource-limit failure, and publishes validator-protected
+replacement only in explicit read-write mode.
+The built-in HTTP listener is loopback-only. Externally visible URL schemes,
+TLS termination, certificates, authentication, and proxy routing are deployment
+concerns rather than separate WIP profiles.
+
+## Validation
+
+Enter the dev shell and run the acceptance commands exactly:
+
+```console
+nix develop
+cargo fmt --all -- --check
+cargo check --workspace --all-targets
+cargo test --workspace --all-targets
+cargo test --workspace --doc
+cargo clippy --workspace --all-targets -- -D warnings
+RUSTDOCFLAGS='-D warnings' cargo doc --workspace --no-deps
+cargo run --package wip-public-api-example
+git diff --check
+```
+
+`cargo test --workspace --all-targets` includes the public-only conformance
+consumer, runtime failure tests, and `trybuild` compile-fail suites. The separate
+doctest, rustdoc, executable, and whitespace checks are all required acceptance
+steps.

RELEASING.md

@@ -0,0 +1,75 @@
+# Releasing
+
+The six crates published from this workspace use one version and must be released in dependency order. The filesystem server, terminal client, and public-API example set `publish = false` and are never uploaded.
+
+## Preconditions
+
+1. Work from a clean `master` whose `HEAD` matches `origin/master`.
+2. Confirm the intended version in `[workspace.package]` and every internal requirement in `[workspace.dependencies]`.
+3. Confirm ownership of all six names on crates.io.
+4. Run the complete repository validation suite:
+
+```console
+cargo fmt --all -- --check
+cargo check --workspace --all-targets
+cargo test --workspace --all-targets
+cargo test --workspace --doc
+cargo clippy --workspace --all-targets -- -D warnings
+RUSTDOCFLAGS='-D warnings' cargo doc --workspace --no-deps
+cargo run --package wip-public-api-example
+git diff --check
+```
+
+## Publish order
+
+Before uploading anything, dry-run the exact public package set together. Cargo uses a temporary local registry for unpublished workspace dependencies during this check:
+
+```console
+cargo publish --dry-run --workspace \
+  --exclude wip-fs-server \
+  --exclude wip-public-api-example \
+  --exclude wip-tui
+```
+
+Then dry-run and publish each layer before moving to a crate that depends on it:
+
+```console
+cargo publish --dry-run --package wip-protocol
+cargo publish --package wip-protocol
+
+cargo publish --dry-run --package wip-interface-macros
+cargo publish --package wip-interface-macros
+```
+
+Wait until both versions are available from the crates.io index, then continue:
+
+```console
+cargo publish --dry-run --package wip-interface
+cargo publish --package wip-interface
+
+cargo publish --dry-run --package wip-http
+cargo publish --package wip-http
+```
+
+After those versions are available from the index:
+
+```console
+cargo publish --dry-run --package wip-host
+cargo publish --package wip-host
+
+cargo publish --dry-run --package wip-client
+cargo publish --package wip-client
+```
+
+Registry propagation can take time. A dependent dry-run reporting that a WIP crate is unavailable means the previous publish is not visible in the selected registry yet; do not bypass verification.
+
+## Tag
+
+After all six uploads resolve successfully, tag the exact published commit and push the tag:
+
+```console
+git tag -a v0.1.0 -m "release: 0.1.0"
+git push origin v0.1.0
+```
+
+Do not move or recreate a published version or its tag. Prepare a new version for any subsequent correction.

crates/wip-client/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "wip-client"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+description = "Presentation-independent stateful WIP client runtime"
+license.workspace = true
+repository.workspace = true
+readme = "README.md"
+documentation = "https://docs.rs/wip-client"
+
+[dependencies]
+wip-http.workspace = true
+wip-protocol.workspace = true

crates/wip-client/LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

crates/wip-client/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crates/wip-client/README.md

@@ -0,0 +1,36 @@
+# wip-client
+
+Presentation-independent stateful runtime for Web Interface Protocol (WIP) clients.
+
+`wip-client` manages endpoint- and security-context-isolated Known Space, object and Interface Descriptor observations, bounded request ownership, supersession, out-of-order response suppression, validator recovery, and operation call contexts. It produces and consumes framework-neutral `wip-http` messages but performs no network I/O and contains no UI types.
+
+```toml
+[dependencies]
+wip-client = "0.1.0"
+```
+
+Applications provide the HTTP adapter and presentation layer, send each prepared request exactly as owned by the runtime, then return the corresponding response for completion.
+
+## Interface identity and scope lifetime
+
+Interface acquisition and call APIs use `wip_protocol::InterfaceReference { scope, name }` directly. Within an endpoint/security-context session, the complete scoped pair is the cache key and the Object membership key: equal names in different scopes remain distinct. A scope is a canonical absolute Worldspace path and must be an ancestor of, or equal to, the call target path. Root scope (`/`) and self scope are valid; clients must not rewrite either into a different reference.
+
+`InterfaceObservation::scope_ref` is optional opaque metadata identifying the scope Object, not a third reference component, a path, or an Interface Descriptor validator. Its absence does not prevent acquisition or calls. Calls copy the exact observed reference, optional `scope_ref`, and optional Interface Descriptor validator into `InterfaceTarget`; the target Object validator is copied separately. The `CallContext` fixes those observations, the descriptor, and the operation declaration before dispatch.
+
+A descriptor without an Interface Descriptor validator is immutable only within the lifetime of its scope Object, not forever at that path. Descriptors with validators are also bound to that scope lifetime. When accepted observations establish that a known scope binding has changed or been lost, dependent cached interface state is invalidated and cannot authorize a new call until explicitly reacquired. A superseded interface response must not restore an observation from the old lifetime. A previously prepared call retains its original context rather than silently adopting a new scope identity or descriptor.
+
+Scope binding evidence is shared across Interface names at the same scope path: a new binding learned by fetching one name retires older descriptors for the other names too. Separately observed Object refs also provide lifetime evidence even when a descriptor's `scope_ref` was omitted. This corroboration is private bounded cache state, not an invented identity, and never fills in missing call metadata. Same-lifetime descriptor validation still applies; a detected ref change or loss retires the old lifetime instead.
+
+Object deletion, entry-edge removal, and local cache eviction are different events. A direct observe `NotFound` confirms unavailability at the requested scope path and removes cached interfaces scoped to that path; it does not guarantee identity-wide Object deletion or unavailability through every alias. Removing one entry edge likewise does not prove that the Object was deleted or invalidate every remaining alias. Cache eviction is local loss of retained knowledge, not evidence of Host deletion. Losing a known binding at an interface's scope path nevertheless ends safe reuse of descriptors dependent on that binding, even if the same Object remains reachable elsewhere. Optional `scope_ref` can provide identity evidence, but clients do not fabricate it when it is absent.
+
+Without Object `ref` or `scope_ref` identity evidence, a replacement at the same scope path can be indistinguishable from the previous Object. The runtime cannot detect every ref-less replacement from path and descriptor contents alone; absence of detectable change is not proof that the scope lifetime continued.
+
+## Explicit recovery and operation outcomes
+
+`ensure_observed` and `ensure_interface` avoid duplicate fresh or loading work; they do not automatically refresh retained stale or failed observations. Use the explicit object/children refresh APIs and `prepare_interface` to recover the observations required for a new call. An operation `InterfaceMismatch` invalidates both sides of the call's assumptions: it marks the target Object observation stale and invalidates the selected cached interface observation, so recovery requires reobserving membership and reacquiring the descriptor. Reobserving an Object and reacquiring its interface are retrievals, not a retry of an operation.
+
+The runtime never automatically retries an operation. Mark a call dispatched when handing it to the transport and report completion or transport failure with its original `RequestId`. A timeout, disconnect, or invalid response after dispatch can leave the outcome unknown: execution or commit cannot be ruled out. Refreshing stale state does not resolve that uncertainty and must not automatically resubmit the call; any new operation is an explicit application decision.
+
+See the [API documentation](https://docs.rs/wip-client) for session, acquisition, cache, and call APIs.
+
+Licensed under either of Apache-2.0 or MIT at your option.

crates/wip-client/tests/adapter.rs

@@ -0,0 +1,713 @@
+fn root_reference(name: &str) -> wip_protocol::InterfaceReference {
+    wip_protocol::InterfaceReference {
+        scope: "/".into(),
+        name: name.into(),
+    }
+}
+
+use std::collections::BTreeMap;
+
+use wip_client::{
+    CallOutcome, Client, ClientErrorKind, ClientLimits, Completion, DiagnosticKind,
+    ObservationState, OutcomeUnknownReason, SecurityContext,
+};
+use wip_http::http::{Response, StatusCode};
+use wip_http::{
+    Limits, decode_call_operation_request, decode_fetch_interface_request,
+    encode_fetch_interface_response, encode_observe_response, encode_protocol_error_response,
+};
+use wip_protocol::{
+    CallOperationRequest, FetchInterfaceRequest, FetchInterfaceResponse, INTERFACE_FORMAT_V1,
+    InterfaceDescriptor, InterfaceReference, InterfaceTarget, Object, ObjectObservation,
+    ObserveRequest, OperationDeclaration, ParameterDeclaration, ProtocolError, ProtocolErrorCode,
+    ProtocolInteraction, ReturnDeclaration, Target, TypeExpr, Value,
+};
+
+fn limits() -> Limits {
+    Limits::new(64 * 1024, 64 * 1024, 64).unwrap()
+}
+
+fn setup() -> (Client, wip_client::SessionId) {
+    let mut client = Client::new(ClientLimits::new(2, 16, 16, 16, 16).unwrap(), limits());
+    let session = client
+        .open_session("https://example.test/wip", SecurityContext::new("subject"))
+        .unwrap();
+    (client, session)
+}
+
+fn response(status: StatusCode, body: &[u8]) -> Response<Vec<u8>> {
+    Response::builder()
+        .status(status)
+        .header("content-type", "application/json; charset=utf-8")
+        .body(body.to_vec())
+        .unwrap()
+}
+
+fn object() -> Object {
+    Object {
+        name: "item".into(),
+        description: None,
+        interfaces: vec![root_reference("math")],
+        r#ref: None,
+        validator: Some(b"object-v1".to_vec()),
+    }
+}
+
+fn descriptor(format: &str) -> InterfaceDescriptor {
+    InterfaceDescriptor {
+        format: format.into(),
+        documentation: None,
+        types: vec![],
+        operations: vec![OperationDeclaration {
+            name: "calculate".into(),
+            documentation: None,
+            parameters: vec![ParameterDeclaration {
+                name: "value".into(),
+                required: true,
+                documentation: None,
+                r#type: TypeExpr::Integer,
+            }],
+            returns: ReturnDeclaration {
+                documentation: None,
+                r#type: TypeExpr::Integer,
+            },
+        }],
+    }
+}
+
+fn reference(scope: &str, name: &str) -> InterfaceReference {
+    InterfaceReference {
+        scope: scope.into(),
+        name: name.into(),
+    }
+}
+
+fn observe(client: &mut Client, session: &wip_client::SessionId, path: &str, value: Object) {
+    let request = client.refresh_object(session, path).unwrap();
+    client
+        .complete(
+            request.id,
+            encode_observe_response(
+                &ObserveRequest {
+                    path: path.into(),
+                    depth: 0,
+                },
+                &ObjectObservation {
+                    object: value,
+                    children: None,
+                },
+                limits(),
+            )
+            .unwrap(),
+        )
+        .unwrap();
+}
+
+fn fetch(
+    client: &mut Client,
+    session: &wip_client::SessionId,
+    value: FetchInterfaceResponse,
+) -> Completion {
+    let request = client
+        .prepare_interface(session, value.interface.clone())
+        .unwrap();
+    let logical = FetchInterfaceRequest {
+        interface: value.interface.clone(),
+    };
+    assert_eq!(
+        decode_fetch_interface_request(request.request.body(), limits()).unwrap(),
+        logical
+    );
+    client
+        .complete(
+            request.id,
+            encode_fetch_interface_response(&logical, &value, limits()).unwrap(),
+        )
+        .unwrap()
+}
+
+#[test]
+fn observe_accepts_same_name_interfaces_in_different_scopes() {
+    let (mut client, session) = setup();
+    let request = client.refresh_object(&session, "/item").unwrap();
+    let completion = client
+        .complete(
+            request.id,
+            response(
+                StatusCode::OK,
+                br#"{"object":{"name":"item","interfaces":[{"scope":"/","name":"math"},{"scope":"/item","name":"math"}]}}"#,
+            ),
+        )
+        .unwrap();
+    let expected = vec![root_reference("math"), reference("/item", "math")];
+    assert!(matches!(
+        completion,
+        Completion::Object(observation)
+            if observation.state == ObservationState::Fresh
+                && observation.object.as_ref().unwrap().interfaces == expected
+    ));
+    let cached = client.object(&session, "/item").unwrap();
+    assert_eq!(cached.state, ObservationState::Fresh);
+    assert_eq!(cached.object.unwrap().interfaces, expected);
+}
+
+#[test]
+fn same_name_different_scopes_have_independent_requests_and_cached_descriptors() {
+    let (mut client, session) = setup();
+    let root = root_reference("math");
+    let scoped = reference("/area", "math");
+    let root_request = client
+        .ensure_interface(&session, root.clone())
+        .unwrap()
+        .unwrap();
+    let scoped_request = client
+        .ensure_interface(&session, scoped.clone())
+        .unwrap()
+        .unwrap();
+    assert_ne!(root_request.id, scoped_request.id);
+    assert_eq!(
+        decode_fetch_interface_request(root_request.request.body(), limits()).unwrap(),
+        FetchInterfaceRequest {
+            interface: root.clone(),
+        }
+    );
+    assert_eq!(
+        decode_fetch_interface_request(scoped_request.request.body(), limits()).unwrap(),
+        FetchInterfaceRequest {
+            interface: scoped.clone(),
+        }
+    );
+    for selected in [&root, &scoped] {
+        assert!(
+            client
+                .ensure_interface(&session, selected.clone())
+                .unwrap()
+                .is_none()
+        );
+    }
+    assert_eq!(client.in_flight_len(), 2);
+
+    // Reverse completion order must not supersede the other scope's request.
+    for (request, selected, documentation, scope_ref, validator) in [
+        (
+            scoped_request,
+            &scoped,
+            "area math",
+            Some("area-object"),
+            Some(b"area-v1".to_vec()),
+        ),
+        (root_request, &root, "root math", None, None),
+    ] {
+        let mut expected_descriptor = descriptor(INTERFACE_FORMAT_V1);
+        expected_descriptor.documentation = Some(wip_protocol::Documentation {
+            summary: documentation.into(),
+            details: None,
+        });
+        let value = FetchInterfaceResponse {
+            interface: selected.clone(),
+            scope_ref: scope_ref.map(str::to_owned),
+            descriptor: expected_descriptor.clone(),
+            validator: validator.clone(),
+        };
+        let completion = client
+            .complete(
+                request.id,
+                encode_fetch_interface_response(
+                    &FetchInterfaceRequest {
+                        interface: selected.clone(),
+                    },
+                    &value,
+                    limits(),
+                )
+                .unwrap(),
+            )
+            .unwrap();
+        assert!(matches!(completion, Completion::Interface(_)));
+        let cached = client.interface(&session, selected).unwrap();
+        assert_eq!(cached.reference, *selected);
+        assert_eq!(cached.descriptor, Some(expected_descriptor));
+        assert_eq!(cached.scope_ref, value.scope_ref);
+        assert_eq!(cached.validator, validator);
+        assert_eq!(cached.state, ObservationState::Fresh);
+    }
+    for selected in [&root, &scoped] {
+        assert!(
+            client
+                .ensure_interface(&session, selected.clone())
+                .unwrap()
+                .is_none()
+        );
+    }
+    assert_eq!(client.in_flight_len(), 0);
+    assert_eq!(
+        client
+            .interface(&session, &root)
+            .unwrap()
+            .descriptor
+            .as_ref()
+            .unwrap()
+            .documentation
+            .as_ref()
+            .map(|documentation| documentation.summary.as_str()),
+        Some("root math")
+    );
+    assert_eq!(
+        client
+            .interface(&session, &scoped)
+            .unwrap()
+            .descriptor
+            .as_ref()
+            .unwrap()
+            .documentation
+            .as_ref()
+            .map(|documentation| documentation.summary.as_str()),
+        Some("area math")
+    );
+}
+
+#[test]
+fn interface_completion_retains_optional_scope_ref_independently_of_validator() {
+    for scope_ref in [None, Some("opaque scope identity / not a path")] {
+        for validator in [None, Some(b"interface-v1".to_vec())] {
+            let (mut client, session) = setup();
+            let selected = reference("/area", "math");
+            let expected = wip_client::InterfaceObservation {
+                reference: selected.clone(),
+                descriptor: Some(descriptor(INTERFACE_FORMAT_V1)),
+                scope_ref: scope_ref.map(str::to_owned),
+                validator: validator.clone(),
+                state: ObservationState::Fresh,
+            };
+            let completion = fetch(
+                &mut client,
+                &session,
+                FetchInterfaceResponse {
+                    interface: selected.clone(),
+                    descriptor: expected.descriptor.clone().unwrap(),
+                    scope_ref: expected.scope_ref.clone(),
+                    validator,
+                },
+            );
+            assert_eq!(completion, Completion::Interface(expected.clone()));
+            assert_eq!(client.interface(&session, &selected), Some(&expected));
+        }
+    }
+}
+
+#[test]
+fn call_membership_requires_the_complete_scope_and_name_pair() {
+    let (mut client, session) = setup();
+    let member = reference("/item", "math");
+    let same_name = root_reference("math");
+    let mut value = object();
+    value.interfaces = vec![member.clone()];
+    observe(&mut client, &session, "/item", value);
+    for selected in [&member, &same_name] {
+        fetch(
+            &mut client,
+            &session,
+            FetchInterfaceResponse {
+                interface: selected.clone(),
+                descriptor: descriptor(INTERFACE_FORMAT_V1),
+                scope_ref: None,
+                validator: None,
+            },
+        );
+    }
+    let arguments = BTreeMap::from([("value".into(), Value::Integer(2))]);
+    assert_eq!(
+        client
+            .prepare_call(
+                &session,
+                "/item",
+                &same_name,
+                "calculate",
+                arguments.clone(),
+            )
+            .unwrap_err()
+            .kind,
+        ClientErrorKind::InvalidRequest
+    );
+    assert_eq!(client.in_flight_len(), 0);
+    let call = client
+        .prepare_call(&session, "/item", &member, "calculate", arguments)
+        .unwrap();
+    assert_eq!(
+        decode_call_operation_request(
+            call.request.body(),
+            &descriptor(INTERFACE_FORMAT_V1),
+            limits(),
+        )
+        .unwrap()
+        .interface
+        .reference,
+        member
+    );
+}
+
+#[test]
+fn calls_copy_exact_observed_references_metadata_and_validators_for_root_ancestor_and_self_scopes()
+{
+    for (path, scope) in [
+        ("/", "/"),
+        ("/item", "/"),
+        ("/item", "/item"),
+        ("/area/item", "/area"),
+        ("/area/item", "/area/item"),
+    ] {
+        for scope_ref in [None, Some("opaque scope identity / not a path")] {
+            for interface_validator in [None, Some(b"interface-v1".to_vec())] {
+                for object_validator in [None, Some(b"object-v1".to_vec())] {
+                    let (mut client, session) = setup();
+                    let selected = reference(scope, "math");
+                    let expected_descriptor = descriptor(INTERFACE_FORMAT_V1);
+                    let mut value = object();
+                    value.name = path.rsplit('/').next().unwrap().into();
+                    value.interfaces = vec![selected.clone()];
+                    value.validator = object_validator.clone();
+                    if path == scope {
+                        value.r#ref = scope_ref.map(str::to_owned);
+                    }
+                    observe(&mut client, &session, path, value.clone());
+                    fetch(
+                        &mut client,
+                        &session,
+                        FetchInterfaceResponse {
+                            interface: selected.clone(),
+                            descriptor: expected_descriptor.clone(),
+                            scope_ref: scope_ref.map(str::to_owned),
+                            validator: interface_validator.clone(),
+                        },
+                    );
+                    let expected_interface = client.interface(&session, &selected).unwrap().clone();
+                    let expected_object = client.object(&session, path).unwrap();
+                    let arguments = BTreeMap::from([("value".into(), Value::Integer(2))]);
+                    let expected = CallOperationRequest {
+                        target: Target {
+                            path: path.into(),
+                            validator: object_validator,
+                        },
+                        interface: InterfaceTarget {
+                            reference: selected.clone(),
+                            scope_ref: scope_ref.map(str::to_owned),
+                            validator: interface_validator.clone(),
+                        },
+                        operation: "calculate".into(),
+                        arguments: arguments.clone(),
+                    };
+                    let call = client
+                        .prepare_call(&session, path, &selected, "calculate", arguments)
+                        .unwrap();
+                    assert_eq!(
+                        decode_call_operation_request(
+                            call.request.body(),
+                            &expected_descriptor,
+                            limits(),
+                        )
+                        .unwrap(),
+                        expected
+                    );
+                    let context = client.pending_call_context(call.id).unwrap();
+                    assert_eq!(context.request(), &expected);
+                    assert_eq!(context.interface(), &expected_interface);
+                    assert_eq!(context.object(), &expected_object);
+                    assert_eq!(context.object().object.as_ref(), Some(&value));
+                    assert_eq!(context.descriptor(), &expected_descriptor);
+                    assert_eq!(context.operation(), &expected_descriptor.operations[0]);
+                    assert_eq!(context.session(), &session);
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn malformed_json_unknown_fields_duplicates_and_invalid_success_are_invalid_response() {
+    let cases: &[&[u8]] = &[
+        b"{not json",
+        br#"{"name":"item","interfaces":[],"unknown":true}"#,
+        br#"{"name":"item","interfaces":[{"scope":"/","name":"math"},{"scope":"/","name":"math"}]}"#,
+        br#"{"name":"wrong","interfaces":[]}"#,
+    ];
+    for body in cases {
+        let (mut client, session) = setup();
+        let request = client.refresh_observed(&session, "/item", 0).unwrap();
+        let error = client
+            .complete(request.id, response(StatusCode::OK, body))
+            .unwrap_err();
+        assert_eq!(error.kind, ClientErrorKind::InvalidResponse);
+        assert!(matches!(
+            client.object(&session, "/item").unwrap().state,
+            ObservationState::Error(_)
+        ));
+    }
+}
+
+#[test]
+fn disallowed_code_and_status_success_contradictions_are_invalid_response() {
+    let cases = [
+        (
+            StatusCode::NOT_FOUND,
+            br#"{"error":{"code":"interface_not_found","message":"wrong"}}"#.as_slice(),
+        ),
+        (
+            StatusCode::OK,
+            br#"{"error":{"code":"not_found","message":"wrong status"}}"#.as_slice(),
+        ),
+        (
+            StatusCode::CREATED,
+            br#"{"name":"item","interfaces":[]}"#.as_slice(),
+        ),
+    ];
+    for (status, body) in cases {
+        let (mut client, session) = setup();
+        let request = client.refresh_observed(&session, "/item", 0).unwrap();
+        assert_eq!(
+            client
+                .complete(request.id, response(status, body))
+                .unwrap_err()
+                .kind,
+            ClientErrorKind::InvalidResponse
+        );
+    }
+}
+
+#[test]
+fn valid_error_envelope_is_authoritative_and_status_mismatch_is_diagnostic() {
+    let (mut client, session) = setup();
+    let request = client.refresh_observed(&session, "/item", 0).unwrap();
+    let error = ProtocolError {
+        code: ProtocolErrorCode::NotFound,
+        message: "missing".into(),
+    };
+    let mut encoded =
+        encode_protocol_error_response(ProtocolInteraction::Observe, &error, limits()).unwrap();
+    *encoded.status_mut() = StatusCode::IM_A_TEAPOT;
+
+    assert_eq!(
+        client.complete(request.id, encoded).unwrap(),
+        Completion::ProtocolFailure(error)
+    );
+    assert_eq!(
+        client.object(&session, "/item").unwrap().state,
+        ObservationState::Stale
+    );
+    assert_eq!(
+        client.diagnostics(&session).unwrap().back().unwrap().kind,
+        DiagnosticKind::HttpStatusMismatch
+    );
+}
+
+#[test]
+fn resource_envelope_on_413_uses_code_and_records_canonical_422_mismatch() {
+    let (mut client, session) = setup();
+    let request = client.refresh_observed(&session, "/item", 0).unwrap();
+    let error = ProtocolError {
+        code: ProtocolErrorCode::ResourceLimitExceeded,
+        message: "logical observation limit exceeded".into(),
+    };
+    let mut encoded =
+        encode_protocol_error_response(ProtocolInteraction::Observe, &error, limits()).unwrap();
+    *encoded.status_mut() = StatusCode::PAYLOAD_TOO_LARGE;
+
+    assert_eq!(
+        client.complete(request.id, encoded).unwrap(),
+        Completion::ProtocolFailure(error)
+    );
+    assert_eq!(
+        client.diagnostics(&session).unwrap().back().unwrap().kind,
+        DiagnosticKind::HttpStatusMismatch
+    );
+}
+
+#[test]
+fn non_success_without_valid_envelope_remains_transport_failure() {
+    for status in [StatusCode::BAD_GATEWAY, StatusCode::PAYLOAD_TOO_LARGE] {
+        let (mut client, session) = setup();
+        let request = client.refresh_observed(&session, "/item", 0).unwrap();
+        let error = client
+            .complete(request.id, response(status, b"infrastructure failure"))
+            .unwrap_err();
+        assert_eq!(error.kind, ClientErrorKind::Transport);
+    }
+}
+
+#[test]
+fn unsupported_descriptor_format_is_distinct_from_invalid_response() {
+    let (mut client, session) = setup();
+    let request = client
+        .prepare_interface(&session, root_reference("math"))
+        .unwrap();
+    let logical = FetchInterfaceRequest {
+        interface: root_reference("math"),
+    };
+    let value = FetchInterfaceResponse {
+        scope_ref: None,
+        interface: root_reference("math"),
+        descriptor: descriptor("future-format/2"),
+        validator: Some(b"v2".to_vec()),
+    };
+    let encoded = encode_fetch_interface_response(&logical, &value, limits()).unwrap();
+    let error = client.complete(request.id, encoded).unwrap_err();
+    assert_eq!(error.kind, ClientErrorKind::UnsupportedDescriptorFormat);
+}
+
+#[test]
+fn malformed_call_success_after_dispatch_is_outcome_unknown_and_stales_object() {
+    let (mut client, session) = setup();
+    let observation = client.refresh_observed(&session, "/item", 0).unwrap();
+    client
+        .complete(
+            observation.id,
+            encode_observe_response(
+                &ObserveRequest {
+                    path: "/item".into(),
+                    depth: 0,
+                },
+                &ObjectObservation {
+                    object: object(),
+                    children: None,
+                },
+                limits(),
+            )
+            .unwrap(),
+        )
+        .unwrap();
+    let interface = client
+        .prepare_interface(&session, root_reference("math"))
+        .unwrap();
+    client
+        .complete(
+            interface.id,
+            encode_fetch_interface_response(
+                &FetchInterfaceRequest {
+                    interface: root_reference("math"),
+                },
+                &FetchInterfaceResponse {
+                    scope_ref: None,
+                    interface: root_reference("math"),
+                    descriptor: descriptor(INTERFACE_FORMAT_V1),
+                    validator: None,
+                },
+                limits(),
+            )
+            .unwrap(),
+        )
+        .unwrap();
+    let call = client
+        .prepare_call(
+            &session,
+            "/item",
+            &root_reference("math"),
+            "calculate",
+            BTreeMap::from([("value".into(), Value::Integer(2))]),
+        )
+        .unwrap();
+    client.mark_dispatched(call.id).unwrap();
+
+    let completion = client
+        .complete(
+            call.id,
+            response(
+                StatusCode::OK,
+                br#"{"result":"not an integer","unknown":true}"#,
+            ),
+        )
+        .unwrap();
+    assert!(matches!(
+        completion,
+        Completion::Call(record)
+            if matches!(
+                &record.outcome,
+                CallOutcome::Unknown {
+                    reason: OutcomeUnknownReason::ResponseDecode,
+                    failure: Some(failure),
+                } if failure.kind == ClientErrorKind::InvalidResponse
+            )
+    ));
+    assert_eq!(
+        client.object(&session, "/item").unwrap().state,
+        ObservationState::Stale
+    );
+    assert_eq!(client.in_flight_len(), 0);
+}
+
+#[test]
+fn plain_413_after_call_dispatch_is_unknown_transport_outcome() {
+    let (mut client, session) = setup();
+    let observation = client.refresh_observed(&session, "/item", 0).unwrap();
+    client
+        .complete(
+            observation.id,
+            encode_observe_response(
+                &ObserveRequest {
+                    path: "/item".into(),
+                    depth: 0,
+                },
+                &ObjectObservation {
+                    object: object(),
+                    children: None,
+                },
+                limits(),
+            )
+            .unwrap(),
+        )
+        .unwrap();
+    let interface = client
+        .prepare_interface(&session, root_reference("math"))
+        .unwrap();
+    client
+        .complete(
+            interface.id,
+            encode_fetch_interface_response(
+                &FetchInterfaceRequest {
+                    interface: root_reference("math"),
+                },
+                &FetchInterfaceResponse {
+                    scope_ref: None,
+                    interface: root_reference("math"),
+                    descriptor: descriptor(INTERFACE_FORMAT_V1),
+                    validator: None,
+                },
+                limits(),
+            )
+            .unwrap(),
+        )
+        .unwrap();
+    let call = client
+        .prepare_call(
+            &session,
+            "/item",
+            &root_reference("math"),
+            "calculate",
+            BTreeMap::from([("value".into(), Value::Integer(2))]),
+        )
+        .unwrap();
+    client.mark_dispatched(call.id).unwrap();
+
+    let completion = client
+        .complete(
+            call.id,
+            Response::builder()
+                .status(StatusCode::PAYLOAD_TOO_LARGE)
+                .body(Vec::<u8>::new())
+                .unwrap(),
+        )
+        .unwrap();
+    assert!(matches!(
+        completion,
+        Completion::Call(record)
+            if matches!(
+                &record.outcome,
+                CallOutcome::Unknown {
+                    reason: OutcomeUnknownReason::ResponseDecode,
+                    failure: Some(failure),
+                } if failure.kind == ClientErrorKind::Transport
+            )
+    ));
+    assert_eq!(
+        client.object(&session, "/item").unwrap().state,
+        ObservationState::Stale
+    );
+    assert_eq!(client.in_flight_len(), 0);
+}

crates/wip-fs-server/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "wip-fs-server"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+description = "Extensible request-time filesystem projection library and WIP over HTTP server"
+license.workspace = true
+repository.workspace = true
+readme = "README.md"
+publish = false
+
+[dependencies]
+http = "1"
+rustix = { version = "1.1", features = ["fs"] }
+wip-host.workspace = true
+wip-http.workspace = true
+wip-interface.workspace = true
+wip-protocol.workspace = true
+
+[dev-dependencies]
+tempfile = "3"

crates/wip-fs-server/README.md

@@ -0,0 +1,309 @@
+# wip-fs-server
+
+`wip-fs-server` projects one configured Linux filesystem directory onto WIP
+Worldspace `/` at request time. It does not register the filesystem contents or
+keep one object instance per entry. It uses `wip-host` for publication and typed
+operation dispatch and uses the standard `wip-http` routes, JSON codecs,
+envelopes, and HTTP status mapping.
+
+## Library assembly and migration
+
+`ServerConfig`, `WipFsServer::new`, `handle_http` and CLI flags retain their
+assembly shape. The scoped Host/Protocol API is a breaking Rust/wire migration:
+Interface references are `{scope, name}` values, registration takes a `Scope`
+and local name, and calls use `interface.reference` plus optional `scope_ref`.
+Fetch returns the same structured reference and current scope Object's optional
+ref. This is the standard WIP wire format, not an FS-specific profile.
+
+Use `default_projection(root, access, limits)` to obtain the default Linux engine
+without starting a listener. `projection.view(&principal)` is the effective view;
+it owns canonical `observe` and `fetch_interface` and implements the standard
+`wip_host::ObjectProvider` typed `call_operation` API. `DefaultPolicy` has the unit
+principal `()`; default engines also offer unit-principal convenience methods.
+
+For an external backend/composition:
+
+1. Implement `BackendEntry` on a local, cloneable, root-confined stable capability.
+   Its `WipObject` metadata is public-only; its validator binds identity and the
+   protected state. Implement `FilesystemBackend` to resolve one connected
+   `ResolvedEntry<Entry>` (root-to-parent ancestry plus pinned target), enumerate
+   bounded children, and execute against that already-resolved lineage.
+2. Create `wip_host::Scope::new("/")` for the deployment-pinned root, then
+   register generated definitions with `registry.register(&scope, name,
+   Definition, validator)`. `DefaultInterfaces::register(&mut registry, &scope)`
+   optionally supplies reusable built-in tokens named `file.read`,
+   `symlink.inspect`, and `file.write`; tokens do not force publication. For a
+   non-root scope, create a handle at its canonical WIP path and implement
+   `Composition::scope(path, &entry, context)` to attest that handle only for
+   its current Object lifetime. Local names are exact names, not parsed `::`/`#`
+   display strings; the same local name can be registered at different scopes.
+3. Implement `Composition<Entry>` on a local type. Its local Object wraps the entry
+   and implements both `WipObject` and the chosen generated traits, avoiding orphan
+   rules. `PublishedObject::expose` proves each implementation at compile time.
+   Publication can add, replace, reorder or omit built-ins based on entry metadata
+   and actual backend capabilities, not just entry kind. `LinuxEntry` implements
+   bounded `FileRead`, `FileWrite` and `SymlinkInspect` for safe delegation; never
+   advertise write in read-only mode or link operations on a non-link capability.
+4. Assemble `Projection::new(backend, registry, composition, policy, limits)`.
+   `ProjectionPolicy` supplies an opaque associated `Principal`, hides Objects and
+   entire hidden subtrees, selects an ordered subset of implemented interfaces,
+   controls descriptor/operation visibility, and permits or denies execution.
+5. An authenticated deployment chooses the principal and `ExecutionContext`. To
+   use HTTP, construct `HttpAdapter::new(&view, &endpoint, limits)` and invoke
+   `handle_http_with_context`. This uses the standard `wip-http` binding, not a
+   filesystem wire profile. Enforce body collection, header, concurrency and
+   deadline bounds in the deployment's listener; the adapter owns none of these
+   intake resources. The bundled loopback listener remains a thin default user.
+
+A complete external-style memory backend, local Object with multiple custom
+Operations, typed registration, principal policy and HTTP flow is exercised in
+[`tests/extensions.rs`](tests/extensions.rs). It uses no Linux filesystem for its
+backend. The public library APIs do not require private types, a fork, an HTTP
+listener, a global object registry, or dynamic plugin loading.
+
+### Extension security contract
+
+Backend implementations and Operation authors are trusted code, not sandboxed
+plugins. `FilesystemBackend::resolve` returns `ResolvedEntry::new(ancestors, target)`
+from one connected backend traversal/snapshot, not independent path-prefix
+resolutions. A root target has no ancestors; other targets retain the root first,
+then intermediate parent containers. This is backend-private context, never wire
+metadata. Backend `resolve` and `execute` signatures both carry this type;
+compositions receive exact retained entries, including publication of the root
+scope Object while another target is executing, never independent raw-path
+lookups. Root publication must be deterministic and side-effect-free.
+
+Every lineage must retain the same deployment-pinned root Object. Replacing that
+Object requires a new projection and fresh `Scope`, not reuse of registrations
+at the same path. The engine constructs `ScopeObservation` from the published
+root Object's metadata using the refreshed retained root capability **inside**
+`FilesystemBackend::execute`, then attaches it with `PublishedObject::bind_scope`.
+It never independently looks up the raw configured root path. Root Objects need
+not expose any interfaces. Calls check both the private lifetime and optional
+`scope_ref`; normal root state updates do not retire the lifetime.
+
+`Composition::scope` is the trusted non-root lifetime attestation hook. It runs
+only for registered scope paths in the refreshed, principal-visible execution
+lineage, never through independent scope-path resolution. Return `Some(scope)`
+only when the retained entry is still the current Object published at that path;
+use retained backend identity and application publication-lifecycle state under
+the backend boundary, not ref or validator equality. Deletion, replacement or
+movement needs a fresh handle and registration, even if a ref is absent or reused.
+Ordinary state changes retain the handle. A different returned path is an internal
+publication failure; `None` or a fresh unregistered lifetime hides old artifacts.
+The default hook returns `None`, so existing compositions fail closed outside `/`.
+
+Self-scope needs special care: a backend may allow ordinary execution against an
+unlinked/replaced pinned leaf, but that does not establish that leaf as the current
+scope Object. The hook must attest current membership as well as retained identity
+within the same boundary. The default Linux composition does not attest non-root
+lifetimes or invent inode-based Object refs. External compositions must provide
+that guarantee themselves, including their documented external-writer limits.
+Scope metadata is obtained by publishing that retained entry (reusing the target
+publication for self-scope); scope Objects need not expose interfaces. Optional
+refs are taken from the published Object, not from a raw backend entry. Calls
+without `scope_ref` remain valid when the lifetime is current; supplied stale refs
+reject with `InterfaceMismatch` after Object validator checks.
+
+`with_object` (including fetch) and individual tree Object publications also
+enter this backend boundary. Generic read callbacks use a `NotStarted` attempt
+as an adapter to the existing execution API; no typed operation runs and no
+commit is implied. Tree observations are bounded traversals, not one global tree
+transaction. Fetch resolves the visible scope Object through the provider and
+returns its ref, Descriptor and Interface validator together; retained registry
+artifacts alone never establish publication.
+
+`FilesystemBackend::execute` must validate ancestor membership/identity and
+refresh **all** lineage state/validators inside its transaction or lock before
+calling the engine callback, retaining the same target and connected ancestry
+through validation and dispatch. Replaced/detached ancestors must return
+`NotFound` without callback invocation, even when the replacement is visible.
+The engine evaluates Object visibility for every refreshed ancestor and target
+inside that same boundary; a hidden ancestor rejects the entire subtree before
+publication/typed dispatch. Never fix a changed lineage by resolving the raw path
+again and substituting capabilities. Participating policy-relevant backend state
+changes must be serialized by this boundary, not just target-content writes.
+Return the committed post-operation validator. Retained ancestry is subject to
+handle/work ceilings; resource exhaustion is an error, not missing ancestry.
+Confirm rollback only after rollback succeeds. Pre-dispatch failures
+must never commit; failed started operations without a non-commit guarantee remain
+`OperationOutcomeUnknown`. Object implementations must delegate validators to
+that entry and declare requirements per `(InterfaceRef, operation)`, rather than
+classify all operations by a read/write name. Operations use the scoped entry and
+propagated context, not a fresh raw-path resolution; they must check deadlines,
+cancellation and resource budgets throughout backend work and report effects
+truthfully. POSIX symlinks, identity, atomic mutations and locking cannot be assumed
+for other backends.
+
+The default Linux backend acquires advisory exclusive locks in root-to-parent
+order and then on the lockable target (directory or regular file). It compares
+retained ancestor identity to no-follow descriptor-relative lookup results,
+refreshes lineage snapshots after acquiring the locks, and holds the guards
+through post-dispatch state observation. The configured root remains its pinned
+capability even if its textual path is renamed; replaced intermediate ancestors
+are rejected. Leaf path replacement never redirects execution to a new inode.
+This serializes cooperating library calls; it does **not** promise transactional
+isolation from unrelated processes ignoring `flock`. Linux capabilities only
+expose bounded methods, not raw descriptors or backend paths.
+
+A policy must be stable/deterministic within one effective Worldspace view.
+Interface/operation visibility is uniform per registered reference within that
+view, so observation, fetch and dispatch use the identical filtered descriptor.
+For entry-specific operation sets, register distinct interface definitions and
+select them by entry. Different principals may have different effective views.
+Changing a policy must establish a new view/reference lifetime (e.g. rebuild the
+registry/engine); do not keep validator-free references while changing their
+meaning. Execution permission may deny a visible Operation without hiding it.
+A published interface is always fetchable by that principal; hidden operations
+are omitted (along with their unreachable named types and interface-wide docs)
+and guessed calls return `OperationNotFound`, whereas visible denied
+operations return `PermissionDenied`. Hidden Objects and descendants return
+`NotFound` and are absent from parent observations. Work spent scanning hidden
+entries still counts against traversal bounds; resource limits are not a
+constant-time/side-channel guarantee.
+
+Never put absolute paths, hidden metadata, credentials or policy internals in
+public `WipObject` metadata, descriptions, validators or normal logs. Validators
+must be opaque public tokens, not confidential content. Engine/HTTP failures use
+bounded generic diagnostics; arbitrary trusted implementation metadata/logging
+cannot be sanitized automatically. Do not log credentials or sensitive panic
+payloads from extensions.
+
+## Security model
+
+- The effective root is opened once as a directory capability. Root path
+  components must be real directories (symlink components are rejected), and the
+  displayed effective root is read back from that same pinned descriptor. Every
+  request is resolved segment-by-segment with directory-relative, `O_NOFOLLOW`
+  handles.
+- Symlinks are projected as links and are never followed. Their stored target is
+  available only through the `SymlinkInspect.read_link` application operation.
+- Regular files, directories, symlinks, and unsupported entry types have distinct
+  public descriptions and capability sets.
+- WIP names are Unicode. Linux names that are not valid UTF-8 are deliberately
+  not published; valid UTF-8 names map byte-for-byte and therefore cannot collide.
+  Unicode paths containing backend-invalid NUL bytes are likewise treated as
+  unpublished rather than as backend failures.
+- No object `ref` is issued. This avoids claiming representation identity for
+  hard links or path-specific names. Regular files and symlinks receive an opaque
+  validator containing filesystem identity plus protected metadata; replacing a
+  path therefore does not preserve its validator.
+- Protocol metadata and errors never contain the backend absolute path. Startup
+  prints only the explicitly configured effective root and security-sensitive
+  modes.
+- The built-in HTTP listener is loopback-only. TLS termination, certificates,
+  authentication, an externally visible URL scheme, and proxy routing are
+  deployment concerns rather than separate WIP transport profiles.
+
+The implementation currently targets Linux because it uses `O_PATH`,
+directory-relative descriptor traversal, and `/proc/self/fd` to reopen the same
+pinned backend object without resolving the untrusted Worldspace path twice.
+
+## Run
+
+Run the loopback listener in read-only mode:
+
+```console
+cargo run -p wip-fs-server -- \
+  --root /srv/public-files \
+  --listen 127.0.0.1:8080 \
+  --base-path /wip
+```
+
+Run with the write capability deliberately enabled:
+
+```console
+cargo run -p wip-fs-server -- \
+  --root ./example-files \
+  --listen 127.0.0.1:8080 \
+  --base-path /wip \
+  --read-write
+```
+
+The server reports the effective root, `ReadOnly`/`ReadWrite` mode, endpoint,
+and actual listen address. It does not enumerate the root.
+
+## Standard interactions
+
+The following examples use the built-in HTTP listener. The JSON follows the
+standard WIP over HTTP binding; validators and operation `Bytes` are base64 body
+fields, never `ETag` or `If-Match` headers.
+
+Observe only the root Object:
+
+```console
+curl -sS -X POST http://127.0.0.1:8080/wip/v1/observe \
+  -H 'Content-Type: application/json' -H 'Accept: application/json' \
+  --data '{"path":"/","depth":0}'
+```
+
+Observe the root and two levels of indexable children:
+
+```console
+curl -sS -X POST http://127.0.0.1:8080/wip/v1/observe \
+  -H 'Content-Type: application/json' -H 'Accept: application/json' \
+  --data '{"path":"/","depth":2}'
+```
+
+A regular-file observation returns a structured read interface reference and an
+object validator. Built-ins explicitly use scope `/` and the local names
+`file.read`, `symlink.inspect`, and `file.write`. The Linux root does not issue an
+Object ref, so fetch omits `scope_ref`; its private publication lifetime still
+binds fetch and call to the pinned deployment root. Copy the complete reference
+from the observation to retrieve that descriptor:
+
+```console
+curl -sS -X POST http://127.0.0.1:8080/wip/v1/fetch_interface \
+  -H 'Content-Type: application/json' -H 'Accept: application/json' \
+  --data '{"interface":{"scope":"/","name":"file.read"}}'
+```
+
+Then call a bounded range read:
+
+```console
+curl -sS -X POST http://127.0.0.1:8080/wip/v1/call_operation \
+  -H 'Content-Type: application/json' -H 'Accept: application/json' \
+  --data '{
+    "target":{"path":"/notes.txt","validator":"<base64-validator>"},
+    "interface":{"reference":{"scope":"/","name":"file.read"}},
+    "operation":"read",
+    "arguments":{"offset":0,"length":4096}
+  }'
+```
+
+In `--read-write` mode a second regular-file interface declares `replace`.
+Writes require the current object validator and return the post-write validator:
+
+```console
+curl -sS -X POST http://127.0.0.1:8080/wip/v1/call_operation \
+  -H 'Content-Type: application/json' -H 'Accept: application/json' \
+  --data '{
+    "target":{"path":"/notes.txt","validator":"<base64-validator>"},
+    "interface":{"reference":{"scope":"/","name":"file.write"}},
+    "operation":"replace",
+    "arguments":{"contents":"dXBkYXRlZA=="}
+  }'
+```
+
+## Resource and failure behavior
+
+`ResourceLimits` bounds request/response bytes, HTTP request-head bytes, JSON
+nesting, file read/write bytes, tree depth/node count, pinned handles, and active
+connections/requests. One absolute request deadline covers header and
+body intake, dispatch, cooperative filesystem work, and response transmission;
+stalled clients are closed and cannot occupy a worker beyond that bound. Workers
+accept connections directly, so the listener never moves more than the configured
+concurrency into active userspace service. Advisory file-lock acquisition uses a
+nonblocking loop and checks the same deadline/cancellation rather than allowing a
+contended lock to stall a worker. Object observation recursively opens only the
+requested depth. A successful response is complete through that depth; if the
+configured projected-node budget would be exceeded, the interaction fails with
+`ResourceLimitExceeded` instead of returning a partial observation. I/O failure
+and cancellation remain errors.
+
+Whole-file replacement compares the request validator against the identity and
+state of the same pinned file handle used for the write. Failures before mutation
+carry a `NotCommitted` guarantee and map to `Internal` or
+`ResourceLimitExceeded`; a failure after truncation/write begins maps to
+`OperationOutcomeUnknown`. The server and Clients do not automatically retry
+side-effecting operations.

crates/wip-fs-server/src/defaults.rs

@@ -0,0 +1,155 @@
+//! Reusable default Linux composition; no listener or authentication dependency.
+use crate::engine::{BackendEntry, Composition, DefaultPolicy, EntryKind, Projection};
+use crate::interfaces::{
+    FileRead, FileReadDefinition, FileWrite, FileWriteDefinition, SymlinkInspect,
+    SymlinkInspectDefinition,
+};
+use crate::projection::{LinuxBackend, LinuxEntry};
+use crate::{AccessMode, ResourceLimits};
+use wip_host::{
+    ExecutionContext, HostError, InterfaceRef, InterfaceRegistry, PublishedObject,
+    RegisteredInterface, RegistrationError, Scope, Validator, WipObject,
+};
+use wip_interface as wip;
+
+/// Registered built-in interfaces, usable by external compositions and Objects.
+pub struct DefaultInterfaces {
+    /// Bounded regular-file reads.
+    pub read: RegisteredInterface<FileReadDefinition>,
+    /// No-follow link inspection.
+    pub symlink: RegisteredInterface<SymlinkInspectDefinition>,
+    /// Validator-protected replacement.
+    pub write: RegisteredInterface<FileWriteDefinition>,
+}
+impl DefaultInterfaces {
+    /// Register reusable descriptors at an explicit publication scope.
+    ///
+    /// Built-in local names are `file.read`, `symlink.inspect`, and `file.write`.
+    /// The default deployment registers them at `/`; external compositions may
+    /// register them at non-root scopes attested by `Composition::scope`.
+    pub fn register(
+        registry: &mut InterfaceRegistry,
+        scope: &Scope,
+    ) -> Result<Self, RegistrationError> {
+        Ok(Self {
+            read: registry.register(scope, "file.read", FileReadDefinition, None)?,
+            symlink: registry.register(scope, "symlink.inspect", SymlinkInspectDefinition, None)?,
+            write: registry.register(scope, "file.write", FileWriteDefinition, None)?,
+        })
+    }
+}
+
+/// Default capability-aware Linux publication, independent of HTTP.
+pub struct DefaultComposition {
+    interfaces: DefaultInterfaces,
+}
+impl DefaultComposition {
+    /// Use previously registered built-in interface tokens.
+    pub fn new(interfaces: DefaultInterfaces) -> Self {
+        Self { interfaces }
+    }
+}
+
+/// Request-scoped default Object; external Objects may instead wrap `LinuxEntry`.
+pub struct DefaultObject {
+    entry: LinuxEntry,
+    write: InterfaceRef,
+}
+impl DefaultObject {
+    /// The pinned, bounded capability used by every operation on this Object.
+    pub fn entry(&self) -> &LinuxEntry {
+        &self.entry
+    }
+}
+impl WipObject for DefaultObject {
+    fn name(&self) -> &str {
+        self.entry.name()
+    }
+    fn description(&self) -> Option<&str> {
+        self.entry.description()
+    }
+    fn reference(&self) -> Option<&str> {
+        self.entry.reference()
+    }
+    fn validator(&self) -> Option<&Validator> {
+        self.entry.validator()
+    }
+    fn requires_validator(&self, interface: &InterfaceRef, operation: &str) -> bool {
+        interface == &self.write && operation == "replace"
+    }
+}
+impl FileRead for DefaultObject {
+    fn read(&self, offset: Option<u64>, length: Option<u64>) -> wip::OperationResult<wip::Bytes> {
+        self.entry.read(offset, length)
+    }
+}
+impl SymlinkInspect for DefaultObject {
+    fn read_link(&self) -> wip::OperationResult<wip::Bytes> {
+        self.entry.read_link()
+    }
+}
+impl FileWrite for DefaultObject {
+    fn replace(&self, contents: wip::Bytes) -> wip::OperationResult<()> {
+        self.entry.replace(contents)
+    }
+}
+impl Composition<LinuxEntry> for DefaultComposition {
+    type Object = DefaultObject;
+    fn publish(
+        &self,
+        entry: LinuxEntry,
+        _: &ExecutionContext,
+    ) -> Result<PublishedObject<Self::Object>, HostError> {
+        let kind = entry.kind();
+        let writable = entry.access_mode() == AccessMode::ReadWrite;
+        let mut publication = PublishedObject::new(DefaultObject {
+            entry,
+            write: self.interfaces.write.reference().clone(),
+        });
+        match kind {
+            EntryKind::Regular => {
+                publication = publication
+                    .expose(&self.interfaces.read)
+                    .map_err(publication_error)?;
+                if writable {
+                    publication = publication
+                        .expose(&self.interfaces.write)
+                        .map_err(publication_error)?;
+                }
+            }
+            EntryKind::Symlink => {
+                publication = publication
+                    .expose(&self.interfaces.symlink)
+                    .map_err(publication_error)?;
+            }
+            EntryKind::Directory | EntryKind::Unsupported => {}
+        }
+        Ok(publication)
+    }
+}
+fn publication_error(_: wip_host::PublicationError) -> HostError {
+    HostError::internal(
+        "default publication failed",
+        wip_host::EffectGuarantee::NotCommitted,
+    )
+}
+
+/// Construct the secure-by-default Linux engine without binding a listener.
+pub fn default_projection(
+    root: &std::path::Path,
+    access: AccessMode,
+    limits: ResourceLimits,
+) -> Result<Projection<LinuxBackend, DefaultComposition, DefaultPolicy>, std::io::Error> {
+    let backend = LinuxBackend::open(root, access, limits)?;
+    let mut registry = InterfaceRegistry::new();
+    let scope = Scope::new("/").map_err(std::io::Error::other)?;
+    let interfaces =
+        DefaultInterfaces::register(&mut registry, &scope).map_err(std::io::Error::other)?;
+    Ok(Projection::new(
+        backend,
+        registry,
+        DefaultComposition::new(interfaces),
+        DefaultPolicy,
+        limits,
+    ))
+}

crates/wip-fs-server/src/engine.rs

@@ -0,0 +1,831 @@
+//! Transport-independent projection, publication, and principal view boundaries.
+
+use crate::ResourceLimits;
+use wip_host::{
+    EffectGuarantee, ExecutionContext, HostError, InterfaceRef, InterfaceRegistry, ObjectProvider,
+    OperationAttempt, ProviderResult, PublishedObject, Scope, ScopeObservation, WipObject,
+};
+use wip_protocol::{
+    FetchInterfaceRequest, FetchInterfaceResponse, ObjectObservation, ObserveRequest,
+    ObserveResponse, ProtocolError, ProtocolErrorCode,
+};
+
+/// Portable entry classification; capabilities must not be inferred from kind alone.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EntryKind {
+    /// Container whose children can be enumerated.
+    Directory,
+    /// Regular data entry.
+    Regular,
+    /// Link itself, never implicitly followed.
+    Symlink,
+    /// Metadata-only entry unless the composition supplies a capability.
+    Unsupported,
+}
+
+/// A root-confined, request-time capability, not a path to resolve again.
+///
+/// Metadata must be safe for public exposure. Validators bind both identity and
+/// protected state. Cloning must retain the same target rather than re-resolve it.
+pub trait BackendEntry: WipObject + Clone {
+    /// Classification for observation and publication selection.
+    fn kind(&self) -> EntryKind;
+}
+
+/// A single resolved target together with its retained root-to-parent lineage.
+///
+/// The backend must resolve a connected lineage, never independent raw-path
+/// prefixes. At execution it validates ancestor membership/identity, refreshes
+/// their policy metadata, and pins that snapshot through dispatch. Target
+/// replacement must not redirect the original capability. This value is private
+/// backend context, not protocol metadata.
+#[derive(Clone)]
+pub struct ResolvedEntry<E> {
+    ancestors: Vec<E>,
+    target: E,
+}
+
+impl<E> ResolvedEntry<E> {
+    /// Create backend resolution context. `/` has no ancestors; a non-root target
+    /// has the pinned root first, followed by its intermediate parent containers.
+    pub fn new(ancestors: Vec<E>, target: E) -> Self {
+        Self { ancestors, target }
+    }
+    /// Pinned ancestor capabilities, ordered from the root to the direct parent.
+    pub fn ancestors(&self) -> &[E] {
+        &self.ancestors
+    }
+    /// The original resolved target capability, never a redirected replacement.
+    pub fn target(&self) -> &E {
+        &self.target
+    }
+    /// Consume this snapshot for refresh or request-time publication.
+    pub fn into_parts(self) -> (Vec<E>, E) {
+        (self.ancestors, self.target)
+    }
+}
+
+/// Trusted backend boundary. Implementations need not use POSIX semantics.
+///
+/// Resolve and enumerate pinned capabilities within the configured root. Enforce
+/// context cancellation, deadlines and work budgets during backend work. Do not
+/// advertise capabilities the backend cannot guarantee. Errors must not include
+/// backend paths, credentials or hidden metadata.
+///
+/// The root is a deployment-pinned Object: every resolution/execution lineage
+/// must retain that same root, even if its textual backend path is renamed or
+/// replaced. Replacing the deployment root requires a new projection and Scope
+/// lifetime. The engine binds `/` to this pinned deployment root. Non-root
+/// lifetimes are attested by [`Composition::scope`] from the refreshed lineage.
+///
+/// `execute` must retain the same target and complete lineage and serialize
+/// ancestor identity/membership checks, policy metadata, validator observation,
+/// publication, validation, typed dispatch and commit/rollback. Changed/detached
+/// ancestors must return `NotFound` before the callback; never substitute a new
+/// ancestor or redirect the target by re-resolving its raw path. Refresh *all*
+/// lineage metadata/validators inside the boundary and retain that snapshot
+/// through dispatch, then return the committed post-operation validator. Never
+/// upgrade an unknown outcome except after confirmed rollback. Locks only protect
+/// actors participating in the protocol; document any external-writer limits.
+pub trait FilesystemBackend {
+    /// Stable capability supplied to the composition.
+    type Entry: BackendEntry;
+    /// Resolve a canonical WIP path and retain its connected ancestry.
+    ///
+    /// Obtain the target and lineage in one backend traversal/snapshot. Enforce
+    /// configured handle/work budgets while retaining ancestors; do not silently
+    /// omit ancestry on resource exhaustion.
+    fn resolve(
+        &self,
+        context: &ExecutionContext,
+        path: &str,
+    ) -> ProviderResult<ResolvedEntry<Self::Entry>>;
+    /// Enumerate direct children, at most `maximum`; excess must fail, not truncate.
+    fn children(
+        &self,
+        context: &ExecutionContext,
+        entry: &Self::Entry,
+        maximum: usize,
+    ) -> Result<Vec<Self::Entry>, HostError>;
+    /// Execute against this already-resolved target within an atomic boundary.
+    fn execute(
+        &self,
+        context: &ExecutionContext,
+        entry: ResolvedEntry<Self::Entry>,
+        operation: impl FnOnce(ResolvedEntry<Self::Entry>) -> OperationAttempt,
+    ) -> ProviderResult<OperationAttempt>;
+}
+
+/// Typed publication extension point, implementable on an external crate's type.
+///
+/// Use `InterfaceRegistry::register` and `PublishedObject::expose` with generated
+/// definitions. An external local Object can wrap the entry and implement any
+/// number of interfaces, avoiding orphan rules. Its `WipObject` implementation
+/// declares validator requirements per qualified operation. Operation failures
+/// declare their own `EffectGuarantee`, not a fixed read/write classification.
+pub trait Composition<E: BackendEntry> {
+    /// Local typed operation implementation and safe public metadata.
+    type Object: WipObject;
+    /// Attest the current non-root scope lifetime of this exact backend entry.
+    ///
+    /// Called only within `FilesystemBackend::execute`, for refreshed entries in
+    /// its connected lineage. Return the same handle used for registration only
+    /// while this same Object remains published at `path`. After deletion,
+    /// replacement or movement return `None` or a fresh Scope, even without an
+    /// Object ref (or when the replacement reuses that ref). Ordinary state
+    /// changes retain the handle. In particular a self-scope target must still
+    /// be the current member at `path`: a backend's ordinary pinned-leaf guarantee
+    /// alone may allow execution after leaf replacement and is not sufficient
+    /// evidence for a scope lifetime. Do not re-resolve `path` or infer lifetime from
+    /// a validator/ref alone: use the entry's retained backend identity and the
+    /// application's publication lifecycle, serialized by the backend boundary.
+    ///
+    /// The default attests no non-root scopes. The deployment-pinned root is
+    /// bound automatically; this hook is not called for `/`. Returning a Scope
+    /// for a different path is an internal publication error. A scope Object
+    /// need not expose any interfaces and its public ref remains optional.
+    fn scope(
+        &self,
+        _path: &str,
+        _entry: &E,
+        _context: &ExecutionContext,
+    ) -> Result<Option<Scope>, HostError> {
+        Ok(None)
+    }
+
+    /// Build a request-scoped publication using this exact capability/context.
+    ///
+    /// Publication and policy hooks must be side-effect-free with respect to the
+    /// backend. This hook may also publish retained scope ancestors to observe
+    /// their metadata while another target is executing. Scope publication must
+    /// be deterministic within the view and use this same retained capability.
+    /// A publication failure is a pre-dispatch rejection, never a
+    /// started Operation. Delegate metadata/validators to the boundary snapshot.
+    fn publish(
+        &self,
+        entry: E,
+        context: &ExecutionContext,
+    ) -> Result<PublishedObject<Self::Object>, HostError>;
+}
+
+/// Principal-specific view policy, independent of authentication transport.
+///
+/// Keep decisions deterministic and stable within an effective Worldspace view.
+/// A changed policy requires a new view/reference lifetime (or interface
+/// validators). Operation visibility is interface-wide within a view so every
+/// published reference has exactly the descriptor returned by fetch. Entry-
+/// specific differences should select different registered interfaces. Hooks
+/// cannot add implementations, metadata, or raw paths to a publication.
+pub trait ProjectionPolicy<E: BackendEntry, O: WipObject> {
+    /// Opaque deployment-established principal/request identity.
+    type Principal;
+    /// Whether the entry is visible. Invisible ancestors hide their whole subtree.
+    fn object_visible(&self, principal: &Self::Principal, entry: &E) -> bool;
+    /// Whether an interface descriptor may be fetched in this view.
+    fn interface_visible(&self, _principal: &Self::Principal, _interface: &InterfaceRef) -> bool {
+        true
+    }
+    /// Select/order a subset of implemented interfaces; defaults to all.
+    fn interfaces(
+        &self,
+        _principal: &Self::Principal,
+        _entry: &E,
+        available: &[InterfaceRef],
+    ) -> Vec<InterfaceRef> {
+        available.to_vec()
+    }
+    /// Whether an operation is present in this view's descriptor and dispatch.
+    fn operation_visible(
+        &self,
+        _principal: &Self::Principal,
+        _interface: &InterfaceRef,
+        _operation: &str,
+    ) -> bool {
+        true
+    }
+    /// Execution permission for a visible operation, after canonical preconditions.
+    fn authorize(
+        &self,
+        _principal: &Self::Principal,
+        _object: &O,
+        _interface: &InterfaceRef,
+        _operation: &str,
+    ) -> bool {
+        true
+    }
+}
+
+/// No authentication assumption: all configured objects/operations are visible.
+pub struct DefaultPolicy;
+impl<E: BackendEntry, O: WipObject> ProjectionPolicy<E, O> for DefaultPolicy {
+    type Principal = ();
+    fn object_visible(&self, _: &(), _: &E) -> bool {
+        true
+    }
+}
+
+/// Canonical request-time engine, independent of HTTP and Linux.
+pub struct Projection<B, C, P> {
+    backend: B,
+    registry: InterfaceRegistry,
+    composition: C,
+    policy: P,
+    limits: ResourceLimits,
+}
+
+impl<B, C, P> Projection<B, C, P>
+where
+    B: FilesystemBackend,
+    C: Composition<B::Entry>,
+    P: ProjectionPolicy<B::Entry, C::Object>,
+{
+    /// Assemble trusted components. The registry must contain all exposed tokens.
+    pub fn new(
+        backend: B,
+        registry: InterfaceRegistry,
+        composition: C,
+        policy: P,
+        limits: ResourceLimits,
+    ) -> Self {
+        Self {
+            backend,
+            registry,
+            composition,
+            policy,
+            limits,
+        }
+    }
+    /// Backend access for trusted composition/configuration, never serialized.
+    pub fn backend(&self) -> &B {
+        &self.backend
+    }
+    /// Borrow one effective principal view for observation, fetch and dispatch.
+    pub fn view<'a>(&'a self, principal: &'a P::Principal) -> ProjectionView<'a, B, C, P> {
+        ProjectionView {
+            projection: self,
+            principal,
+        }
+    }
+}
+
+/// A coherent principal view implementing canonical typed host dispatch.
+pub struct ProjectionView<'a, B, C, P>
+where
+    B: FilesystemBackend,
+    C: Composition<B::Entry>,
+    P: ProjectionPolicy<B::Entry, C::Object>,
+{
+    projection: &'a Projection<B, C, P>,
+    principal: &'a P::Principal,
+}
+
+impl<B, C, P> ProjectionView<'_, B, C, P>
+where
+    B: FilesystemBackend,
+    C: Composition<B::Entry>,
+    P: ProjectionPolicy<B::Entry, C::Object>,
+{
+    fn resolve(
+        &self,
+        context: &ExecutionContext,
+        path: &str,
+    ) -> ProviderResult<ResolvedEntry<B::Entry>> {
+        if let Err(error) = preflight(context) {
+            return ProviderResult::Failure(error);
+        }
+        if wip_protocol::validate_path(path).is_err() {
+            return ProviderResult::NotFound;
+        }
+        match self.projection.backend.resolve(context, path) {
+            ProviderResult::Found(resolved) => {
+                if !lineage_matches_path(&resolved, path) {
+                    return ProviderResult::Failure(internal());
+                }
+                if !self.lineage_visible(&resolved) {
+                    return ProviderResult::NotFound;
+                }
+                ProviderResult::Found(resolved)
+            }
+            ProviderResult::NotFound => ProviderResult::NotFound,
+            ProviderResult::Failure(error) => ProviderResult::Failure(error),
+        }
+    }
+
+    fn lineage_visible(&self, resolved: &ResolvedEntry<B::Entry>) -> bool {
+        resolved
+            .ancestors()
+            .iter()
+            .chain(std::iter::once(resolved.target()))
+            .all(|entry| self.projection.policy.object_visible(self.principal, entry))
+    }
+
+    fn publication(
+        &self,
+        resolved: &ResolvedEntry<B::Entry>,
+        context: &ExecutionContext,
+    ) -> Result<PublishedObject<C::Object>, HostError> {
+        let entry = resolved.target();
+        let publication = self
+            .projection
+            .composition
+            .publish(entry.clone(), context)?;
+        let mut current_scopes = Vec::new();
+        let mut path = String::from("/");
+        // Only this refreshed, visible, connected lineage can attest scopes.
+        // Never independently resolve a scope path while a target is executing.
+        for (index, scope_entry) in resolved
+            .ancestors()
+            .iter()
+            .chain(std::iter::once(entry))
+            .enumerate()
+        {
+            if index > 0 {
+                if path != "/" {
+                    path.push('/');
+                }
+                path.push_str(scope_entry.name());
+            }
+            if !self
+                .projection
+                .registry
+                .scopes()
+                .any(|scope| scope.path() == path)
+            {
+                continue;
+            }
+            let scopes = if path == "/" {
+                self.projection
+                    .registry
+                    .scopes()
+                    .filter(|scope| scope.path() == "/")
+                    .cloned()
+                    .collect::<Vec<_>>()
+            } else {
+                self.projection
+                    .composition
+                    .scope(&path, scope_entry, context)?
+                    .into_iter()
+                    .collect::<Vec<_>>()
+            };
+            if scopes.iter().any(|scope| scope.path() != path) {
+                return Err(internal());
+            }
+            if scopes.is_empty() {
+                continue;
+            }
+            // Refs belong to the Composition's published Object, not necessarily
+            // the raw entry. Self-scope reuses exactly the target publication.
+            let scope_publication = if index == resolved.ancestors().len() {
+                None
+            } else {
+                Some(
+                    self.projection
+                        .composition
+                        .publish(scope_entry.clone(), context)?,
+                )
+            };
+            let object = scope_publication
+                .as_ref()
+                .map_or(publication.implementation(), |scope| scope.implementation());
+            current_scopes.extend(
+                scopes
+                    .iter()
+                    .map(|scope| ScopeObservation::new(scope, object)),
+            );
+        }
+        let available = publication
+            .protocol_object()
+            .interfaces
+            .iter()
+            .map(|reference| {
+                self.projection
+                    .registry
+                    .resolve(reference)
+                    .ok_or_else(internal)
+            })
+            .collect::<Result<Vec<_>, _>>()?;
+        let mut selected = self
+            .projection
+            .policy
+            .interfaces(self.principal, entry, &available);
+        selected.retain(|reference| {
+            let reference_value = reference.protocol_reference();
+            current_scopes.iter().any(|current| {
+                self.projection
+                    .registry
+                    .fetch_interface(&reference_value, current)
+                    .is_ok()
+            }) && self
+                .projection
+                .policy
+                .interface_visible(self.principal, reference)
+        });
+        let mut publication = publication
+            .project(&selected, |reference, operation| {
+                self.projection
+                    .policy
+                    .operation_visible(self.principal, reference, operation)
+            })
+            .map_err(|_| internal())?;
+        for current in current_scopes {
+            publication = publication.bind_scope(current);
+        }
+        Ok(publication)
+    }
+
+    // Adapt read-only callbacks to the existing backend execution boundary. The
+    // sentinel is NotStarted: no typed operation ran and no commit/rollback may
+    // be inferred. The actual callback result never escapes until execute exits.
+    fn with_publication<R>(
+        &self,
+        context: &ExecutionContext,
+        path: &str,
+        resolved: ResolvedEntry<B::Entry>,
+        operation: impl FnOnce(&PublishedObject<C::Object>) -> R,
+    ) -> ProviderResult<R> {
+        let mut observed = None;
+        let boundary = self
+            .projection
+            .backend
+            .execute(context, resolved, |resolved| {
+                if !lineage_matches_path(&resolved, path) {
+                    observed = Some(ProviderResult::Failure(internal()));
+                    return OperationAttempt::reject(wip_host::CallErrorKind::Internal);
+                }
+                if !self.lineage_visible(&resolved) {
+                    observed = Some(ProviderResult::NotFound);
+                    return OperationAttempt::reject(wip_host::CallErrorKind::NotFound);
+                }
+                observed = Some(
+                    match preflight(context).and_then(|()| {
+                        self.publication(&resolved, context)
+                            .map(|publication| operation(&publication))
+                    }) {
+                        Ok(result) => ProviderResult::Found(result),
+                        Err(error) => ProviderResult::Failure(error),
+                    },
+                );
+                OperationAttempt::reject(wip_host::CallErrorKind::Internal)
+            });
+        match boundary {
+            ProviderResult::Found(_) => {
+                observed.unwrap_or_else(|| ProviderResult::Failure(internal()))
+            }
+            ProviderResult::NotFound => ProviderResult::NotFound,
+            ProviderResult::Failure(error) => ProviderResult::Failure(error),
+        }
+    }
+
+    /// Retrieve the descriptor with precisely this principal's visible operations.
+    pub fn fetch_interface(
+        &self,
+        request: &FetchInterfaceRequest,
+    ) -> Result<FetchInterfaceResponse, ProtocolError> {
+        read_boundary(|| self.fetch_interface_inner(request))
+    }
+
+    fn fetch_interface_inner(
+        &self,
+        request: &FetchInterfaceRequest,
+    ) -> Result<FetchInterfaceResponse, ProtocolError> {
+        let observation =
+            ObjectProvider::fetch_interface(self, &self.projection.registry, &request.interface)?;
+        if !self
+            .projection
+            .policy
+            .interface_visible(self.principal, &observation.reference)
+        {
+            return Err(protocol(
+                ProtocolErrorCode::InterfaceNotFound,
+                "interface is not published",
+            ));
+        }
+        let reference = observation.reference.clone();
+        observation
+            .project_operations(|operation| {
+                self.projection
+                    .policy
+                    .operation_visible(self.principal, &reference, operation)
+            })
+            .protocol_response()
+    }
+
+    /// Observe a complete bounded tree, omitting invisible children and subtrees.
+    pub fn observe(
+        &self,
+        context: &ExecutionContext,
+        request: &ObserveRequest,
+    ) -> Result<ObserveResponse, ProtocolError> {
+        read_boundary(|| self.observe_inner(context, request))
+    }
+
+    fn observe_inner(
+        &self,
+        context: &ExecutionContext,
+        request: &ObserveRequest,
+    ) -> Result<ObserveResponse, ProtocolError> {
+        request
+            .validate()
+            .map_err(|_| protocol(ProtocolErrorCode::InvalidRequest, "invalid observe request"))?;
+        if request.depth > self.projection.limits.max_observation_depth {
+            return Err(resource_protocol());
+        }
+        let entry = match self.resolve(context, &request.path) {
+            ProviderResult::Found(entry) => entry,
+            ProviderResult::NotFound => {
+                return Err(protocol(
+                    ProtocolErrorCode::NotFound,
+                    "target path is not published",
+                ));
+            }
+            ProviderResult::Failure(error) => return Err(read_error(error)),
+        };
+        let mut remaining = u64::from(self.projection.limits.max_observation_nodes)
+            .min(context.resource_budget().unwrap_or(u64::MAX));
+        let response =
+            self.observe_entry(context, &request.path, entry, request.depth, &mut remaining)?;
+        request.validate_response(&response).map_err(|_| {
+            protocol(
+                ProtocolErrorCode::Internal,
+                "invalid projection observation",
+            )
+        })?;
+        Ok(response)
+    }
+
+    fn observe_entry(
+        &self,
+        context: &ExecutionContext,
+        path: &str,
+        resolved: ResolvedEntry<B::Entry>,
+        depth: u32,
+        remaining: &mut u64,
+    ) -> Result<ObjectObservation, ProtocolError> {
+        preflight(context).map_err(read_error)?;
+        if *remaining == 0 {
+            return Err(resource_protocol());
+        }
+        *remaining -= 1;
+        let object = match self.with_publication(context, path, resolved.clone(), |publication| {
+            publication.protocol_object_at(path)
+        }) {
+            ProviderResult::Found(object) => object.map_err(|error| error.protocol_error())?,
+            ProviderResult::NotFound => {
+                return Err(protocol(
+                    ProtocolErrorCode::NotFound,
+                    "target path is not published",
+                ));
+            }
+            ProviderResult::Failure(error) => return Err(read_error(error)),
+        };
+        let (mut ancestors, entry) = resolved.into_parts();
+        if depth == 0 {
+            return Ok(ObjectObservation {
+                object,
+                children: None,
+            });
+        }
+        let mut children = Vec::new();
+        if entry.kind() == EntryKind::Directory {
+            let entries = self
+                .projection
+                .backend
+                .children(
+                    context,
+                    &entry,
+                    usize::try_from(*remaining).unwrap_or(usize::MAX),
+                )
+                .map_err(read_error)?;
+            if entries.len() as u64 > *remaining {
+                return Err(resource_protocol());
+            }
+            ancestors.push(entry.clone());
+            for child in entries {
+                if self
+                    .projection
+                    .policy
+                    .object_visible(self.principal, &child)
+                {
+                    let child_path = if path == "/" {
+                        format!("/{}", child.name())
+                    } else {
+                        format!("{path}/{}", child.name())
+                    };
+                    children.push(self.observe_entry(
+                        context,
+                        &child_path,
+                        ResolvedEntry::new(ancestors.clone(), child),
+                        depth - 1,
+                        remaining,
+                    )?);
+                } else {
+                    if *remaining == 0 {
+                        return Err(resource_protocol());
+                    }
+                    *remaining -= 1;
+                }
+            }
+        }
+        Ok(ObjectObservation {
+            object,
+            children: Some(children),
+        })
+    }
+}
+
+impl<B, C, P> ObjectProvider for ProjectionView<'_, B, C, P>
+where
+    B: FilesystemBackend,
+    C: Composition<B::Entry>,
+    P: ProjectionPolicy<B::Entry, C::Object>,
+{
+    type Object = C::Object;
+    fn with_object<R>(
+        &self,
+        context: &ExecutionContext,
+        path: &str,
+        operation: impl FnOnce(&PublishedObject<Self::Object>) -> R,
+    ) -> ProviderResult<R> {
+        match self.resolve(context, path) {
+            ProviderResult::Found(resolved) => {
+                self.with_publication(context, path, resolved, operation)
+            }
+            ProviderResult::NotFound => ProviderResult::NotFound,
+            ProviderResult::Failure(error) => ProviderResult::Failure(error),
+        }
+    }
+    fn execute_operation(
+        &self,
+        context: &ExecutionContext,
+        path: &str,
+        operation: impl FnOnce(&PublishedObject<Self::Object>) -> OperationAttempt,
+    ) -> ProviderResult<OperationAttempt> {
+        let entry = match self.resolve(context, path) {
+            ProviderResult::Found(entry) => entry,
+            ProviderResult::NotFound => return ProviderResult::NotFound,
+            ProviderResult::Failure(error) => return ProviderResult::Failure(error),
+        };
+        self.projection.backend.execute(context, entry, |resolved| {
+            // Backend validates retained lineage membership/identity and refreshes
+            // all metadata before this callback under the same boundary as dispatch.
+            if !lineage_matches_path(&resolved, path) {
+                return OperationAttempt::reject(wip_host::CallErrorKind::Internal);
+            }
+            if !self.lineage_visible(&resolved) {
+                return OperationAttempt::reject(wip_host::CallErrorKind::NotFound);
+            }
+            if let Err(error) = preflight(context) {
+                return OperationAttempt::reject(match error.kind() {
+                    wip_host::HostErrorKind::Internal => wip_host::CallErrorKind::Internal,
+                    wip_host::HostErrorKind::ResourceLimitExceeded => {
+                        wip_host::CallErrorKind::ResourceLimitExceeded
+                    }
+                });
+            }
+            match self.publication(&resolved, context) {
+                Ok(publication) => operation(&publication),
+                Err(error) => OperationAttempt::reject(match error.kind() {
+                    wip_host::HostErrorKind::Internal => wip_host::CallErrorKind::Internal,
+                    wip_host::HostErrorKind::ResourceLimitExceeded => {
+                        wip_host::CallErrorKind::ResourceLimitExceeded
+                    }
+                }),
+            }
+        })
+    }
+    fn authorize(
+        &self,
+        _: &str,
+        object: &Self::Object,
+        interface: &InterfaceRef,
+        operation: &str,
+    ) -> bool {
+        self.projection
+            .policy
+            .authorize(self.principal, object, interface, operation)
+    }
+}
+
+impl<B, C, P> ObjectProvider for Projection<B, C, P>
+where
+    B: FilesystemBackend,
+    C: Composition<B::Entry>,
+    P: ProjectionPolicy<B::Entry, C::Object, Principal = ()>,
+{
+    type Object = C::Object;
+    fn with_object<R>(
+        &self,
+        context: &ExecutionContext,
+        path: &str,
+        operation: impl FnOnce(&PublishedObject<Self::Object>) -> R,
+    ) -> ProviderResult<R> {
+        self.view(&()).with_object(context, path, operation)
+    }
+    fn execute_operation(
+        &self,
+        context: &ExecutionContext,
+        path: &str,
+        operation: impl FnOnce(&PublishedObject<Self::Object>) -> OperationAttempt,
+    ) -> ProviderResult<OperationAttempt> {
+        self.view(&()).execute_operation(context, path, operation)
+    }
+    fn authorize(
+        &self,
+        path: &str,
+        object: &Self::Object,
+        interface: &InterfaceRef,
+        operation: &str,
+    ) -> bool {
+        self.view(&()).authorize(path, object, interface, operation)
+    }
+}
+
+impl<B, C, P> Projection<B, C, P>
+where
+    B: FilesystemBackend,
+    C: Composition<B::Entry>,
+    P: ProjectionPolicy<B::Entry, C::Object, Principal = ()>,
+{
+    /// Observe the default unit-principal view.
+    pub fn observe(
+        &self,
+        context: &ExecutionContext,
+        request: &ObserveRequest,
+    ) -> Result<ObserveResponse, ProtocolError> {
+        self.view(&()).observe(context, request)
+    }
+    /// Fetch in the default unit-principal view.
+    pub fn fetch_interface(
+        &self,
+        request: &FetchInterfaceRequest,
+    ) -> Result<FetchInterfaceResponse, ProtocolError> {
+        self.view(&()).fetch_interface(request)
+    }
+}
+
+fn lineage_matches_path<E: BackendEntry>(resolved: &ResolvedEntry<E>, path: &str) -> bool {
+    let names: Vec<_> = if path == "/" {
+        vec![""]
+    } else {
+        std::iter::once("").chain(path[1..].split('/')).collect()
+    };
+    if resolved.ancestors().len() + 1 != names.len()
+        || resolved.target().name() != names[names.len() - 1]
+    {
+        return false;
+    }
+    resolved
+        .ancestors()
+        .iter()
+        .zip(names)
+        .all(|(entry, name)| entry.kind() == EntryKind::Directory && entry.name() == name)
+}
+
+fn read_boundary<T>(
+    operation: impl FnOnce() -> Result<T, ProtocolError>,
+) -> Result<T, ProtocolError> {
+    std::panic::catch_unwind(std::panic::AssertUnwindSafe(operation))
+        .unwrap_or_else(|_| Err(protocol(ProtocolErrorCode::Internal, "projection failed")))
+}
+
+fn internal() -> HostError {
+    HostError::internal(
+        "projection publication failed",
+        EffectGuarantee::NotCommitted,
+    )
+}
+fn protocol(code: ProtocolErrorCode, message: &str) -> ProtocolError {
+    ProtocolError {
+        code,
+        message: message.into(),
+    }
+}
+fn resource_protocol() -> ProtocolError {
+    protocol(
+        ProtocolErrorCode::ResourceLimitExceeded,
+        "projection resource limit exceeded",
+    )
+}
+fn read_error(error: HostError) -> ProtocolError {
+    match error.kind() {
+        wip_host::HostErrorKind::ResourceLimitExceeded => resource_protocol(),
+        wip_host::HostErrorKind::Internal => {
+            protocol(ProtocolErrorCode::Internal, "projection failed")
+        }
+    }
+}
+fn preflight(context: &ExecutionContext) -> Result<(), HostError> {
+    if context.cancellation().is_cancelled()
+        || context
+            .deadline()
+            .is_some_and(|deadline| std::time::Instant::now() >= deadline)
+        || context.resource_budget() == Some(0)
+    {
+        Err(HostError::resource_limit(
+            "projection work limit exceeded",
+            EffectGuarantee::NotCommitted,
+        ))
+    } else {
+        Ok(())
+    }
+}

crates/wip-fs-server/src/http_adapter.rs

@@ -0,0 +1,435 @@
+//! Framework-neutral standard WIP over HTTP mapping for a projection view.
+
+use std::time::Instant;
+
+use http::header::ALLOW;
+use http::{Request, Response, StatusCode};
+use wip_host::{ExecutionContext, ObjectProvider};
+use wip_http::{
+    CodecError, EncodeHttpError, Endpoint, RequestMetadataError, Route,
+    decode_call_operation_metadata, decode_fetch_interface_request, decode_observe_request,
+    encode_call_operation_response, encode_fetch_interface_response, encode_observe_response,
+    encode_protocol_error_response, validate_http_request,
+};
+use wip_protocol::{ProtocolError, ProtocolErrorCode, ProtocolInteraction};
+
+use crate::engine::ProjectionView;
+use crate::{Composition, FilesystemBackend, ProjectionPolicy, ResourceLimits};
+
+/// Standard HTTP routes and codecs over a caller-scoped projection view.
+///
+/// The adapter borrows the view and endpoint without owning a listener, selecting
+/// a principal, or imposing a new execution context. Integrations must enforce
+/// the request body limit while collecting bytes, before calling this adapter.
+pub struct HttpAdapter<'a, 'view, B, C, P>
+where
+    B: FilesystemBackend,
+    C: Composition<B::Entry>,
+    P: ProjectionPolicy<B::Entry, C::Object>,
+{
+    view: &'a ProjectionView<'view, B, C, P>,
+    endpoint: &'a Endpoint,
+    limits: ResourceLimits,
+}
+
+impl<'a, 'view, B, C, P> HttpAdapter<'a, 'view, B, C, P>
+where
+    B: FilesystemBackend,
+    C: Composition<B::Entry>,
+    P: ProjectionPolicy<B::Entry, C::Object>,
+{
+    /// Creates an adapter for an already-selected principal's projection view.
+    #[must_use]
+    pub fn new(
+        view: &'a ProjectionView<'view, B, C, P>,
+        endpoint: &'a Endpoint,
+        limits: ResourceLimits,
+    ) -> Self {
+        Self {
+            view,
+            endpoint,
+            limits,
+        }
+    }
+
+    /// Handles one buffered request using the supplied execution controls.
+    ///
+    /// Observation and operation dispatch receive the original context, including
+    /// cancellation and resource budget. An elapsed deadline after dispatch keeps
+    /// the listener's existing empty HTTP 504 transport-failure behavior.
+    #[must_use]
+    pub fn handle_http_with_context(
+        &self,
+        request: Request<Vec<u8>>,
+        context: &ExecutionContext,
+    ) -> Response<Vec<u8>> {
+        let Some(route) = self.route(request.uri()) else {
+            return empty_response(StatusCode::NOT_FOUND);
+        };
+        if let Err(error) = validate_http_request(self.endpoint, route, &request) {
+            return self.metadata_error(error);
+        }
+        let response = match route {
+            Route::Observe => self.observe(request.body(), context),
+            Route::FetchInterface => self.fetch_interface(request.body()),
+            Route::CallOperation => self.call_operation(request.body(), context),
+        };
+        if context
+            .deadline()
+            .is_some_and(|deadline| Instant::now() >= deadline)
+        {
+            empty_response(StatusCode::GATEWAY_TIMEOUT)
+        } else {
+            response
+        }
+    }
+
+    fn route(&self, uri: &http::Uri) -> Option<Route> {
+        if uri.query().is_some() {
+            return None;
+        }
+        [Route::Observe, Route::FetchInterface, Route::CallOperation]
+            .into_iter()
+            .find(|route| self.endpoint.route(*route).path() == uri.path())
+    }
+
+    fn observe(&self, body: &[u8], context: &ExecutionContext) -> Response<Vec<u8>> {
+        let request = match decode_observe_request(body, self.limits.wire) {
+            Ok(request) => request,
+            Err(error) => return self.codec_error(ProtocolInteraction::Observe, error),
+        };
+        match self.view.observe(context, &request) {
+            Ok(tree) => {
+                encode_observe_response(&request, &tree, self.limits.wire).unwrap_or_else(|error| {
+                    self.read_encode_error(ProtocolInteraction::Observe, error)
+                })
+            }
+            Err(error) => self.protocol_error(ProtocolInteraction::Observe, &error),
+        }
+    }
+
+    fn fetch_interface(&self, body: &[u8]) -> Response<Vec<u8>> {
+        let request = match decode_fetch_interface_request(body, self.limits.wire) {
+            Ok(request) => request,
+            Err(error) => return self.codec_error(ProtocolInteraction::FetchInterface, error),
+        };
+        match self.view.fetch_interface(&request) {
+            Ok(interface) => {
+                encode_fetch_interface_response(&request, &interface, self.limits.wire)
+                    .unwrap_or_else(|error| {
+                        self.read_encode_error(ProtocolInteraction::FetchInterface, error)
+                    })
+            }
+            Err(error) => self.protocol_error(ProtocolInteraction::FetchInterface, &error),
+        }
+    }
+
+    fn call_operation(&self, body: &[u8], context: &ExecutionContext) -> Response<Vec<u8>> {
+        let metadata = match decode_call_operation_metadata(body, self.limits.wire) {
+            Ok(metadata) => metadata,
+            Err(error) => return self.codec_error(ProtocolInteraction::CallOperation, error),
+        };
+        let decoded = std::sync::Mutex::new(None);
+        let execution = self.view.call_operation_with_context_and_decoder(
+            context,
+            metadata.target.clone(),
+            metadata.interface.clone(),
+            metadata.operation.clone(),
+            |descriptor| {
+                let request = metadata.decode_request(body, descriptor, self.limits.wire)?;
+                let arguments = request.arguments.clone();
+                *decoded.lock().unwrap_or_else(|error| error.into_inner()) =
+                    Some((request, descriptor.clone()));
+                Ok::<_, CodecError>(arguments)
+            },
+        );
+        match execution.map_err(|error| error.protocol_error()) {
+            Ok(result) => {
+                let Some((request, descriptor)) = decoded
+                    .into_inner()
+                    .unwrap_or_else(|error| error.into_inner())
+                else {
+                    return self.protocol_error(
+                        ProtocolInteraction::CallOperation,
+                        &operation_outcome_unknown(),
+                    );
+                };
+                encode_call_operation_response(&request, &descriptor, &result, self.limits.wire)
+                    .unwrap_or_else(|error| self.operation_encode_error(error))
+            }
+            Err(error) => self.protocol_error(ProtocolInteraction::CallOperation, &error),
+        }
+    }
+
+    fn operation_encode_error(&self, error: EncodeHttpError) -> Response<Vec<u8>> {
+        if matches!(&error, EncodeHttpError::Codec(codec) if is_transport_limit(codec)) {
+            return empty_response(StatusCode::INTERNAL_SERVER_ERROR);
+        }
+        // Any successfully executed operation may have committed effects. Its
+        // name cannot establish a non-commit guarantee after response failure.
+        self.protocol_error(
+            ProtocolInteraction::CallOperation,
+            &operation_outcome_unknown(),
+        )
+    }
+
+    fn metadata_error(&self, error: RequestMetadataError) -> Response<Vec<u8>> {
+        match error {
+            RequestMetadataError::NotFound => empty_response(StatusCode::NOT_FOUND),
+            error @ RequestMetadataError::MethodNotAllowed => Response::builder()
+                .status(error.status())
+                .header(
+                    ALLOW,
+                    error
+                        .allow()
+                        .expect("method-not-allowed metadata has an Allow value"),
+                )
+                .body(Vec::new())
+                .expect("static method response is valid"),
+            RequestMetadataError::UnsupportedMediaType => {
+                empty_response(StatusCode::UNSUPPORTED_MEDIA_TYPE)
+            }
+            RequestMetadataError::NotAcceptable => empty_response(StatusCode::NOT_ACCEPTABLE),
+        }
+    }
+
+    fn codec_error(
+        &self,
+        interaction: ProtocolInteraction,
+        error: CodecError,
+    ) -> Response<Vec<u8>> {
+        if is_transport_limit(&error) {
+            empty_response(StatusCode::PAYLOAD_TOO_LARGE)
+        } else {
+            self.protocol_error(
+                interaction,
+                &ProtocolError {
+                    code: ProtocolErrorCode::InvalidRequest,
+                    message: "malformed WIP request".into(),
+                },
+            )
+        }
+    }
+
+    fn read_encode_error(
+        &self,
+        interaction: ProtocolInteraction,
+        error: EncodeHttpError,
+    ) -> Response<Vec<u8>> {
+        match error {
+            EncodeHttpError::Codec(codec) if is_transport_limit(&codec) => {
+                empty_response(StatusCode::INTERNAL_SERVER_ERROR)
+            }
+            _ => self.protocol_error(
+                interaction,
+                &ProtocolError {
+                    code: ProtocolErrorCode::Internal,
+                    message: "HTTP adapter failed".into(),
+                },
+            ),
+        }
+    }
+
+    fn protocol_error(
+        &self,
+        interaction: ProtocolInteraction,
+        error: &ProtocolError,
+    ) -> Response<Vec<u8>> {
+        // Engine and policy diagnostics may contain paths, argument values, or
+        // backend details. Emit only fixed, bounded diagnostics on the wire.
+        let sanitized = ProtocolError {
+            code: error.code,
+            message: sanitized_message(error.code).into(),
+        };
+        encode_protocol_error_response(interaction, &sanitized, self.limits.wire)
+            .unwrap_or_else(|_| empty_response(StatusCode::INTERNAL_SERVER_ERROR))
+    }
+}
+
+fn operation_outcome_unknown() -> ProtocolError {
+    ProtocolError {
+        code: ProtocolErrorCode::OperationOutcomeUnknown,
+        message: "operation completed but its response could not be encoded".into(),
+    }
+}
+
+fn sanitized_message(code: ProtocolErrorCode) -> &'static str {
+    match code {
+        ProtocolErrorCode::InvalidRequest => "malformed WIP request",
+        ProtocolErrorCode::NotFound => "target path is not published",
+        ProtocolErrorCode::InterfaceNotFound => "interface is not published",
+        ProtocolErrorCode::InterfaceMismatch => "interface is not published on the target",
+        ProtocolErrorCode::OperationNotFound => "operation is not published",
+        ProtocolErrorCode::InvalidArguments => "arguments do not match the operation",
+        ProtocolErrorCode::ValidatorRequired => "object validator is required",
+        ProtocolErrorCode::ValidatorMismatch => "object validator does not match",
+        ProtocolErrorCode::InterfaceValidatorRequired => "interface validator is required",
+        ProtocolErrorCode::InterfaceValidatorMismatch => "interface validator does not match",
+        ProtocolErrorCode::PermissionDenied => "operation is not permitted",
+        ProtocolErrorCode::ResourceLimitExceeded => "projection resource limit exceeded",
+        ProtocolErrorCode::Internal => "HTTP adapter failed",
+        ProtocolErrorCode::OperationOutcomeUnknown => "operation outcome is unknown",
+    }
+}
+
+fn is_transport_limit(error: &CodecError) -> bool {
+    matches!(
+        error,
+        CodecError::BodyTooLarge { .. } | CodecError::NestingTooDeep { .. }
+    )
+}
+
+fn empty_response(status: StatusCode) -> Response<Vec<u8>> {
+    Response::builder()
+        .status(status)
+        .body(Vec::new())
+        .expect("static status builds an HTTP response")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+    use wip_http::{
+        DecodedResponse, Limits, decode_fetch_interface_response, decode_observe_response,
+        encode_fetch_interface_request, encode_observe_request,
+    };
+    use wip_protocol::{FetchInterfaceRequest, ObserveRequest};
+
+    #[test]
+    fn adapter_serves_observation_and_interface_fetch_without_server() {
+        let root = tempdir().unwrap();
+        std::fs::write(root.path().join("file"), b"contents").unwrap();
+        let limits = ResourceLimits::default();
+        let projection =
+            crate::default_projection(root.path(), crate::AccessMode::ReadOnly, limits).unwrap();
+        let view = projection.view(&());
+        let endpoint = Endpoint::parse("http://localhost/custom").unwrap();
+        let adapter = HttpAdapter::new(&view, &endpoint, limits);
+        let context = ExecutionContext::new();
+        let request = ObserveRequest {
+            path: "/file".into(),
+            depth: 0,
+        };
+        let response = adapter.handle_http_with_context(
+            encode_observe_request(&endpoint, &request, limits.wire).unwrap(),
+            &context,
+        );
+        let DecodedResponse::Success(observation) =
+            decode_observe_response(&request, &response, limits.wire).unwrap()
+        else {
+            panic!("expected observation success")
+        };
+        let request = FetchInterfaceRequest {
+            interface: observation.object.interfaces[0].clone(),
+        };
+        let response = adapter.handle_http_with_context(
+            encode_fetch_interface_request(&endpoint, &request, limits.wire).unwrap(),
+            &context,
+        );
+        assert!(matches!(
+            decode_fetch_interface_response(&request, &response, limits.wire).unwrap(),
+            DecodedResponse::Success(_)
+        ));
+    }
+
+    #[test]
+    fn adapter_preserves_transport_boundaries_and_execution_context() {
+        let root = tempdir().unwrap();
+        let limits = ResourceLimits::default();
+        let projection =
+            crate::default_projection(root.path(), crate::AccessMode::ReadOnly, limits).unwrap();
+        let view = projection.view(&());
+        let endpoint = Endpoint::parse("http://localhost/wip").unwrap();
+        let adapter = HttpAdapter::new(&view, &endpoint, limits);
+        let context = ExecutionContext::new();
+        for uri in [
+            "/wip/v1/observe?query=1",
+            "/wip/v1/unknown",
+            "/wip/v1/observe/extra",
+        ] {
+            let response = adapter.handle_http_with_context(
+                Request::builder().uri(uri).body(Vec::new()).unwrap(),
+                &context,
+            );
+            assert_eq!(response.status(), StatusCode::NOT_FOUND);
+            assert!(response.body().is_empty());
+        }
+        let response = adapter.handle_http_with_context(
+            Request::builder()
+                .uri("/wip/v1/observe")
+                .body(Vec::new())
+                .unwrap(),
+            &context,
+        );
+        assert_eq!(response.status(), StatusCode::METHOD_NOT_ALLOWED);
+        assert_eq!(response.headers()[ALLOW], "POST");
+        assert!(response.body().is_empty());
+        let request = ObserveRequest {
+            path: "/".into(),
+            depth: 0,
+        };
+        let response = adapter.handle_http_with_context(
+            encode_observe_request(&endpoint, &request, limits.wire).unwrap(),
+            &ExecutionContext::new().with_resource_budget(0),
+        );
+        let text = std::str::from_utf8(response.body()).unwrap();
+        assert!(text.contains("resource_limit_exceeded"));
+        let response = adapter.handle_http_with_context(
+            encode_observe_request(&endpoint, &request, limits.wire).unwrap(),
+            &ExecutionContext::new().with_deadline(Instant::now()),
+        );
+        assert_eq!(response.status(), StatusCode::GATEWAY_TIMEOUT);
+        assert!(response.body().is_empty());
+    }
+
+    #[test]
+    fn post_success_encoding_is_unknown_except_empty_transport_limit_failure() {
+        let root = tempdir().unwrap();
+        let limits = ResourceLimits::default();
+        let projection =
+            crate::default_projection(root.path(), crate::AccessMode::ReadOnly, limits).unwrap();
+        let view = projection.view(&());
+        let endpoint = Endpoint::parse("http://localhost/wip").unwrap();
+        let adapter = HttpAdapter::new(&view, &endpoint, limits);
+        let error = decode_observe_request(b"{", limits.wire).unwrap_err();
+        let response = adapter.operation_encode_error(EncodeHttpError::Codec(error));
+        assert!(
+            std::str::from_utf8(response.body())
+                .unwrap()
+                .contains("operation_outcome_unknown")
+        );
+        let tiny_limits = Limits::new(1, 1, 1).unwrap();
+        let error = decode_observe_request(b"{}", tiny_limits).unwrap_err();
+        assert!(is_transport_limit(&error));
+        let response = adapter.operation_encode_error(EncodeHttpError::Codec(error));
+        assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR);
+        assert!(response.body().is_empty());
+        assert!(!response.headers().contains_key(http::header::CONTENT_TYPE));
+    }
+
+    #[test]
+    fn engine_error_diagnostics_are_sanitized_and_bounded() {
+        let root = tempdir().unwrap();
+        let limits = ResourceLimits::default();
+        let projection =
+            crate::default_projection(root.path(), crate::AccessMode::ReadOnly, limits).unwrap();
+        let view = projection.view(&());
+        let endpoint = Endpoint::parse("http://localhost/wip").unwrap();
+        let adapter = HttpAdapter::new(&view, &endpoint, limits);
+        let response = adapter.protocol_error(
+            ProtocolInteraction::Observe,
+            &ProtocolError {
+                code: ProtocolErrorCode::Internal,
+                message: "/private/backend/secret".repeat(1000),
+            },
+        );
+        assert!(response.body().len() < 512);
+        assert!(
+            !std::str::from_utf8(response.body())
+                .unwrap()
+                .contains("secret")
+        );
+        assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR);
+    }
+}

crates/wip-fs-server/src/interfaces.rs

@@ -0,0 +1,43 @@
+//! Filesystem capability interfaces published by the projection.
+
+use wip_interface as wip;
+
+/// Bounded reads from a regular file.
+#[wip::interface]
+pub trait FileRead {
+    /// Reads bytes from the current regular file.
+    ///
+    /// # Returns
+    /// At most the configured read limit, beginning at `offset`.
+    fn read(
+        &self,
+        /// Byte offset; omitted means zero.
+        offset: Option<u64>,
+        /// Requested byte count; omitted means the rest of the file.
+        length: Option<u64>,
+    ) -> wip::OperationResult<wip::Bytes>;
+}
+
+/// Inspection operations for a symbolic link itself.
+#[wip::interface]
+pub trait SymlinkInspect {
+    /// Reads the link payload without following it.
+    ///
+    /// # Returns
+    /// The platform path bytes stored in the symbolic link.
+    fn read_link(&self) -> wip::OperationResult<wip::Bytes>;
+}
+
+/// Explicitly enabled mutation of a regular file.
+#[wip::interface]
+pub trait FileWrite {
+    /// Replaces the current regular file contents through its pinned handle.
+    ///
+    /// # Returns
+    /// Unit after the new bytes have been written and synchronized.
+    fn replace(
+        &self,
+        /// Complete replacement contents.
+        contents: wip::Bytes,
+    ) -> wip::OperationResult<()>;
+}

crates/wip-fs-server/src/lib.rs

@@ -0,0 +1,235 @@
+//! Request-time filesystem projection served through the standard WIP over HTTP binding.
+//!
+//! This crate deliberately keeps the boundaries visible:
+//!
+//! - [`wip_protocol`] owns logical requests and responses;
+//! - [`wip_host`] owns object publication, validators, and typed dispatch;
+//! - [`wip_http`] owns routes, JSON, envelopes, and status mapping;
+//! - this crate owns the filesystem capability boundary and the real HTTP listener.
+//!
+//! # Extension boundary
+//!
+//! [`Projection`] composes a [`FilesystemBackend`], typed [`Composition`] and
+//! [`ProjectionPolicy`]. External local Objects can wrap a [`BackendEntry`] and
+//! implement generated interfaces without orphan-rule workarounds. The backend
+//! retains a root-confined target and atomic validator/dispatch boundary; the
+//! engine owns recursive observation and standard host typed validation. No
+//! listener is needed to use [`ProjectionView`]. [`HttpAdapter`] applies the
+//! existing standard HTTP binding to a deployment-established principal view.
+//!
+//! # Scope publication migration
+//!
+//! Registration uses `registry.register(&scope, name, Definition, validator)`.
+//! [`DefaultInterfaces::register`] takes an explicit [`wip_host::Scope`]; built-ins
+//! use root-local names `file.read`, `symlink.inspect` and `file.write`. The engine
+//! binds its deployment-pinned root lifetime automatically inside the backend
+//! execution boundary. External [`Composition::scope`] implementations attest
+//! non-root lifetimes using the refreshed connected lineage in that same boundary.
+//! Without an attestation non-root registrations fail closed. Scope refs come
+//! from the current published scope Object and remain optional.
+//! The Linux root survives textual root renames and does not issue an Object ref;
+//! fetch therefore omits `scope_ref` without weakening the private lifetime check.
+//!
+//! Backends and Operations are trusted code, responsible for truthful effects,
+//! public-only metadata and ongoing execution-context bounds. Policies must be
+//! stable within a view; changing descriptor visibility requires new reference
+//! lifetimes. See the crate README for implementer security and migration details.
+//!
+//! ```no_run
+//! use wip_fs_server::{default_projection, AccessMode, ResourceLimits};
+//! use wip_host::{ExecutionContext, ObjectProvider};
+//! use wip_protocol::ObserveRequest;
+//!
+//! let engine = default_projection(std::path::Path::new("./public"),
+//!     AccessMode::ReadOnly, ResourceLimits::default())?;
+//! let view = engine.view(&());
+//! let context = ExecutionContext::new().with_resource_budget(128);
+//! let tree = view.observe(&context, &ObserveRequest { path: "/".into(), depth: 1 })?;
+//! assert_eq!(tree.object.name, "");
+//! let object = view.observe_object_with_context(&context, "/")?;
+//! assert!(object.interfaces.is_empty());
+//! # Ok::<(), Box<dyn std::error::Error>>(())
+//! ```
+//!
+//! The built-in HTTP listener is intentionally loopback-only. TLS termination,
+//! certificates, authentication, and externally visible schemes are independent
+//! deployment concerns rather than WIP transport profiles.
+
+#![deny(missing_docs)]
+
+mod defaults;
+mod engine;
+mod http_adapter;
+mod interfaces;
+mod projection;
+mod server;
+
+use std::net::{IpAddr, Ipv4Addr, SocketAddr};
+use std::path::PathBuf;
+use std::time::Duration;
+
+pub use defaults::{DefaultComposition, DefaultInterfaces, DefaultObject, default_projection};
+pub use engine::{
+    BackendEntry, Composition, DefaultPolicy, EntryKind, FilesystemBackend, Projection,
+    ProjectionPolicy, ProjectionView, ResolvedEntry,
+};
+pub use http_adapter::HttpAdapter;
+pub use interfaces::{
+    FileRead, FileReadDefinition, FileWrite, FileWriteDefinition, SymlinkInspect,
+    SymlinkInspectDefinition,
+};
+pub use projection::{LinuxBackend, LinuxEntry};
+pub use server::{BoundServer, ServerBuildError, WipFsServer};
+
+/// Filesystem capabilities published by regular files.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AccessMode {
+    /// Publish bounded reads only.
+    ReadOnly,
+    /// Also publish validator-protected whole-file replacement.
+    ReadWrite,
+}
+
+/// Bounded resource policy applied by the HTTP adapter and filesystem provider.
+#[derive(Debug, Clone, Copy)]
+pub struct ResourceLimits {
+    /// Standard JSON, body-size, and nesting limits.
+    pub wire: wip_http::Limits,
+    /// Maximum bytes returned by one file read.
+    pub max_file_read_bytes: usize,
+    /// Maximum bytes accepted by one file replacement.
+    pub max_file_write_bytes: usize,
+    /// Maximum accepted `observe` depth.
+    pub max_observation_depth: u32,
+    /// Maximum accepted `observe` node count, including its root.
+    pub max_observation_nodes: u32,
+    /// Maximum simultaneously pinned projected filesystem handles.
+    pub max_open_handles: usize,
+    /// Maximum bytes accepted for one HTTP request head, including its terminator.
+    pub max_http_header_bytes: usize,
+    /// Maximum requests executing concurrently.
+    pub max_concurrent_requests: usize,
+    /// End-to-end deadline for HTTP intake, dispatch, and response transmission.
+    pub request_timeout: Duration,
+}
+
+impl Default for ResourceLimits {
+    fn default() -> Self {
+        Self {
+            wire: wip_http::Limits::new(256 * 1024, 2 * 1024 * 1024, 64)
+                .expect("default wire limits are nonzero"),
+            max_file_read_bytes: 1024 * 1024,
+            max_file_write_bytes: 1024 * 1024,
+            max_observation_depth: 32,
+            max_observation_nodes: 1024,
+            max_open_handles: 2048,
+            max_http_header_bytes: 16 * 1024,
+            max_concurrent_requests: 32,
+            request_timeout: Duration::from_secs(30),
+        }
+    }
+}
+
+/// Complete listener and projection configuration.
+#[derive(Debug, Clone)]
+pub struct ServerConfig {
+    /// Filesystem directory projected as Worldspace `/`.
+    pub root: PathBuf,
+    /// Loopback socket used by the built-in cleartext listener.
+    pub listen: SocketAddr,
+    /// URL path prefix below which standard `v1/*` routes are mounted.
+    pub endpoint_base_path: String,
+    /// Read-only or explicit read-write publication mode.
+    pub access: AccessMode,
+    /// Request, operation, traversal, and concurrency bounds.
+    pub limits: ResourceLimits,
+}
+
+impl ServerConfig {
+    /// Builds a secure-by-default configuration for `root`.
+    ///
+    /// The listener defaults to an ephemeral loopback port and read-only access.
+    #[must_use]
+    pub fn for_root(root: impl Into<PathBuf>) -> Self {
+        Self {
+            root: root.into(),
+            listen: SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0),
+            endpoint_base_path: "/wip".into(),
+            access: AccessMode::ReadOnly,
+            limits: ResourceLimits::default(),
+        }
+    }
+
+    pub(crate) fn validate(&self) -> Result<(), ConfigError> {
+        if !self.listen.ip().is_loopback() {
+            return Err(ConfigError::NonLoopbackCleartext);
+        }
+        if !valid_base_path(&self.endpoint_base_path) {
+            return Err(ConfigError::InvalidBasePath);
+        }
+        if self.limits.max_file_read_bytes == 0
+            || self.limits.max_file_write_bytes == 0
+            || self.limits.max_observation_nodes == 0
+            || self.limits.max_open_handles == 0
+            || self.limits.max_http_header_bytes == 0
+            || self.limits.max_concurrent_requests == 0
+            || self.limits.request_timeout.is_zero()
+        {
+            return Err(ConfigError::ZeroLimit);
+        }
+        if self.limits.max_open_handles < self.limits.max_observation_nodes as usize {
+            return Err(ConfigError::InsufficientHandles);
+        }
+        if self.limits.wire.max_response_bytes() < 512 {
+            return Err(ConfigError::ResponseLimitTooSmall);
+        }
+        Ok(())
+    }
+
+    pub(crate) fn endpoint(&self) -> Result<wip_http::Endpoint, ConfigError> {
+        let endpoint = format!("http://localhost{}", self.endpoint_base_path);
+        wip_http::Endpoint::parse(&endpoint).map_err(|_| ConfigError::InvalidBasePath)
+    }
+}
+
+/// Invalid server configuration.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ConfigError {
+    /// The cleartext built-in listener was exposed beyond loopback.
+    NonLoopbackCleartext,
+    /// The endpoint prefix is not an absolute canonical URL path.
+    InvalidBasePath,
+    /// A resource limit is zero.
+    ZeroLimit,
+    /// Tree nodes could exhaust the configured handle ceiling by construction.
+    InsufficientHandles,
+    /// The response limit cannot reliably carry a bounded protocol error envelope.
+    ResponseLimitTooSmall,
+}
+
+impl std::fmt::Display for ConfigError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(match self {
+            Self::NonLoopbackCleartext => "the built-in cleartext listener must bind to loopback",
+            Self::InvalidBasePath => {
+                "endpoint base path must be absolute, canonical, and query-free"
+            }
+            Self::ZeroLimit => "all resource limits and the request timeout must be nonzero",
+            Self::InsufficientHandles => "max_open_handles must cover max_observation_nodes",
+            Self::ResponseLimitTooSmall => "max_response_bytes must be at least 512",
+        })
+    }
+}
+
+impl std::error::Error for ConfigError {}
+
+fn valid_base_path(path: &str) -> bool {
+    path.starts_with('/')
+        && !path.contains('?')
+        && !path.contains('#')
+        && !path.contains("//")
+        && !path
+            .split('/')
+            .any(|segment| segment == "." || segment == "..")
+        && (path == "/" || !path.ends_with('/'))
+}

crates/wip-fs-server/src/main.rs

@@ -0,0 +1,62 @@
+use std::error::Error;
+use std::net::SocketAddr;
+use std::path::PathBuf;
+
+use wip_fs_server::{AccessMode, ServerConfig, WipFsServer};
+
+fn main() -> Result<(), Box<dyn Error>> {
+    let mut root: Option<PathBuf> = None;
+    let mut listen: SocketAddr = "127.0.0.1:8080".parse()?;
+    let mut base_path = "/wip".to_owned();
+    let mut access = AccessMode::ReadOnly;
+    let mut arguments = std::env::args().skip(1);
+    while let Some(argument) = arguments.next() {
+        match argument.as_str() {
+            "--root" => root = Some(PathBuf::from(required_value(&mut arguments, "--root")?)),
+            "--listen" => listen = required_value(&mut arguments, "--listen")?.parse()?,
+            "--base-path" => base_path = required_value(&mut arguments, "--base-path")?,
+            "--read-write" => access = AccessMode::ReadWrite,
+            "--help" | "-h" => {
+                print_help();
+                return Ok(());
+            }
+            unknown => return Err(format!("unknown argument `{unknown}`; use --help").into()),
+        }
+    }
+
+    let root = root.ok_or("--root is required")?;
+    let mut config = ServerConfig::for_root(root);
+    config.listen = listen;
+    config.endpoint_base_path = base_path;
+    config.access = access;
+
+    let server = WipFsServer::new(config)?;
+    let effective_root = server.effective_root().to_owned();
+    let endpoint = server.endpoint().clone();
+    let bound = server.bind()?;
+    eprintln!(
+        "wip-fs-server root={} access={access:?} endpoint={} listen={}",
+        effective_root.display(),
+        endpoint,
+        bound.local_addr()
+    );
+    bound.serve()?;
+    Ok(())
+}
+
+fn required_value(
+    arguments: &mut impl Iterator<Item = String>,
+    option: &str,
+) -> Result<String, Box<dyn Error>> {
+    arguments
+        .next()
+        .ok_or_else(|| format!("{option} requires a value").into())
+}
+
+fn print_help() {
+    println!(
+        "Usage: wip-fs-server --root PATH [--listen 127.0.0.1:8080] \\\n         [--base-path /wip] [--read-write]\n\n\
+         The built-in HTTP listener is loopback-only. TLS termination, authentication, \
+         and external routing are deployment concerns."
+    );
+}

crates/wip-fs-server/src/server.rs

@@ -0,0 +1,427 @@
+use std::io::{Read, Write};
+use std::net::{SocketAddr, TcpListener, TcpStream};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::{Duration, Instant};
+
+use http::{Request, Response, StatusCode};
+use wip_host::ExecutionContext;
+use wip_http::Endpoint;
+
+use crate::engine::Projection;
+use crate::http_adapter::HttpAdapter;
+use crate::{ConfigError, DefaultComposition, DefaultPolicy, LinuxBackend, ServerConfig};
+
+/// Default Linux filesystem projection and bounded loopback HTTP listener.
+pub struct WipFsServer {
+    config: ServerConfig,
+    endpoint: Endpoint,
+    effective_root: std::path::PathBuf,
+    projection: Arc<Projection<LinuxBackend, DefaultComposition, DefaultPolicy>>,
+}
+
+impl WipFsServer {
+    /// Validates configuration and opens the configured directory capability.
+    pub fn new(config: ServerConfig) -> Result<Self, ServerBuildError> {
+        config.validate()?;
+        let endpoint = config.endpoint()?;
+        let projection = crate::default_projection(&config.root, config.access, config.limits)?;
+        let effective_root = projection.backend().effective_root()?;
+        Ok(Self {
+            config,
+            endpoint,
+            effective_root,
+            projection: Arc::new(projection),
+        })
+    }
+
+    /// Returns the canonical effective filesystem root opened by the server.
+    #[must_use]
+    pub fn effective_root(&self) -> &std::path::Path {
+        &self.effective_root
+    }
+
+    /// Returns the configured transport endpoint prefix.
+    #[must_use]
+    pub fn endpoint(&self) -> &Endpoint {
+        &self.endpoint
+    }
+
+    /// Handles one already-buffered HTTP request with the standard `wip-http` codecs.
+    ///
+    /// Listener integrations must enforce the same body limit while collecting bytes.
+    #[must_use]
+    pub fn handle_http(&self, request: Request<Vec<u8>>) -> Response<Vec<u8>> {
+        self.handle_http_with_deadline(request, Instant::now() + self.config.limits.request_timeout)
+    }
+
+    fn handle_http_with_deadline(
+        &self,
+        request: Request<Vec<u8>>,
+        deadline: Instant,
+    ) -> Response<Vec<u8>> {
+        let context = ExecutionContext::new()
+            .with_deadline(deadline)
+            .with_resource_budget(u64::from(self.config.limits.max_observation_nodes));
+        let view = self.projection.view(&());
+        HttpAdapter::new(&view, &self.endpoint, self.config.limits)
+            .handle_http_with_context(request, &context)
+    }
+
+    /// Binds the built-in bounded loopback HTTP listener.
+    ///
+    /// The built-in listener is cleartext and loopback-only. Externally visible
+    /// schemes, TLS termination, authentication, and proxy routing are deployment
+    /// concerns rather than WIP transport profiles.
+    pub fn bind(self) -> Result<BoundServer, ServerBuildError> {
+        let listener = TcpListener::bind(self.config.listen)
+            .map_err(|error| ServerBuildError::Listener(error.to_string()))?;
+        listener
+            .set_nonblocking(true)
+            .map_err(|error| ServerBuildError::Listener(error.to_string()))?;
+        let local_addr = listener
+            .local_addr()
+            .map_err(|error| ServerBuildError::Listener(error.to_string()))?;
+        Ok(BoundServer {
+            local_addr,
+            service: Arc::new(self),
+            listener: Arc::new(listener),
+        })
+    }
+}
+
+/// Bound real HTTP listener for a [`WipFsServer`].
+pub struct BoundServer {
+    local_addr: SocketAddr,
+    service: Arc<WipFsServer>,
+    listener: Arc<TcpListener>,
+}
+
+impl BoundServer {
+    /// Returns the actual bound loopback address, including an assigned port.
+    #[must_use]
+    pub fn local_addr(&self) -> SocketAddr {
+        self.local_addr
+    }
+
+    /// Serves requests with a fixed worker count until `shutdown` becomes true.
+    ///
+    /// Workers accept connections directly, so at most
+    /// `max_concurrent_requests` sockets are active in userspace. Each connection
+    /// is closed after one request and shares one absolute deadline across HTTP
+    /// intake, dispatch, and response transmission.
+    pub fn serve_until(&self, shutdown: Arc<AtomicBool>) -> Result<(), std::io::Error> {
+        let mut workers = Vec::with_capacity(self.service.config.limits.max_concurrent_requests);
+        for _ in 0..self.service.config.limits.max_concurrent_requests {
+            let listener = Arc::clone(&self.listener);
+            let service = Arc::clone(&self.service);
+            let shutdown = Arc::clone(&shutdown);
+            workers.push(thread::spawn(move || {
+                while !shutdown.load(Ordering::Acquire) {
+                    match listener.accept() {
+                        Ok((stream, _)) => serve_connection(&service, stream),
+                        Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                            thread::sleep(Duration::from_millis(5));
+                        }
+                        Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
+                        Err(error) => return Err(error),
+                    }
+                }
+                Ok(())
+            }));
+        }
+        for worker in workers {
+            worker
+                .join()
+                .map_err(|_| std::io::Error::other("HTTP worker panicked"))??;
+        }
+        Ok(())
+    }
+
+    /// Serves until the process is terminated.
+    pub fn serve(&self) -> Result<(), std::io::Error> {
+        self.serve_until(Arc::new(AtomicBool::new(false)))
+    }
+}
+
+#[derive(Debug)]
+struct ParsedRequestHead {
+    method: http::Method,
+    target: String,
+    headers: Vec<(http::header::HeaderName, http::HeaderValue)>,
+    content_length: usize,
+}
+
+#[derive(Debug)]
+enum IntakeError {
+    Timeout,
+    HeaderTooLarge,
+    PayloadTooLarge,
+    BadRequest,
+    Socket,
+}
+
+fn serve_connection(service: &WipFsServer, mut stream: TcpStream) {
+    let _ = stream.set_nonblocking(false);
+    let started = Instant::now();
+    let deadline = started
+        .checked_add(service.config.limits.request_timeout)
+        .unwrap_or(started);
+    let response = match read_http_request(
+        &mut stream,
+        service.config.limits.max_http_header_bytes,
+        service.config.limits.wire.max_request_bytes(),
+        deadline,
+    ) {
+        Ok(request) => Some(service.handle_http_with_deadline(request, deadline)),
+        Err(IntakeError::HeaderTooLarge) => {
+            Some(empty_response(StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE))
+        }
+        Err(IntakeError::PayloadTooLarge) => Some(empty_response(StatusCode::PAYLOAD_TOO_LARGE)),
+        Err(IntakeError::BadRequest) => Some(empty_response(StatusCode::BAD_REQUEST)),
+        Err(IntakeError::Timeout | IntakeError::Socket) => None,
+    };
+    if let Some(response) = response {
+        let _ = write_http_response(&mut stream, &response, deadline);
+    }
+    let _ = stream.shutdown(std::net::Shutdown::Both);
+}
+
+fn read_http_request(
+    stream: &mut TcpStream,
+    maximum_header: usize,
+    maximum_body: usize,
+    deadline: Instant,
+) -> Result<Request<Vec<u8>>, IntakeError> {
+    let mut received = Vec::with_capacity(maximum_header.min(8 * 1024));
+    let header_end = loop {
+        if let Some(position) = received.windows(4).position(|window| window == b"\r\n\r\n") {
+            let end = position + 4;
+            if end > maximum_header {
+                return Err(IntakeError::HeaderTooLarge);
+            }
+            break end;
+        }
+        if received.len() >= maximum_header {
+            return Err(IntakeError::HeaderTooLarge);
+        }
+        let mut chunk = [0_u8; 4 * 1024];
+        let available = (maximum_header - received.len()).min(chunk.len());
+        let count = read_with_deadline(stream, &mut chunk[..available], deadline)?;
+        if count == 0 {
+            return Err(IntakeError::BadRequest);
+        }
+        received.extend_from_slice(&chunk[..count]);
+    };
+
+    let parsed = parse_request_head(&received[..header_end])?;
+    if parsed.content_length > maximum_body {
+        return Err(IntakeError::PayloadTooLarge);
+    }
+    let mut body = Vec::with_capacity(parsed.content_length);
+    let buffered = &received[header_end..];
+    body.extend_from_slice(&buffered[..buffered.len().min(parsed.content_length)]);
+    while body.len() < parsed.content_length {
+        let mut chunk = [0_u8; 8 * 1024];
+        let wanted = (parsed.content_length - body.len()).min(chunk.len());
+        let count = read_with_deadline(stream, &mut chunk[..wanted], deadline)?;
+        if count == 0 {
+            return Err(IntakeError::BadRequest);
+        }
+        body.extend_from_slice(&chunk[..count]);
+    }
+
+    let mut builder = Request::builder().method(parsed.method).uri(parsed.target);
+    for (name, value) in parsed.headers {
+        builder = builder.header(name, value);
+    }
+    builder.body(body).map_err(|_| IntakeError::BadRequest)
+}
+
+fn parse_request_head(bytes: &[u8]) -> Result<ParsedRequestHead, IntakeError> {
+    let text = std::str::from_utf8(bytes).map_err(|_| IntakeError::BadRequest)?;
+    let mut lines = text
+        .strip_suffix("\r\n\r\n")
+        .ok_or(IntakeError::BadRequest)?
+        .split("\r\n");
+    let mut request_line = lines
+        .next()
+        .ok_or(IntakeError::BadRequest)?
+        .split_ascii_whitespace();
+    let method = request_line.next().ok_or(IntakeError::BadRequest)?;
+    let target = request_line.next().ok_or(IntakeError::BadRequest)?;
+    let version = request_line.next().ok_or(IntakeError::BadRequest)?;
+    if request_line.next().is_some()
+        || !matches!(version, "HTTP/1.0" | "HTTP/1.1")
+        || !target.starts_with('/')
+    {
+        return Err(IntakeError::BadRequest);
+    }
+    let method =
+        http::Method::from_bytes(method.as_bytes()).map_err(|_| IntakeError::BadRequest)?;
+    let _: http::Uri = target.parse().map_err(|_| IntakeError::BadRequest)?;
+
+    let mut headers = Vec::new();
+    let mut content_length = None;
+    for line in lines {
+        if line.is_empty() || line.starts_with([' ', '\t']) {
+            return Err(IntakeError::BadRequest);
+        }
+        let (name, value) = line.split_once(':').ok_or(IntakeError::BadRequest)?;
+        let name = http::header::HeaderName::from_bytes(name.as_bytes())
+            .map_err(|_| IntakeError::BadRequest)?;
+        let value =
+            http::HeaderValue::from_str(value.trim()).map_err(|_| IntakeError::BadRequest)?;
+        if name == http::header::CONTENT_LENGTH {
+            if content_length.is_some() {
+                return Err(IntakeError::BadRequest);
+            }
+            content_length = Some(
+                value
+                    .to_str()
+                    .ok()
+                    .and_then(|value| value.parse::<usize>().ok())
+                    .ok_or(IntakeError::BadRequest)?,
+            );
+        }
+        if name == http::header::TRANSFER_ENCODING {
+            return Err(IntakeError::BadRequest);
+        }
+        headers.push((name, value));
+    }
+
+    Ok(ParsedRequestHead {
+        method,
+        target: target.to_owned(),
+        headers,
+        content_length: content_length.unwrap_or(0),
+    })
+}
+
+fn read_with_deadline(
+    stream: &mut TcpStream,
+    buffer: &mut [u8],
+    deadline: Instant,
+) -> Result<usize, IntakeError> {
+    let remaining = deadline
+        .checked_duration_since(Instant::now())
+        .ok_or(IntakeError::Timeout)?;
+    stream
+        .set_read_timeout(Some(remaining.max(Duration::from_millis(1))))
+        .map_err(|_| IntakeError::Socket)?;
+    stream.read(buffer).map_err(|error| match error.kind() {
+        std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock => IntakeError::Timeout,
+        _ => IntakeError::Socket,
+    })
+}
+
+fn write_http_response(
+    stream: &mut TcpStream,
+    response: &Response<Vec<u8>>,
+    deadline: Instant,
+) -> Result<(), std::io::Error> {
+    let mut encoded = Vec::new();
+    write!(
+        encoded,
+        "HTTP/1.1 {} {}\r\n",
+        response.status().as_u16(),
+        response.status().canonical_reason().unwrap_or("")
+    )?;
+    for (name, value) in response.headers() {
+        if name == http::header::CONTENT_LENGTH
+            || name == http::header::CONNECTION
+            || name == http::header::TRANSFER_ENCODING
+        {
+            continue;
+        }
+        encoded.extend_from_slice(name.as_str().as_bytes());
+        encoded.extend_from_slice(b": ");
+        encoded.extend_from_slice(value.as_bytes());
+        encoded.extend_from_slice(b"\r\n");
+    }
+    write!(
+        encoded,
+        "Content-Length: {}\r\nConnection: close\r\n\r\n",
+        response.body().len()
+    )?;
+    encoded.extend_from_slice(response.body());
+    write_all_with_deadline(stream, &encoded, deadline)
+}
+
+fn write_all_with_deadline(
+    stream: &mut TcpStream,
+    mut bytes: &[u8],
+    deadline: Instant,
+) -> Result<(), std::io::Error> {
+    while !bytes.is_empty() {
+        let remaining = deadline
+            .checked_duration_since(Instant::now())
+            .ok_or_else(|| {
+                std::io::Error::new(std::io::ErrorKind::TimedOut, "request timed out")
+            })?;
+        stream.set_write_timeout(Some(remaining.max(Duration::from_millis(1))))?;
+        match stream.write(bytes) {
+            Ok(0) => {
+                return Err(std::io::Error::new(
+                    std::io::ErrorKind::WriteZero,
+                    "socket closed",
+                ));
+            }
+            Ok(count) => bytes = &bytes[count..],
+            Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
+            Err(error) => return Err(error),
+        }
+    }
+    stream.flush()
+}
+
+fn empty_response(status: StatusCode) -> Response<Vec<u8>> {
+    Response::builder()
+        .status(status)
+        .body(Vec::new())
+        .expect("static status builds an HTTP response")
+}
+
+/// Failure while validating, opening, or binding the server.
+#[derive(Debug)]
+pub enum ServerBuildError {
+    /// Configuration is unsafe or unbounded.
+    Config(ConfigError),
+    /// The root capability could not be opened.
+    Io(std::io::Error),
+    /// The listener could not be bound.
+    Listener(String),
+}
+
+impl std::fmt::Display for ServerBuildError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Config(error) => write!(formatter, "invalid server configuration: {error}"),
+            Self::Io(error) => write!(formatter, "filesystem root could not be opened: {error}"),
+            Self::Listener(error) => write!(formatter, "HTTP listener could not be bound: {error}"),
+        }
+    }
+}
+
+impl std::error::Error for ServerBuildError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Config(error) => Some(error),
+            Self::Io(error) => Some(error),
+            Self::Listener(_) => None,
+        }
+    }
+}
+
+impl From<ConfigError> for ServerBuildError {
+    fn from(value: ConfigError) -> Self {
+        Self::Config(value)
+    }
+}
+
+impl From<std::io::Error> for ServerBuildError {
+    fn from(value: std::io::Error) -> Self {
+        Self::Io(value)
+    }
+}

crates/wip-fs-server/tests/end_to_end.rs

@@ -0,0 +1,586 @@
+use std::collections::BTreeMap;
+use std::io::{Read, Write};
+use std::net::{SocketAddr, TcpStream};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::{Duration, Instant};
+
+use tempfile::tempdir;
+use wip_fs_server::{AccessMode, ServerConfig, WipFsServer};
+use wip_http::{
+    ClientResponseError, DecodedResponse, Endpoint, JSON_CONTENT_TYPE, Limits, Route,
+    TransportFailureKind, decode_call_operation_response, decode_fetch_interface_response,
+    decode_observe_response, encode_call_operation_request, encode_fetch_interface_request,
+    encode_observe_request,
+};
+use wip_protocol::{
+    CallOperationRequest, FetchInterfaceRequest, InterfaceTarget, ObserveRequest,
+    ProtocolErrorCode, Target, Value,
+};
+
+#[test]
+fn real_listener_serves_three_core_interactions_and_write() {
+    let temporary = tempdir().expect("temporary root");
+    std::fs::write(temporary.path().join("hello.txt"), b"hello world").expect("write file");
+    std::fs::create_dir(temporary.path().join("nested")).expect("create directory");
+
+    let mut config = ServerConfig::for_root(temporary.path());
+    config.access = AccessMode::ReadWrite;
+    let limits = config.limits.wire;
+    let bound = Arc::new(
+        WipFsServer::new(config)
+            .expect("build server")
+            .bind()
+            .expect("bind"),
+    );
+    let address = bound.local_addr();
+    let shutdown = Arc::new(AtomicBool::new(false));
+    let worker = {
+        let bound = Arc::clone(&bound);
+        let shutdown = Arc::clone(&shutdown);
+        thread::spawn(move || bound.serve_until(shutdown))
+    };
+    let endpoint = Endpoint::parse(&format!("http://localhost:{}/wip", address.port()))
+        .expect("client endpoint");
+
+    let file_request = ObserveRequest {
+        path: "/hello.txt".into(),
+        depth: 0,
+    };
+    let response = exchange(
+        address,
+        encode_observe_request(&endpoint, &file_request, limits).expect("encode observation"),
+    );
+    let file = success(
+        decode_observe_response(&file_request, &response, limits).expect("decode observation"),
+    )
+    .object;
+    assert_eq!(file.name, "hello.txt");
+    assert_eq!(file.interfaces.len(), 2);
+    assert!(file.validator.is_some());
+
+    let tree_request = ObserveRequest {
+        path: "/".into(),
+        depth: 1,
+    };
+    let response = exchange(
+        address,
+        encode_observe_request(&endpoint, &tree_request, limits).expect("encode tree"),
+    );
+    let tree =
+        success(decode_observe_response(&tree_request, &response, limits).expect("decode tree"));
+    assert_eq!(
+        tree.children
+            .as_ref()
+            .expect("root children observed")
+            .len(),
+        2
+    );
+
+    let read_interface_request = FetchInterfaceRequest {
+        interface: file.interfaces[0].clone(),
+    };
+    let response = exchange(
+        address,
+        encode_fetch_interface_request(&endpoint, &read_interface_request, limits)
+            .expect("encode interface fetch"),
+    );
+    let read_interface = success(
+        decode_fetch_interface_response(&read_interface_request, &response, limits)
+            .expect("decode interface"),
+    );
+    assert_eq!(read_interface.descriptor.operations[0].name, "read");
+
+    let read_request = CallOperationRequest {
+        target: Target {
+            path: "/hello.txt".into(),
+            validator: file.validator.clone(),
+        },
+        interface: InterfaceTarget {
+            scope_ref: None,
+            reference: file.interfaces[0].clone(),
+            validator: None,
+        },
+        operation: "read".into(),
+        arguments: BTreeMap::from([
+            ("offset".into(), Value::Integer(6)),
+            ("length".into(), Value::Integer(5)),
+        ]),
+    };
+    let response = exchange(
+        address,
+        encode_call_operation_request(&endpoint, &read_request, &read_interface.descriptor, limits)
+            .expect("encode read call"),
+    );
+    let read = success(
+        decode_call_operation_response(
+            &read_request,
+            &read_interface.descriptor,
+            &response,
+            limits,
+        )
+        .expect("decode read call"),
+    );
+    assert_eq!(read.result, Value::Bytes(b"world".to_vec()));
+
+    let write_interface_request = FetchInterfaceRequest {
+        interface: file.interfaces[1].clone(),
+    };
+    let response = exchange(
+        address,
+        encode_fetch_interface_request(&endpoint, &write_interface_request, limits)
+            .expect("encode write interface fetch"),
+    );
+    let write_interface = success(
+        decode_fetch_interface_response(&write_interface_request, &response, limits)
+            .expect("decode write interface"),
+    );
+    let write_request = CallOperationRequest {
+        target: Target {
+            path: "/hello.txt".into(),
+            validator: file.validator,
+        },
+        interface: InterfaceTarget {
+            scope_ref: None,
+            reference: file.interfaces[1].clone(),
+            validator: None,
+        },
+        operation: "replace".into(),
+        arguments: BTreeMap::from([("contents".into(), Value::Bytes(b"updated".to_vec()))]),
+    };
+    let response = exchange(
+        address,
+        encode_call_operation_request(
+            &endpoint,
+            &write_request,
+            &write_interface.descriptor,
+            limits,
+        )
+        .expect("encode write call"),
+    );
+    let write = success(
+        decode_call_operation_response(
+            &write_request,
+            &write_interface.descriptor,
+            &response,
+            limits,
+        )
+        .expect("decode write call"),
+    );
+    assert!(write.validator.is_some());
+    assert_eq!(
+        std::fs::read(temporary.path().join("hello.txt")).expect("read updated file"),
+        b"updated"
+    );
+
+    shutdown.store(true, Ordering::Release);
+    worker
+        .join()
+        .expect("join listener")
+        .expect("listener exits cleanly");
+}
+
+#[test]
+fn real_listener_keeps_route_method_and_malformed_body_boundaries_distinct() {
+    let temporary = tempdir().expect("temporary root");
+    let mut config = ServerConfig::for_root(temporary.path());
+    config.limits.wire = Limits::new(64, 4_096, 64).expect("wire limits");
+    let bound = Arc::new(
+        WipFsServer::new(config)
+            .expect("build server")
+            .bind()
+            .expect("bind"),
+    );
+    let address = bound.local_addr();
+    let shutdown = Arc::new(AtomicBool::new(false));
+    let worker = {
+        let bound = Arc::clone(&bound);
+        let shutdown = Arc::clone(&shutdown);
+        thread::spawn(move || bound.serve_until(shutdown))
+    };
+
+    for uri in [
+        "/wip/v1/unknown",
+        "/wip/v1/batch",
+        "/wip/v1/observe?unexpected=true",
+        "/wip/v1/observe/extra",
+    ] {
+        let response = exchange(address, json_request(http::Method::POST, uri, b"{}"));
+        assert_eq!(response.status(), http::StatusCode::NOT_FOUND);
+        assert!(response.body().is_empty());
+        assert!(!response.headers().contains_key(http::header::CONTENT_TYPE));
+        assert!(!response.headers().contains_key(http::header::ALLOW));
+    }
+
+    let wrong_method = exchange(
+        address,
+        json_request(http::Method::GET, "/wip/v1/observe", b""),
+    );
+    assert_eq!(wrong_method.status(), http::StatusCode::METHOD_NOT_ALLOWED);
+    assert_eq!(wrong_method.headers()[http::header::ALLOW], "POST");
+    assert!(wrong_method.body().is_empty());
+    assert!(
+        !wrong_method
+            .headers()
+            .contains_key(http::header::CONTENT_TYPE)
+    );
+
+    let mut unsupported_coding = json_request(
+        http::Method::POST,
+        "/wip/v1/observe",
+        br#"{"path":"/","depth":0}"#,
+    );
+    unsupported_coding
+        .headers_mut()
+        .insert(http::header::CONTENT_ENCODING, "gzip".parse().unwrap());
+    let unsupported_coding = exchange(address, unsupported_coding);
+    assert_eq!(
+        unsupported_coding.status(),
+        http::StatusCode::UNSUPPORTED_MEDIA_TYPE
+    );
+    assert!(unsupported_coding.body().is_empty());
+    assert!(
+        !unsupported_coding
+            .headers()
+            .contains_key(http::header::CONTENT_TYPE)
+    );
+
+    let malformed = exchange(
+        address,
+        json_request(http::Method::POST, "/wip/v1/observe", b"{"),
+    );
+    assert_eq!(malformed.status(), http::StatusCode::BAD_REQUEST);
+    assert_eq!(
+        malformed.headers()[http::header::CONTENT_TYPE],
+        JSON_CONTENT_TYPE
+    );
+    assert!(
+        std::str::from_utf8(malformed.body())
+            .expect("UTF-8 error envelope")
+            .contains("\"invalid_request\"")
+    );
+
+    let oversized = exchange(
+        address,
+        json_request(http::Method::POST, "/wip/v1/observe", &[b'x'; 65]),
+    );
+    assert_eq!(oversized.status(), http::StatusCode::PAYLOAD_TOO_LARGE);
+    assert!(oversized.body().is_empty());
+    assert!(!oversized.headers().contains_key(http::header::CONTENT_TYPE));
+
+    let mut header_only = TcpStream::connect(address).expect("connect header-only client");
+    header_only
+        .set_read_timeout(Some(Duration::from_secs(1)))
+        .expect("set header-only timeout");
+    write!(
+        header_only,
+        "POST /wip/v1/observe HTTP/1.1\r\nHost: localhost\r\nContent-Type: application/json\r\nContent-Length: 65\r\n\r\n"
+    )
+    .expect("write oversized request head");
+    header_only.flush().expect("flush oversized request head");
+    let mut raw = Vec::new();
+    header_only
+        .read_to_end(&mut raw)
+        .expect("read immediate limit response");
+    assert!(raw.starts_with(b"HTTP/1.1 413 "));
+    assert!(raw.ends_with(b"\r\n\r\n"));
+    assert!(
+        !raw.windows(b"resource_limit_exceeded".len())
+            .any(|window| { window == b"resource_limit_exceeded" })
+    );
+
+    shutdown.store(true, Ordering::Release);
+    worker
+        .join()
+        .expect("join listener")
+        .expect("listener exits cleanly");
+}
+
+#[test]
+fn raw_decoder_limits_are_transport_failures() {
+    let temporary = tempdir().expect("temporary root");
+    let mut config = ServerConfig::for_root(temporary.path());
+    config.limits.wire = Limits::new(4_096, 4_096, 8).expect("wire limits");
+    let server = WipFsServer::new(config).expect("build server");
+
+    let nested = br#"{"path":[[[[[[[[["/"]]]]]]]]],"depth":0}"#;
+    let response = server.handle_http(json_request(http::Method::POST, "/wip/v1/observe", nested));
+    assert_eq!(response.status(), http::StatusCode::PAYLOAD_TOO_LARGE);
+    assert!(response.body().is_empty());
+    assert!(!response.headers().contains_key(http::header::CONTENT_TYPE));
+}
+
+#[test]
+fn logical_observation_limit_remains_protocol_resource_failure() {
+    let temporary = tempdir().expect("temporary root");
+    let mut config = ServerConfig::for_root(temporary.path());
+    config.limits.max_observation_depth = 0;
+    let limits = config.limits.wire;
+    let server = WipFsServer::new(config).expect("build server");
+    let endpoint = Endpoint::parse("http://localhost/wip").expect("endpoint");
+    let request = ObserveRequest {
+        path: "/".into(),
+        depth: 1,
+    };
+
+    let response = server.handle_http(
+        encode_observe_request(&endpoint, &request, limits).expect("encode observation"),
+    );
+    assert_eq!(response.status(), http::StatusCode::UNPROCESSABLE_ENTITY);
+    assert!(matches!(
+        decode_observe_response(&request, &response, limits).expect("decode logical limit"),
+        DecodedResponse::ProtocolFailure {
+            error,
+            status_mismatch: None,
+        } if error.code == ProtocolErrorCode::ResourceLimitExceeded
+    ));
+}
+
+#[test]
+fn stalled_request_body_times_out_and_releases_the_only_worker() {
+    let temporary = tempdir().expect("temporary root");
+    let mut config = ServerConfig::for_root(temporary.path());
+    config.limits.max_concurrent_requests = 1;
+    config.limits.request_timeout = Duration::from_millis(200);
+    let limits = config.limits.wire;
+    let bound = Arc::new(
+        WipFsServer::new(config)
+            .expect("build server")
+            .bind()
+            .expect("bind"),
+    );
+    let address = bound.local_addr();
+    let shutdown = Arc::new(AtomicBool::new(false));
+    let worker = {
+        let bound = Arc::clone(&bound);
+        let shutdown = Arc::clone(&shutdown);
+        thread::spawn(move || bound.serve_until(shutdown))
+    };
+
+    let mut stalled = TcpStream::connect(address).expect("connect stalled client");
+    stalled
+        .set_read_timeout(Some(Duration::from_secs(1)))
+        .expect("set stalled read timeout");
+    write!(
+        stalled,
+        "POST /wip/v1/observe HTTP/1.1\r\nHost: localhost\r\nContent-Type: application/json\r\nAccept: application/json\r\nContent-Length: 100\r\n\r\n{{"
+    )
+    .expect("write partial request");
+    stalled.flush().expect("flush partial request");
+    thread::sleep(Duration::from_millis(25));
+
+    let endpoint = Endpoint::parse(&format!("http://localhost:{}/wip", address.port()))
+        .expect("client endpoint");
+    let observe = ObserveRequest {
+        path: "/".into(),
+        depth: 0,
+    };
+    let started = Instant::now();
+    let response = exchange(
+        address,
+        encode_observe_request(&endpoint, &observe, limits).expect("encode observation"),
+    );
+    let _root =
+        success(decode_observe_response(&observe, &response, limits).expect("decode observation"));
+    assert!(
+        started.elapsed() < Duration::from_secs(1),
+        "the valid request remained starved after the intake deadline"
+    );
+
+    let mut byte = [0_u8; 1];
+    match stalled.read(&mut byte) {
+        Ok(0) => {}
+        Err(error)
+            if matches!(
+                error.kind(),
+                std::io::ErrorKind::ConnectionReset
+                    | std::io::ErrorKind::ConnectionAborted
+                    | std::io::ErrorKind::BrokenPipe
+            ) => {}
+        outcome => panic!("stalled connection was not closed after its deadline: {outcome:?}"),
+    }
+
+    shutdown.store(true, Ordering::Release);
+    worker
+        .join()
+        .expect("join listener")
+        .expect("listener exits cleanly");
+}
+
+#[test]
+fn call_argument_decoding_does_not_mask_missing_target() {
+    let temporary = tempdir().expect("temporary root");
+    let config = ServerConfig::for_root(temporary.path());
+    let server = WipFsServer::new(config).expect("build server");
+    let endpoint = Endpoint::parse("http://localhost/wip").expect("endpoint");
+    let body = br#"{"target":{"path":"/missing"},"interface":{"reference":{"scope":"/","name":"unknown"}},"operation":"missing","arguments":{"bytes":"not-base64"}}"#;
+    let request = http::Request::builder()
+        .method(http::Method::POST)
+        .uri(endpoint.route(Route::CallOperation).as_str())
+        .header(http::header::CONTENT_TYPE, JSON_CONTENT_TYPE)
+        .header(http::header::ACCEPT, "application/json")
+        .body(body.to_vec())
+        .expect("build request");
+    let response = server.handle_http(request);
+    assert_eq!(response.status(), http::StatusCode::NOT_FOUND);
+    assert!(
+        std::str::from_utf8(response.body())
+            .expect("UTF-8 error")
+            .contains("\"not_found\"")
+    );
+}
+
+#[test]
+fn backend_invalid_unicode_path_is_not_found_not_internal() {
+    let temporary = tempdir().expect("temporary root");
+    let config = ServerConfig::for_root(temporary.path());
+    let limits = config.limits.wire;
+    let server = WipFsServer::new(config).expect("build server");
+    let endpoint = Endpoint::parse("http://localhost/wip").expect("endpoint");
+    let request = ObserveRequest {
+        path: "/bad\0name".into(),
+        depth: 0,
+    };
+    let response = server.handle_http(
+        encode_observe_request(&endpoint, &request, limits).expect("encode observation"),
+    );
+    assert_eq!(response.status(), http::StatusCode::NOT_FOUND);
+    match decode_observe_response(&request, &response, limits).expect("decode missing response") {
+        DecodedResponse::ProtocolFailure { error, .. } => {
+            assert_eq!(error.code, ProtocolErrorCode::NotFound);
+        }
+        DecodedResponse::Success(_) => panic!("backend-invalid path must not resolve"),
+    }
+}
+
+#[test]
+fn read_response_size_failure_is_transport_local() {
+    let temporary = tempdir().expect("temporary root");
+    std::fs::write(temporary.path().join("large"), vec![b'x'; 2_000]).expect("write file");
+    let mut config = ServerConfig::for_root(temporary.path());
+    config.limits.wire = Limits::new(4_096, 1_024, 64).expect("wire limits");
+    let limits = config.limits.wire;
+    let server = WipFsServer::new(config).expect("build server");
+    let endpoint = Endpoint::parse("http://localhost/wip").expect("endpoint");
+
+    let observe_request = ObserveRequest {
+        path: "/large".into(),
+        depth: 0,
+    };
+    let response = server.handle_http(
+        encode_observe_request(&endpoint, &observe_request, limits).expect("encode observation"),
+    );
+    let file = success(
+        decode_observe_response(&observe_request, &response, limits).expect("decode observation"),
+    )
+    .object;
+    let interface_request = FetchInterfaceRequest {
+        interface: file.interfaces[0].clone(),
+    };
+    let response = server.handle_http(
+        encode_fetch_interface_request(&endpoint, &interface_request, limits)
+            .expect("encode interface fetch"),
+    );
+    let interface = success(
+        decode_fetch_interface_response(&interface_request, &response, limits)
+            .expect("decode interface"),
+    );
+    let call = CallOperationRequest {
+        target: Target {
+            path: "/large".into(),
+            validator: file.validator,
+        },
+        interface: InterfaceTarget {
+            scope_ref: None,
+            reference: file.interfaces[0].clone(),
+            validator: None,
+        },
+        operation: "read".into(),
+        arguments: BTreeMap::from([("length".into(), Value::Integer(1_500))]),
+    };
+    let response = server.handle_http(
+        encode_call_operation_request(&endpoint, &call, &interface.descriptor, limits)
+            .expect("encode read call"),
+    );
+    assert_eq!(response.status(), http::StatusCode::INTERNAL_SERVER_ERROR);
+    assert!(response.body().is_empty());
+    assert!(!response.headers().contains_key(http::header::CONTENT_TYPE));
+    assert!(matches!(
+        decode_call_operation_response(&call, &interface.descriptor, &response, limits)
+            .expect_err("oversized representation is not a protocol failure"),
+        ClientResponseError::TransportBinding(failure)
+            if failure.status == http::StatusCode::INTERNAL_SERVER_ERROR
+                && failure.kind == TransportFailureKind::HttpStatus
+    ));
+}
+
+fn success<T>(response: DecodedResponse<T>) -> T {
+    match response {
+        DecodedResponse::Success(value) => value,
+        DecodedResponse::ProtocolFailure { error, .. } => panic!("protocol failure: {error}"),
+    }
+}
+
+fn json_request(method: http::Method, uri: &str, body: &[u8]) -> http::Request<Vec<u8>> {
+    http::Request::builder()
+        .method(method)
+        .uri(uri)
+        .header(http::header::CONTENT_TYPE, JSON_CONTENT_TYPE)
+        .header(http::header::ACCEPT, "application/json")
+        .body(body.to_vec())
+        .expect("build JSON request")
+}
+
+fn exchange(address: SocketAddr, request: http::Request<Vec<u8>>) -> http::Response<Vec<u8>> {
+    let mut stream = TcpStream::connect(address).expect("connect listener");
+    stream
+        .set_read_timeout(Some(Duration::from_secs(5)))
+        .expect("set read timeout");
+    let path = request
+        .uri()
+        .path_and_query()
+        .map_or("/", |value| value.as_str());
+    write!(
+        stream,
+        "{} {} HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n",
+        request.method(),
+        path
+    )
+    .expect("write request line");
+    for (name, value) in request.headers() {
+        write!(
+            stream,
+            "{}: {}\r\n",
+            name,
+            value.to_str().expect("ASCII request header")
+        )
+        .expect("write header");
+    }
+    write!(stream, "Content-Length: {}\r\n\r\n", request.body().len())
+        .expect("write content length");
+    stream.write_all(request.body()).expect("write body");
+    stream.flush().expect("flush request");
+
+    let mut raw = Vec::new();
+    stream.read_to_end(&mut raw).expect("read response");
+    let split = raw
+        .windows(4)
+        .position(|window| window == b"\r\n\r\n")
+        .expect("HTTP response header");
+    let head = std::str::from_utf8(&raw[..split]).expect("UTF-8 response head");
+    let mut lines = head.split("\r\n");
+    let status = lines
+        .next()
+        .and_then(|line| line.split_whitespace().nth(1))
+        .and_then(|status| status.parse::<u16>().ok())
+        .expect("response status");
+    let mut builder = http::Response::builder().status(status);
+    for line in lines {
+        let (name, value) = line.split_once(':').expect("response header");
+        builder = builder.header(name, value.trim());
+    }
+    builder
+        .body(raw[split + 4..].to_vec())
+        .expect("build response")
+}

crates/wip-fs-server/tests/support/scoped.rs

@@ -0,0 +1,456 @@
+//! External non-root scope regression coverage, sharing the memory backend.
+use super::*;
+
+struct ScopedObject {
+    inner: Object,
+    reference: Option<String>,
+}
+impl WipObject for ScopedObject {
+    fn name(&self) -> &str {
+        self.inner.name()
+    }
+    fn reference(&self) -> Option<&str> {
+        self.reference.as_deref()
+    }
+    fn validator(&self) -> Option<&Validator> {
+        self.inner.validator()
+    }
+    fn requires_validator(&self, _: &InterfaceRef, operation: &str) -> bool {
+        operation == "read"
+    }
+}
+impl FileRead for ScopedObject {
+    fn read(&self, offset: Option<u64>, length: Option<u64>) -> wip::OperationResult<wip::Bytes> {
+        FileRead::read(&self.inner, offset, length)
+    }
+}
+struct ScopedComposition {
+    shared: Arc<Shared>,
+    associations: BTreeMap<String, (Arc<Node>, Scope)>,
+    interfaces: Vec<RegisteredInterface<wip_fs_server::FileReadDefinition>>,
+    with_refs: bool,
+}
+impl Composition<Entry> for ScopedComposition {
+    type Object = ScopedObject;
+    fn scope(
+        &self,
+        path: &str,
+        entry: &Entry,
+        context: &ExecutionContext,
+    ) -> Result<Option<Scope>, HostError> {
+        assert!(matches!(
+            self.shared.transaction.try_lock(),
+            Err(TryLockError::WouldBlock)
+        ));
+        assert_eq!(path, entry.path);
+        self.shared.record("scope", path, context);
+        assert_eq!(
+            entry.validator,
+            Entry::snapshot(entry.path.clone(), entry.node.clone()).validator
+        );
+        let nodes = self.shared.nodes.lock().unwrap();
+        // Self-scope also requires current membership; ordinary pinned-leaf
+        // execution intentionally need not check its path mapping.
+        Ok(self.associations.get(path).and_then(|(identity, scope)| {
+            (Arc::ptr_eq(identity, &entry.node)
+                && nodes
+                    .get(path)
+                    .is_some_and(|node| Arc::ptr_eq(node, identity)))
+            .then(|| scope.clone())
+        }))
+    }
+    fn publish(
+        &self,
+        entry: Entry,
+        context: &ExecutionContext,
+    ) -> Result<PublishedObject<ScopedObject>, HostError> {
+        assert!(matches!(
+            self.shared.transaction.try_lock(),
+            Err(TryLockError::WouldBlock)
+        ));
+        self.shared.record("scoped_publish", &entry.path, context);
+        let path = entry.path.clone();
+        let regular = entry.kind() == EntryKind::Regular;
+        let reference = self
+            .with_refs
+            .then(|| format!("published-object-{}", entry.node.id));
+        let mut publication = PublishedObject::new(ScopedObject {
+            inner: Object {
+                entry,
+                custom: self.interfaces[0].reference().clone(),
+                shared: self.shared.clone(),
+                context: context.clone(),
+            },
+            reference,
+        });
+        // Containers expose no interfaces but remain valid fetch subjects.
+        if regular {
+            for interface in &self.interfaces {
+                if interface
+                    .reference()
+                    .protocol_reference()
+                    .validate_for_path(&path)
+                    .is_ok()
+                {
+                    publication = publication.expose(interface).unwrap();
+                }
+            }
+        }
+        Ok(publication)
+    }
+}
+struct ScopedPolicy;
+impl ProjectionPolicy<Entry, ScopedObject> for ScopedPolicy {
+    type Principal = Principal;
+    fn object_visible(&self, principal: &Principal, entry: &Entry) -> bool {
+        !entry.hidden && (!matches!(principal, Principal::Limited) || entry.path != "/secret")
+    }
+    fn interface_visible(&self, principal: &Principal, interface: &InterfaceRef) -> bool {
+        !(matches!(principal, Principal::Limited)
+            && interface.protocol_reference().scope == "/added")
+    }
+}
+type ScopedEngine = Projection<MemoryBackend, ScopedComposition, ScopedPolicy>;
+fn scoped_engine(shared: Arc<Shared>, with_refs: bool) -> ScopedEngine {
+    configured_engine(shared, with_refs, None)
+}
+fn configured_engine(
+    shared: Arc<Shared>,
+    with_refs: bool,
+    interface_validator: Option<Validator>,
+) -> ScopedEngine {
+    let mut registry = InterfaceRegistry::new();
+    let mut associations = BTreeMap::new();
+    let mut interfaces = Vec::new();
+    for path in ["/", "/secret", "/secret/nested", "/added"] {
+        let scope = Scope::new(path).unwrap();
+        let validator = if path == "/secret" {
+            interface_validator.clone()
+        } else {
+            None
+        };
+        interfaces.push(
+            registry
+                .register(
+                    &scope,
+                    "file.read",
+                    wip_fs_server::FileReadDefinition,
+                    validator,
+                )
+                .unwrap(),
+        );
+        associations.insert(path.into(), (shared.node(path), scope));
+    }
+    Projection::new(
+        MemoryBackend::new(shared.clone()),
+        registry,
+        ScopedComposition {
+            shared,
+            associations,
+            interfaces,
+            with_refs,
+        },
+        ScopedPolicy,
+        ResourceLimits::default(),
+    )
+}
+fn reference(scope: &str) -> wip_protocol::InterfaceReference {
+    wip_protocol::InterfaceReference {
+        scope: scope.into(),
+        name: "file.read".into(),
+    }
+}
+fn request(path: &str, scope: &str, scope_ref: Option<String>) -> CallOperationRequest {
+    CallOperationRequest {
+        target: Target {
+            path: path.into(),
+            validator: None,
+        },
+        interface: InterfaceTarget {
+            reference: reference(scope),
+            scope_ref,
+            validator: None,
+        },
+        operation: "read".into(),
+        arguments: BTreeMap::new(),
+    }
+}
+
+#[test]
+fn nonroot_observe_fetch_call_with_optional_refs_over_http() {
+    for with_refs in [false, true] {
+        let fixture = Fixture::new();
+        let engine = scoped_engine(fixture.shared.clone(), with_refs);
+        let view = engine.view(&Principal::Admin);
+        let limits = ResourceLimits::default();
+        let endpoint = Endpoint::parse("https://example.test/scopes").unwrap();
+        let adapter = HttpAdapter::new(&view, &endpoint, limits);
+        for (path, scope) in [("/secret/nested/data", "/secret"), ("/added", "/added")] {
+            let observe = observe_request(path, 0);
+            let response = adapter.handle_http_with_context(
+                encode_observe_request(&endpoint, &observe, limits.wire).unwrap(),
+                &ExecutionContext::new(),
+            );
+            let DecodedResponse::Success(observed) =
+                decode_observe_response(&observe, &response, limits.wire).unwrap()
+            else {
+                panic!("observation must succeed");
+            };
+            assert!(observed.object.interfaces.contains(&reference(scope)));
+            let fetch = fetch_request(&reference(scope));
+            let response = adapter.handle_http_with_context(
+                encode_fetch_interface_request(&endpoint, &fetch, limits.wire).unwrap(),
+                &ExecutionContext::new(),
+            );
+            let DecodedResponse::Success(fetched) =
+                decode_fetch_interface_response(&fetch, &response, limits.wire).unwrap()
+            else {
+                panic!("fetch must succeed");
+            };
+            assert_eq!(
+                fetched.scope_ref,
+                with_refs.then(|| format!("published-object-{}", fixture.shared.node(scope).id))
+            );
+            let mut call = request(path, scope, fetched.scope_ref);
+            call.target.validator = observed.object.validator;
+            let response = adapter.handle_http_with_context(
+                encode_call_operation_request(&endpoint, &call, &fetched.descriptor, limits.wire)
+                    .unwrap(),
+                &ExecutionContext::new(),
+            );
+            let DecodedResponse::Success(result) =
+                decode_call_operation_response(&call, &fetched.descriptor, &response, limits.wire)
+                    .unwrap()
+            else {
+                panic!("call must succeed");
+            };
+            assert_eq!(result.result, Value::Bytes(b"hello memory".to_vec()));
+            if !with_refs {
+                call.interface.scope_ref = Some("ref-not-provided-by-publication".into());
+                assert_eq!(
+                    view.call_operation(call).unwrap_err().kind(),
+                    wip_host::CallErrorKind::InterfaceMismatch
+                );
+            }
+        }
+        assert!(
+            view.observe_object("/secret")
+                .unwrap()
+                .interfaces
+                .is_empty()
+        );
+        assert_eq!(
+            view.observe_object("/secret/nested/data")
+                .unwrap()
+                .interfaces,
+            [
+                reference("/"),
+                reference("/secret"),
+                reference("/secret/nested")
+            ]
+        );
+        let limited = engine.view(&Principal::Limited);
+        for scope in ["/secret", "/secret/nested", "/added"] {
+            assert_eq!(
+                limited
+                    .fetch_interface(&fetch_request(&reference(scope)))
+                    .unwrap_err()
+                    .code,
+                ProtocolErrorCode::InterfaceNotFound
+            );
+        }
+        assert_eq!(
+            limited
+                .observe_object("/secret/nested/data")
+                .unwrap_err()
+                .kind(),
+            wip_host::CallErrorKind::NotFound
+        );
+        assert!(
+            !limited
+                .observe_object("/added")
+                .unwrap()
+                .interfaces
+                .contains(&reference("/added"))
+        );
+    }
+}
+
+#[test]
+fn scope_refs_and_object_validator_precedence_use_current_atomic_lineage() {
+    let fixture = Fixture::new();
+    let engine = scoped_engine(fixture.shared.clone(), true);
+    let view = engine.view(&Principal::Admin);
+    let mut call = request("/secret/nested/data", "/secret", Some("stale".into()));
+    call.target.validator = Some(vec![0]);
+    assert_eq!(
+        view.call_operation(call.clone()).unwrap_err().kind(),
+        wip_host::CallErrorKind::ValidatorMismatch
+    );
+    call.target.validator = view.observe_object(&call.target.path).unwrap().validator;
+    assert_eq!(
+        view.call_operation(call.clone()).unwrap_err().kind(),
+        wip_host::CallErrorKind::InterfaceMismatch
+    );
+    call.interface.scope_ref = view
+        .fetch_interface(&fetch_request(&call.interface.reference))
+        .unwrap()
+        .scope_ref;
+    // Scope state changes do not retire its lifetime; the published ref is not
+    // its validator, and the hook runs on refreshed metadata under the lock.
+    fixture.shared.controls.lock().unwrap().bump_ancestor = Some("/secret".into());
+    fixture.shared.seen.lock().unwrap().clear();
+    view.call_operation(call).unwrap();
+    let seen = fixture.shared.seen.lock().unwrap();
+    let resolves: Vec<_> = seen
+        .iter()
+        .filter(|event| event.stage == "resolve")
+        .map(|event| event.path.as_str())
+        .collect();
+    assert_eq!(resolves, ["/secret/nested/data"]);
+    assert!(
+        seen.iter()
+            .any(|event| event.stage == "scope" && event.path == "/secret")
+    );
+}
+
+#[test]
+fn nonroot_interface_validator_checks_follow_scope_ref_checks() {
+    let fixture = Fixture::new();
+    let engine = configured_engine(fixture.shared.clone(), true, Some(Validator::new(vec![7])));
+    let view = engine.view(&Principal::Admin);
+    let fetched = view
+        .fetch_interface(&fetch_request(&reference("/secret")))
+        .unwrap();
+    assert_eq!(fetched.validator, Some(vec![7]));
+    let mut call = request("/secret/nested/data", "/secret", Some("stale".into()));
+    call.target.validator = view.observe_object(&call.target.path).unwrap().validator;
+    assert_eq!(
+        view.call_operation(call.clone()).unwrap_err().kind(),
+        wip_host::CallErrorKind::InterfaceMismatch
+    );
+    call.interface.scope_ref = fetched.scope_ref;
+    assert_eq!(
+        view.call_operation(call.clone()).unwrap_err().kind(),
+        wip_host::CallErrorKind::InterfaceValidatorRequired
+    );
+    call.interface.validator = Some(vec![8]);
+    assert_eq!(
+        view.call_operation(call.clone()).unwrap_err().kind(),
+        wip_host::CallErrorKind::InterfaceValidatorMismatch
+    );
+    assert!(
+        fixture
+            .shared
+            .node(&call.target.path)
+            .calls
+            .lock()
+            .unwrap()
+            .is_empty()
+    );
+    call.interface.validator = fetched.validator;
+    view.call_operation(call).unwrap();
+}
+
+#[test]
+fn visibility_and_replacement_races_reject_before_dispatch() {
+    for replace in [false, true] {
+        let fixture = Fixture::new();
+        let engine = scoped_engine(fixture.shared.clone(), false);
+        let view = engine.view(&Principal::Admin);
+        let mut call = request("/secret/nested/data", "/secret", None);
+        call.target.validator = view.observe_object(&call.target.path).unwrap().validator;
+        let leaf = fixture.shared.node(&call.target.path);
+        if replace {
+            fixture.shared.controls.lock().unwrap().replace_ancestor = Some("/secret".into());
+        } else {
+            fixture.shared.controls.lock().unwrap().hide_ancestor = Some("/secret".into());
+        }
+        assert_eq!(
+            view.call_operation(call).unwrap_err().kind(),
+            wip_host::CallErrorKind::NotFound
+        );
+        assert!(leaf.calls.lock().unwrap().is_empty());
+        assert_eq!(
+            view.fetch_interface(&fetch_request(&reference("/secret")))
+                .unwrap_err()
+                .code,
+            ProtocolErrorCode::InterfaceNotFound
+        );
+    }
+}
+
+#[test]
+fn deletion_replacement_and_self_scope_do_not_reuse_registry_lifetimes() {
+    for with_refs in [false, true] {
+        let fixture = Fixture::new();
+        let engine = scoped_engine(fixture.shared.clone(), with_refs);
+        let view = engine.view(&Principal::Admin);
+        let old_scope = fixture.shared.node("/secret");
+        let old_ref = view
+            .fetch_interface(&fetch_request(&reference("/secret")))
+            .unwrap()
+            .scope_ref;
+        fixture.shared.nodes.lock().unwrap().remove("/secret");
+        assert_eq!(
+            view.fetch_interface(&fetch_request(&reference("/secret")))
+                .unwrap_err()
+                .code,
+            ProtocolErrorCode::InterfaceNotFound
+        );
+        // Reuse even the same id/public ref: refs cannot attest a lifetime.
+        fixture.shared.nodes.lock().unwrap().insert(
+            "/secret".into(),
+            Arc::new(Node {
+                id: old_scope.id,
+                kind: EntryKind::Directory,
+                data: Mutex::new(old_scope.data.lock().unwrap().clone()),
+                calls: Mutex::new(Vec::new()),
+            }),
+        );
+        assert_eq!(
+            view.fetch_interface(&fetch_request(&reference("/secret")))
+                .unwrap_err()
+                .code,
+            ProtocolErrorCode::InterfaceNotFound
+        );
+        let mut call = request("/secret/nested/data", "/secret", old_ref);
+        call.target.validator = view.observe_object(&call.target.path).unwrap().validator;
+        assert_eq!(
+            view.call_operation(call).unwrap_err().kind(),
+            wip_host::CallErrorKind::InterfaceMismatch
+        );
+        assert!(
+            fixture
+                .shared
+                .node("/secret/nested/data")
+                .calls
+                .lock()
+                .unwrap()
+                .is_empty()
+        );
+        // Fresh registration/engine attests the new publication.
+        let republished = scoped_engine(fixture.shared.clone(), with_refs);
+        republished
+            .view(&Principal::Admin)
+            .fetch_interface(&fetch_request(&reference("/secret")))
+            .unwrap();
+        // Scope == target: ordinary execution pins the old leaf, but cannot
+        // attest it as the current scope after its mapping is replaced.
+        let leaf = fixture.shared.node("/added");
+        let mut call = request("/added", "/added", None);
+        call.target.validator = view.observe_object("/added").unwrap().validator;
+        fixture.shared.controls.lock().unwrap().replace_mapping = true;
+        assert_eq!(
+            view.call_operation(call).unwrap_err().kind(),
+            wip_host::CallErrorKind::InterfaceMismatch
+        );
+        assert!(leaf.calls.lock().unwrap().is_empty());
+        assert_eq!(
+            view.fetch_interface(&fetch_request(&reference("/added")))
+                .unwrap_err()
+                .code,
+            ProtocolErrorCode::InterfaceNotFound
+        );
+    }
+}

crates/wip-host/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "wip-host"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+description = "Host-side object publication and operation dispatch for WIP"
+license.workspace = true
+repository.workspace = true
+readme = "README.md"
+documentation = "https://docs.rs/wip-host"
+
+[dependencies]
+wip-interface.workspace = true
+wip-protocol.workspace = true
+
+[dev-dependencies]
+trybuild = "1"

crates/wip-host/LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

crates/wip-host/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crates/wip-host/README.md

@@ -0,0 +1,19 @@
+# wip-host
+
+Framework-independent Host publication and operation dispatch for the Web Interface Protocol (WIP).
+
+`wip-host` registers generated interfaces, explicitly publishes them on request-scoped objects, validates object and interface preconditions, and performs interface-qualified operation dispatch against one host-owned instance. Backend transactions, persistence, and network serving remain application responsibilities.
+
+```toml
+[dependencies]
+wip-host = "0.1.0"
+wip-interface = "0.1.0"
+```
+
+Protocol publication and dispatch use `wip_protocol::InterfaceReference { scope, name }` and compare both fields exactly. The legacy `InterfaceRef` registration token remains Host-private: `protocol_reference()` maps its opaque string verbatim to the name at root scope `/`, without parsing it. Registry lookup and fetch accept structured references; non-root references do not resolve legacy registrations. Legacy responses omit `scope_ref`.
+
+Malformed interface-reference shapes fail calls as `InvalidRequest` before object resolution. A well-shaped reference outside the target path's ancestor-or-self scope fails at the membership check as `InterfaceMismatch`.
+
+See the [API documentation](https://docs.rs/wip-host) for publication, provider, execution-context, and effect-guarantee boundaries.
+
+Licensed under either of Apache-2.0 or MIT at your option.

crates/wip-host/tests/compile_fail.rs

@@ -0,0 +1,5 @@
+#[test]
+fn rejects_exposing_an_unimplemented_interface() {
+    let tests = trybuild::TestCases::new();
+    tests.compile_fail("tests/ui/unimplemented_interface.rs");
+}

crates/wip-host/tests/scope.rs

@@ -0,0 +1,560 @@
+use std::cell::{Cell, RefCell};
+use std::collections::BTreeMap;
+use std::rc::Rc;
+
+use wip_host::{
+    CallErrorKind, CallRequest, ExecutionContext, InterfaceRegistry, InterfaceTarget,
+    ObjectProvider, ProviderResult, PublishedObject, RegisteredInterface, RegistrationError, Scope,
+    ScopeObservation, Target, Validator, WipObject,
+};
+use wip_interface::{OperationResult, interface};
+use wip_protocol::{InterfaceReference, ProtocolErrorCode, Value};
+
+#[interface]
+pub trait Read {
+    fn read(&self, value: String) -> OperationResult<String>;
+}
+
+#[interface]
+pub trait Count {
+    fn read(&self, value: i64) -> OperationResult<i64>;
+}
+
+#[derive(Clone)]
+struct Metadata {
+    name: String,
+    reference: Option<String>,
+    validator: Option<Validator>,
+}
+impl WipObject for Metadata {
+    fn name(&self) -> &str {
+        &self.name
+    }
+    fn reference(&self) -> Option<&str> {
+        self.reference.as_deref()
+    }
+    fn validator(&self) -> Option<&Validator> {
+        self.validator.as_ref()
+    }
+}
+
+type OnStart = Rc<RefCell<Option<Box<dyn Fn()>>>>;
+
+struct Implementation {
+    metadata: Metadata,
+    calls: Rc<Cell<usize>>,
+    on_start: OnStart,
+}
+impl WipObject for Implementation {
+    fn name(&self) -> &str {
+        self.metadata.name()
+    }
+    fn reference(&self) -> Option<&str> {
+        self.metadata.reference()
+    }
+    fn validator(&self) -> Option<&Validator> {
+        self.metadata.validator()
+    }
+}
+impl Read for Implementation {
+    fn read(&self, value: String) -> OperationResult<String> {
+        self.calls.set(self.calls.get() + 1);
+        if let Some(action) = self.on_start.borrow_mut().take() {
+            action();
+        }
+        Ok(value)
+    }
+}
+
+struct Provider {
+    interface: RegisteredInterface<ReadDefinition>,
+    current: Rc<RefCell<Option<(Scope, Metadata)>>>,
+    target_path: String,
+    target_exists: Cell<bool>,
+    member: Cell<bool>,
+    calls: Rc<Cell<usize>>,
+    resolutions: Cell<usize>,
+    on_start: OnStart,
+}
+impl Provider {
+    fn new(
+        scope: &Scope,
+        interface: RegisteredInterface<ReadDefinition>,
+        target: &str,
+        reference: Option<&str>,
+    ) -> Self {
+        Self {
+            interface,
+            current: Rc::new(RefCell::new(Some((
+                scope.clone(),
+                Metadata {
+                    name: scope.path().rsplit('/').next().unwrap().into(),
+                    reference: reference.map(str::to_owned),
+                    validator: Some(Validator::new(b"scope-state-v1")),
+                },
+            )))),
+            target_path: target.into(),
+            target_exists: Cell::new(true),
+            member: Cell::new(true),
+            calls: Rc::new(Cell::new(0)),
+            resolutions: Cell::new(0),
+            on_start: Rc::new(RefCell::new(None)),
+        }
+    }
+    fn request(&self, scope_ref: Option<&str>) -> CallRequest {
+        CallRequest {
+            target: Target {
+                path: self.target_path.clone(),
+                validator: None,
+            },
+            interface: InterfaceTarget {
+                reference: self.interface.reference().protocol_reference(),
+                scope_ref: scope_ref.map(str::to_owned),
+                validator: Some(b"descriptor-v1".to_vec()),
+            },
+            operation: "read".into(),
+            arguments: BTreeMap::from([("value".into(), Value::String("original backend".into()))]),
+        }
+    }
+}
+impl ObjectProvider for Provider {
+    type Object = Implementation;
+    fn with_object<R>(
+        &self,
+        _: &ExecutionContext,
+        path: &str,
+        callback: impl FnOnce(&PublishedObject<Self::Object>) -> R,
+    ) -> ProviderResult<R> {
+        self.resolutions.set(self.resolutions.get() + 1);
+        // A single boundary captures both the target and the live scope association.
+        let current = self.current.borrow().clone();
+        let target = path == self.target_path;
+        let metadata = if target {
+            if !self.target_exists.get() {
+                return ProviderResult::NotFound;
+            }
+            if let Some((scope, object)) = &current
+                && scope.path() == path
+            {
+                object.clone()
+            } else {
+                Metadata {
+                    name: path.rsplit('/').next().unwrap().into(),
+                    reference: None,
+                    validator: Some(Validator::new(b"target-v1")),
+                }
+            }
+        } else if let Some((scope, object)) = &current {
+            if path != scope.path() {
+                return ProviderResult::NotFound;
+            }
+            object.clone()
+        } else {
+            return ProviderResult::NotFound;
+        };
+        let mut publication = PublishedObject::new(Implementation {
+            metadata,
+            calls: self.calls.clone(),
+            on_start: self.on_start.clone(),
+        });
+        if target && self.member.get() {
+            publication = publication.expose(&self.interface).unwrap();
+        }
+        if let Some((scope, object)) = current {
+            publication = publication.bind_scope(ScopeObservation::new(&scope, &object));
+        }
+        ProviderResult::Found(callback(&publication))
+    }
+}
+fn setup(
+    scope: &str,
+    target: &str,
+    reference: Option<&str>,
+) -> (InterfaceRegistry, Scope, Provider) {
+    let scope = Scope::new(scope).unwrap();
+    let mut registry = InterfaceRegistry::new();
+    let interface = registry
+        .register(
+            &scope,
+            "read::#日本語",
+            ReadDefinition,
+            Some(Validator::new(b"descriptor-v1")),
+        )
+        .unwrap();
+    let provider = Provider::new(&scope, interface, target, reference);
+    (registry, scope, provider)
+}
+
+#[test]
+fn registrations_use_scope_name_not_definition_type_or_delimiters() {
+    let mut registry = InterfaceRegistry::new();
+    let left = Scope::new("/left").unwrap();
+    let right = Scope::new("/right").unwrap();
+    let a = registry
+        .register(&left, "read::#日本語", ReadDefinition, None)
+        .unwrap();
+    let b = registry
+        .register(&right, "read::#日本語", ReadDefinition, None)
+        .unwrap();
+    assert_ne!(a.reference(), b.reference());
+    assert_eq!(
+        a.reference().protocol_reference(),
+        InterfaceReference {
+            scope: "/left".into(),
+            name: "read::#日本語".into(),
+        }
+    );
+    assert!(matches!(
+        registry.register(&left, "read::#日本語", CountDefinition, None),
+        Err(RegistrationError::AlreadyRegistered)
+    ));
+    assert!(matches!(
+        registry.register(&left, "", ReadDefinition, None),
+        Err(RegistrationError::InvalidReference(_))
+    ));
+    assert!(Scope::new("/invalid/").is_err());
+    registry
+        .register(&left, "another", ReadDefinition, None)
+        .unwrap();
+}
+
+#[test]
+fn self_root_ancestor_and_membership_are_independent() {
+    for (scope, target) in [
+        ("/", "/"),
+        ("/", "/target"),
+        ("/scope", "/scope"),
+        ("/scope", "/scope/target"),
+    ] {
+        let (registry, _, provider) = setup(scope, target, Some("scope-id"));
+        assert_eq!(
+            provider
+                .call_operation(provider.request(Some("scope-id")))
+                .unwrap()
+                .result,
+            Value::String("original backend".into())
+        );
+        assert_eq!(
+            provider
+                .fetch_interface(&registry, &provider.request(None).interface.reference)
+                .unwrap()
+                .scope_ref
+                .as_deref(),
+            Some("scope-id")
+        );
+        provider.member.set(false);
+        assert_eq!(
+            provider
+                .call_operation(provider.request(None))
+                .unwrap_err()
+                .kind(),
+            CallErrorKind::InterfaceMismatch
+        );
+    }
+    // Non-self scope Objects need not implement or expose any Interface.
+    let (registry, _, provider) = setup("/scope", "/scope/target", None);
+    assert!(
+        provider
+            .observe_object("/scope")
+            .unwrap()
+            .interfaces
+            .is_empty()
+    );
+    provider
+        .fetch_interface(&registry, &provider.request(None).interface.reference)
+        .unwrap();
+    for target in ["/sibling/target", "/scopelong", "/"] {
+        let (_, _, provider) = setup("/scope", target, None);
+        assert_eq!(
+            provider
+                .call_operation(provider.request(None))
+                .unwrap_err()
+                .kind(),
+            CallErrorKind::InterfaceMismatch
+        );
+        assert_eq!(provider.calls.get(), 0);
+        assert_eq!(
+            provider.observe_object(target).unwrap_err().kind(),
+            CallErrorKind::Internal
+        );
+    }
+}
+
+#[test]
+fn optional_scope_ref_and_state_validator_have_distinct_responsibilities() {
+    for current in [Some("scope-id"), None, Some("")] {
+        let (registry, _, provider) = setup("/scope", "/scope/target", current);
+        let observation = provider
+            .fetch_interface(&registry, &provider.request(None).interface.reference)
+            .unwrap();
+        assert_eq!(
+            observation
+                .protocol_response()
+                .unwrap()
+                .scope_ref
+                .as_deref(),
+            current
+        );
+        assert_eq!(
+            observation.validator,
+            Some(Validator::new(b"descriptor-v1"))
+        );
+        provider.call_operation(provider.request(None)).unwrap();
+        if let Some(reference) = current {
+            provider
+                .call_operation(provider.request(Some(reference)))
+                .unwrap();
+        }
+        let before = provider.calls.get();
+        for supplied in ["other", "missing"] {
+            let mut call = provider.request(Some(supplied));
+            call.interface.validator = None;
+            call.operation = "missing".into();
+            assert_eq!(
+                provider.call_operation(call).unwrap_err().kind(),
+                CallErrorKind::InterfaceMismatch
+            );
+        }
+        assert_eq!(provider.calls.get(), before);
+        provider.current.borrow_mut().as_mut().unwrap().1.validator =
+            Some(Validator::new(b"scope-state-v2"));
+        provider.call_operation(provider.request(current)).unwrap();
+        assert_eq!(
+            provider
+                .fetch_interface(&registry, &provider.request(None).interface.reference)
+                .unwrap(),
+            observation
+        );
+    }
+}
+
+#[test]
+fn scope_precondition_is_membership_stage_in_both_dispatch_paths() {
+    let (_, _, provider) = setup("/scope", "/scope/target", Some("current"));
+    let mut call = provider.request(Some("stale"));
+    call.target.validator = Some(b"wrong".to_vec());
+    assert_eq!(
+        provider.call_operation(call.clone()).unwrap_err().kind(),
+        CallErrorKind::ValidatorMismatch
+    );
+    provider.target_exists.set(false);
+    assert_eq!(
+        provider.call_operation(call).unwrap_err().kind(),
+        CallErrorKind::NotFound
+    );
+    provider.target_exists.set(true);
+    let call = provider.request(Some("stale"));
+    assert_eq!(
+        provider
+            .call_operation_with_context_and_decoder(
+                &ExecutionContext::new(),
+                call.target,
+                call.interface,
+                call.operation,
+                |_| -> Result<BTreeMap<String, Value>, ()> { panic!("decoder must not run") }
+            )
+            .unwrap_err()
+            .kind(),
+        CallErrorKind::InterfaceMismatch
+    );
+    assert_eq!(provider.calls.get(), 0);
+}
+
+#[test]
+fn deletion_republication_and_movement_never_inherit_retained_artifacts() {
+    let (mut registry, scope, provider) = setup("/scope", "/scope/target", Some("old"));
+    let reference = provider.request(None).interface.reference;
+    provider.fetch_interface(&registry, &reference).unwrap();
+    *provider.current.borrow_mut() = None;
+    provider.target_exists.set(false);
+    assert_eq!(
+        provider
+            .fetch_interface(&registry, &reference)
+            .unwrap_err()
+            .code,
+        ProtocolErrorCode::InterfaceNotFound
+    );
+    assert_eq!(
+        provider
+            .call_operation(provider.request(None))
+            .unwrap_err()
+            .kind(),
+        CallErrorKind::NotFound
+    );
+    provider.target_exists.set(true);
+    // Even the same ref is not proof that a replacement inherits registration.
+    let replacement = Scope::new("/scope").unwrap();
+    *provider.current.borrow_mut() = Some((
+        replacement.clone(),
+        Metadata {
+            name: "scope".into(),
+            reference: Some("old".into()),
+            validator: None,
+        },
+    ));
+    assert_eq!(
+        provider
+            .fetch_interface(&registry, &reference)
+            .unwrap_err()
+            .code,
+        ProtocolErrorCode::InterfaceNotFound
+    );
+    assert_eq!(
+        provider
+            .call_operation(provider.request(Some("old")))
+            .unwrap_err()
+            .kind(),
+        CallErrorKind::InterfaceMismatch
+    );
+    registry.remove_scope(&scope);
+    assert!(matches!(
+        registry.register(&scope, "new", ReadDefinition, None),
+        Err(RegistrationError::RetiredScope)
+    ));
+    let fresh = registry
+        .register(&replacement, reference.name.clone(), ReadDefinition, None)
+        .unwrap();
+    provider.fetch_interface(&registry, &reference).unwrap();
+    // Old target membership still binds the old lifetime, even after new publication.
+    assert_eq!(
+        provider
+            .call_operation(provider.request(None))
+            .unwrap_err()
+            .kind(),
+        CallErrorKind::InterfaceMismatch
+    );
+    let new_provider = Provider::new(&replacement, fresh, "/scope/target", Some("new"));
+    let mut new_call = new_provider.request(Some("new"));
+    new_call.interface.validator = None;
+    new_provider.call_operation(new_call).unwrap();
+    let moved = Scope::new("/moved").unwrap();
+    new_provider.target_exists.set(false);
+    *new_provider.current.borrow_mut() = Some((
+        moved.clone(),
+        Metadata {
+            name: "moved".into(),
+            reference: Some("new".into()),
+            validator: None,
+        },
+    ));
+    assert_eq!(
+        new_provider
+            .fetch_interface(&registry, &reference)
+            .unwrap_err()
+            .code,
+        ProtocolErrorCode::InterfaceNotFound
+    );
+    assert_eq!(
+        new_provider
+            .call_operation(new_provider.request(None))
+            .unwrap_err()
+            .kind(),
+        CallErrorKind::NotFound
+    );
+    let moved_interface = registry
+        .register(&moved, reference.name, ReadDefinition, None)
+        .unwrap();
+    assert_eq!(
+        moved_interface.reference().protocol_reference().scope,
+        "/moved"
+    );
+    assert_eq!(provider.calls.get(), 0);
+}
+
+#[test]
+fn replacement_after_fetch_rejects_old_ref_but_omission_and_refless_are_allowed() {
+    for previous_ref in [Some("old"), None] {
+        let (mut registry, old_scope, old_provider) =
+            setup("/scope", "/scope/target", previous_ref);
+        let observed = old_provider
+            .fetch_interface(&registry, &old_provider.request(None).interface.reference)
+            .unwrap();
+        registry.remove_scope(&old_scope);
+        let new_scope = Scope::new("/scope").unwrap();
+        let token = registry
+            .register(
+                &new_scope,
+                "read::#日本語",
+                ReadDefinition,
+                Some(Validator::new(b"descriptor-v1")),
+            )
+            .unwrap();
+        let new_provider = Provider::new(&new_scope, token, "/scope/target", None);
+        if let Some(reference) = observed.scope_ref {
+            assert_eq!(
+                new_provider
+                    .call_operation(new_provider.request(Some(&reference)))
+                    .unwrap_err()
+                    .kind(),
+                CallErrorKind::InterfaceMismatch
+            );
+            assert_eq!(new_provider.calls.get(), 0);
+        }
+        new_provider
+            .call_operation(new_provider.request(None))
+            .unwrap();
+    }
+}
+
+#[test]
+fn started_execution_retains_target_and_same_descriptor_through_replacement() {
+    let (registry, old_scope, provider) = setup("/scope", "/scope/target", Some("old"));
+    let registry = Rc::new(RefCell::new(registry));
+    let current = provider.current.clone();
+    let replacement = Scope::new("/scope").unwrap();
+    let registry_for_action = registry.clone();
+    let replacement_for_action = replacement.clone();
+    *provider.on_start.borrow_mut() = Some(Box::new(move || {
+        let mut registry = registry_for_action.borrow_mut();
+        registry.remove_scope(&old_scope);
+        registry
+            .register(
+                &replacement_for_action,
+                "read::#日本語",
+                CountDefinition,
+                Some(Validator::new(b"descriptor-v2")),
+            )
+            .unwrap();
+        *current.borrow_mut() = Some((
+            replacement_for_action.clone(),
+            Metadata {
+                name: "scope".into(),
+                reference: Some("new".into()),
+                validator: None,
+            },
+        ));
+    }));
+    let call = provider.request(Some("old"));
+    let result = provider
+        .call_operation_with_context_and_decoder(
+            &ExecutionContext::new(),
+            call.target,
+            call.interface,
+            call.operation,
+            |descriptor| {
+                assert_eq!(descriptor, &ReadDefinition::descriptor());
+                Ok::<_, ()>(call.arguments)
+            },
+        )
+        .unwrap();
+    assert_eq!(result.result, Value::String("original backend".into()));
+    assert_eq!(provider.calls.get(), 1);
+    assert_eq!(provider.resolutions.get(), 1);
+    let new = provider
+        .fetch_interface(
+            &registry.borrow(),
+            &provider.request(None).interface.reference,
+        )
+        .unwrap();
+    assert_eq!(new.descriptor, CountDefinition::descriptor());
+    assert_eq!(new.scope_ref.as_deref(), Some("new"));
+    // The old bound target can no longer start a call against the new descriptor.
+    assert_eq!(
+        provider
+            .call_operation(provider.request(None))
+            .unwrap_err()
+            .kind(),
+        CallErrorKind::InterfaceMismatch
+    );
+    assert_eq!(provider.calls.get(), 1);
+}

crates/wip-host/tests/ui/unimplemented_interface.rs

@@ -0,0 +1,21 @@
+use wip_host::{InterfaceRegistry, PublishedObject, WipObject};
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+pub trait Search {
+    fn search(&self) -> OperationResult<String>;
+}
+
+struct Object;
+
+impl WipObject for Object {
+    fn name(&self) -> &str {
+        "object"
+    }
+}
+
+fn main() {
+    let mut registry = InterfaceRegistry::new();
+    let search = registry.register(&wip_host::Scope::new("/").unwrap(), "search", SearchDefinition, None).unwrap();
+    let _published = PublishedObject::new(Object).expose(&search).unwrap();
+}

crates/wip-host/tests/ui/unimplemented_interface.stderr

@@ -0,0 +1,34 @@
+error[E0277]: the trait bound `Object: Search` is not satisfied
+  --> tests/ui/unimplemented_interface.rs:20:58
+   |
+20 |     let _published = PublishedObject::new(Object).expose(&search).unwrap();
+   |                                                   ------ ^^^^^^^ unsatisfied trait bound
+   |                                                   |
+   |                                                   required by a bound introduced by this call
+   |
+help: the trait `Search` is not implemented for `Object`
+  --> tests/ui/unimplemented_interface.rs:9:1
+   |
+ 9 | struct Object;
+   | ^^^^^^^^^^^^^
+help: this trait has no implementations, consider adding one
+  --> tests/ui/unimplemented_interface.rs:5:1
+   |
+ 5 | pub trait Search {
+   | ^^^^^^^^^^^^^^^^
+note: required for `SearchDefinition` to implement `InterfaceImplementation<Object>`
+  --> tests/ui/unimplemented_interface.rs:4:1
+   |
+ 4 | #[interface]
+   | ^^^^^^^^^^^^
+ 5 | pub trait Search {
+   |           ^^^^^^
+note: required by a bound in `PublishedObject::<T>::expose`
+  --> src/lib.rs
+   |
+   |     pub fn expose<D>(mut self, interface: &RegisteredInterface<D>) -> Result<Self, PublicationError>
+   |            ------ required by a bound in this associated function
+   |     where
+   |         D: InterfaceImplementation<T>,
+   |            ^^^^^^^^^^^^^^^^^^^^^^^^^^ required by this bound in `PublishedObject::<T>::expose`
+   = note: this error originates in the attribute macro `interface` (in Nightly builds, run with -Z macro-backtrace for more info)

crates/wip-http/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "wip-http"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+description = "Framework-independent standard WIP over HTTP v1 binding"
+license.workspace = true
+repository.workspace = true
+readme = "README.md"
+documentation = "https://docs.rs/wip-http"
+
+[dependencies]
+base64 = "0.22"
+http = "1"
+serde = "1"
+serde_json = "1"
+url = "2"
+wip-protocol.workspace = true

crates/wip-http/LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

crates/wip-http/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crates/wip-http/README.md

@@ -0,0 +1,52 @@
+# wip-http
+
+Framework-independent WIP over HTTP v1 endpoint, route, JSON codec, and response-classification support.
+
+The crate maps the three WIP Core interactions to fixed HTTP routes and strict UTF-8 JSON representations. It constructs and validates `http` request and response values but deliberately performs no network I/O and does not define TLS, authentication, proxy, or connection policy.
+
+```toml
+[dependencies]
+wip-http = "0.1.0"
+```
+
+```rust
+use wip_http::wip_protocol::ObserveRequest;
+use wip_http::{Endpoint, Limits, encode_observe_request};
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let endpoint = Endpoint::parse("https://example.test/wip")?;
+    let limits = Limits::new(64 * 1024, 1024 * 1024, 64)?;
+    let request = encode_observe_request(
+        &endpoint,
+        &ObserveRequest { path: "/".into(), depth: 0 },
+        limits,
+    )?;
+    assert_eq!(request.uri(), "https://example.test/wip/v1/observe");
+    Ok(())
+}
+```
+
+## Interface references and scope identity
+
+Every interface reference is encoded as an exact JSON object with required
+`scope` and `name` strings, for example `{"scope":"/github","name":"issue.read"}`.
+This applies to `Object.interfaces` elements, fetch request/response `interface`,
+and call `interface.reference`. Scope must be a canonical absolute Worldspace
+path and name must be nonempty. Legacy opaque strings, short-form strings,
+relative scopes, missing fields, and extra members are rejected. Unicode, `::`,
+and `#` in names remain literal data; comparison uses decoded field values,
+independent of JSON member order and escapes. HTTP endpoint prefixes do not
+change Worldspace scope.
+
+Fetch responses and call interface targets additionally carry optional
+`scope_ref`, an opaque string copied from the scope Object's `ref` observation.
+It is not base64 and is not part of interface identity. Absent values are omitted;
+null and nonstring values are rejected. Descriptor-independent call metadata
+validates reference shape, but leaves scope ancestry and identity preconditions
+to the Host's `InterfaceMismatch` check, preserving protocol error precedence.
+Invalid success responses remain client-local `InvalidResponse` errors; protocol
+error envelopes and transport failures retain their existing classification.
+
+See the [API documentation](https://docs.rs/wip-http) for codec and failure-boundary details.
+
+Licensed under either of Apache-2.0 or MIT at your option.

crates/wip-http/src/codec.rs

@@ -0,0 +1,598 @@
+use std::error::Error;
+use std::fmt::{self, Display, Formatter};
+
+use http::header::{ACCEPT, CONTENT_ENCODING, CONTENT_TYPE};
+use http::{HeaderMap, Method, Request, Response, StatusCode};
+use wip_protocol::{
+    CallOperationRequest, CallOperationResponse, FetchInterfaceRequest, FetchInterfaceResponse,
+    INTERFACE_FORMAT_V1, InterfaceDescriptor, InterfaceTarget, ObserveRequest, ObserveResponse,
+    ProtocolError, ProtocolInteraction, Target,
+};
+
+use crate::response::{self, DecodedResponse};
+use crate::{
+    BodyKind, ClientResponseError, CodecError, Endpoint, InvalidResponseKind, JSON_CONTENT_TYPE,
+    Limits, Route, json,
+};
+
+fn request(
+    endpoint: &Endpoint,
+    route: Route,
+    body: Vec<u8>,
+) -> Result<Request<Vec<u8>>, http::Error> {
+    Request::builder()
+        .method(Method::POST)
+        .uri(endpoint.route(route).as_str())
+        .header(CONTENT_TYPE, JSON_CONTENT_TYPE)
+        .header(ACCEPT, "application/json")
+        .body(body)
+}
+
+fn response(status: StatusCode, body: Vec<u8>) -> Result<Response<Vec<u8>>, http::Error> {
+    Response::builder()
+        .status(status)
+        .header(CONTENT_TYPE, JSON_CONTENT_TYPE)
+        .body(body)
+}
+
+fn require_response_content_type<B>(response: &Response<B>) -> Result<(), ClientResponseError> {
+    if !has_supported_content_coding(response.headers()) {
+        return Err(response::unsupported_content_coding(response.status()));
+    }
+    let valid = response
+        .headers()
+        .get(CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(is_json_content_type);
+    if valid {
+        Ok(())
+    } else if response.status().is_success() {
+        Err(ClientResponseError::invalid(
+            InvalidResponseKind::InvalidSuccessBody,
+            "missing or non-UTF-8 application/json Content-Type",
+        ))
+    } else {
+        Err(response::transport_failure(response.status()))
+    }
+}
+
+fn is_utf8_charset(value: &str) -> bool {
+    let value = value.trim();
+    value.eq_ignore_ascii_case("utf-8")
+        || value
+            .strip_prefix('"')
+            .and_then(|value| value.strip_suffix('"'))
+            .is_some_and(|value| value.eq_ignore_ascii_case("utf-8"))
+}
+
+/// Returns whether a Content-Type value denotes UTF-8 `application/json`.
+///
+/// The charset parameter is optional because JSON exchanged by this binding is
+/// always UTF-8; when present, its value must be `utf-8`. Other parameters are
+/// rejected so intermediaries cannot silently select another representation.
+#[must_use]
+pub fn is_json_content_type(value: &str) -> bool {
+    let mut parts = value.split(';');
+    if !parts
+        .next()
+        .is_some_and(|media| media.trim().eq_ignore_ascii_case("application/json"))
+    {
+        return false;
+    }
+    let mut saw_charset = false;
+    for parameter in parts {
+        let Some((name, value)) = parameter.trim().split_once('=') else {
+            return false;
+        };
+        if !name.trim().eq_ignore_ascii_case("charset") || !is_utf8_charset(value) || saw_charset {
+            return false;
+        }
+        saw_charset = true;
+    }
+    true
+}
+
+fn accepts_json(headers: &HeaderMap) -> bool {
+    let mut present = false;
+    let mut best_match: Option<((u8, u8), f32)> = None;
+    for value in headers.get_all(ACCEPT) {
+        present = true;
+        let Ok(value) = value.to_str() else {
+            continue;
+        };
+        for range in value.split(',') {
+            let mut parts = range.split(';');
+            let media_range = parts.next().unwrap_or_default().trim();
+            let mut quality = 1.0_f32;
+            let mut saw_quality = false;
+            let mut saw_charset = false;
+            let mut media_parameter_count = 0;
+            let mut valid = true;
+            for parameter in parts {
+                let parameter = parameter.trim();
+                let (name, value) = parameter
+                    .split_once('=')
+                    .map_or((parameter, None), |(name, value)| {
+                        (name.trim(), Some(value))
+                    });
+                if name.is_empty() {
+                    valid = false;
+                    break;
+                }
+                if saw_quality {
+                    // Parameters after q are Accept extensions and do not
+                    // constrain the selected representation.
+                    continue;
+                }
+                if name.eq_ignore_ascii_case("q") {
+                    let Some(value) = value else {
+                        valid = false;
+                        break;
+                    };
+                    saw_quality = true;
+                    match value.trim().parse::<f32>() {
+                        Ok(value) if (0.0..=1.0).contains(&value) => quality = value,
+                        _ => {
+                            valid = false;
+                            break;
+                        }
+                    }
+                } else {
+                    let Some(value) = value else {
+                        valid = false;
+                        break;
+                    };
+                    if !name.eq_ignore_ascii_case("charset")
+                        || !is_utf8_charset(value)
+                        || saw_charset
+                    {
+                        valid = false;
+                        break;
+                    }
+                    saw_charset = true;
+                    media_parameter_count += 1;
+                }
+            }
+            let media_specificity = if media_range.eq_ignore_ascii_case("application/json") {
+                Some(2)
+            } else if media_range.eq_ignore_ascii_case("application/*") {
+                Some(1)
+            } else if media_range == "*/*" {
+                Some(0)
+            } else {
+                None
+            };
+            if valid && let Some(media_specificity) = media_specificity {
+                let specificity = (media_specificity, media_parameter_count);
+                match best_match {
+                    Some((best_specificity, _)) if best_specificity > specificity => {}
+                    Some((best_specificity, best_quality)) if best_specificity == specificity => {
+                        best_match = Some((specificity, best_quality.max(quality)));
+                    }
+                    _ => best_match = Some((specificity, quality)),
+                }
+            }
+        }
+    }
+    if present {
+        best_match.is_some_and(|(_, quality)| quality > 0.0)
+    } else {
+        true
+    }
+}
+
+/// A failure while validating inbound HTTP request metadata.
+#[derive(Debug)]
+pub enum RequestMetadataError {
+    /// The request URI does not exactly identify the selected standard route.
+    NotFound,
+    /// A known standard route was requested with a method other than `POST`.
+    MethodNotAllowed,
+    /// The request body does not use UTF-8 `application/json` or identity coding.
+    UnsupportedMediaType,
+    /// The request's `Accept` metadata excludes `application/json`.
+    NotAcceptable,
+}
+
+impl RequestMetadataError {
+    /// Returns the HTTP status for this metadata failure.
+    #[must_use]
+    pub const fn status(&self) -> StatusCode {
+        match self {
+            Self::NotFound => StatusCode::NOT_FOUND,
+            Self::MethodNotAllowed => StatusCode::METHOD_NOT_ALLOWED,
+            Self::UnsupportedMediaType => StatusCode::UNSUPPORTED_MEDIA_TYPE,
+            Self::NotAcceptable => StatusCode::NOT_ACCEPTABLE,
+        }
+    }
+
+    /// Returns the value for an `Allow` response header, when required.
+    #[must_use]
+    pub const fn allow(&self) -> Option<&'static str> {
+        match self {
+            Self::MethodNotAllowed => Some("POST"),
+            Self::NotFound | Self::UnsupportedMediaType | Self::NotAcceptable => None,
+        }
+    }
+}
+
+impl Display for RequestMetadataError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::NotFound => formatter.write_str("request URI is not a standard WIP route"),
+            Self::MethodNotAllowed => formatter.write_str("standard WIP routes require POST"),
+            Self::UnsupportedMediaType => {
+                formatter.write_str("expected identity-coded UTF-8 application/json Content-Type")
+            }
+            Self::NotAcceptable => formatter.write_str("request does not accept application/json"),
+        }
+    }
+}
+
+impl Error for RequestMetadataError {}
+
+pub(crate) fn has_supported_content_coding(headers: &HeaderMap) -> bool {
+    headers.get_all(CONTENT_ENCODING).iter().all(|value| {
+        value.to_str().is_ok_and(|value| {
+            let mut codings = value.split(',').map(str::trim);
+            let first = codings.next();
+            first.is_some_and(|coding| coding.eq_ignore_ascii_case("identity"))
+                && codings.all(|coding| coding.eq_ignore_ascii_case("identity"))
+        })
+    })
+}
+
+/// Validates mandatory HTTP metadata for an inbound WIP request.
+///
+/// Both absolute-form and origin-form request URIs are accepted, but the path
+/// must exactly equal the selected endpoint route and a query is forbidden.
+/// Unsupported content negotiation is reported as a Transport Binding metadata
+/// failure rather than a Core `invalid_request`.
+pub fn validate_http_request<B>(
+    endpoint: &Endpoint,
+    route: Route,
+    value: &Request<B>,
+) -> Result<(), RequestMetadataError> {
+    let expected = endpoint.route(route);
+    if value.uri().path() != expected.path() || value.uri().query().is_some() {
+        return Err(RequestMetadataError::NotFound);
+    }
+    if value.method() != Method::POST {
+        return Err(RequestMetadataError::MethodNotAllowed);
+    }
+    let valid_content_type = value
+        .headers()
+        .get(CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(is_json_content_type);
+    if !valid_content_type || !has_supported_content_coding(value.headers()) {
+        return Err(RequestMetadataError::UnsupportedMediaType);
+    }
+    if !accepts_json(value.headers()) {
+        return Err(RequestMetadataError::NotAcceptable);
+    }
+    Ok(())
+}
+
+/// Encodes an `observe` HTTP request.
+pub fn encode_observe_request(
+    endpoint: &Endpoint,
+    value: &ObserveRequest,
+    limits: Limits,
+) -> Result<Request<Vec<u8>>, EncodeHttpError> {
+    value.validate().map_err(CodecError::from)?;
+    let body = json::serialize(
+        &json::observe_request_to_json(value),
+        BodyKind::Request,
+        limits,
+    )?;
+    Ok(request(endpoint, Route::Observe, body)?)
+}
+
+/// Decodes an `observe` request body.
+pub fn decode_observe_request(body: &[u8], limits: Limits) -> Result<ObserveRequest, CodecError> {
+    let value = json::parse(body, BodyKind::Request, limits)?;
+    json::observe_request_from_json(&value)
+}
+
+/// Encodes a `fetch_interface` HTTP request.
+///
+/// Validates reference shape without requiring a target Object path.
+pub fn encode_fetch_interface_request(
+    endpoint: &Endpoint,
+    value: &FetchInterfaceRequest,
+    limits: Limits,
+) -> Result<Request<Vec<u8>>, EncodeHttpError> {
+    value.interface.validate().map_err(CodecError::from)?;
+    let body = json::serialize(
+        &json::fetch_interface_request_to_json(value),
+        BodyKind::Request,
+        limits,
+    )?;
+    Ok(request(endpoint, Route::FetchInterface, body)?)
+}
+
+/// Decodes a `fetch_interface` request body.
+pub fn decode_fetch_interface_request(
+    body: &[u8],
+    limits: Limits,
+) -> Result<FetchInterfaceRequest, CodecError> {
+    let value = json::parse(body, BodyKind::Request, limits)?;
+    json::fetch_interface_request_from_json(&value)
+}
+
+/// Descriptor-independent fields needed to resolve a `call_operation` request.
+///
+/// A Host decodes this metadata first, fixes the current interface descriptor,
+/// then passes the same body and descriptor to [`decode_call_operation_request`].
+/// This preserves canonical path/interface/operation lookup and error precedence
+/// without treating unvalidated argument JSON as a logical [`wip_protocol::Value`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CallOperationMetadata {
+    /// Path and optional object-state precondition.
+    pub target: Target,
+    /// Interface reference and optional interface precondition.
+    pub interface: InterfaceTarget,
+    /// Operation name used to select a declaration.
+    pub operation: String,
+}
+
+impl CallOperationMetadata {
+    /// Decodes the descriptor-bound request and verifies that routing metadata
+    /// still matches the values used to resolve `descriptor`.
+    pub fn decode_request(
+        &self,
+        body: &[u8],
+        descriptor: &InterfaceDescriptor,
+        limits: Limits,
+    ) -> Result<CallOperationRequest, CodecError> {
+        let request = decode_call_operation_request(body, descriptor, limits)?;
+        if request.target != self.target
+            || request.interface != self.interface
+            || request.operation != self.operation
+        {
+            return Err(CodecError::InvalidField {
+                field: "request".into(),
+                reason: "call metadata changed after descriptor resolution".into(),
+            });
+        }
+        Ok(request)
+    }
+}
+
+/// Decodes descriptor-independent `call_operation` routing metadata.
+///
+/// Reference shape is validated, but scope ancestry and `scope_ref` identity
+/// are left to Host resolution so `NotFound`, validator failures, and
+/// `InterfaceMismatch` retain their protocol precedence.
+pub fn decode_call_operation_metadata(
+    body: &[u8],
+    limits: Limits,
+) -> Result<CallOperationMetadata, CodecError> {
+    let value = json::parse(body, BodyKind::Request, limits)?;
+    let (target, interface, operation) = json::call_request_metadata_from_json(&value)?;
+    Ok(CallOperationMetadata {
+        target,
+        interface,
+        operation,
+    })
+}
+
+/// Encodes a descriptor-bound `call_operation` HTTP request.
+pub fn encode_call_operation_request(
+    endpoint: &Endpoint,
+    value: &CallOperationRequest,
+    descriptor: &InterfaceDescriptor,
+    limits: Limits,
+) -> Result<Request<Vec<u8>>, EncodeHttpError> {
+    let value = json::call_request_to_json(value, descriptor)?;
+    let body = json::serialize(&value, BodyKind::Request, limits)?;
+    Ok(request(endpoint, Route::CallOperation, body)?)
+}
+
+/// Decodes a descriptor-bound `call_operation` request body.
+pub fn decode_call_operation_request(
+    body: &[u8],
+    descriptor: &InterfaceDescriptor,
+    limits: Limits,
+) -> Result<CallOperationRequest, CodecError> {
+    let value = json::parse(body, BodyKind::Request, limits)?;
+    json::call_request_from_json(&value, descriptor)
+}
+
+/// Encodes a successful `observe` response as a direct body with HTTP 200.
+pub fn encode_observe_response(
+    request_value: &ObserveRequest,
+    value: &ObserveResponse,
+    limits: Limits,
+) -> Result<Response<Vec<u8>>, EncodeHttpError> {
+    request_value
+        .validate_response(value)
+        .map_err(CodecError::from)?;
+    let body = json::serialize(
+        &json::observe_response_to_json(value),
+        BodyKind::Response,
+        limits,
+    )?;
+    Ok(response(StatusCode::OK, body)?)
+}
+
+/// Decodes and classifies an `observe` client response.
+pub fn decode_observe_response<B: AsRef<[u8]>>(
+    request_value: &ObserveRequest,
+    value: &Response<B>,
+    limits: Limits,
+) -> Result<DecodedResponse<ObserveResponse>, ClientResponseError> {
+    require_response_content_type(value)?;
+    response::decode(
+        value.status(),
+        value.body().as_ref(),
+        ProtocolInteraction::Observe,
+        limits,
+        |json| {
+            let observation = json::observe_response_from_json(json)?;
+            request_value.validate_response(&observation)?;
+            Ok(observation)
+        },
+    )
+}
+
+/// Encodes a successful `fetch_interface` response as a direct body with HTTP 200.
+pub fn encode_fetch_interface_response(
+    request_value: &FetchInterfaceRequest,
+    value: &FetchInterfaceResponse,
+    limits: Limits,
+) -> Result<Response<Vec<u8>>, EncodeHttpError> {
+    value
+        .validate_for(request_value)
+        .map_err(CodecError::from)?;
+    let body = json::serialize(
+        &json::fetch_interface_response_to_json(value),
+        BodyKind::Response,
+        limits,
+    )?;
+    Ok(response(StatusCode::OK, body)?)
+}
+
+/// Decodes and classifies a `fetch_interface` client response.
+pub fn decode_fetch_interface_response<B: AsRef<[u8]>>(
+    request_value: &FetchInterfaceRequest,
+    value: &Response<B>,
+    limits: Limits,
+) -> Result<DecodedResponse<FetchInterfaceResponse>, ClientResponseError> {
+    require_response_content_type(value)?;
+    let decoded = response::decode(
+        value.status(),
+        value.body().as_ref(),
+        ProtocolInteraction::FetchInterface,
+        limits,
+        |json| {
+            let interface = json::fetch_interface_response_from_json(json)?;
+            interface.validate_for(request_value)?;
+            Ok(interface)
+        },
+    )?;
+    if let DecodedResponse::Success(success) = &decoded
+        && success.descriptor.format != INTERFACE_FORMAT_V1
+    {
+        return Err(ClientResponseError::UnsupportedDescriptorFormat {
+            format: success.descriptor.format.clone(),
+        });
+    }
+    Ok(decoded)
+}
+
+/// Encodes a successful `call_operation` response as a direct body with HTTP 200.
+pub fn encode_call_operation_response(
+    request_value: &CallOperationRequest,
+    descriptor: &InterfaceDescriptor,
+    value: &CallOperationResponse,
+    limits: Limits,
+) -> Result<Response<Vec<u8>>, EncodeHttpError> {
+    let json = json::call_response_to_json(value, descriptor, &request_value.operation)?;
+    let body = json::serialize(&json, BodyKind::Response, limits)?;
+    Ok(response(StatusCode::OK, body)?)
+}
+
+/// Decodes and classifies a descriptor-bound `call_operation` client response.
+pub fn decode_call_operation_response<B: AsRef<[u8]>>(
+    request_value: &CallOperationRequest,
+    descriptor: &InterfaceDescriptor,
+    value: &Response<B>,
+    limits: Limits,
+) -> Result<DecodedResponse<CallOperationResponse>, ClientResponseError> {
+    require_response_content_type(value)?;
+    response::decode(
+        value.status(),
+        value.body().as_ref(),
+        ProtocolInteraction::CallOperation,
+        limits,
+        |json| json::call_response_from_json(json, descriptor, &request_value.operation),
+    )
+}
+
+fn validate_protocol_error(
+    interaction: ProtocolInteraction,
+    error: &ProtocolError,
+) -> Result<(), CodecError> {
+    if !error.code.is_allowed_for(interaction) {
+        return Err(CodecError::InvalidField {
+            field: "error.code".into(),
+            reason: format!(
+                "code `{}` is not allowed for {interaction:?}",
+                response::error_code_name(error.code)
+            ),
+        });
+    }
+    Ok(())
+}
+
+fn encode_protocol_error_with_status(
+    interaction: ProtocolInteraction,
+    error: &ProtocolError,
+    status: StatusCode,
+    limits: Limits,
+) -> Result<Response<Vec<u8>>, EncodeHttpError> {
+    validate_protocol_error(interaction, error)?;
+    let body = json::serialize(&response::error_to_json(error), BodyKind::Response, limits)?;
+    Ok(response(status, body)?)
+}
+
+/// Encodes a canonical Host error envelope using its standard HTTP status.
+///
+/// The code must be allowed for `interaction`. This API accepts only
+/// [`ProtocolError`], so client-local `InvalidResponse` and
+/// `UnsupportedDescriptorFormat` classifications cannot be emitted as Host
+/// error envelopes. Logical `resource_limit_exceeded` failures use HTTP 422;
+/// representation and deployment limits are not protocol errors.
+pub fn encode_protocol_error_response(
+    interaction: ProtocolInteraction,
+    error: &ProtocolError,
+    limits: Limits,
+) -> Result<Response<Vec<u8>>, EncodeHttpError> {
+    encode_protocol_error_with_status(
+        interaction,
+        error,
+        response::status_for_error(error.code),
+        limits,
+    )
+}
+
+/// Failure while building an outbound framework-neutral HTTP message.
+#[derive(Debug)]
+pub enum EncodeHttpError {
+    /// JSON or protocol encoding failed.
+    Codec(CodecError),
+    /// The framework-neutral HTTP message builder rejected the URI or headers.
+    Http(http::Error),
+}
+
+impl std::fmt::Display for EncodeHttpError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Codec(error) => error.fmt(formatter),
+            Self::Http(error) => error.fmt(formatter),
+        }
+    }
+}
+
+impl std::error::Error for EncodeHttpError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Codec(error) => Some(error),
+            Self::Http(error) => Some(error),
+        }
+    }
+}
+
+impl From<CodecError> for EncodeHttpError {
+    fn from(value: CodecError) -> Self {
+        Self::Codec(value)
+    }
+}
+
+impl From<http::Error> for EncodeHttpError {
+    fn from(value: http::Error) -> Self {
+        Self::Http(value)
+    }
+}

crates/wip-http/src/endpoint.rs

@@ -0,0 +1,139 @@
+use std::error::Error;
+use std::fmt::{self, Display, Formatter};
+
+use url::Url;
+
+/// The media type emitted for every WIP request and every response with a body.
+pub const JSON_CONTENT_TYPE: &str = "application/json; charset=utf-8";
+
+/// A fixed standard WIP over HTTP v1 route.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum Route {
+    /// Observe one object and its indexable descendants.
+    Observe,
+    /// Fetch an interface descriptor.
+    FetchInterface,
+    /// Call one operation.
+    CallOperation,
+}
+
+impl Route {
+    /// Returns the RFC 3986 relative reference used below an endpoint prefix.
+    #[must_use]
+    pub const fn relative_reference(self) -> &'static str {
+        match self {
+            Self::Observe => "v1/observe",
+            Self::FetchInterface => "v1/fetch_interface",
+            Self::CallOperation => "v1/call_operation",
+        }
+    }
+}
+
+/// A canonical absolute hierarchical base URL whose path always ends in `/`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Endpoint(Url);
+
+impl Endpoint {
+    /// Parses and canonicalizes an endpoint.
+    ///
+    /// The input must be an absolute hierarchical URL with a host and without a
+    /// query or fragment. Its path is an endpoint prefix, not a Worldspace path.
+    /// A trailing slash is appended when absent so RFC 3986 relative-reference
+    /// resolution preserves the final prefix segment. The supplied scheme is
+    /// preserved; scheme and transport security are deployment concerns.
+    pub fn parse(input: &str) -> Result<Self, EndpointError> {
+        let mut url = Url::parse(input).map_err(EndpointError::InvalidUrl)?;
+        if url.cannot_be_a_base() || url.host_str().is_none() {
+            return Err(EndpointError::NotAbsoluteBase);
+        }
+        if url.query().is_some() {
+            return Err(EndpointError::HasQuery);
+        }
+        if url.fragment().is_some() {
+            return Err(EndpointError::HasFragment);
+        }
+        if !url.path().ends_with('/') {
+            let path = format!("{}/", url.path());
+            url.set_path(&path);
+        }
+        Ok(Self(url))
+    }
+
+    /// Returns the canonical base URL.
+    #[must_use]
+    pub fn as_url(&self) -> &Url {
+        &self.0
+    }
+
+    /// Resolves one fixed v1 route below this endpoint prefix.
+    #[must_use]
+    pub fn route(&self, route: Route) -> Url {
+        self.0
+            .join(route.relative_reference())
+            .expect("fixed relative WIP routes are valid URL references")
+    }
+
+    /// Recognizes an exact standard route below this endpoint.
+    ///
+    /// Query strings, fragments, additional path segments, and Worldspace paths
+    /// are not route components and therefore never match.
+    #[must_use]
+    pub fn recognize(&self, candidate: &Url) -> Option<Route> {
+        const ROUTES: [Route; 3] = [Route::Observe, Route::FetchInterface, Route::CallOperation];
+        if candidate.query().is_some() || candidate.fragment().is_some() {
+            return None;
+        }
+        ROUTES
+            .into_iter()
+            .find(|route| self.route(*route) == *candidate)
+    }
+}
+
+impl Display for Endpoint {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+impl TryFrom<&str> for Endpoint {
+    type Error = EndpointError;
+
+    fn try_from(value: &str) -> Result<Self, Self::Error> {
+        Self::parse(value)
+    }
+}
+
+/// Why an endpoint is not a valid standard WIP over HTTP base.
+#[derive(Debug)]
+pub enum EndpointError {
+    /// URL parsing failed.
+    InvalidUrl(url::ParseError),
+    /// The URL is not a hierarchical absolute URL with an authority.
+    NotAbsoluteBase,
+    /// A query component was supplied.
+    HasQuery,
+    /// A fragment component was supplied.
+    HasFragment,
+}
+
+impl Display for EndpointError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidUrl(error) => write!(formatter, "invalid endpoint URL: {error}"),
+            Self::NotAbsoluteBase => {
+                formatter.write_str("WIP endpoint must be an absolute base URL")
+            }
+            Self::HasQuery => formatter.write_str("WIP endpoint must not contain a query"),
+            Self::HasFragment => formatter.write_str("WIP endpoint must not contain a fragment"),
+        }
+    }
+}
+
+impl Error for EndpointError {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        match self {
+            Self::InvalidUrl(error) => Some(error),
+            _ => None,
+        }
+    }
+}

crates/wip-http/src/error.rs

@@ -0,0 +1,180 @@
+use std::error::Error;
+use std::fmt::{self, Display, Formatter};
+
+/// Caller-selected hard limits applied before or while decoding JSON.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Limits {
+    /// Largest accepted request body in bytes.
+    pub(crate) max_request_bytes: usize,
+    /// Largest accepted response body in bytes.
+    pub(crate) max_response_bytes: usize,
+    /// Largest accepted JSON container nesting depth.
+    pub(crate) max_nesting: usize,
+}
+
+impl Limits {
+    /// Creates a nonzero limit set.
+    pub fn new(
+        max_request_bytes: usize,
+        max_response_bytes: usize,
+        max_nesting: usize,
+    ) -> Result<Self, LimitConfigurationError> {
+        if max_request_bytes == 0 {
+            return Err(LimitConfigurationError::ZeroRequestBytes);
+        }
+        if max_response_bytes == 0 {
+            return Err(LimitConfigurationError::ZeroResponseBytes);
+        }
+        if max_nesting == 0 {
+            return Err(LimitConfigurationError::ZeroNesting);
+        }
+        Ok(Self {
+            max_request_bytes,
+            max_response_bytes,
+            max_nesting,
+        })
+    }
+
+    /// Returns the request body byte limit.
+    #[must_use]
+    pub const fn max_request_bytes(self) -> usize {
+        self.max_request_bytes
+    }
+
+    /// Returns the response body byte limit.
+    #[must_use]
+    pub const fn max_response_bytes(self) -> usize {
+        self.max_response_bytes
+    }
+
+    /// Returns the JSON container nesting limit.
+    #[must_use]
+    pub const fn max_nesting(self) -> usize {
+        self.max_nesting
+    }
+}
+
+/// Why a [`Limits`] configuration is not bounded.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LimitConfigurationError {
+    /// Request-byte limit was zero.
+    ZeroRequestBytes,
+    /// Response-byte limit was zero.
+    ZeroResponseBytes,
+    /// Nesting limit was zero.
+    ZeroNesting,
+}
+
+impl Display for LimitConfigurationError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::ZeroRequestBytes => "request byte limit must be nonzero",
+            Self::ZeroResponseBytes => "response byte limit must be nonzero",
+            Self::ZeroNesting => "nesting limit must be nonzero",
+        })
+    }
+}
+
+impl Error for LimitConfigurationError {}
+
+/// Whether a body is being decoded as a request or response.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BodyKind {
+    /// An inbound server request.
+    Request,
+    /// An inbound client response.
+    Response,
+}
+
+/// A malformed or locally disallowed wire representation.
+#[derive(Debug)]
+pub enum CodecError {
+    /// The body exceeds its configured byte limit.
+    BodyTooLarge {
+        /// Actual body size.
+        actual: usize,
+        /// Configured maximum.
+        maximum: usize,
+    },
+    /// JSON syntax is invalid.
+    InvalidJson(serde_json::Error),
+    /// A JSON container exceeds the configured nesting depth.
+    NestingTooDeep {
+        /// Configured maximum.
+        maximum: usize,
+    },
+    /// A required field is absent.
+    MissingField {
+        /// Field name.
+        field: String,
+    },
+    /// An undeclared field is present.
+    UnknownField {
+        /// Field name.
+        field: String,
+    },
+    /// A field has an invalid JSON type or semantic representation.
+    InvalidField {
+        /// Field name or value location.
+        field: String,
+        /// Stable human-readable reason.
+        reason: String,
+    },
+    /// An optional field was represented by JSON null rather than omission.
+    NullOptionalField {
+        /// Field name.
+        field: String,
+    },
+    /// Base64 is not canonical RFC 4648 Section 4 encoding.
+    InvalidBase64 {
+        /// Field name or value location.
+        field: String,
+    },
+    /// Logical protocol validation rejected the decoded representation.
+    ProtocolValidation(wip_protocol::ValidationError),
+}
+
+impl Display for CodecError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::BodyTooLarge { actual, maximum } => {
+                write!(formatter, "body has {actual} bytes; maximum is {maximum}")
+            }
+            Self::InvalidJson(error) => write!(formatter, "invalid JSON: {error}"),
+            Self::NestingTooDeep { maximum } => {
+                write!(formatter, "JSON nesting exceeds maximum {maximum}")
+            }
+            Self::MissingField { field } => write!(formatter, "missing field `{field}`"),
+            Self::UnknownField { field } => write!(formatter, "unknown field `{field}`"),
+            Self::InvalidField { field, reason } => {
+                write!(formatter, "invalid field `{field}`: {reason}")
+            }
+            Self::NullOptionalField { field } => {
+                write!(
+                    formatter,
+                    "optional field `{field}` must be omitted instead of null"
+                )
+            }
+            Self::InvalidBase64 { field } => {
+                write!(formatter, "field `{field}` is not canonical base64")
+            }
+            Self::ProtocolValidation(error) => error.fmt(formatter),
+        }
+    }
+}
+
+impl Error for CodecError {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        match self {
+            Self::InvalidJson(error) => Some(error),
+            Self::ProtocolValidation(error) => Some(error),
+            _ => None,
+        }
+    }
+}
+
+impl From<wip_protocol::ValidationError> for CodecError {
+    fn from(value: wip_protocol::ValidationError) -> Self {
+        Self::ProtocolValidation(value)
+    }
+}

crates/wip-http/src/lib.rs

@@ -0,0 +1,67 @@
+//! Framework-independent standard WIP over HTTP v1 binding.
+//!
+//! This crate owns endpoint and route derivation, UTF-8 JSON encoding, canonical
+//! success and error response handling, HTTP status mapping, descriptor-guided
+//! operation-value conversion. It deliberately performs no I/O and depends on no
+//! server framework, TLS implementation, filesystem projection, client cache, or
+//! presentation layer. URL schemes, TLS, certificates, authentication mechanisms,
+//! proxies, and caches are selected by the HTTP implementation and deployment
+//! rather than by WIP conformance.
+//!
+//! Logical values remain owned by [`wip_protocol`]. Validators and `Bytes` are
+//! encoded in JSON bodies using canonical RFC 4648 Section 4 base64; this crate
+//! does not infer WIP validator semantics from `ETag` or `If-Match`.
+//!
+//! Interface references use exact JSON objects with required `scope` and `name`
+//! strings in every position. Legacy strings and display shorthand are rejected.
+//! Scope is a canonical absolute Worldspace path, not an HTTP endpoint prefix.
+//! Optional `scope_ref` metadata on fetch responses and call interface targets is
+//! an opaque string, never base64; absent fields are omitted and null is rejected.
+//! Call metadata validates reference shape without resolving scope ancestry or
+//! identity, which remain Host checks with `InterfaceMismatch` precedence.
+//!
+//! ```
+//! use wip_http::{Endpoint, Limits, encode_observe_request};
+//! use wip_protocol::ObserveRequest;
+//!
+//! let endpoint = Endpoint::parse("http://example.test/api/wip")?;
+//! let limits = Limits::new(64 * 1024, 1024 * 1024, 64)?;
+//! let request = encode_observe_request(
+//!     &endpoint,
+//!     &ObserveRequest { path: "/items/123".into(), depth: 0 },
+//!     limits,
+//! )?;
+//! assert_eq!(request.uri(), "http://example.test/api/wip/v1/observe");
+//! assert_eq!(request.method(), http::Method::POST);
+//! # Ok::<(), Box<dyn std::error::Error>>(())
+//! ```
+
+#![deny(missing_docs)]
+
+mod codec;
+mod endpoint;
+mod error;
+mod json;
+mod response;
+
+pub use codec::{
+    CallOperationMetadata, EncodeHttpError, RequestMetadataError, decode_call_operation_metadata,
+    decode_call_operation_request, decode_call_operation_response, decode_fetch_interface_request,
+    decode_fetch_interface_response, decode_observe_request, decode_observe_response,
+    encode_call_operation_request, encode_call_operation_response, encode_fetch_interface_request,
+    encode_fetch_interface_response, encode_observe_request, encode_observe_response,
+    encode_protocol_error_response, is_json_content_type, validate_http_request,
+};
+pub use endpoint::{Endpoint, EndpointError, JSON_CONTENT_TYPE, Route};
+pub use error::{BodyKind, CodecError, LimitConfigurationError, Limits};
+pub use response::{
+    ClientResponseError, DecodedResponse, InvalidResponseKind, StatusMismatch,
+    TransportBindingFailure, TransportFailureKind, error_code_name, status_for_error,
+};
+
+/// Framework-neutral HTTP types used by this binding's public API.
+pub use http;
+/// URL type used by [`Endpoint`].
+pub use url;
+/// Transport-independent logical protocol model used by this binding.
+pub use wip_protocol;

crates/wip-http/src/response.rs

@@ -0,0 +1,347 @@
+use std::error::Error;
+use std::fmt::{self, Display, Formatter};
+
+use http::StatusCode;
+use serde_json::{Map, Value as Json};
+use wip_protocol::{ProtocolError, ProtocolErrorCode, ProtocolInteraction};
+
+use crate::{BodyKind, CodecError, Limits, json};
+
+/// A successfully classified client response.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum DecodedResponse<T> {
+    /// A successful direct response body.
+    Success(T),
+    /// A canonical Host protocol failure.
+    ProtocolFailure {
+        /// The authoritative protocol error decoded from the envelope.
+        error: ProtocolError,
+        /// A diagnostic when the HTTP status differs from the canonical mapping.
+        status_mismatch: Option<StatusMismatch>,
+    },
+}
+
+/// Diagnostic evidence that HTTP metadata disagrees with a valid error envelope.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct StatusMismatch {
+    /// Status received from the peer.
+    pub actual: StatusCode,
+    /// Canonical status for the envelope's protocol code.
+    pub expected: StatusCode,
+}
+
+/// Class of non-protocol HTTP failure returned without a valid WIP envelope.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum TransportFailureKind {
+    /// HTTP 401, commonly emitted by authentication infrastructure.
+    AuthenticationRequired,
+    /// HTTP 403, commonly emitted by endpoint policy or infrastructure.
+    EndpointForbidden,
+    /// The response uses a content coding the client does not support.
+    UnsupportedContentCoding,
+    /// Another non-success HTTP response without a WIP error envelope.
+    HttpStatus,
+}
+
+/// A non-success HTTP response that is not a valid WIP protocol failure.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct TransportBindingFailure {
+    /// HTTP status returned by the peer or intermediary.
+    pub status: StatusCode,
+    /// Coarse classification which does not invent a protocol error code.
+    pub kind: TransportFailureKind,
+}
+
+/// Why a response violates the WIP v1 response contract.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum InvalidResponseKind {
+    /// A 2xx response contained an error envelope.
+    ErrorEnvelopeOnSuccessStatus,
+    /// A non-2xx response contained a valid success body.
+    SuccessBodyOnErrorStatus,
+    /// A valid error envelope used a code forbidden for the interaction.
+    DisallowedProtocolCode,
+    /// A valid success body used a 2xx status other than canonical HTTP 200.
+    NonCanonicalSuccessStatus,
+    /// A 2xx body was malformed or semantically invalid.
+    InvalidSuccessBody,
+}
+
+/// A local failure while classifying or validating a peer response.
+#[derive(Debug)]
+pub enum ClientResponseError {
+    /// The HTTP exchange failed outside the protocol envelope.
+    TransportBinding(TransportBindingFailure),
+    /// The peer supplied a contradictory or invalid WIP response.
+    InvalidResponse {
+        /// Stable response-failure category.
+        kind: InvalidResponseKind,
+        /// Bounded diagnostic from local decoding.
+        detail: String,
+    },
+    /// The descriptor is structurally valid but uses an unsupported format.
+    UnsupportedDescriptorFormat {
+        /// Format identifier received from the Host.
+        format: String,
+    },
+}
+
+impl ClientResponseError {
+    pub(crate) fn invalid(kind: InvalidResponseKind, detail: impl Into<String>) -> Self {
+        Self::InvalidResponse {
+            kind,
+            detail: detail.into(),
+        }
+    }
+}
+
+impl Display for ClientResponseError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::TransportBinding(failure) => write!(
+                formatter,
+                "transport binding failure ({:?}, HTTP {})",
+                failure.kind, failure.status
+            ),
+            Self::InvalidResponse { kind, detail } => {
+                write!(formatter, "invalid WIP response ({kind:?}): {detail}")
+            }
+            Self::UnsupportedDescriptorFormat { format } => {
+                write!(
+                    formatter,
+                    "unsupported interface descriptor format `{format}`"
+                )
+            }
+        }
+    }
+}
+
+impl Error for ClientResponseError {}
+
+/// Returns the canonical HTTP status for a wire-level protocol error.
+#[must_use]
+pub const fn status_for_error(code: ProtocolErrorCode) -> StatusCode {
+    match code {
+        ProtocolErrorCode::InvalidRequest => StatusCode::BAD_REQUEST,
+        ProtocolErrorCode::NotFound | ProtocolErrorCode::InterfaceNotFound => StatusCode::NOT_FOUND,
+        ProtocolErrorCode::InterfaceMismatch => StatusCode::CONFLICT,
+        ProtocolErrorCode::OperationNotFound => StatusCode::NOT_FOUND,
+        ProtocolErrorCode::InvalidArguments => StatusCode::UNPROCESSABLE_ENTITY,
+        ProtocolErrorCode::ValidatorRequired | ProtocolErrorCode::InterfaceValidatorRequired => {
+            StatusCode::PRECONDITION_REQUIRED
+        }
+        ProtocolErrorCode::ValidatorMismatch | ProtocolErrorCode::InterfaceValidatorMismatch => {
+            StatusCode::PRECONDITION_FAILED
+        }
+        ProtocolErrorCode::PermissionDenied => StatusCode::FORBIDDEN,
+        ProtocolErrorCode::ResourceLimitExceeded => StatusCode::UNPROCESSABLE_ENTITY,
+        ProtocolErrorCode::Internal | ProtocolErrorCode::OperationOutcomeUnknown => {
+            StatusCode::INTERNAL_SERVER_ERROR
+        }
+    }
+}
+
+fn status_matches_error(status: StatusCode, code: ProtocolErrorCode) -> bool {
+    status == status_for_error(code)
+}
+
+/// Returns the stable snake-case wire spelling of a protocol code.
+#[must_use]
+pub const fn error_code_name(code: ProtocolErrorCode) -> &'static str {
+    match code {
+        ProtocolErrorCode::InvalidRequest => "invalid_request",
+        ProtocolErrorCode::NotFound => "not_found",
+        ProtocolErrorCode::InterfaceNotFound => "interface_not_found",
+        ProtocolErrorCode::InterfaceMismatch => "interface_mismatch",
+        ProtocolErrorCode::OperationNotFound => "operation_not_found",
+        ProtocolErrorCode::InvalidArguments => "invalid_arguments",
+        ProtocolErrorCode::ValidatorRequired => "validator_required",
+        ProtocolErrorCode::ValidatorMismatch => "validator_mismatch",
+        ProtocolErrorCode::InterfaceValidatorRequired => "interface_validator_required",
+        ProtocolErrorCode::InterfaceValidatorMismatch => "interface_validator_mismatch",
+        ProtocolErrorCode::PermissionDenied => "permission_denied",
+        ProtocolErrorCode::ResourceLimitExceeded => "resource_limit_exceeded",
+        ProtocolErrorCode::Internal => "internal",
+        ProtocolErrorCode::OperationOutcomeUnknown => "operation_outcome_unknown",
+    }
+}
+
+fn error_code_from_name(name: &str) -> Option<ProtocolErrorCode> {
+    Some(match name {
+        "invalid_request" => ProtocolErrorCode::InvalidRequest,
+        "not_found" => ProtocolErrorCode::NotFound,
+        "interface_not_found" => ProtocolErrorCode::InterfaceNotFound,
+        "interface_mismatch" => ProtocolErrorCode::InterfaceMismatch,
+        "operation_not_found" => ProtocolErrorCode::OperationNotFound,
+        "invalid_arguments" => ProtocolErrorCode::InvalidArguments,
+        "validator_required" => ProtocolErrorCode::ValidatorRequired,
+        "validator_mismatch" => ProtocolErrorCode::ValidatorMismatch,
+        "interface_validator_required" => ProtocolErrorCode::InterfaceValidatorRequired,
+        "interface_validator_mismatch" => ProtocolErrorCode::InterfaceValidatorMismatch,
+        "permission_denied" => ProtocolErrorCode::PermissionDenied,
+        "resource_limit_exceeded" => ProtocolErrorCode::ResourceLimitExceeded,
+        "internal" => ProtocolErrorCode::Internal,
+        "operation_outcome_unknown" => ProtocolErrorCode::OperationOutcomeUnknown,
+        _ => return None,
+    })
+}
+
+pub(crate) fn error_to_json(error: &ProtocolError) -> Json {
+    serde_json::json!({
+        "error": {
+            "code": error_code_name(error.code),
+            "message": error.message,
+        }
+    })
+}
+
+fn protocol_error_from_json(value: &Json) -> Result<ProtocolError, CodecError> {
+    let fields = value
+        .as_object()
+        .ok_or_else(|| invalid_field("error", "expected object"))?;
+    exact(fields, &["code", "message"], "error")?;
+    let code_name = required_string(fields, "code")?;
+    let code = error_code_from_name(code_name)
+        .ok_or_else(|| invalid_field("error.code", "unknown protocol error code"))?;
+    let message = required_string(fields, "message")?.to_owned();
+    Ok(ProtocolError { code, message })
+}
+
+fn envelope_error_from_json(value: &Json) -> Result<Option<ProtocolError>, CodecError> {
+    let Some(fields) = value.as_object() else {
+        return Ok(None);
+    };
+    if fields.len() != 1 || !fields.contains_key("error") {
+        return Ok(None);
+    }
+    protocol_error_from_json(&fields["error"]).map(Some)
+}
+
+fn exact(fields: &Map<String, Json>, allowed: &[&str], parent: &str) -> Result<(), CodecError> {
+    for name in fields.keys() {
+        if !allowed.contains(&name.as_str()) {
+            return Err(CodecError::UnknownField {
+                field: format!("{parent}.{name}"),
+            });
+        }
+    }
+    for name in allowed {
+        if !fields.contains_key(*name) {
+            return Err(CodecError::MissingField {
+                field: format!("{parent}.{name}"),
+            });
+        }
+    }
+    Ok(())
+}
+
+fn required_string<'a>(fields: &'a Map<String, Json>, name: &str) -> Result<&'a str, CodecError> {
+    fields
+        .get(name)
+        .and_then(Json::as_str)
+        .ok_or_else(|| invalid_field(&format!("error.{name}"), "expected string"))
+}
+
+fn invalid_field(field: &str, reason: &str) -> CodecError {
+    CodecError::InvalidField {
+        field: field.into(),
+        reason: reason.into(),
+    }
+}
+
+pub(crate) fn decode<T>(
+    status: StatusCode,
+    body: &[u8],
+    interaction: ProtocolInteraction,
+    limits: Limits,
+    success: impl FnOnce(&Json) -> Result<T, CodecError>,
+) -> Result<DecodedResponse<T>, ClientResponseError> {
+    let value = match json::parse(body, BodyKind::Response, limits) {
+        Ok(value) => value,
+        Err(_) if !status.is_success() => {
+            return Err(transport_failure(status));
+        }
+        Err(error) => {
+            return Err(ClientResponseError::invalid(
+                InvalidResponseKind::InvalidSuccessBody,
+                error.to_string(),
+            ));
+        }
+    };
+
+    match envelope_error_from_json(&value) {
+        Ok(Some(error)) => {
+            if status.is_success() {
+                return Err(ClientResponseError::invalid(
+                    InvalidResponseKind::ErrorEnvelopeOnSuccessStatus,
+                    "protocol error envelope carried by a success status",
+                ));
+            }
+            if !error.code.is_allowed_for(interaction) {
+                return Err(ClientResponseError::invalid(
+                    InvalidResponseKind::DisallowedProtocolCode,
+                    format!(
+                        "code `{}` is not allowed for {interaction:?}",
+                        error_code_name(error.code)
+                    ),
+                ));
+            }
+            let expected = status_for_error(error.code);
+            let status_mismatch =
+                (!status_matches_error(status, error.code)).then_some(StatusMismatch {
+                    actual: status,
+                    expected,
+                });
+            Ok(DecodedResponse::ProtocolFailure {
+                error,
+                status_mismatch,
+            })
+        }
+        Err(_) if !status.is_success() => Err(transport_failure(status)),
+        Err(error) => Err(ClientResponseError::invalid(
+            InvalidResponseKind::InvalidSuccessBody,
+            error.to_string(),
+        )),
+        Ok(None) if status == StatusCode::OK => success(&value)
+            .map(DecodedResponse::Success)
+            .map_err(|error| {
+                ClientResponseError::invalid(
+                    InvalidResponseKind::InvalidSuccessBody,
+                    error.to_string(),
+                )
+            }),
+        Ok(None) if status.is_success() => match success(&value) {
+            Ok(_) => Err(ClientResponseError::invalid(
+                InvalidResponseKind::NonCanonicalSuccessStatus,
+                format!("success body carried by non-canonical HTTP {status}"),
+            )),
+            Err(error) => Err(ClientResponseError::invalid(
+                InvalidResponseKind::InvalidSuccessBody,
+                error.to_string(),
+            )),
+        },
+        Ok(None) => match success(&value) {
+            Ok(_) => Err(ClientResponseError::invalid(
+                InvalidResponseKind::SuccessBodyOnErrorStatus,
+                "valid success body carried by a non-success status",
+            )),
+            Err(_) => Err(transport_failure(status)),
+        },
+    }
+}
+
+pub(crate) fn unsupported_content_coding(status: StatusCode) -> ClientResponseError {
+    ClientResponseError::TransportBinding(TransportBindingFailure {
+        status,
+        kind: TransportFailureKind::UnsupportedContentCoding,
+    })
+}
+
+pub(crate) fn transport_failure(status: StatusCode) -> ClientResponseError {
+    let kind = match status {
+        StatusCode::UNAUTHORIZED => TransportFailureKind::AuthenticationRequired,
+        StatusCode::FORBIDDEN => TransportFailureKind::EndpointForbidden,
+        _ => TransportFailureKind::HttpStatus,
+    };
+    ClientResponseError::TransportBinding(TransportBindingFailure { status, kind })
+}

crates/wip-http/tests/codecs.rs

@@ -0,0 +1,528 @@
+use std::collections::BTreeMap;
+
+use wip_http::http::StatusCode;
+use wip_http::wip_protocol::{
+    CallOperationRequest, CallOperationResponse, Documentation, EnumCase, FetchInterfaceRequest,
+    FetchInterfaceResponse, FieldDeclaration, INTERFACE_FORMAT_V1, InterfaceDescriptor,
+    InterfaceReference, InterfaceTarget, MAX_SAFE_INTEGER, Object, ObjectObservation,
+    ObserveRequest, OperationDeclaration, ParameterDeclaration, ReturnDeclaration, Target,
+    TypeDeclaration, TypeExpr, UnionCase, Value,
+};
+use wip_http::{
+    ClientResponseError, CodecError, DecodedResponse, Endpoint, InvalidResponseKind, Limits,
+    decode_call_operation_metadata, decode_call_operation_request, decode_call_operation_response,
+    decode_fetch_interface_request, decode_fetch_interface_response, decode_observe_request,
+    decode_observe_response, encode_call_operation_request, encode_call_operation_response,
+    encode_fetch_interface_request, encode_fetch_interface_response, encode_observe_request,
+    encode_observe_response,
+};
+
+fn limits() -> Limits {
+    Limits::new(1_000_000, 1_000_000, 100).unwrap()
+}
+
+fn endpoint() -> Endpoint {
+    Endpoint::parse("https://example.test/wip").unwrap()
+}
+
+fn reference(scope: &str, name: &str) -> InterfaceReference {
+    InterfaceReference {
+        scope: scope.into(),
+        name: name.into(),
+    }
+}
+
+fn object(name: &str, validator: &[u8]) -> Object {
+    Object {
+        name: name.into(),
+        description: Some("description".into()),
+        interfaces: vec![reference("/", "interface-v1")],
+        r#ref: Some(format!("object:{name}")),
+        validator: Some(validator.to_vec()),
+    }
+}
+
+fn descriptor() -> InterfaceDescriptor {
+    InterfaceDescriptor {
+        format: INTERFACE_FORMAT_V1.into(),
+        documentation: Some(Documentation {
+            summary: "Codec fixture".into(),
+            details: None,
+        }),
+        types: vec![TypeDeclaration {
+            name: "Pair".into(),
+            documentation: None,
+            definition: TypeExpr::Record {
+                fields: vec![
+                    FieldDeclaration {
+                        name: "required".into(),
+                        required: true,
+                        documentation: None,
+                        r#type: TypeExpr::String,
+                    },
+                    FieldDeclaration {
+                        name: "optional".into(),
+                        required: false,
+                        documentation: None,
+                        r#type: TypeExpr::String,
+                    },
+                    FieldDeclaration {
+                        name: "optional_json".into(),
+                        required: false,
+                        documentation: None,
+                        r#type: TypeExpr::Json,
+                    },
+                ],
+            },
+        }],
+        operations: vec![OperationDeclaration {
+            name: "everything".into(),
+            documentation: None,
+            parameters: vec![
+                parameter("unit", TypeExpr::Unit),
+                parameter("boolean", TypeExpr::Boolean),
+                parameter("integer", TypeExpr::Integer),
+                parameter("number", TypeExpr::Number),
+                parameter("string", TypeExpr::String),
+                parameter("bytes", TypeExpr::Bytes),
+                parameter("entry", TypeExpr::Entry),
+                parameter(
+                    "list",
+                    TypeExpr::List {
+                        items: Box::new(TypeExpr::Integer),
+                    },
+                ),
+                parameter(
+                    "record",
+                    TypeExpr::Named {
+                        name: "Pair".into(),
+                    },
+                ),
+                parameter(
+                    "enum",
+                    TypeExpr::Enum {
+                        cases: vec![EnumCase {
+                            name: "ready".into(),
+                            documentation: None,
+                        }],
+                    },
+                ),
+                parameter(
+                    "union",
+                    TypeExpr::Union {
+                        cases: vec![
+                            UnionCase {
+                                name: "empty".into(),
+                                documentation: None,
+                                payload: None,
+                            },
+                            UnionCase {
+                                name: "found".into(),
+                                documentation: None,
+                                payload: Some(TypeExpr::Entry),
+                            },
+                        ],
+                    },
+                ),
+                parameter("json", TypeExpr::Json),
+            ],
+            returns: ReturnDeclaration {
+                documentation: None,
+                r#type: TypeExpr::Bytes,
+            },
+        }],
+    }
+}
+
+fn parameter(name: &str, r#type: TypeExpr) -> ParameterDeclaration {
+    ParameterDeclaration {
+        name: name.into(),
+        required: true,
+        documentation: None,
+        r#type,
+    }
+}
+
+fn record(fields: impl IntoIterator<Item = (&'static str, Value)>) -> Value {
+    Value::Record(
+        fields
+            .into_iter()
+            .map(|(name, value)| (name.into(), value))
+            .collect(),
+    )
+}
+
+fn call_request() -> CallOperationRequest {
+    CallOperationRequest {
+        target: Target {
+            path: "/items/123".into(),
+            validator: Some(vec![0, 1, 2, 255]),
+        },
+        interface: InterfaceTarget {
+            reference: reference("/", "interface-v1"),
+            scope_ref: None,
+            validator: Some(vec![9, 8, 7]),
+        },
+        operation: "everything".into(),
+        arguments: BTreeMap::from([
+            ("unit".into(), Value::Unit),
+            ("boolean".into(), Value::Boolean(true)),
+            ("integer".into(), Value::Integer(MAX_SAFE_INTEGER)),
+            ("number".into(), Value::Number(1.5)),
+            ("string".into(), Value::String("text".into())),
+            ("bytes".into(), Value::Bytes(vec![0, 1, 2, 255])),
+            ("entry".into(), Value::String("/items/123".into())),
+            (
+                "list".into(),
+                Value::List(vec![Value::Integer(1), Value::Integer(2)]),
+            ),
+            (
+                "record".into(),
+                record([("required", Value::String("present".into()))]),
+            ),
+            ("enum".into(), Value::String("ready".into())),
+            (
+                "union".into(),
+                record([
+                    ("$case", Value::String("found".into())),
+                    ("value", Value::String("/items/123".into())),
+                ]),
+            ),
+            (
+                "json".into(),
+                record([
+                    ("null", Value::Unit),
+                    ("number", Value::Integer(2)),
+                    ("path_like", Value::String("/not-an-entry".into())),
+                ]),
+            ),
+        ]),
+    }
+}
+
+#[test]
+fn every_single_interaction_request_accepts_json() {
+    let observe = encode_observe_request(
+        &endpoint(),
+        &ObserveRequest {
+            path: "/".into(),
+            depth: 0,
+        },
+        limits(),
+    )
+    .unwrap();
+    let fetch_interface = encode_fetch_interface_request(
+        &endpoint(),
+        &FetchInterfaceRequest {
+            interface: reference("/", "interface-v1"),
+        },
+        limits(),
+    )
+    .unwrap();
+    let call = encode_call_operation_request(&endpoint(), &call_request(), &descriptor(), limits())
+        .unwrap();
+
+    for request in [observe, fetch_interface, call] {
+        assert_eq!(request.headers()["accept"], "application/json");
+    }
+}
+
+#[test]
+fn depth_zero_observe_round_trips_direct_body_and_validator() {
+    let request = ObserveRequest {
+        path: "/items/123".into(),
+        depth: 0,
+    };
+    let encoded_request = encode_observe_request(&endpoint(), &request, limits()).unwrap();
+    assert_eq!(encoded_request.uri().path(), "/wip/v1/observe");
+    assert_eq!(
+        decode_observe_request(encoded_request.body(), limits()).unwrap(),
+        request
+    );
+
+    let expected = ObjectObservation {
+        object: object("123", &[0, 1, 2, 255]),
+        children: None,
+    };
+    let encoded = encode_observe_response(&request, &expected, limits()).unwrap();
+    assert_eq!(encoded.status(), StatusCode::OK);
+    assert!(
+        !std::str::from_utf8(encoded.body())
+            .unwrap()
+            .contains("children")
+    );
+    assert_eq!(
+        decode_observe_response(&request, &encoded, limits()).unwrap(),
+        DecodedResponse::Success(expected)
+    );
+    assert!(encoded.headers().get("etag").is_none());
+}
+
+#[test]
+fn observe_and_interface_round_trip_nested_logical_models() {
+    let observe_request = ObserveRequest {
+        path: "/items".into(),
+        depth: 1,
+    };
+    let encoded_request = encode_observe_request(&endpoint(), &observe_request, limits()).unwrap();
+    assert_eq!(
+        decode_observe_request(encoded_request.body(), limits()).unwrap(),
+        observe_request
+    );
+    let observation = ObjectObservation {
+        object: object("items", b"root-validator"),
+        children: Some(vec![ObjectObservation {
+            object: object("123", b"child-validator"),
+            children: None,
+        }]),
+    };
+    let encoded = encode_observe_response(&observe_request, &observation, limits()).unwrap();
+    assert_eq!(
+        decode_observe_response(&observe_request, &encoded, limits()).unwrap(),
+        DecodedResponse::Success(observation)
+    );
+
+    let empty = ObjectObservation {
+        object: object("items", b"root-validator"),
+        children: Some(vec![]),
+    };
+    let encoded_empty = encode_observe_response(&observe_request, &empty, limits()).unwrap();
+    assert!(
+        std::str::from_utf8(encoded_empty.body())
+            .unwrap()
+            .contains("\"children\":[]")
+    );
+
+    let interface_request = FetchInterfaceRequest {
+        interface: reference("/", "interface-v1"),
+    };
+    let encoded_request =
+        encode_fetch_interface_request(&endpoint(), &interface_request, limits()).unwrap();
+    assert_eq!(
+        decode_fetch_interface_request(encoded_request.body(), limits()).unwrap(),
+        interface_request
+    );
+    let interface = FetchInterfaceResponse {
+        interface: interface_request.interface.clone(),
+        scope_ref: None,
+        descriptor: descriptor(),
+        validator: Some(vec![4, 5, 6, 255]),
+    };
+    let encoded =
+        encode_fetch_interface_response(&interface_request, &interface, limits()).unwrap();
+    assert_eq!(
+        decode_fetch_interface_response(&interface_request, &encoded, limits()).unwrap(),
+        DecodedResponse::Success(interface)
+    );
+}
+
+#[test]
+fn descriptor_guided_values_and_validators_round_trip_both_directions() {
+    let descriptor = descriptor();
+    let request = call_request();
+    let encoded =
+        encode_call_operation_request(&endpoint(), &request, &descriptor, limits()).unwrap();
+    let body = std::str::from_utf8(encoded.body()).unwrap();
+    assert!(body.contains("AAEC/w=="));
+    let metadata = decode_call_operation_metadata(encoded.body(), limits()).unwrap();
+    assert_eq!(metadata.target, request.target);
+    assert_eq!(metadata.interface, request.interface);
+    assert_eq!(metadata.operation, request.operation);
+    assert_eq!(
+        metadata
+            .decode_request(encoded.body(), &descriptor, limits())
+            .unwrap(),
+        request
+    );
+    let mut changed_route = request.clone();
+    changed_route.target.path = "/items/other".into();
+    let changed =
+        encode_call_operation_request(&endpoint(), &changed_route, &descriptor, limits()).unwrap();
+    assert!(
+        metadata
+            .decode_request(changed.body(), &descriptor, limits())
+            .is_err()
+    );
+
+    let mut null_json_request = request.clone();
+    null_json_request
+        .arguments
+        .insert("json".into(), Value::Unit);
+    null_json_request.arguments.insert(
+        "record".into(),
+        record([
+            ("required", Value::String("present".into())),
+            ("optional_json", Value::Unit),
+        ]),
+    );
+    let null_json =
+        encode_call_operation_request(&endpoint(), &null_json_request, &descriptor, limits())
+            .unwrap();
+    assert_eq!(
+        decode_call_operation_request(null_json.body(), &descriptor, limits()).unwrap(),
+        null_json_request
+    );
+
+    let expected = CallOperationResponse {
+        result: Value::Bytes(vec![255, 0, 1]),
+        validator: Some(vec![3, 2, 1, 0]),
+    };
+    let encoded =
+        encode_call_operation_response(&request, &descriptor, &expected, limits()).unwrap();
+    assert!(
+        std::str::from_utf8(encoded.body())
+            .unwrap()
+            .contains("/wAB")
+    );
+    assert_eq!(
+        decode_call_operation_response(&request, &descriptor, &encoded, limits()).unwrap(),
+        DecodedResponse::Success(expected)
+    );
+}
+
+#[test]
+fn malformed_unknown_null_and_noncanonical_base64_are_rejected() {
+    let limits = limits();
+    assert!(decode_observe_request(br#"{"path":"/","depth":0,"extra":true}"#, limits).is_err());
+    assert!(
+        decode_observe_request(br#"{"path":"relative","path":"/","depth":0}"#, limits).is_err()
+    );
+
+    let request = call_request();
+    let descriptor = descriptor();
+    let body = serde_json::to_vec(&serde_json::json!({
+        "target": {"path": "/items/123", "validator": null},
+        "interface": {"reference": {"scope": "/", "name": "interface-v1"}},
+        "operation": "everything",
+        "arguments": {}
+    }))
+    .unwrap();
+    assert!(decode_call_operation_request(&body, &descriptor, limits).is_err());
+
+    let mut json: serde_json::Value = serde_json::from_slice(
+        encode_call_operation_request(&endpoint(), &request, &descriptor, limits)
+            .unwrap()
+            .body(),
+    )
+    .unwrap();
+    json["arguments"]["bytes"] = serde_json::Value::String("AAEC_w==".into());
+    assert!(
+        decode_call_operation_request(&serde_json::to_vec(&json).unwrap(), &descriptor, limits)
+            .is_err()
+    );
+}
+
+#[test]
+fn caller_limits_remain_local_codec_failures() {
+    let tiny = Limits::new(8, 8, 2).unwrap();
+    let too_large = decode_observe_request(br#"{"path":"/long","depth":0}"#, tiny).unwrap_err();
+    assert!(matches!(&too_large, CodecError::BodyTooLarge { .. }));
+
+    let nested = br#"{"path":[[["/"]]],"depth":0}"#;
+    let nesting_limited = Limits::new(1024, 1024, 2).unwrap();
+    let too_deep = decode_observe_request(nested, nesting_limited).unwrap_err();
+    assert!(matches!(&too_deep, CodecError::NestingTooDeep { .. }));
+
+    let outbound_limited = Limits::new(1_000_000, 1_000_000, 1).unwrap();
+    assert!(
+        encode_call_operation_request(
+            &endpoint(),
+            &call_request(),
+            &descriptor(),
+            outbound_limited,
+        )
+        .is_err()
+    );
+    assert!(
+        encode_observe_response(
+            &ObserveRequest {
+                path: "/item".into(),
+                depth: 0,
+            },
+            &ObjectObservation {
+                object: object("item", b"validator"),
+                children: None,
+            },
+            outbound_limited,
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn unsupported_descriptor_format_is_client_local() {
+    let request = FetchInterfaceRequest {
+        interface: reference("/", "interface-v1"),
+    };
+    let mut interface = FetchInterfaceResponse {
+        interface: request.interface.clone(),
+        scope_ref: None,
+        descriptor: descriptor(),
+        validator: None,
+    };
+    interface.descriptor.format = "future-format".into();
+    let response = encode_fetch_interface_response(&request, &interface, limits()).unwrap();
+    let error = decode_fetch_interface_response(&request, &response, limits()).unwrap_err();
+    assert!(matches!(
+        error,
+        ClientResponseError::UnsupportedDescriptorFormat { .. }
+    ));
+
+    let future_shape = wip_http::http::Response::builder()
+        .status(StatusCode::OK)
+        .header("content-type", "application/json; charset=utf-8")
+        .body(
+            br#"{"interface":{"scope":"/","name":"interface-v1"},"descriptor":{"format":"wip-interface/2","future_shape":true}}"#
+                .to_vec(),
+        )
+        .unwrap();
+    assert!(matches!(
+        decode_fetch_interface_response(&request, &future_shape, limits()).unwrap_err(),
+        ClientResponseError::UnsupportedDescriptorFormat { format }
+            if format == "wip-interface/2"
+    ));
+
+    for malformed in [
+        br#"{"interface":{"scope":"/","name":"wrong"},"descriptor":{"format":"wip-interface/2"}}"#.as_slice(),
+        br#"{"interface":{"scope":"/","name":"interface-v1"},"descriptor":{"format":"wip-interface/2"},"validator":null}"#
+            .as_slice(),
+    ] {
+        let response = wip_http::http::Response::builder()
+            .status(StatusCode::OK)
+            .header("content-type", "application/json; charset=utf-8")
+            .body(malformed.to_vec())
+            .unwrap();
+        assert!(matches!(
+            decode_fetch_interface_response(&request, &response, limits()).unwrap_err(),
+            ClientResponseError::InvalidResponse {
+                kind: InvalidResponseKind::InvalidSuccessBody,
+                ..
+            }
+        ));
+    }
+}
+
+#[test]
+fn invalid_success_is_classified_as_invalid_response() {
+    let response = wip_http::http::Response::builder()
+        .status(StatusCode::OK)
+        .header("content-type", "application/json; charset=utf-8")
+        .body(br#"{"object":{"name":"wrong","interfaces":[]}}"#.to_vec())
+        .unwrap();
+    let error = decode_observe_response(
+        &ObserveRequest {
+            path: "/expected".into(),
+            depth: 0,
+        },
+        &response,
+        limits(),
+    )
+    .unwrap_err();
+    assert!(matches!(
+        error,
+        ClientResponseError::InvalidResponse {
+            kind: InvalidResponseKind::InvalidSuccessBody,
+            ..
+        }
+    ));
+}

crates/wip-http/tests/references.rs

@@ -0,0 +1,740 @@
+use std::collections::BTreeMap;
+
+use serde_json::{Value as Json, json};
+use wip_http::http::{Response, StatusCode};
+use wip_http::wip_protocol::{
+    CallOperationRequest, FetchInterfaceRequest, FetchInterfaceResponse, INTERFACE_FORMAT_V1,
+    InterfaceDescriptor, InterfaceReference, InterfaceTarget, Object, ObjectObservation,
+    ObserveRequest, OperationDeclaration, ProtocolError, ProtocolErrorCode, ProtocolInteraction,
+    ReturnDeclaration, Target, TypeExpr,
+};
+use wip_http::{
+    ClientResponseError, CodecError, DecodedResponse, Endpoint, InvalidResponseKind, Limits,
+    TransportFailureKind, decode_call_operation_metadata, decode_call_operation_request,
+    decode_call_operation_response, decode_fetch_interface_request,
+    decode_fetch_interface_response, decode_observe_response, encode_call_operation_request,
+    encode_fetch_interface_request, encode_fetch_interface_response, encode_observe_response,
+    encode_protocol_error_response,
+};
+
+fn limits() -> Limits {
+    Limits::new(64 * 1024, 64 * 1024, 64).unwrap()
+}
+
+fn endpoint() -> Endpoint {
+    Endpoint::parse("https://example.test/deployment/prefix").unwrap()
+}
+
+fn reference(scope: &str, name: &str) -> InterfaceReference {
+    InterfaceReference {
+        scope: scope.into(),
+        name: name.into(),
+    }
+}
+
+fn descriptor() -> InterfaceDescriptor {
+    InterfaceDescriptor {
+        format: INTERFACE_FORMAT_V1.into(),
+        documentation: None,
+        types: vec![],
+        operations: vec![OperationDeclaration {
+            name: "run#::操作".into(),
+            documentation: None,
+            parameters: vec![],
+            returns: ReturnDeclaration {
+                documentation: None,
+                r#type: TypeExpr::Unit,
+            },
+        }],
+    }
+}
+
+fn call(reference: InterfaceReference, scope_ref: Option<String>) -> CallOperationRequest {
+    CallOperationRequest {
+        target: Target {
+            path: "/世界::#/item".into(),
+            validator: Some(vec![0, 255]),
+        },
+        interface: InterfaceTarget {
+            reference,
+            scope_ref,
+            validator: Some(vec![1, 255]),
+        },
+        operation: "run#::操作".into(),
+        arguments: BTreeMap::new(),
+    }
+}
+
+fn observation(references: Vec<InterfaceReference>) -> ObjectObservation {
+    ObjectObservation {
+        object: Object {
+            name: "item".into(),
+            description: None,
+            interfaces: references,
+            r#ref: None,
+            validator: None,
+        },
+        children: None,
+    }
+}
+
+fn observe_request() -> ObserveRequest {
+    ObserveRequest {
+        path: "/世界::#/item".into(),
+        depth: 0,
+    }
+}
+
+fn response(status: StatusCode, value: Json) -> Response<Vec<u8>> {
+    raw_response(status, &serde_json::to_vec(&value).unwrap())
+}
+
+fn raw_response(status: StatusCode, body: &[u8]) -> Response<Vec<u8>> {
+    Response::builder()
+        .status(status)
+        .header("content-type", "application/json")
+        .body(body.to_vec())
+        .unwrap()
+}
+
+fn fetch_json(interface: Json) -> Json {
+    json!({
+        "interface": interface,
+        "descriptor": {"format": INTERFACE_FORMAT_V1, "types": [], "operations": []}
+    })
+}
+
+fn call_json(reference: Json) -> Json {
+    json!({
+        "target": {"path": "/世界::#/item"},
+        "interface": {"reference": reference},
+        "operation": "run#::操作",
+        "arguments": {}
+    })
+}
+
+fn invalid_success<T: std::fmt::Debug>(result: Result<T, ClientResponseError>) {
+    assert!(matches!(
+        result.unwrap_err(),
+        ClientResponseError::InvalidResponse {
+            kind: InvalidResponseKind::InvalidSuccessBody,
+            ..
+        }
+    ));
+}
+
+#[test]
+fn exact_structured_reference_is_encoded_and_round_tripped_in_every_position() {
+    let interface_ref = reference("/世界::#", "é::接口#read/with\"quote\\slash");
+    let expected = json!({"scope": interface_ref.scope, "name": interface_ref.name});
+    let fetch_request = FetchInterfaceRequest {
+        interface: interface_ref.clone(),
+    };
+    let encoded = encode_fetch_interface_request(&endpoint(), &fetch_request, limits()).unwrap();
+    assert_eq!(
+        encoded.uri().path(),
+        "/deployment/prefix/v1/fetch_interface"
+    );
+    assert_eq!(
+        serde_json::from_slice::<Json>(encoded.body()).unwrap(),
+        json!({"interface": expected})
+    );
+    assert_eq!(
+        decode_fetch_interface_request(encoded.body(), limits()).unwrap(),
+        fetch_request
+    );
+
+    let fetch_response = FetchInterfaceResponse {
+        interface: interface_ref.clone(),
+        scope_ref: Some("opaque:世界::# not base64!".into()),
+        descriptor: descriptor(),
+        validator: Some(vec![1, 255]),
+    };
+    let encoded =
+        encode_fetch_interface_response(&fetch_request, &fetch_response, limits()).unwrap();
+    let body: Json = serde_json::from_slice(encoded.body()).unwrap();
+    assert_eq!(body["interface"], expected);
+    assert_eq!(body["scope_ref"], "opaque:世界::# not base64!");
+    assert_eq!(body["validator"], "Af8=");
+    assert_eq!(
+        decode_fetch_interface_response(&fetch_request, &encoded, limits()).unwrap(),
+        DecodedResponse::Success(fetch_response)
+    );
+
+    let observation = observation(vec![interface_ref.clone(), reference("/", "root")]);
+    let encoded = encode_observe_response(&observe_request(), &observation, limits()).unwrap();
+    let body: Json = serde_json::from_slice(encoded.body()).unwrap();
+    assert_eq!(
+        body["object"]["interfaces"],
+        json!([expected, {"scope": "/", "name": "root"}])
+    );
+    assert_eq!(
+        decode_observe_response(&observe_request(), &encoded, limits()).unwrap(),
+        DecodedResponse::Success(observation)
+    );
+
+    let request = call(interface_ref, Some("opaque:世界::# not base64!".into()));
+    let encoded =
+        encode_call_operation_request(&endpoint(), &request, &descriptor(), limits()).unwrap();
+    let body: Json = serde_json::from_slice(encoded.body()).unwrap();
+    assert_eq!(body["interface"]["reference"], expected);
+    assert_eq!(body["interface"]["scope_ref"], "opaque:世界::# not base64!");
+    assert_eq!(body["interface"]["validator"], "Af8=");
+    assert_eq!(body["target"]["validator"], "AP8=");
+    assert_eq!(body["operation"], "run#::操作");
+    assert_eq!(
+        decode_call_operation_request(encoded.body(), &descriptor(), limits()).unwrap(),
+        request
+    );
+    assert_eq!(
+        decode_call_operation_metadata(encoded.body(), limits())
+            .unwrap()
+            .interface,
+        request.interface
+    );
+}
+
+#[test]
+fn malformed_reference_corpus_is_rejected_in_all_positions() {
+    let request = FetchInterfaceRequest {
+        interface: reference("/", "interface-v1"),
+    };
+    for bad in [
+        json!("interface-v1"),
+        json!("/::interface-v1"),
+        json!("interface-v1#run"),
+        Json::Null,
+        json!(false),
+        json!(1),
+        json!([]),
+        json!({}),
+        json!({"name": "interface-v1"}),
+        json!({"scope": "/"}),
+        json!({"scope": null, "name": "interface-v1"}),
+        json!({"scope": 1, "name": "interface-v1"}),
+        json!({"scope": "/", "name": null}),
+        json!({"scope": "/", "name": []}),
+        json!({"scope": "/", "name": ""}),
+        json!({"scope": "/", "name": "interface-v1", "extra": true}),
+        json!({"scope": "/", "name": "interface-v1", "scope_ref": "identity"}),
+        json!({"Scope": "/", "name": "interface-v1"}),
+        json!({"scope": "", "name": "interface-v1"}),
+        json!({"scope": "relative", "name": "interface-v1"}),
+        json!({"scope": ".", "name": "interface-v1"}),
+        json!({"scope": "..", "name": "interface-v1"}),
+        json!({"scope": "/a/", "name": "interface-v1"}),
+        json!({"scope": "//a", "name": "interface-v1"}),
+        json!({"scope": "/a//b", "name": "interface-v1"}),
+        json!({"scope": "/a/./b", "name": "interface-v1"}),
+        json!({"scope": "/a/../b", "name": "interface-v1"}),
+    ] {
+        let body = serde_json::to_vec(&json!({"interface": bad})).unwrap();
+        assert!(
+            decode_fetch_interface_request(&body, limits()).is_err(),
+            "{bad}"
+        );
+        let body = serde_json::to_vec(&call_json(bad.clone())).unwrap();
+        assert!(
+            decode_call_operation_metadata(&body, limits()).is_err(),
+            "{bad}"
+        );
+        assert!(
+            decode_call_operation_request(&body, &descriptor(), limits()).is_err(),
+            "{bad}"
+        );
+        invalid_success(decode_fetch_interface_response(
+            &request,
+            &response(StatusCode::OK, fetch_json(bad.clone())),
+            limits(),
+        ));
+        let mut future = fetch_json(bad.clone());
+        future["descriptor"] = json!({"format": "future-format", "future": true});
+        invalid_success(decode_fetch_interface_response(
+            &request,
+            &response(StatusCode::OK, future),
+            limits(),
+        ));
+        invalid_success(decode_observe_response(
+            &observe_request(),
+            &response(
+                StatusCode::OK,
+                json!({"object": {"name": "item", "interfaces": [bad]}}),
+            ),
+            limits(),
+        ));
+    }
+}
+
+#[test]
+fn duplicate_reference_members_are_rejected_even_when_escaped_or_equal() {
+    let request = FetchInterfaceRequest {
+        interface: reference("/", "x"),
+    };
+    for bad in [
+        r#"{"scope":"/","scope":"/","name":"x"}"#,
+        r#"{"scope":"/","name":"x","name":"x"}"#,
+        r#"{"scope":"/","name":"x","na\u006de":"x"}"#,
+    ] {
+        let fetch = format!(r#"{{"interface":{bad}}}"#);
+        assert!(matches!(
+            decode_fetch_interface_request(fetch.as_bytes(), limits()).unwrap_err(),
+            CodecError::InvalidJson(_)
+        ));
+        let call = format!(
+            r#"{{"target":{{"path":"/"}},"interface":{{"reference":{bad}}},"operation":"run","arguments":{{}}}}"#
+        );
+        assert!(matches!(
+            decode_call_operation_metadata(call.as_bytes(), limits()).unwrap_err(),
+            CodecError::InvalidJson(_)
+        ));
+        assert!(matches!(
+            decode_call_operation_request(call.as_bytes(), &descriptor(), limits()).unwrap_err(),
+            CodecError::InvalidJson(_)
+        ));
+        let fetch_response = format!(
+            r#"{{"interface":{bad},"descriptor":{{"format":"wip-interface/1","types":[],"operations":[]}}}}"#
+        );
+        invalid_success(decode_fetch_interface_response(
+            &request,
+            &raw_response(StatusCode::OK, fetch_response.as_bytes()),
+            limits(),
+        ));
+        let observe = format!(r#"{{"object":{{"name":"item","interfaces":[{bad}]}}}}"#);
+        invalid_success(decode_observe_response(
+            &observe_request(),
+            &raw_response(StatusCode::OK, observe.as_bytes()),
+            limits(),
+        ));
+    }
+}
+
+#[test]
+fn member_order_and_json_escapes_do_not_change_reference_identity() {
+    let expected = reference("/世界::#", "é::接口#");
+    let raw_reference = r#"{"name":"\u00e9::\u63a5\u53e3#","scope":"\/\u4e16\u754c::#"}"#;
+    let fetch = format!(r#"{{"interface":{raw_reference}}}"#);
+    let request = decode_fetch_interface_request(fetch.as_bytes(), limits()).unwrap();
+    assert_eq!(request.interface, expected);
+    let fetch_response = format!(
+        r#"{{"descriptor":{{"operations":[],"types":[],"format":"wip-interface/1"}},"interface":{raw_reference}}}"#
+    );
+    assert!(
+        matches!(decode_fetch_interface_response(&request, &raw_response(StatusCode::OK, fetch_response.as_bytes()), limits()).unwrap(), DecodedResponse::Success(value) if value.interface == expected)
+    );
+    let call = format!(
+        r#"{{"arguments":{{}},"operation":"run#::操作","interface":{{"reference":{raw_reference}}},"target":{{"path":"/世界::#/item"}}}}"#
+    );
+    assert_eq!(
+        decode_call_operation_metadata(call.as_bytes(), limits())
+            .unwrap()
+            .interface
+            .reference,
+        expected
+    );
+    assert_eq!(
+        decode_call_operation_request(call.as_bytes(), &descriptor(), limits())
+            .unwrap()
+            .interface
+            .reference,
+        expected
+    );
+    let observe = format!(r#"{{"object":{{"interfaces":[{raw_reference}],"name":"item"}}}}"#);
+    assert!(
+        matches!(decode_observe_response(&observe_request(), &raw_response(StatusCode::OK, observe.as_bytes()), limits()).unwrap(), DecodedResponse::Success(value) if value.object.interfaces == vec![expected])
+    );
+}
+
+#[test]
+fn reference_comparison_is_exact_without_normalization_case_or_url_decoding() {
+    for different in [
+        reference("/", "e\u{301}"),
+        reference("/", "É"),
+        reference("/", "%C3%A9"),
+        reference("/other", "é"),
+    ] {
+        let request = FetchInterfaceRequest {
+            interface: reference("/", "é"),
+        };
+        invalid_success(decode_fetch_interface_response(
+            &request,
+            &response(
+                StatusCode::OK,
+                fetch_json(json!({"scope": different.scope, "name": different.name})),
+            ),
+            limits(),
+        ));
+    }
+    let request = FetchInterfaceRequest {
+        interface: reference("/%2E", "é"),
+    };
+    let encoded = encode_fetch_interface_request(&endpoint(), &request, limits()).unwrap();
+    assert_eq!(
+        decode_fetch_interface_request(encoded.body(), limits()).unwrap(),
+        request
+    );
+    let request = FetchInterfaceRequest {
+        interface: reference("/", "."),
+    };
+    assert!(encode_fetch_interface_request(&endpoint(), &request, limits()).is_ok());
+}
+
+#[test]
+fn request_encoding_rejects_invalid_reference_shape_without_needing_a_fetch_target() {
+    for bad in [
+        reference("relative", "x"),
+        reference("", "x"),
+        reference("/a/../b", "x"),
+        reference("/", ""),
+    ] {
+        assert!(
+            encode_fetch_interface_request(
+                &endpoint(),
+                &FetchInterfaceRequest {
+                    interface: bad.clone()
+                },
+                limits()
+            )
+            .is_err()
+        );
+        assert!(
+            encode_call_operation_request(&endpoint(), &call(bad, None), &descriptor(), limits())
+                .is_err()
+        );
+    }
+    let request = FetchInterfaceRequest {
+        interface: reference("/unrelated/scope", "x"),
+    };
+    let encoded = encode_fetch_interface_request(&endpoint(), &request, limits()).unwrap();
+    assert_eq!(
+        decode_fetch_interface_request(encoded.body(), limits()).unwrap(),
+        request
+    );
+}
+
+#[test]
+fn call_metadata_leaves_valid_out_of_scope_references_and_identity_to_host_resolution() {
+    let request = call(
+        reference("/elsewhere", "x"),
+        Some("not-current-identity".into()),
+    );
+    let encoded =
+        encode_call_operation_request(&endpoint(), &request, &descriptor(), limits()).unwrap();
+    let metadata = decode_call_operation_metadata(encoded.body(), limits()).unwrap();
+    assert_eq!(metadata.interface, request.interface);
+    assert_eq!(
+        metadata
+            .decode_request(encoded.body(), &descriptor(), limits())
+            .unwrap(),
+        request
+    );
+
+    // Neither an unknown operation nor descriptor-bound argument values are
+    // resolved by the metadata boundary before Host precondition checks.
+    let mut body: Json = serde_json::from_slice(encoded.body()).unwrap();
+    body["operation"] = json!("missing");
+    body["arguments"] = json!({"not_declared": [null, {"anything": true}]});
+    let metadata =
+        decode_call_operation_metadata(&serde_json::to_vec(&body).unwrap(), limits()).unwrap();
+    assert_eq!(metadata.operation, "missing");
+    assert_eq!(metadata.interface, request.interface);
+}
+
+#[test]
+fn observation_scope_validation_uses_each_nodes_path_and_structural_duplicates() {
+    let request = ObserveRequest {
+        path: "/a".into(),
+        depth: 1,
+    };
+    let valid = json!({
+        "object": {"name": "a", "interfaces": [{"scope": "/", "name": "x"}, {"scope": "/a", "name": "x"}]},
+        "children": [{"object": {"name": "b", "interfaces": [{"scope": "/a/b", "name": "x"}]}}]
+    });
+    assert!(
+        decode_observe_response(&request, &response(StatusCode::OK, valid.clone()), limits())
+            .is_ok()
+    );
+    for scope in ["/ab", "/elsewhere", "/a/b/c"] {
+        let mut bad = valid.clone();
+        bad["children"][0]["object"]["interfaces"][0]["scope"] = json!(scope);
+        invalid_success(decode_observe_response(
+            &request,
+            &response(StatusCode::OK, bad),
+            limits(),
+        ));
+    }
+    let mut duplicate = valid;
+    duplicate["object"]["interfaces"] =
+        json!([{"scope": "/a", "name": "x"}, {"name": "x", "scope": "/a"}]);
+    invalid_success(decode_observe_response(
+        &request,
+        &response(StatusCode::OK, duplicate),
+        limits(),
+    ));
+    let root_request = ObserveRequest {
+        path: "/".into(),
+        depth: 0,
+    };
+    for (scope, valid) in [("/", true), ("/a", false)] {
+        let result = decode_observe_response(
+            &root_request,
+            &response(
+                StatusCode::OK,
+                json!({"object": {"name": "", "interfaces": [{"scope": scope, "name": "x"}]}}),
+            ),
+            limits(),
+        );
+        if valid {
+            assert!(result.is_ok());
+        } else {
+            invalid_success(result);
+        }
+    }
+}
+
+#[test]
+fn scope_ref_omission_and_opaque_strings_round_trip_in_both_positions() {
+    for scope_ref in [
+        None,
+        Some(String::new()),
+        Some("opaque::# 世界 ! not base64 /+=".into()),
+        Some("\"\\\n\u{0}".into()),
+    ] {
+        let request = FetchInterfaceRequest {
+            interface: reference("/", "x"),
+        };
+        let expected = FetchInterfaceResponse {
+            interface: request.interface.clone(),
+            scope_ref: scope_ref.clone(),
+            descriptor: descriptor(),
+            validator: None,
+        };
+        let encoded = encode_fetch_interface_response(&request, &expected, limits()).unwrap();
+        let body: Json = serde_json::from_slice(encoded.body()).unwrap();
+        assert_eq!(
+            body.get("scope_ref"),
+            scope_ref
+                .as_ref()
+                .map(|value| Json::String(value.clone()))
+                .as_ref()
+        );
+        assert!(body.get("validator").is_none());
+        assert_eq!(
+            decode_fetch_interface_response(&request, &encoded, limits()).unwrap(),
+            DecodedResponse::Success(expected)
+        );
+        let call = call(request.interface, scope_ref);
+        let encoded =
+            encode_call_operation_request(&endpoint(), &call, &descriptor(), limits()).unwrap();
+        let body: Json = serde_json::from_slice(encoded.body()).unwrap();
+        assert_eq!(
+            body["interface"].get("scope_ref"),
+            call.interface
+                .scope_ref
+                .as_ref()
+                .map(|value| Json::String(value.clone()))
+                .as_ref()
+        );
+        assert_eq!(
+            decode_call_operation_metadata(encoded.body(), limits())
+                .unwrap()
+                .interface,
+            call.interface
+        );
+        assert_eq!(
+            decode_call_operation_request(encoded.body(), &descriptor(), limits()).unwrap(),
+            call
+        );
+    }
+}
+
+#[test]
+fn scope_ref_null_and_every_nonstring_type_are_rejected_before_descriptor_resolution() {
+    let request = FetchInterfaceRequest {
+        interface: reference("/", "x"),
+    };
+    for bad in [Json::Null, json!(true), json!(0), json!([]), json!({})] {
+        let mut fetch = fetch_json(json!({"scope": "/", "name": "x"}));
+        fetch["scope_ref"] = bad.clone();
+        invalid_success(decode_fetch_interface_response(
+            &request,
+            &response(StatusCode::OK, fetch.clone()),
+            limits(),
+        ));
+        // Unknown format does not mask malformed common response fields.
+        fetch["descriptor"] = json!({"format": "future-format", "future": true});
+        invalid_success(decode_fetch_interface_response(
+            &request,
+            &response(StatusCode::OK, fetch),
+            limits(),
+        ));
+        let mut call = call_json(json!({"scope": "/", "name": "x"}));
+        call["interface"]["scope_ref"] = bad.clone();
+        let body = serde_json::to_vec(&call).unwrap();
+        let error = decode_call_operation_metadata(&body, limits()).unwrap_err();
+        if bad.is_null() {
+            assert!(matches!(error, CodecError::NullOptionalField { .. }));
+        } else {
+            assert!(matches!(error, CodecError::InvalidField { .. }));
+        }
+        assert!(decode_call_operation_request(&body, &descriptor(), limits()).is_err());
+    }
+}
+
+#[test]
+fn scope_ref_is_only_allowed_on_fetch_responses_and_call_interface_targets() {
+    let request = FetchInterfaceRequest {
+        interface: reference("/", "x"),
+    };
+    let reference = json!({"scope": "/", "name": "x"});
+    let fetch_request = json!({"interface": reference, "scope_ref": "identity"});
+    assert!(
+        decode_fetch_interface_request(&serde_json::to_vec(&fetch_request).unwrap(), limits())
+            .is_err()
+    );
+
+    let mut call = call_json(reference.clone());
+    call["scope_ref"] = json!("identity");
+    assert!(decode_call_operation_metadata(&serde_json::to_vec(&call).unwrap(), limits()).is_err());
+    let mut call = call_json(reference);
+    call["target"]["scope_ref"] = json!("identity");
+    assert!(decode_call_operation_metadata(&serde_json::to_vec(&call).unwrap(), limits()).is_err());
+
+    let duplicate = br#"{"interface":{"scope":"/","name":"x"},"scope_ref":"identity","scope_ref":"identity","descriptor":{"format":"wip-interface/1","types":[],"operations":[]}}"#;
+    invalid_success(decode_fetch_interface_response(
+        &request,
+        &raw_response(StatusCode::OK, duplicate),
+        limits(),
+    ));
+    let duplicate = br#"{"target":{"path":"/"},"interface":{"reference":{"scope":"/","name":"x"},"scope_ref":"identity","scope_ref":"identity"},"operation":"run#::\u64cd\u4f5c","arguments":{}}"#;
+    assert!(matches!(
+        decode_call_operation_metadata(duplicate, limits()).unwrap_err(),
+        CodecError::InvalidJson(_)
+    ));
+    assert!(matches!(
+        decode_call_operation_request(duplicate, &descriptor(), limits()).unwrap_err(),
+        CodecError::InvalidJson(_)
+    ));
+}
+
+#[test]
+fn metadata_correspondence_includes_reference_and_scope_ref_but_not_wire_order() {
+    let request = call(reference("/", "x"), Some("identity".into()));
+    let encoded =
+        encode_call_operation_request(&endpoint(), &request, &descriptor(), limits()).unwrap();
+    let metadata = decode_call_operation_metadata(encoded.body(), limits()).unwrap();
+    for (field, changed) in [
+        ("scope_ref", json!("other")),
+        ("reference", json!({"scope": "/", "name": "other"})),
+    ] {
+        let mut body: Json = serde_json::from_slice(encoded.body()).unwrap();
+        body["interface"][field] = changed;
+        assert!(
+            matches!(metadata.decode_request(&serde_json::to_vec(&body).unwrap(), &descriptor(), limits()).unwrap_err(), CodecError::InvalidField { field, .. } if field == "request")
+        );
+    }
+    let mut body: Json = serde_json::from_slice(encoded.body()).unwrap();
+    body["interface"]
+        .as_object_mut()
+        .unwrap()
+        .remove("scope_ref");
+    assert!(
+        metadata
+            .decode_request(&serde_json::to_vec(&body).unwrap(), &descriptor(), limits())
+            .is_err()
+    );
+}
+
+#[test]
+fn fetch_classification_preserves_transport_status_and_error_envelope_semantics() {
+    let request = FetchInterfaceRequest {
+        interface: reference("/", "x"),
+    };
+    let valid = fetch_json(json!({"scope": "/", "name": "x"}));
+    for (status, kind) in [
+        (
+            StatusCode::CREATED,
+            InvalidResponseKind::NonCanonicalSuccessStatus,
+        ),
+        (
+            StatusCode::BAD_GATEWAY,
+            InvalidResponseKind::SuccessBodyOnErrorStatus,
+        ),
+    ] {
+        assert!(
+            matches!(decode_fetch_interface_response(&request, &response(status, valid.clone()), limits()).unwrap_err(), ClientResponseError::InvalidResponse { kind: actual, .. } if actual == kind)
+        );
+    }
+    for status in [
+        StatusCode::UNAUTHORIZED,
+        StatusCode::FORBIDDEN,
+        StatusCode::BAD_GATEWAY,
+    ] {
+        let malformed = response(status, fetch_json(json!("legacy")));
+        assert!(
+            matches!(decode_fetch_interface_response(&request, &malformed, limits()).unwrap_err(), ClientResponseError::TransportBinding(failure) if failure.status == status)
+        );
+    }
+    let error = ProtocolError {
+        code: ProtocolErrorCode::InterfaceNotFound,
+        message: "unpublished".into(),
+    };
+    let mut encoded =
+        encode_protocol_error_response(ProtocolInteraction::FetchInterface, &error, limits())
+            .unwrap();
+    assert_eq!(
+        decode_fetch_interface_response(&request, &encoded, limits()).unwrap(),
+        DecodedResponse::ProtocolFailure {
+            error: error.clone(),
+            status_mismatch: None
+        }
+    );
+    *encoded.status_mut() = StatusCode::BAD_GATEWAY;
+    assert!(
+        matches!(decode_fetch_interface_response(&request, &encoded, limits()).unwrap(), DecodedResponse::ProtocolFailure { error: actual, status_mismatch: Some(_) } if actual == error)
+    );
+    *encoded.status_mut() = StatusCode::OK;
+    assert!(matches!(
+        decode_fetch_interface_response(&request, &encoded, limits()).unwrap_err(),
+        ClientResponseError::InvalidResponse {
+            kind: InvalidResponseKind::ErrorEnvelopeOnSuccessStatus,
+            ..
+        }
+    ));
+    let disallowed = response(
+        StatusCode::CONFLICT,
+        json!({"error": {"code": "interface_mismatch", "message": "wrong interaction"}}),
+    );
+    assert!(matches!(
+        decode_fetch_interface_response(&request, &disallowed, limits()).unwrap_err(),
+        ClientResponseError::InvalidResponse {
+            kind: InvalidResponseKind::DisallowedProtocolCode,
+            ..
+        }
+    ));
+    let mut coded = response(StatusCode::OK, valid);
+    coded
+        .headers_mut()
+        .insert("content-encoding", "gzip".parse().unwrap());
+    assert!(
+        matches!(decode_fetch_interface_response(&request, &coded, limits()).unwrap_err(), ClientResponseError::TransportBinding(failure) if failure.kind == TransportFailureKind::UnsupportedContentCoding)
+    );
+}
+
+#[test]
+fn call_interface_mismatch_envelope_remains_protocol_failure_with_structured_metadata() {
+    let request = call(reference("/unrelated", "x"), Some("stale identity".into()));
+    let error = ProtocolError {
+        code: ProtocolErrorCode::InterfaceMismatch,
+        message: "interface precondition".into(),
+    };
+    let encoded =
+        encode_protocol_error_response(ProtocolInteraction::CallOperation, &error, limits())
+            .unwrap();
+    assert_eq!(
+        decode_call_operation_response(&request, &descriptor(), &encoded, limits()).unwrap(),
+        DecodedResponse::ProtocolFailure {
+            error,
+            status_mismatch: None
+        }
+    );
+}

crates/wip-http/tests/responses.rs

@@ -0,0 +1,356 @@
+use wip_http::http::{Response, StatusCode};
+use wip_http::wip_protocol::{
+    ObserveRequest, ProtocolError, ProtocolErrorCode, ProtocolInteraction,
+};
+use wip_http::{
+    ClientResponseError, DecodedResponse, InvalidResponseKind, Limits, TransportFailureKind,
+    decode_observe_response, encode_protocol_error_response, error_code_name, is_json_content_type,
+    status_for_error,
+};
+
+fn limits() -> Limits {
+    Limits::new(64 * 1024, 64 * 1024, 32).unwrap()
+}
+
+fn request() -> ObserveRequest {
+    ObserveRequest {
+        path: "/".into(),
+        depth: 0,
+    }
+}
+
+fn response(status: StatusCode, body: impl Into<Vec<u8>>) -> Response<Vec<u8>> {
+    Response::builder()
+        .status(status)
+        .header("content-type", "application/json; charset=utf-8")
+        .body(body.into())
+        .unwrap()
+}
+
+#[test]
+fn content_type_accepts_only_utf8_json_syntax() {
+    assert!(is_json_content_type("application/json"));
+    assert!(is_json_content_type("Application/JSON; Charset=\"UTF-8\""));
+    assert!(!is_json_content_type("application/json; charset=utf-16"));
+    assert!(!is_json_content_type("application/json; charset=\"utf-8"));
+    assert!(!is_json_content_type("application/json; charset=utf-8\""));
+    assert!(!is_json_content_type("application/json; profile=other"));
+}
+
+#[test]
+fn every_protocol_code_has_stable_name_and_status() {
+    let expected = [
+        (
+            ProtocolErrorCode::InvalidRequest,
+            "invalid_request",
+            StatusCode::BAD_REQUEST,
+        ),
+        (
+            ProtocolErrorCode::NotFound,
+            "not_found",
+            StatusCode::NOT_FOUND,
+        ),
+        (
+            ProtocolErrorCode::InterfaceNotFound,
+            "interface_not_found",
+            StatusCode::NOT_FOUND,
+        ),
+        (
+            ProtocolErrorCode::InterfaceMismatch,
+            "interface_mismatch",
+            StatusCode::CONFLICT,
+        ),
+        (
+            ProtocolErrorCode::OperationNotFound,
+            "operation_not_found",
+            StatusCode::NOT_FOUND,
+        ),
+        (
+            ProtocolErrorCode::InvalidArguments,
+            "invalid_arguments",
+            StatusCode::UNPROCESSABLE_ENTITY,
+        ),
+        (
+            ProtocolErrorCode::ValidatorRequired,
+            "validator_required",
+            StatusCode::PRECONDITION_REQUIRED,
+        ),
+        (
+            ProtocolErrorCode::ValidatorMismatch,
+            "validator_mismatch",
+            StatusCode::PRECONDITION_FAILED,
+        ),
+        (
+            ProtocolErrorCode::InterfaceValidatorRequired,
+            "interface_validator_required",
+            StatusCode::PRECONDITION_REQUIRED,
+        ),
+        (
+            ProtocolErrorCode::InterfaceValidatorMismatch,
+            "interface_validator_mismatch",
+            StatusCode::PRECONDITION_FAILED,
+        ),
+        (
+            ProtocolErrorCode::PermissionDenied,
+            "permission_denied",
+            StatusCode::FORBIDDEN,
+        ),
+        (
+            ProtocolErrorCode::ResourceLimitExceeded,
+            "resource_limit_exceeded",
+            StatusCode::UNPROCESSABLE_ENTITY,
+        ),
+        (
+            ProtocolErrorCode::Internal,
+            "internal",
+            StatusCode::INTERNAL_SERVER_ERROR,
+        ),
+        (
+            ProtocolErrorCode::OperationOutcomeUnknown,
+            "operation_outcome_unknown",
+            StatusCode::INTERNAL_SERVER_ERROR,
+        ),
+    ];
+    assert_eq!(expected.len(), ProtocolErrorCode::ALL.len());
+    for (code, name, status) in expected {
+        assert_eq!(error_code_name(code), name);
+        assert_eq!(status_for_error(code), status);
+    }
+}
+
+#[test]
+fn logical_resource_limit_uses_only_422_and_bare_413_is_transport_failure() {
+    let error = ProtocolError {
+        code: ProtocolErrorCode::ResourceLimitExceeded,
+        message: "logical observation limit exceeded".into(),
+    };
+    let encoded =
+        encode_protocol_error_response(ProtocolInteraction::Observe, &error, limits()).unwrap();
+    assert_eq!(encoded.status(), StatusCode::UNPROCESSABLE_ENTITY);
+    assert_eq!(
+        decode_observe_response(&request(), &encoded, limits()).unwrap(),
+        DecodedResponse::ProtocolFailure {
+            error: error.clone(),
+            status_mismatch: None,
+        }
+    );
+
+    let mut noncanonical = encoded;
+    *noncanonical.status_mut() = StatusCode::PAYLOAD_TOO_LARGE;
+    assert_eq!(
+        decode_observe_response(&request(), &noncanonical, limits()).unwrap(),
+        DecodedResponse::ProtocolFailure {
+            error,
+            status_mismatch: Some(wip_http::StatusMismatch {
+                actual: StatusCode::PAYLOAD_TOO_LARGE,
+                expected: StatusCode::UNPROCESSABLE_ENTITY,
+            }),
+        }
+    );
+
+    let bare_413 = Response::builder()
+        .status(StatusCode::PAYLOAD_TOO_LARGE)
+        .body(Vec::<u8>::new())
+        .unwrap();
+    assert!(matches!(
+        decode_observe_response(&request(), &bare_413, limits()).unwrap_err(),
+        ClientResponseError::TransportBinding(failure)
+            if failure.status == StatusCode::PAYLOAD_TOO_LARGE
+                && failure.kind == TransportFailureKind::HttpStatus
+    ));
+}
+
+#[test]
+fn rate_limit_status_without_protocol_envelope_stays_transport_failure() {
+    let response = Response::builder()
+        .status(StatusCode::TOO_MANY_REQUESTS)
+        .body(b"rate limited".to_vec())
+        .unwrap();
+    assert!(matches!(
+        decode_observe_response(&request(), &response, limits()).unwrap_err(),
+        ClientResponseError::TransportBinding(failure)
+            if failure.status == StatusCode::TOO_MANY_REQUESTS
+                && failure.kind == TransportFailureKind::HttpStatus
+    ));
+}
+
+#[test]
+fn unsupported_response_content_coding_is_transport_failure() {
+    let mut encoded = encode_protocol_error_response(
+        ProtocolInteraction::Observe,
+        &ProtocolError {
+            code: ProtocolErrorCode::NotFound,
+            message: "missing".into(),
+        },
+        limits(),
+    )
+    .unwrap();
+    encoded
+        .headers_mut()
+        .insert("content-encoding", "gzip".parse().unwrap());
+    assert!(matches!(
+        decode_observe_response(&request(), &encoded, limits()).unwrap_err(),
+        ClientResponseError::TransportBinding(failure)
+            if failure.status == StatusCode::NOT_FOUND
+                && failure.kind == TransportFailureKind::UnsupportedContentCoding
+    ));
+
+    let success = response(StatusCode::OK, br#"{"object":{"name":"","interfaces":[]}}"#);
+    let mut identity = success.clone();
+    identity
+        .headers_mut()
+        .insert("content-encoding", "identity".parse().unwrap());
+    assert!(matches!(
+        decode_observe_response(&request(), &identity, limits()).unwrap(),
+        DecodedResponse::Success(_)
+    ));
+
+    let mut unsupported = success;
+    unsupported
+        .headers_mut()
+        .insert("content-encoding", "br".parse().unwrap());
+    assert!(matches!(
+        decode_observe_response(&request(), &unsupported, limits()).unwrap_err(),
+        ClientResponseError::TransportBinding(failure)
+            if failure.status == StatusCode::OK
+                && failure.kind == TransportFailureKind::UnsupportedContentCoding
+    ));
+}
+
+#[test]
+fn valid_success_body_requires_exactly_http_200() {
+    let success_body = br#"{"object":{"name":"","interfaces":[]}}"#;
+    for status in [StatusCode::CREATED, StatusCode::ACCEPTED] {
+        assert!(matches!(
+            decode_observe_response(&request(), &response(status, success_body), limits())
+                .unwrap_err(),
+            ClientResponseError::InvalidResponse {
+                kind: InvalidResponseKind::NonCanonicalSuccessStatus,
+                ..
+            }
+        ));
+    }
+}
+
+#[test]
+fn server_encoder_rejects_codes_disallowed_for_the_interaction() {
+    let error = ProtocolError {
+        code: ProtocolErrorCode::InterfaceNotFound,
+        message: "not valid for observe".into(),
+    };
+    assert!(
+        encode_protocol_error_response(ProtocolInteraction::Observe, &error, limits()).is_err()
+    );
+}
+
+#[test]
+fn valid_envelope_code_is_authoritative_when_status_mismatches() {
+    let error = ProtocolError {
+        code: ProtocolErrorCode::NotFound,
+        message: "missing".into(),
+    };
+    let mut encoded =
+        encode_protocol_error_response(ProtocolInteraction::Observe, &error, limits()).unwrap();
+    *encoded.status_mut() = StatusCode::IM_A_TEAPOT;
+
+    assert_eq!(
+        decode_observe_response(&request(), &encoded, limits()).unwrap(),
+        DecodedResponse::ProtocolFailure {
+            error,
+            status_mismatch: Some(wip_http::StatusMismatch {
+                actual: StatusCode::IM_A_TEAPOT,
+                expected: StatusCode::NOT_FOUND,
+            }),
+        }
+    );
+}
+
+#[test]
+fn envelope_and_status_contradictions_are_invalid_responses() {
+    let error_body = br#"{"error":{"code":"not_found","message":"missing"}}"#;
+    let on_success =
+        decode_observe_response(&request(), &response(StatusCode::OK, error_body), limits())
+            .unwrap_err();
+    assert!(matches!(
+        on_success,
+        ClientResponseError::InvalidResponse {
+            kind: InvalidResponseKind::ErrorEnvelopeOnSuccessStatus,
+            ..
+        }
+    ));
+
+    let success_body = br#"{"object":{"name":"","interfaces":[]}}"#;
+    let on_error = decode_observe_response(
+        &request(),
+        &response(StatusCode::BAD_GATEWAY, success_body),
+        limits(),
+    )
+    .unwrap_err();
+    assert!(matches!(
+        on_error,
+        ClientResponseError::InvalidResponse {
+            kind: InvalidResponseKind::SuccessBodyOnErrorStatus,
+            ..
+        }
+    ));
+}
+
+#[test]
+fn disallowed_protocol_code_is_invalid_instead_of_reclassified() {
+    let body = br#"{"error":{"code":"interface_not_found","message":"wrong interaction"}}"#;
+    let error =
+        decode_observe_response(&request(), &response(StatusCode::NOT_FOUND, body), limits())
+            .unwrap_err();
+    assert!(matches!(
+        error,
+        ClientResponseError::InvalidResponse {
+            kind: InvalidResponseKind::DisallowedProtocolCode,
+            ..
+        }
+    ));
+}
+
+#[test]
+fn proxy_authentication_and_endpoint_failures_stay_transport_failures() {
+    let cases = [
+        (
+            StatusCode::BAD_GATEWAY,
+            TransportFailureKind::HttpStatus,
+            b"proxy failure".as_slice(),
+        ),
+        (
+            StatusCode::UNAUTHORIZED,
+            TransportFailureKind::AuthenticationRequired,
+            b"login required".as_slice(),
+        ),
+        (
+            StatusCode::FORBIDDEN,
+            TransportFailureKind::EndpointForbidden,
+            b"denied".as_slice(),
+        ),
+    ];
+    for (status, expected_kind, body) in cases {
+        let response = Response::builder()
+            .status(status)
+            .body(body.to_vec())
+            .unwrap();
+        let error = decode_observe_response(&request(), &response, limits()).unwrap_err();
+        assert!(matches!(
+            error,
+            ClientResponseError::TransportBinding(failure)
+                if failure.status == status && failure.kind == expected_kind
+        ));
+    }
+}
+
+#[test]
+fn malformed_non_success_envelope_is_transport_binding_failure() {
+    let malformed = response(
+        StatusCode::BAD_GATEWAY,
+        br#"{"error":{"code":"not_found","message":null}}"#,
+    );
+    assert!(matches!(
+        decode_observe_response(&request(), &malformed, limits()).unwrap_err(),
+        ClientResponseError::TransportBinding(_)
+    ));
+}

crates/wip-http/tests/routes.rs

@@ -0,0 +1,182 @@
+use wip_http::http::{Method, Request, StatusCode};
+use wip_http::{Endpoint, RequestMetadataError, Route, validate_http_request};
+
+#[test]
+fn endpoint_preserves_http_and_https_when_resolving_canonical_routes() {
+    for scheme in ["http", "https"] {
+        let endpoint = Endpoint::parse(&format!("{scheme}://example.test/root/prefix")).unwrap();
+        assert_eq!(
+            endpoint.to_string(),
+            format!("{scheme}://example.test/root/prefix/")
+        );
+
+        let expected = [
+            (Route::Observe, "v1/observe"),
+            (Route::FetchInterface, "v1/fetch_interface"),
+            (Route::CallOperation, "v1/call_operation"),
+        ];
+        for (route, suffix) in expected {
+            let url = format!("{scheme}://example.test/root/prefix/{suffix}");
+            assert_eq!(endpoint.route(route).as_str(), url);
+            assert_eq!(
+                endpoint.recognize(&wip_http::url::Url::parse(&url).unwrap()),
+                Some(route)
+            );
+        }
+        assert_eq!(
+            endpoint.recognize(
+                &wip_http::url::Url::parse(&format!(
+                    "{scheme}://example.test/root/prefix/v1/observe?path=/items"
+                ))
+                .unwrap()
+            ),
+            None
+        );
+    }
+}
+
+#[test]
+fn routes_never_mix_worldspace_paths_into_endpoint_prefixes() {
+    let endpoint = Endpoint::parse("https://example.test/wip/%E4%B8%96%E7%95%8C/").unwrap();
+    let route = endpoint.route(Route::Observe);
+    assert_eq!(route.path(), "/wip/%E4%B8%96%E7%95%8C/v1/observe");
+    assert!(!route.as_str().contains("items"));
+}
+
+#[test]
+fn inbound_http_metadata_enforces_post_route_and_json() {
+    let endpoint = Endpoint::parse("https://example.test/wip").unwrap();
+    let valid = Request::builder()
+        .method(Method::POST)
+        .uri("/wip/v1/observe")
+        .header("content-type", "application/json; charset=utf-8")
+        .body(Vec::<u8>::new())
+        .unwrap();
+    assert!(validate_http_request(&endpoint, Route::Observe, &valid).is_ok());
+
+    let wrong_method = Request::builder()
+        .method(Method::GET)
+        .uri("/wip/v1/observe")
+        .header("content-type", "application/json")
+        .body(Vec::<u8>::new())
+        .unwrap();
+    let error = validate_http_request(&endpoint, Route::Observe, &wrong_method).unwrap_err();
+    assert!(matches!(&error, RequestMetadataError::MethodNotAllowed));
+    assert_eq!(error.status(), StatusCode::METHOD_NOT_ALLOWED);
+    assert_eq!(error.allow(), Some("POST"));
+
+    let wrong_route = Request::builder()
+        .method(Method::POST)
+        .uri("/wip/v1/fetch_interface")
+        .header("content-type", "application/json")
+        .body(Vec::<u8>::new())
+        .unwrap();
+    let error = validate_http_request(&endpoint, Route::Observe, &wrong_route).unwrap_err();
+    assert!(matches!(&error, RequestMetadataError::NotFound));
+    assert_eq!(error.status(), StatusCode::NOT_FOUND);
+    assert_eq!(error.allow(), None);
+
+    let query_and_wrong_method = Request::builder()
+        .method(Method::GET)
+        .uri("/wip/v1/observe?unexpected=true")
+        .header("content-type", "application/json")
+        .body(Vec::<u8>::new())
+        .unwrap();
+    assert!(matches!(
+        validate_http_request(&endpoint, Route::Observe, &query_and_wrong_method).unwrap_err(),
+        RequestMetadataError::NotFound
+    ));
+
+    for accept in [
+        "text/plain, */*;q=1, application/json;q=0",
+        "application/json; charset=utf-16",
+        "application/json; profile=future",
+    ] {
+        let incompatible_accept = Request::builder()
+            .method(Method::POST)
+            .uri("/wip/v1/observe")
+            .header("content-type", "application/json")
+            .header("accept", accept)
+            .body(Vec::<u8>::new())
+            .unwrap();
+        let error =
+            validate_http_request(&endpoint, Route::Observe, &incompatible_accept).unwrap_err();
+        assert!(matches!(&error, RequestMetadataError::NotAcceptable));
+        assert_eq!(error.status(), StatusCode::NOT_ACCEPTABLE);
+    }
+
+    for accept in [
+        "application/json; charset=UTF-8",
+        "application/json; q=1; profile=accept-extension",
+    ] {
+        let compatible_accept = Request::builder()
+            .method(Method::POST)
+            .uri("/wip/v1/observe")
+            .header("content-type", "application/json")
+            .header("accept", accept)
+            .body(Vec::<u8>::new())
+            .unwrap();
+        assert!(validate_http_request(&endpoint, Route::Observe, &compatible_accept).is_ok());
+    }
+
+    let unsupported_media_type = Request::builder()
+        .method(Method::POST)
+        .uri("/wip/v1/observe")
+        .header("content-type", "text/plain")
+        .header("accept", "application/json")
+        .body(Vec::<u8>::new())
+        .unwrap();
+    let error =
+        validate_http_request(&endpoint, Route::Observe, &unsupported_media_type).unwrap_err();
+    assert!(matches!(&error, RequestMetadataError::UnsupportedMediaType));
+    assert_eq!(error.status(), StatusCode::UNSUPPORTED_MEDIA_TYPE);
+
+    for coding in ["gzip", "identity, gzip"] {
+        let unsupported_coding = Request::builder()
+            .method(Method::POST)
+            .uri("/wip/v1/observe")
+            .header("content-type", "application/json")
+            .header("content-encoding", coding)
+            .body(Vec::<u8>::new())
+            .unwrap();
+        let error =
+            validate_http_request(&endpoint, Route::Observe, &unsupported_coding).unwrap_err();
+        assert!(matches!(&error, RequestMetadataError::UnsupportedMediaType));
+        assert_eq!(error.status(), StatusCode::UNSUPPORTED_MEDIA_TYPE);
+    }
+
+    let identity_coding = Request::builder()
+        .method(Method::POST)
+        .uri("/wip/v1/observe")
+        .header("content-type", "application/json")
+        .header("content-encoding", "identity")
+        .body(Vec::<u8>::new())
+        .unwrap();
+    assert!(validate_http_request(&endpoint, Route::Observe, &identity_coding).is_ok());
+}
+
+#[test]
+fn invalid_endpoint_components_and_non_routes_are_rejected() {
+    assert!(Endpoint::parse("/relative").is_err());
+    assert!(Endpoint::parse("file:///wip").is_err());
+    assert!(Endpoint::parse("https://example.test/wip?q=1").is_err());
+    assert!(Endpoint::parse("https://example.test/wip#fragment").is_err());
+
+    let deployment_endpoint = Endpoint::parse("http://user:secret@example.test/wip").unwrap();
+    assert_eq!(deployment_endpoint.as_url().scheme(), "http");
+    assert_eq!(deployment_endpoint.as_url().username(), "user");
+
+    let endpoint = Endpoint::parse("http://example.test/wip").unwrap();
+    for outside in [
+        "http://example.test/wip/v1/unknown",
+        "http://example.test/wip/v1/batch",
+        "http://example.test/wip/v1/observe/extra",
+        "https://example.test/wip/v1/observe",
+        "http://other.test/wip/v1/observe",
+    ] {
+        assert_eq!(
+            endpoint.recognize(&wip_http::url::Url::parse(outside).unwrap()),
+            None
+        );
+    }
+}

crates/wip-interface-macros/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "wip-interface-macros"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+description = "Procedural macros for WIP interface declarations and DTO codecs"
+license.workspace = true
+repository.workspace = true
+readme = "README.md"
+documentation = "https://docs.rs/wip-interface-macros"
+
+[lib]
+proc-macro = true
+
+[dependencies]
+proc-macro2 = "1"
+quote = "1"
+syn = { version = "2", features = ["full", "visit"] }

crates/wip-interface-macros/LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

crates/wip-interface-macros/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crates/wip-interface-macros/README.md

@@ -0,0 +1,9 @@
+# wip-interface-macros
+
+Procedural-macro implementation used by [`wip-interface`](https://crates.io/crates/wip-interface).
+
+Applications should depend on `wip-interface`, which re-exports `#[interface]` and `#[derive(WipType)]` together with the traits and types required by generated code. Direct use of this implementation crate is not a supported application API.
+
+See the [API documentation](https://docs.rs/wip-interface-macros) for the exported macro entry points.
+
+Licensed under either of Apache-2.0 or MIT at your option.

crates/wip-interface/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "wip-interface"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+description = "Public Rust authoring API for WIP interfaces and operation value codecs"
+license.workspace = true
+repository.workspace = true
+readme = "README.md"
+documentation = "https://docs.rs/wip-interface"
+
+[dependencies]
+wip-interface-macros.workspace = true
+wip-protocol.workspace = true
+
+[dev-dependencies]
+trybuild = "1"

crates/wip-interface/LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

crates/wip-interface/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crates/wip-interface/README.md

@@ -0,0 +1,32 @@
+# wip-interface
+
+Public Rust authoring API for Web Interface Protocol (WIP) interfaces and application DTO codecs.
+
+The crate re-exports `#[interface]` and `#[derive(WipType)]`, generates Interface Descriptors and typed dispatch companions, and converts application-owned Rust values to and from the transport-independent value model.
+
+```toml
+[dependencies]
+wip-interface = "0.1.0"
+```
+
+```rust
+use wip_interface as wip;
+
+#[derive(wip::WipType)]
+struct Greeting {
+    message: String,
+}
+
+#[wip::interface]
+pub trait Greeter {
+    /// Builds a greeting.
+    ///
+    /// # Returns
+    /// The generated greeting.
+    fn greet(&self, name: String) -> wip::OperationResult<Greeting>;
+}
+```
+
+See the [API documentation](https://docs.rs/wip-interface) for supported interface syntax, DTO shapes, and failure semantics.
+
+Licensed under either of Apache-2.0 or MIT at your option.

crates/wip-interface/src/lib.rs

@@ -0,0 +1,920 @@
+//! Public authoring API for Web Interface Protocol (WIP) interfaces.
+//!
+//! Add `wip-interface` to an application and import it under the short name
+//! used by the attribute examples:
+//!
+//! ```
+//! use wip_interface as wip;
+//!
+//! #[derive(Debug, PartialEq, wip::WipType)]
+//! struct Greeting {
+//!     /// Text shown to the recipient.
+//!     message: String,
+//! }
+//!
+//! #[wip::interface]
+//! pub trait Greeter {
+//!     /// Builds a greeting.
+//!     ///
+//!     /// # Returns
+//!     /// The generated greeting.
+//!     fn greet(&self, /// Person to greet.
+//!         name: String) -> wip::OperationResult<Greeting>;
+//! }
+//! ```
+//!
+//! The attribute and derive are re-exported by this facade; applications do
+//! not depend on the implementation-only `wip-interface-macros` crate.
+//!
+//! # Rust to protocol type mapping
+//!
+//! | Rust type | Protocol type/value |
+//! | --- | --- |
+//! | `()` | `Unit` |
+//! | `bool` | `Boolean` |
+//! | signed and unsigned integer primitives | JavaScript-lossless `Integer` |
+//! | `f32`, `f64` | finite `Number` |
+//! | `String` | `String` |
+//! | [`Bytes`] | `Bytes` |
+//! | [`JsonValue`] | schema-neutral `Json` value tree |
+//! | [`Entry`] | canonical absolute Worldspace path (`Entry`) |
+//! | `Vec<T>` | `List<T>` |
+//! | a named-field struct deriving [`WipType`] | named record |
+//! | an all-unit enum deriving [`WipType`] | named enum |
+//! | an enum mixing unit and single-payload cases deriving [`WipType`] | named union |
+//!
+//! `Option<T>` is supported only directly as a record field or operation
+//! parameter. It means omission, not a null value. A domain failure belongs in
+//! an application return enum/union and is returned as `Ok(value)`.
+//! [`HostError`] is reserved for host/runtime failure and requires an explicit
+//! [`HostErrorKind`] plus [`EffectGuarantee`]. The required [`OperationResult`]
+//! convention therefore keeps domain failures separate from runtime failures and
+//! makes outcome uncertainty visible to Host dispatch.
+//!
+//! # Migration to canonical values
+//!
+//! Earlier releases exposed `Entry<K, V>` and semantic `Value::Json`,
+//! `Value::Entry`, `Value::Enum`, and `Value::Union` variants. Those forms are
+//! intentionally gone: [`Entry`] is now one validated absolute Worldspace path,
+//! while JSON, enum, and union meaning comes only from the descriptor. Codecs
+//! exchange only raw [`Value`] strings, records, lists, and primitives. Unit
+//! operation results now cross the boundary as [`Value::Unit`] rather than an
+//! absent value.
+//!
+//! # Supported interface syntax
+//!
+//! An interface is a public, non-generic trait whose operations use exactly
+//! `&self`, simple named owned parameters, and an explicit
+//! `OperationResult<T>`. `WipType` derives support named-field structs,
+//! all-unit enums as protocol enums, and enums made from any mix of unit and
+//! single-payload cases as protocol unions.
+//!
+//! The macros reject trait inheritance and associated items; const, async,
+//! unsafe, extern, variadic, generic, default-bodied, or non-`&self` methods;
+//! borrowed values and custom lifetimes; tuple, unit, or generic structs;
+//! unsupported named-field or multi-field enum variants; explicit discriminants; Rust unions;
+//! and `Option` anywhere except a direct DTO field or operation parameter.
+//! Unsupported inputs produce source-located compile errors rather than
+//! generating a partial interface.
+
+#![deny(missing_docs)]
+
+use std::collections::BTreeMap;
+use std::error::Error;
+use std::fmt::{self, Display, Formatter};
+
+pub use wip_interface_macros::{WipType, interface};
+pub use wip_protocol;
+pub use wip_protocol::{
+    Documentation, EnumCase, FieldDeclaration, InterfaceDescriptor, MAX_SAFE_INTEGER,
+    MIN_SAFE_INTEGER, OperationDeclaration, ParameterDeclaration, ReturnDeclaration,
+    TypeDeclaration, TypeExpr, UnionCase, ValidationError, Value,
+};
+
+/// Converts one Rust application type to and from its protocol representation.
+///
+/// Implementations must describe the same shape accepted by [`WipType::decode`]
+/// and produced by [`WipType::encode`]. Prefer deriving this trait for named
+/// DTOs. Its declaration-collection method exists for generated interface code
+/// and normally should not be called by applications.
+pub trait WipType: Sized {
+    /// Returns the protocol type expression for this Rust type.
+    fn type_expr() -> TypeExpr;
+
+    /// Adds named declarations reachable from this type to `declarations`.
+    ///
+    /// Implementations must be cycle-safe and preserve declaration order.
+    fn collect_declarations(declarations: &mut Vec<TypeDeclaration>);
+
+    /// Encodes this value into the transport-independent protocol value model.
+    fn encode(self) -> Result<Value, CodecError>;
+
+    /// Decodes a previously validated protocol value.
+    fn decode(value: Value) -> Result<Self, CodecError>;
+}
+
+/// Static metadata implemented by every companion generated by
+/// [`interface`].
+pub trait InterfaceDefinition {
+    /// Builds the interface descriptor solely from its trait declaration.
+    fn descriptor() -> InterfaceDescriptor;
+}
+
+/// Typed dispatch implemented by every generated interface companion.
+///
+/// `T` must implement the Rust interface trait associated with this definition.
+/// Host runtimes use this bound when an interface is explicitly exposed, so an
+/// object that does not implement that interface is rejected at compile time.
+pub trait InterfaceImplementation<T>: InterfaceDefinition {
+    /// Validates, decodes, and dispatches one operation to `implementation`,
+    /// then encodes and validates its result.
+    fn dispatch(
+        implementation: &T,
+        operation: &str,
+        arguments: BTreeMap<String, Value>,
+    ) -> Result<Value, DispatchError>;
+}
+
+/// Result convention required for generated interface operations.
+///
+/// `Ok(T)` is an application result, including domain-failure union cases.
+/// `Err(HostError)` means the host or runtime could not perform the operation.
+pub type OperationResult<T> = Result<T, HostError>;
+
+/// Whether an operation failure proves that no effects were committed.
+///
+/// This guarantee is consumed by Host dispatch when choosing a protocol failure:
+/// only [`NotCommitted`](Self::NotCommitted) failures may become `Internal` or
+/// `ResourceLimitExceeded`; [`Unknown`](Self::Unknown) failures must become
+/// `OperationOutcomeUnknown`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EffectGuarantee {
+    /// The operation was not invoked, or every effect was rolled back.
+    NotCommitted,
+    /// The operation may have committed effects.
+    Unknown,
+}
+
+/// Host/runtime failure category used when effects are known not to be committed.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum HostErrorKind {
+    /// The Host or backend encountered an internal failure.
+    Internal,
+    /// A cancellation, deadline, or bounded resource limit was exceeded.
+    ResourceLimitExceeded,
+}
+
+/// A typed host/runtime failure, kept separate from the operation's application
+/// return type.
+///
+/// The effect guarantee is mandatory. Host runtimes must ignore the diagnostic
+/// when producing a wire response; it is bounded here for local observability but
+/// can still contain backend-private information.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct HostError {
+    kind: HostErrorKind,
+    effect_guarantee: EffectGuarantee,
+    message: String,
+}
+
+impl HostError {
+    /// Creates an internal Host failure with an explicit effect guarantee.
+    #[must_use]
+    pub fn internal(message: impl Into<String>, effect_guarantee: EffectGuarantee) -> Self {
+        Self::new(HostErrorKind::Internal, effect_guarantee, message)
+    }
+
+    /// Creates a resource-limit Host failure with an explicit effect guarantee.
+    #[must_use]
+    pub fn resource_limit(message: impl Into<String>, effect_guarantee: EffectGuarantee) -> Self {
+        Self::new(
+            HostErrorKind::ResourceLimitExceeded,
+            effect_guarantee,
+            message,
+        )
+    }
+
+    fn new(
+        kind: HostErrorKind,
+        effect_guarantee: EffectGuarantee,
+        message: impl Into<String>,
+    ) -> Self {
+        Self {
+            kind,
+            effect_guarantee,
+            message: bounded_diagnostic(message.into()),
+        }
+    }
+
+    /// Returns the typed Host failure category.
+    #[must_use]
+    pub fn kind(&self) -> HostErrorKind {
+        self.kind
+    }
+
+    /// Returns the operation-effect guarantee attached by the implementation.
+    #[must_use]
+    pub fn effect_guarantee(&self) -> EffectGuarantee {
+        self.effect_guarantee
+    }
+
+    /// Returns the bounded local diagnostic message.
+    ///
+    /// Host runtimes must not place this value in protocol responses because it
+    /// can contain backend paths, credentials, or other private details.
+    #[must_use]
+    pub fn message(&self) -> &str {
+        &self.message
+    }
+}
+
+const MAX_DIAGNOSTIC_BYTES: usize = 512;
+
+fn bounded_diagnostic(mut message: String) -> String {
+    if message.len() <= MAX_DIAGNOSTIC_BYTES {
+        return message;
+    }
+    let mut end = MAX_DIAGNOSTIC_BYTES;
+    while !message.is_char_boundary(end) {
+        end -= 1;
+    }
+    message.truncate(end);
+    message
+}
+
+impl Display for HostError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        formatter.write_str(&self.message)
+    }
+}
+
+impl Error for HostError {}
+
+/// A failure while converting between a Rust value and a protocol [`Value`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CodecError {
+    path: Vec<String>,
+    message: String,
+}
+
+impl CodecError {
+    /// Creates a codec failure at the current value.
+    #[must_use]
+    pub fn new(message: impl Into<String>) -> Self {
+        Self {
+            path: Vec::new(),
+            message: message.into(),
+        }
+    }
+
+    /// Creates a structural-kind mismatch diagnostic.
+    #[must_use]
+    pub fn expected(expected: &str, actual: &Value) -> Self {
+        Self::new(format!("expected {expected}, found {:?}", actual.kind()))
+    }
+
+    /// Prepends a field, variant, or collection position to the error path.
+    #[must_use]
+    pub fn at(mut self, segment: impl Into<String>) -> Self {
+        self.path.insert(0, segment.into());
+        self
+    }
+
+    /// Returns the path from the decoded root to the failing value.
+    #[must_use]
+    pub fn path(&self) -> &[String] {
+        &self.path
+    }
+
+    /// Returns the human-readable reason for the failure.
+    #[must_use]
+    pub fn message(&self) -> &str {
+        &self.message
+    }
+}
+
+impl Display for CodecError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        if self.path.is_empty() {
+            write!(formatter, "WIP codec error: {}", self.message)
+        } else {
+            write!(
+                formatter,
+                "WIP codec error at {}: {}",
+                self.path.join("."),
+                self.message
+            )
+        }
+    }
+}
+
+impl Error for CodecError {}
+
+/// A failure produced by macro-generated typed operation dispatch.
+#[derive(Debug)]
+pub enum DispatchError {
+    /// The requested operation is not declared by this interface.
+    UnknownOperation(String),
+    /// Protocol validation rejected the named arguments.
+    InvalidArguments(wip_protocol::ValidationError),
+    /// A validated value could not be decoded to its Rust type.
+    Decode(CodecError),
+    /// The implementation reported a host/runtime failure.
+    Host(HostError),
+    /// The implementation panicked after invocation began.
+    ///
+    /// Panic payloads are deliberately discarded because they can contain
+    /// backend-private diagnostics.
+    Panic,
+    /// The Rust result could not be encoded.
+    Encode(CodecError),
+    /// The encoded result did not match the generated declaration.
+    InvalidResult(wip_protocol::ValidationError),
+}
+
+/// Whether generated dispatch failed before or after typed implementation
+/// invocation began.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DispatchPhase {
+    /// Typed implementation code was not invoked.
+    BeforeInvocation,
+    /// Typed implementation invocation began, so effects require an explicit
+    /// non-commit or rollback guarantee.
+    AfterInvocation,
+}
+
+impl DispatchError {
+    /// Returns the execution phase in which this dispatch failure occurred.
+    #[must_use]
+    pub fn phase(&self) -> DispatchPhase {
+        match self {
+            Self::UnknownOperation(_) | Self::InvalidArguments(_) | Self::Decode(_) => {
+                DispatchPhase::BeforeInvocation
+            }
+            Self::Host(_) | Self::Panic | Self::Encode(_) | Self::InvalidResult(_) => {
+                DispatchPhase::AfterInvocation
+            }
+        }
+    }
+
+    /// Returns a post-invocation effect guarantee when the implementation
+    /// supplied one.
+    ///
+    /// Panic, encode, and result-validation failures default to `Unknown` until
+    /// a provider confirms rollback. Pre-invocation failures return `None`.
+    #[must_use]
+    pub fn effect_guarantee(&self) -> Option<EffectGuarantee> {
+        match self {
+            Self::UnknownOperation(_) | Self::InvalidArguments(_) | Self::Decode(_) => None,
+            Self::Host(error) => Some(error.effect_guarantee()),
+            Self::Panic | Self::Encode(_) | Self::InvalidResult(_) => {
+                Some(EffectGuarantee::Unknown)
+            }
+        }
+    }
+}
+
+impl Display for DispatchError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::UnknownOperation(operation) => {
+                write!(formatter, "unknown operation `{operation}`")
+            }
+            Self::InvalidArguments(error) => write!(formatter, "invalid arguments: {error}"),
+            Self::Decode(error) => write!(formatter, "argument decoding failed: {error}"),
+            Self::Host(error) => write!(formatter, "host operation failed: {error}"),
+            Self::Panic => formatter.write_str("operation implementation panicked"),
+            Self::Encode(error) => write!(formatter, "result encoding failed: {error}"),
+            Self::InvalidResult(error) => write!(formatter, "invalid operation result: {error}"),
+        }
+    }
+}
+
+impl Error for DispatchError {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        match self {
+            Self::UnknownOperation(_) | Self::Panic => None,
+            Self::InvalidArguments(error) | Self::InvalidResult(error) => Some(error),
+            Self::Decode(error) | Self::Encode(error) => Some(error),
+            Self::Host(error) => Some(error),
+        }
+    }
+}
+
+/// An explicitly byte-oriented sequence.
+///
+/// Use this wrapper when the protocol type must be `Bytes`; `Vec<T>` always
+/// denotes a protocol list, including `Vec<u8>`.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct Bytes(pub Vec<u8>);
+
+impl From<Vec<u8>> for Bytes {
+    fn from(value: Vec<u8>) -> Self {
+        Self(value)
+    }
+}
+
+impl From<Bytes> for Vec<u8> {
+    fn from(value: Bytes) -> Self {
+        value.0
+    }
+}
+
+/// A canonical absolute path to an entry in the current Worldspace.
+///
+/// This replaces the pre-canonical `Entry<K, V>` key/value pair. Construct an
+/// entry from a path such as `/articles/1`; application data associated with
+/// that entry belongs in an ordinary record alongside this value.
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct Entry(String);
+
+impl Entry {
+    /// Validates and creates an entry path.
+    pub fn new(path: impl Into<String>) -> Result<Self, CodecError> {
+        let path = path.into();
+        validate_entry_path(&path)?;
+        Ok(Self(path))
+    }
+
+    /// Returns the canonical absolute Worldspace path.
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    /// Consumes the entry and returns its path.
+    #[must_use]
+    pub fn into_string(self) -> String {
+        self.0
+    }
+}
+
+impl TryFrom<String> for Entry {
+    type Error = CodecError;
+
+    fn try_from(path: String) -> Result<Self, Self::Error> {
+        Self::new(path)
+    }
+}
+
+impl std::str::FromStr for Entry {
+    type Err = CodecError;
+
+    fn from_str(path: &str) -> Result<Self, Self::Err> {
+        Self::new(path)
+    }
+}
+
+/// One member in a [`JsonValue::Object`].
+#[derive(Debug, Clone, PartialEq)]
+pub struct JsonMember {
+    /// Member name.
+    pub name: String,
+    /// Member value.
+    pub value: JsonValue,
+}
+
+/// JSON data represented independently of any application schema.
+///
+/// Its codec uses the ordinary schema-neutral [`Value`] variants. JSON null is
+/// [`Value::Unit`], arrays are [`Value::List`], and objects are
+/// [`Value::Record`]. Protocol bytes have no JSON representation and decoding
+/// a tree containing [`Value::Bytes`] is rejected.
+#[derive(Debug, Clone, PartialEq)]
+pub enum JsonValue {
+    /// JSON null.
+    Null,
+    /// A JSON boolean.
+    Boolean(bool),
+    /// An interoperable integral JSON number.
+    Integer(i64),
+    /// A finite non-integral JSON number.
+    Number(f64),
+    /// A JSON string.
+    String(String),
+    /// A JSON array.
+    Array(Vec<JsonValue>),
+    /// A JSON object. Duplicate member names are rejected while encoding.
+    Object(Vec<JsonMember>),
+}
+
+impl WipType for () {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::Unit
+    }
+
+    fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+    fn encode(self) -> Result<Value, CodecError> {
+        Ok(Value::Unit)
+    }
+
+    fn decode(value: Value) -> Result<Self, CodecError> {
+        match value {
+            Value::Unit => Ok(()),
+            other => Err(CodecError::expected("unit", &other)),
+        }
+    }
+}
+
+impl WipType for bool {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::Boolean
+    }
+
+    fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+    fn encode(self) -> Result<Value, CodecError> {
+        Ok(Value::Boolean(self))
+    }
+
+    fn decode(value: Value) -> Result<Self, CodecError> {
+        match value {
+            Value::Boolean(value) => Ok(value),
+            other => Err(CodecError::expected("boolean", &other)),
+        }
+    }
+}
+
+macro_rules! integer_codec {
+    ($($ty:ty),+ $(,)?) => {
+        $(
+            impl WipType for $ty {
+                fn type_expr() -> TypeExpr {
+                    TypeExpr::Integer
+                }
+
+                fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+                fn encode(self) -> Result<Value, CodecError> {
+                    let value = i64::try_from(self).map_err(|_| {
+                        CodecError::new("integer is outside the protocol i64 range")
+                    })?;
+                    ensure_safe_integer(value)?;
+                    Ok(Value::Integer(value))
+                }
+
+                fn decode(value: Value) -> Result<Self, CodecError> {
+                    let Value::Integer(value) = value else {
+                        return Err(CodecError::expected("integer", &value));
+                    };
+                    ensure_safe_integer(value)?;
+                    Self::try_from(value).map_err(|_| {
+                        CodecError::new(concat!("integer does not fit Rust `", stringify!($ty), "`"))
+                    })
+                }
+            }
+        )+
+    };
+}
+
+integer_codec!(
+    i8, i16, i32, i64, i128, isize, u8, u16, u32, u64, u128, usize
+);
+
+fn ensure_safe_integer(value: i64) -> Result<(), CodecError> {
+    if (MIN_SAFE_INTEGER..=MAX_SAFE_INTEGER).contains(&value) {
+        Ok(())
+    } else {
+        Err(CodecError::new(format!(
+            "integer {value} is outside the JavaScript-lossless protocol range"
+        )))
+    }
+}
+
+impl WipType for f64 {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::Number
+    }
+
+    fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+    fn encode(self) -> Result<Value, CodecError> {
+        ensure_finite(self)?;
+        Ok(Value::Number(self))
+    }
+
+    fn decode(value: Value) -> Result<Self, CodecError> {
+        match value {
+            Value::Number(value) => {
+                ensure_finite(value)?;
+                Ok(value)
+            }
+            other => Err(CodecError::expected("number", &other)),
+        }
+    }
+}
+
+impl WipType for f32 {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::Number
+    }
+
+    fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+    fn encode(self) -> Result<Value, CodecError> {
+        let value = f64::from(self);
+        ensure_finite(value)?;
+        Ok(Value::Number(value))
+    }
+
+    fn decode(value: Value) -> Result<Self, CodecError> {
+        let value = f64::decode(value)?;
+        let narrowed = value as Self;
+        if narrowed.is_finite() {
+            Ok(narrowed)
+        } else {
+            Err(CodecError::new("number does not fit finite Rust `f32`"))
+        }
+    }
+}
+
+fn ensure_finite(value: f64) -> Result<(), CodecError> {
+    if value.is_finite() {
+        Ok(())
+    } else {
+        Err(CodecError::new("protocol numbers must be finite"))
+    }
+}
+
+impl WipType for String {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::String
+    }
+
+    fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+    fn encode(self) -> Result<Value, CodecError> {
+        Ok(Value::String(self))
+    }
+
+    fn decode(value: Value) -> Result<Self, CodecError> {
+        match value {
+            Value::String(value) => Ok(value),
+            other => Err(CodecError::expected("string", &other)),
+        }
+    }
+}
+
+impl WipType for Bytes {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::Bytes
+    }
+
+    fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+    fn encode(self) -> Result<Value, CodecError> {
+        Ok(Value::Bytes(self.0))
+    }
+
+    fn decode(value: Value) -> Result<Self, CodecError> {
+        match value {
+            Value::Bytes(value) => Ok(Self(value)),
+            other => Err(CodecError::expected("bytes", &other)),
+        }
+    }
+}
+
+impl WipType for JsonValue {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::Json
+    }
+
+    fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+    fn encode(self) -> Result<Value, CodecError> {
+        encode_json(self)
+    }
+
+    fn decode(value: Value) -> Result<Self, CodecError> {
+        decode_json(value)
+    }
+}
+
+fn encode_json(value: JsonValue) -> Result<Value, CodecError> {
+    match value {
+        JsonValue::Null => Ok(Value::Unit),
+        JsonValue::Boolean(value) => Ok(Value::Boolean(value)),
+        JsonValue::Integer(value) => {
+            ensure_safe_integer(value)?;
+            Ok(Value::Integer(value))
+        }
+        JsonValue::Number(value) => {
+            ensure_finite(value)?;
+            Ok(Value::Number(value))
+        }
+        JsonValue::String(value) => Ok(Value::String(value)),
+        JsonValue::Array(values) => values
+            .into_iter()
+            .enumerate()
+            .map(|(index, value)| encode_json(value).map_err(|error| error.at(index.to_string())))
+            .collect::<Result<Vec<_>, _>>()
+            .map(Value::List),
+        JsonValue::Object(members) => {
+            let mut fields = BTreeMap::new();
+            for member in members {
+                let name = member.name;
+                let value = encode_json(member.value).map_err(|error| error.at(name.clone()))?;
+                if fields.insert(name.clone(), value).is_some() {
+                    return Err(CodecError::new(format!("duplicate JSON member `{name}`")).at(name));
+                }
+            }
+            Ok(Value::Record(fields))
+        }
+    }
+}
+
+fn decode_json(value: Value) -> Result<JsonValue, CodecError> {
+    match value {
+        Value::Unit => Ok(JsonValue::Null),
+        Value::Boolean(value) => Ok(JsonValue::Boolean(value)),
+        Value::Integer(value) => {
+            ensure_safe_integer(value)?;
+            Ok(JsonValue::Integer(value))
+        }
+        Value::Number(value) => {
+            ensure_finite(value)?;
+            Ok(JsonValue::Number(value))
+        }
+        Value::String(value) => Ok(JsonValue::String(value)),
+        Value::Bytes(_) => Err(CodecError::new("bytes are not valid inside JSON")),
+        Value::List(values) => values
+            .into_iter()
+            .enumerate()
+            .map(|(index, value)| decode_json(value).map_err(|error| error.at(index.to_string())))
+            .collect::<Result<Vec<_>, _>>()
+            .map(JsonValue::Array),
+        Value::Record(fields) => fields
+            .into_iter()
+            .map(|(name, value)| {
+                decode_json(value)
+                    .map(|value| JsonMember {
+                        name: name.clone(),
+                        value,
+                    })
+                    .map_err(|error| error.at(name))
+            })
+            .collect::<Result<Vec<_>, _>>()
+            .map(JsonValue::Object),
+    }
+}
+
+impl<T: WipType> WipType for Vec<T> {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::List {
+            items: Box::new(T::type_expr()),
+        }
+    }
+
+    fn collect_declarations(declarations: &mut Vec<TypeDeclaration>) {
+        T::collect_declarations(declarations);
+    }
+
+    fn encode(self) -> Result<Value, CodecError> {
+        self.into_iter()
+            .enumerate()
+            .map(|(index, value)| value.encode().map_err(|error| error.at(index.to_string())))
+            .collect::<Result<Vec<_>, _>>()
+            .map(Value::List)
+    }
+
+    fn decode(value: Value) -> Result<Self, CodecError> {
+        let Value::List(values) = value else {
+            return Err(CodecError::expected("list", &value));
+        };
+        values
+            .into_iter()
+            .enumerate()
+            .map(|(index, value)| T::decode(value).map_err(|error| error.at(index.to_string())))
+            .collect()
+    }
+}
+
+impl WipType for Entry {
+    fn type_expr() -> TypeExpr {
+        TypeExpr::Entry
+    }
+
+    fn collect_declarations(_: &mut Vec<TypeDeclaration>) {}
+
+    fn encode(self) -> Result<Value, CodecError> {
+        validate_entry_path(&self.0)?;
+        Ok(Value::String(self.0))
+    }
+
+    fn decode(value: Value) -> Result<Self, CodecError> {
+        let Value::String(path) = value else {
+            return Err(CodecError::expected("entry path string", &value));
+        };
+        Self::new(path)
+    }
+}
+
+fn validate_entry_path(path: &str) -> Result<(), CodecError> {
+    wip_protocol::validate_path(path)
+        .map_err(|error| CodecError::new(format!("invalid canonical Worldspace path: {error}")))
+}
+
+/// Implementation details used by code emitted from the facade's macros.
+///
+/// These APIs are public only because macro expansions execute in the
+/// application crate. They are excluded from normal generated documentation
+/// and are not intended for direct use.
+#[doc(hidden)]
+pub mod __private {
+    use std::collections::BTreeMap;
+
+    use wip_protocol::{InterfaceDescriptor, TypeDeclaration, ValidationError, Value};
+
+    use crate::{CodecError, Documentation, WipType};
+
+    /// Builds optional descriptor documentation from generated string literals.
+    pub fn documentation(summary: &str, details: Option<&str>) -> Option<Documentation> {
+        if summary.is_empty() && details.is_none() {
+            None
+        } else {
+            Some(Documentation {
+                summary: summary.into(),
+                details: details.map(str::to_owned),
+            })
+        }
+    }
+
+    /// Registers one declaration and reports whether its dependencies should
+    /// be traversed. Identical declarations are deduplicated; a conflicting
+    /// declaration with the same name is retained for protocol validation.
+    pub fn register_declaration(
+        declarations: &mut Vec<TypeDeclaration>,
+        declaration: TypeDeclaration,
+    ) -> bool {
+        if declarations.iter().any(|existing| existing == &declaration) {
+            false
+        } else {
+            declarations.push(declaration);
+            true
+        }
+    }
+
+    /// Validates named arguments against one generated operation declaration.
+    pub fn validate_arguments(
+        descriptor: &InterfaceDescriptor,
+        operation: &str,
+        arguments: &BTreeMap<String, Value>,
+    ) -> Result<(), ValidationError> {
+        descriptor.validate_arguments(operation, arguments)
+    }
+
+    /// Builds a codec error for a generated structural mismatch.
+    pub fn decode_type_mismatch(expected: &str, actual: Value) -> CodecError {
+        CodecError::expected(expected, &actual)
+    }
+
+    /// Builds a codec error for an unknown generated enum or union variant.
+    pub fn decode_unknown_variant(type_name: &str, variant: String) -> CodecError {
+        CodecError::new(format!(
+            "unknown variant `{variant}` for WIP type `{type_name}`"
+        ))
+        .at(variant)
+    }
+
+    /// Decoder for a protocol record or operation's named argument collection.
+    pub struct RecordDecoder {
+        fields: BTreeMap<String, Value>,
+    }
+
+    impl RecordDecoder {
+        /// Starts decoding record fields or named operation arguments.
+        pub fn new(fields: BTreeMap<String, Value>) -> Self {
+            Self { fields }
+        }
+
+        /// Decodes a required field.
+        pub fn required<T: WipType>(&mut self, name: &str) -> Result<T, CodecError> {
+            let value = self.take(name).ok_or_else(|| {
+                CodecError::new(format!("missing required field `{name}`")).at(name)
+            })?;
+            T::decode(value).map_err(|error| error.at(name))
+        }
+
+        /// Decodes an optional field, where absence maps to `None`.
+        pub fn optional<T: WipType>(&mut self, name: &str) -> Result<Option<T>, CodecError> {
+            self.take(name)
+                .map(T::decode)
+                .transpose()
+                .map_err(|error| error.at(name))
+        }
+
+        /// Rejects any fields that were not consumed by generated code.
+        pub fn finish(self) -> Result<(), CodecError> {
+            if let Some(name) = self.fields.keys().next() {
+                Err(CodecError::new(format!("unknown field `{name}`")).at(name.clone()))
+            } else {
+                Ok(())
+            }
+        }
+
+        fn take(&mut self, name: &str) -> Option<Value> {
+            self.fields.remove(name)
+        }
+    }
+}

crates/wip-interface/tests/codecs.rs

@@ -0,0 +1,231 @@
+use std::collections::BTreeMap;
+
+use wip_interface::wip_protocol::{TypeExpr, UNION_CASE_FIELD, UNION_VALUE_FIELD, Value};
+use wip_interface::{Bytes, Entry, JsonMember, JsonValue, WipType};
+
+/// A request record.
+#[derive(Debug, Clone, PartialEq, WipType)]
+struct Request {
+    /// Required title.
+    title: String,
+    /// Optional priority.
+    priority: Option<i32>,
+    /// Related Worldspace entries.
+    related: Vec<Entry>,
+    /// Opaque bytes.
+    body: Bytes,
+    /// Arbitrary metadata.
+    metadata: JsonValue,
+}
+
+/// Available colors.
+#[derive(Debug, Clone, PartialEq, WipType)]
+enum Color {
+    /// Warm red.
+    Red,
+    /// Cool blue.
+    Blue,
+}
+
+/// A receipt record.
+#[derive(Debug, Clone, PartialEq, WipType)]
+struct Receipt {
+    /// Receipt number.
+    number: u32,
+}
+
+/// Application-level publication outcome.
+#[derive(Debug, Clone, PartialEq, WipType)]
+enum PublishOutcome {
+    /// Work has not completed and carries no payload.
+    Pending,
+    /// Application success.
+    Published(Receipt),
+    /// Domain rejection, not a host failure.
+    Rejected(String),
+}
+
+fn field<'a>(record: &'a BTreeMap<String, Value>, name: &str) -> &'a Value {
+    record
+        .get(name)
+        .unwrap_or_else(|| panic!("missing `{name}`"))
+}
+
+#[test]
+fn primitive_unit_record_list_entry_and_json_values_round_trip() {
+    assert_eq!(().encode().unwrap(), Value::Unit);
+    assert_eq!(<()>::decode(Value::Unit).unwrap(), ());
+    assert_eq!(<()>::type_expr(), TypeExpr::Unit);
+
+    let request = Request {
+        title: "hello".into(),
+        priority: None,
+        related: vec![Entry::new("/articles/1").unwrap()],
+        body: Bytes(vec![1, 2, 3]),
+        metadata: JsonValue::Object(vec![JsonMember {
+            name: "source".into(),
+            value: JsonValue::Array(vec![JsonValue::String("test".into()), JsonValue::Null]),
+        }]),
+    };
+
+    let encoded = request.clone().encode().unwrap();
+    let Value::Record(fields) = &encoded else {
+        panic!("record derive must encode a raw protocol record")
+    };
+    assert!(!fields.contains_key("priority"));
+    assert_eq!(
+        field(fields, "related"),
+        &Value::List(vec![Value::String("/articles/1".into())])
+    );
+    assert_eq!(
+        field(fields, "metadata"),
+        &Value::Record(BTreeMap::from([(
+            "source".into(),
+            Value::List(vec![Value::String("test".into()), Value::Unit]),
+        )]))
+    );
+    assert_eq!(Request::decode(encoded).unwrap(), request);
+
+    let number = 42.5_f64;
+    assert_eq!(f64::type_expr(), TypeExpr::Number);
+    assert_eq!(f64::decode(number.encode().unwrap()).unwrap(), number);
+
+    let narrow_number = 1.5_f32;
+    assert_eq!(f32::type_expr(), TypeExpr::Number);
+    assert_eq!(
+        f32::decode(narrow_number.encode().unwrap()).unwrap(),
+        narrow_number
+    );
+}
+
+#[test]
+fn enums_are_strings_and_unions_are_discriminated_records() {
+    for color in [Color::Red, Color::Blue] {
+        let encoded = color.clone().encode().unwrap();
+        assert!(matches!(encoded, Value::String(_)));
+        assert_eq!(Color::decode(encoded).unwrap(), color);
+    }
+
+    let pending = PublishOutcome::Pending.encode().unwrap();
+    assert_eq!(
+        pending,
+        Value::Record(BTreeMap::from([(
+            UNION_CASE_FIELD.into(),
+            Value::String("Pending".into()),
+        )]))
+    );
+
+    let published = PublishOutcome::Published(Receipt { number: 7 })
+        .encode()
+        .unwrap();
+    let Value::Record(fields) = &published else {
+        panic!("union must encode as a record")
+    };
+    assert_eq!(
+        fields.get(UNION_CASE_FIELD),
+        Some(&Value::String("Published".into()))
+    );
+    assert!(matches!(
+        fields.get(UNION_VALUE_FIELD),
+        Some(Value::Record(_))
+    ));
+
+    for outcome in [
+        PublishOutcome::Pending,
+        PublishOutcome::Published(Receipt { number: 7 }),
+        PublishOutcome::Rejected("policy".into()),
+    ] {
+        let encoded = outcome.clone().encode().unwrap();
+        assert_eq!(PublishOutcome::decode(encoded).unwrap(), outcome);
+    }
+}
+
+#[test]
+fn derived_declarations_use_canonical_named_type_expressions() {
+    let mut declarations = Vec::new();
+    Request::collect_declarations(&mut declarations);
+    Color::collect_declarations(&mut declarations);
+    PublishOutcome::collect_declarations(&mut declarations);
+
+    let request = declarations
+        .iter()
+        .find(|declaration| declaration.name == "Request")
+        .unwrap();
+    assert_eq!(
+        request.documentation.as_ref().unwrap().summary,
+        "A request record."
+    );
+    let TypeExpr::Record { fields } = &request.definition else {
+        panic!("Request must be a record declaration")
+    };
+    assert_eq!(
+        fields[0].documentation.as_ref().unwrap().summary,
+        "Required title."
+    );
+    assert!(fields[0].required);
+    assert!(!fields[1].required);
+    assert_eq!(fields[1].r#type, TypeExpr::Integer);
+    assert_eq!(
+        fields[2].r#type,
+        TypeExpr::List {
+            items: Box::new(TypeExpr::Entry),
+        }
+    );
+
+    let color = declarations
+        .iter()
+        .find(|declaration| declaration.name == "Color")
+        .unwrap();
+    let TypeExpr::Enum { cases } = &color.definition else {
+        panic!("Color must be an enum declaration")
+    };
+    assert_eq!(
+        cases[0].documentation.as_ref().unwrap().summary,
+        "Warm red."
+    );
+
+    let outcome = declarations
+        .iter()
+        .find(|declaration| declaration.name == "PublishOutcome")
+        .unwrap();
+    let TypeExpr::Union { cases } = &outcome.definition else {
+        panic!("PublishOutcome must be a union declaration")
+    };
+    assert_eq!(cases[0].payload, None);
+    assert_eq!(
+        cases[1].payload,
+        Some(TypeExpr::Named {
+            name: "Receipt".into(),
+        })
+    );
+    assert!(
+        declarations
+            .iter()
+            .any(|declaration| declaration.name == "Receipt")
+    );
+}
+
+#[test]
+fn codecs_reject_invalid_boundaries_and_json_bytes() {
+    assert!(i64::MAX.encode().is_err());
+    assert!(f64::NAN.encode().is_err());
+    assert!(Request::decode(Value::Record(BTreeMap::new())).is_err());
+    assert!(
+        Request::decode(Value::Record(BTreeMap::from([(
+            "unknown".into(),
+            Value::String("value".into()),
+        )])))
+        .is_err()
+    );
+    assert!(Color::decode(Value::String("Green".into())).is_err());
+    assert!(Entry::new("articles/1").is_err());
+    assert!(Entry::decode(Value::String("/articles/../1".into())).is_err());
+    assert!(JsonValue::decode(Value::Bytes(vec![1])).is_err());
+    assert!(
+        JsonValue::decode(Value::Record(BTreeMap::from([(
+            "nested".into(),
+            Value::List(vec![Value::Bytes(vec![1])]),
+        )])))
+        .is_err()
+    );
+}

crates/wip-interface/tests/compile_fail.rs

@@ -0,0 +1,5 @@
+#[test]
+fn rejects_unsupported_interface_and_dto_syntax() {
+    let tests = trybuild::TestCases::new();
+    tests.compile_fail("tests/ui/*.rs");
+}

crates/wip-interface/tests/interface.rs

@@ -0,0 +1,303 @@
+use std::collections::BTreeMap;
+
+use wip_interface::wip_protocol::{INTERFACE_FORMAT_V1, TypeExpr, Value};
+use wip_interface::{
+    DispatchError, DispatchPhase, EffectGuarantee, HostError, HostErrorKind, OperationResult,
+    WipType, interface,
+};
+
+/// Publication request.
+#[derive(Debug, Clone, PartialEq, WipType)]
+pub struct PublishRequest {
+    /// Item title.
+    pub title: String,
+}
+
+/// Application outcome, including domain failure.
+#[derive(Debug, Clone, PartialEq, WipType)]
+pub enum PublishOutcome {
+    /// The item was accepted.
+    Published(bool),
+    /// The application rejected the item.
+    Rejected(String),
+}
+
+/// Catalog editing capability.
+///
+/// The shape is implementation-independent.
+#[interface]
+pub trait Catalog {
+    /// Publishes one item.
+    ///
+    /// This operation can report a domain rejection in its application union.
+    ///
+    /// # Returns
+    /// The application publication outcome.
+    fn publish(
+        &self,
+        /// Item to publish.
+        request: PublishRequest,
+        /// Optional audit note.
+        note: Option<String>,
+    ) -> OperationResult<PublishOutcome>;
+
+    /// Checks connectivity without returning application data.
+    fn ping(&self) -> OperationResult<()>;
+
+    /// Demonstrates a host/runtime failure.
+    ///
+    /// # Returns
+    /// A value only when the host succeeds.
+    fn host_value(&self) -> OperationResult<String>;
+}
+
+struct AcceptingCatalog;
+
+impl Catalog for AcceptingCatalog {
+    fn publish(
+        &self,
+        request: PublishRequest,
+        note: Option<String>,
+    ) -> OperationResult<PublishOutcome> {
+        assert_eq!(request.title, "example");
+        assert_eq!(note.as_deref(), Some("audit"));
+        Ok(PublishOutcome::Published(true))
+    }
+
+    fn ping(&self) -> OperationResult<()> {
+        Ok(())
+    }
+
+    fn host_value(&self) -> OperationResult<String> {
+        Err(HostError::internal(
+            "backend unavailable",
+            EffectGuarantee::Unknown,
+        ))
+    }
+}
+
+struct RejectingCatalog;
+
+impl Catalog for RejectingCatalog {
+    fn publish(
+        &self,
+        _request: PublishRequest,
+        _note: Option<String>,
+    ) -> OperationResult<PublishOutcome> {
+        Ok(PublishOutcome::Rejected("policy".into()))
+    }
+
+    fn ping(&self) -> OperationResult<()> {
+        Ok(())
+    }
+
+    fn host_value(&self) -> OperationResult<String> {
+        Ok("ready".into())
+    }
+}
+
+struct PanickingCatalog;
+
+impl Catalog for PanickingCatalog {
+    fn publish(
+        &self,
+        _request: PublishRequest,
+        _note: Option<String>,
+    ) -> OperationResult<PublishOutcome> {
+        panic!("private panic payload")
+    }
+
+    fn ping(&self) -> OperationResult<()> {
+        panic!("private panic payload")
+    }
+
+    fn host_value(&self) -> OperationResult<String> {
+        panic!("private panic payload")
+    }
+}
+
+fn publish_arguments(with_note: bool) -> BTreeMap<String, Value> {
+    let mut arguments = BTreeMap::from([(
+        "request".into(),
+        PublishRequest {
+            title: "example".into(),
+        }
+        .encode()
+        .unwrap(),
+    )]);
+    if with_note {
+        arguments.insert("note".into(), Value::String("audit".into()));
+    }
+    arguments
+}
+
+#[test]
+fn descriptor_is_canonical_and_generated_only_from_the_trait_declaration() {
+    let first = CatalogDefinition::descriptor();
+    let second = CatalogDefinition::descriptor();
+    assert_eq!(first, second);
+    first.validate().unwrap();
+
+    assert_eq!(first.format, INTERFACE_FORMAT_V1);
+    assert_eq!(
+        first.documentation.as_ref().unwrap().summary,
+        "Catalog editing capability."
+    );
+    assert_eq!(
+        first.documentation.as_ref().unwrap().details.as_deref(),
+        Some("The shape is implementation-independent.")
+    );
+    assert_eq!(first.operations.len(), 3);
+
+    let publish = &first.operations[0];
+    assert_eq!(publish.name, "publish");
+    assert_eq!(publish.parameters[0].name, "request");
+    assert_eq!(
+        publish.parameters[0]
+            .documentation
+            .as_ref()
+            .unwrap()
+            .summary,
+        "Item to publish."
+    );
+    assert!(publish.parameters[0].required);
+    assert!(!publish.parameters[1].required);
+    assert_eq!(
+        publish.returns.documentation.as_ref().unwrap().summary,
+        "The application publication outcome."
+    );
+    assert_eq!(
+        publish.returns.r#type,
+        TypeExpr::Named {
+            name: "PublishOutcome".into(),
+        }
+    );
+    assert_eq!(first.operations[1].returns.r#type, TypeExpr::Unit);
+    assert!(
+        first
+            .types
+            .iter()
+            .any(|declaration| matches!(declaration.definition, TypeExpr::Record { .. }))
+    );
+    assert!(
+        first
+            .types
+            .iter()
+            .any(|declaration| matches!(declaration.definition, TypeExpr::Union { .. }))
+    );
+
+    // Both implementation types satisfy one immutable generated definition;
+    // implementation selection cannot contribute fields to the descriptor.
+    fn accepts_definition<T: Catalog>(_: &T) {}
+    accepts_definition(&AcceptingCatalog);
+    accepts_definition(&RejectingCatalog);
+    assert_eq!(CatalogDefinition::descriptor(), first);
+}
+
+#[test]
+fn generated_argument_decoder_and_result_encoder_use_raw_values() {
+    let decoded = CatalogPublishArguments::decode(publish_arguments(false)).unwrap();
+    assert_eq!(decoded.request.title, "example");
+    assert_eq!(decoded.note, None);
+
+    let encoded =
+        CatalogPublishArguments::encode_result(PublishOutcome::Rejected("domain".into())).unwrap();
+    assert_eq!(
+        PublishOutcome::decode(encoded).unwrap(),
+        PublishOutcome::Rejected("domain".into())
+    );
+    assert_eq!(
+        CatalogPingArguments::encode_result(()).unwrap(),
+        Value::Unit
+    );
+}
+
+#[test]
+fn typed_dispatch_validates_decodes_invokes_encodes_and_validates() {
+    let value =
+        CatalogDefinition::dispatch(&AcceptingCatalog, "publish", publish_arguments(true)).unwrap();
+    assert_eq!(
+        PublishOutcome::decode(value).unwrap(),
+        PublishOutcome::Published(true)
+    );
+
+    assert_eq!(
+        CatalogDefinition::dispatch(&AcceptingCatalog, "ping", BTreeMap::new()).unwrap(),
+        Value::Unit
+    );
+
+    let invalid =
+        CatalogDefinition::dispatch(&AcceptingCatalog, "publish", BTreeMap::new()).unwrap_err();
+    assert!(matches!(invalid, DispatchError::InvalidArguments(_)));
+    assert_eq!(invalid.phase(), DispatchPhase::BeforeInvocation);
+    assert_eq!(invalid.effect_guarantee(), None);
+
+    let host =
+        CatalogDefinition::dispatch(&AcceptingCatalog, "host_value", BTreeMap::new()).unwrap_err();
+    assert!(
+        matches!(&host, DispatchError::Host(error) if error.message() == "backend unavailable")
+    );
+    assert_eq!(host.phase(), DispatchPhase::AfterInvocation);
+    assert_eq!(host.effect_guarantee(), Some(EffectGuarantee::Unknown));
+
+    let panic =
+        CatalogDefinition::dispatch(&PanickingCatalog, "host_value", BTreeMap::new()).unwrap_err();
+    assert!(matches!(panic, DispatchError::Panic));
+    assert_eq!(panic.phase(), DispatchPhase::AfterInvocation);
+    assert_eq!(panic.effect_guarantee(), Some(EffectGuarantee::Unknown));
+    assert!(!panic.to_string().contains("private panic payload"));
+
+    let unknown =
+        CatalogDefinition::dispatch(&AcceptingCatalog, "missing", BTreeMap::new()).unwrap_err();
+    assert!(matches!(unknown, DispatchError::UnknownOperation(name) if name == "missing"));
+}
+
+#[test]
+fn host_errors_require_a_typed_kind_and_effect_guarantee() {
+    let internal = HostError::internal("x".repeat(4_096), EffectGuarantee::NotCommitted);
+    assert_eq!(internal.kind(), HostErrorKind::Internal);
+    assert_eq!(internal.effect_guarantee(), EffectGuarantee::NotCommitted);
+    assert!(internal.message().len() <= 512);
+
+    let resource = HostError::resource_limit("deadline", EffectGuarantee::Unknown);
+    assert_eq!(resource.kind(), HostErrorKind::ResourceLimitExceeded);
+    assert_eq!(resource.effect_guarantee(), EffectGuarantee::Unknown);
+}
+
+/// Operations whose distinct source names normalize to the same PascalCase.
+#[interface]
+pub trait DistinctOperations {
+    /// Returns the first item marker.
+    fn item(&self) -> OperationResult<String>;
+
+    /// Returns the underscored item marker.
+    fn item_(&self) -> OperationResult<String>;
+}
+
+struct DistinctImplementation;
+
+impl DistinctOperations for DistinctImplementation {
+    fn item(&self) -> OperationResult<String> {
+        Ok("item".into())
+    }
+
+    fn item_(&self) -> OperationResult<String> {
+        Ok("item_".into())
+    }
+}
+
+#[test]
+fn distinct_operation_names_always_generate_distinct_public_items() {
+    let descriptor = DistinctOperationsDefinition::descriptor();
+    assert_eq!(descriptor.operations[0].name, "item");
+    assert_eq!(descriptor.operations[1].name, "item_");
+
+    let first =
+        DistinctOperationsDefinition::dispatch(&DistinctImplementation, "item", BTreeMap::new())
+            .unwrap();
+    let second =
+        DistinctOperationsDefinition::dispatch(&DistinctImplementation, "item_", BTreeMap::new())
+            .unwrap();
+    assert_eq!(first, Value::String("item".into()));
+    assert_eq!(second, Value::String("item_".into()));
+}

crates/wip-interface/tests/ui/associated_type.rs

@@ -0,0 +1,10 @@
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+pub trait AssociatedType {
+    type Item;
+
+    fn load(&self) -> OperationResult<String>;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/associated_type.stderr

@@ -0,0 +1,13 @@
+error: associated types are not supported in WIP interfaces
+ --> tests/ui/associated_type.rs:5:5
+  |
+5 |     type Item;
+  |     ^^^^^^^^^^
+
+warning: unused import: `OperationResult`
+ --> tests/ui/associated_type.rs:1:21
+  |
+1 | use wip_interface::{OperationResult, interface};
+  |                     ^^^^^^^^^^^^^^^
+  |
+  = note: `#[warn(unused_imports)]` (part of `#[warn(unused)]`) on by default

crates/wip-interface/tests/ui/async_operation.rs

@@ -0,0 +1,8 @@
+use wip_interface::interface;
+
+#[interface]
+pub trait AsyncOperation {
+    async fn status(&self) -> wip_interface::OperationResult<String>;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/async_operation.stderr

@@ -0,0 +1,5 @@
+error: async operations are not supported
+ --> tests/ui/async_operation.rs:5:5
+  |
+5 |     async fn status(&self) -> wip_interface::OperationResult<String>;
+  |     ^^^^^

crates/wip-interface/tests/ui/bad_receiver.rs

@@ -0,0 +1,8 @@
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+pub trait BadReceiver {
+    fn load(&mut self) -> OperationResult<String>;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/bad_receiver.stderr

@@ -0,0 +1,13 @@
+error: the only supported receiver is exactly `&self`
+ --> tests/ui/bad_receiver.rs:5:13
+  |
+5 |     fn load(&mut self) -> OperationResult<String>;
+  |             ^^^^^^^^^
+
+warning: unused import: `OperationResult`
+ --> tests/ui/bad_receiver.rs:1:21
+  |
+1 | use wip_interface::{OperationResult, interface};
+  |                     ^^^^^^^^^^^^^^^
+  |
+  = note: `#[warn(unused_imports)]` (part of `#[warn(unused)]`) on by default

crates/wip-interface/tests/ui/bad_return.rs

@@ -0,0 +1,8 @@
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+pub trait BadReturn {
+    fn load(&self) -> String;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/bad_return.stderr

@@ -0,0 +1,13 @@
+error: an operation must explicitly return `OperationResult<T>`
+ --> tests/ui/bad_return.rs:5:23
+  |
+5 |     fn load(&self) -> String;
+  |                       ^^^^^^
+
+warning: unused import: `OperationResult`
+ --> tests/ui/bad_return.rs:1:21
+  |
+1 | use wip_interface::{OperationResult, interface};
+  |                     ^^^^^^^^^^^^^^^
+  |
+  = note: `#[warn(unused_imports)]` (part of `#[warn(unused)]`) on by default

crates/wip-interface/tests/ui/custom_lifetime.rs

@@ -0,0 +1,8 @@
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+pub trait BorrowedValue<'a> {
+    fn load(&self, value: &'a str) -> OperationResult<String>;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/custom_lifetime.stderr

@@ -0,0 +1,13 @@
+error: generic WIP interface traits are not supported
+ --> tests/ui/custom_lifetime.rs:4:24
+  |
+4 | pub trait BorrowedValue<'a> {
+  |                        ^^^^
+
+warning: unused import: `OperationResult`
+ --> tests/ui/custom_lifetime.rs:1:21
+  |
+1 | use wip_interface::{OperationResult, interface};
+  |                     ^^^^^^^^^^^^^^^
+  |
+  = note: `#[warn(unused_imports)]` (part of `#[warn(unused)]`) on by default

crates/wip-interface/tests/ui/default_method.rs

@@ -0,0 +1,10 @@
+use wip_interface::interface;
+
+#[interface]
+pub trait DefaultMethod {
+    fn status(&self) -> wip_interface::OperationResult<String> {
+        Ok(String::new())
+    }
+}
+
+fn main() {}

crates/wip-interface/tests/ui/default_method.stderr

@@ -0,0 +1,8 @@
+error: WIP operation methods must not have a body
+ --> tests/ui/default_method.rs:5:64
+  |
+5 |       fn status(&self) -> wip_interface::OperationResult<String> {
+  |  ________________________________________________________________^
+6 | |         Ok(String::new())
+7 | |     }
+  | |_____^

crates/wip-interface/tests/ui/duplicate_operation.rs

@@ -0,0 +1,9 @@
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+pub trait DuplicateOperation {
+    fn load(&self) -> OperationResult<String>;
+    fn load(&self, other: String) -> OperationResult<String>;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/duplicate_operation.stderr

@@ -0,0 +1,13 @@
+error: duplicate operation name `load`
+ --> tests/ui/duplicate_operation.rs:6:8
+  |
+6 |     fn load(&self, other: String) -> OperationResult<String>;
+  |        ^^^^
+
+warning: unused import: `OperationResult`
+ --> tests/ui/duplicate_operation.rs:1:21
+  |
+1 | use wip_interface::{OperationResult, interface};
+  |                     ^^^^^^^^^^^^^^^
+  |
+  = note: `#[warn(unused_imports)]` (part of `#[warn(unused)]`) on by default

crates/wip-interface/tests/ui/generic_dto.rs

@@ -0,0 +1,8 @@
+use wip_interface::WipType;
+
+#[derive(WipType)]
+struct GenericDto<T> {
+    value: T,
+}
+
+fn main() {}

crates/wip-interface/tests/ui/generic_dto.stderr

@@ -0,0 +1,5 @@
+error: generic DTOs are not supported by `WipType`
+ --> tests/ui/generic_dto.rs:4:18
+  |
+4 | struct GenericDto<T> {
+  |                  ^^^

crates/wip-interface/tests/ui/generic_method.rs

@@ -0,0 +1,8 @@
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+pub trait GenericOperation {
+    fn load<T>(&self, value: T) -> OperationResult<String>;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/generic_method.stderr

@@ -0,0 +1,13 @@
+error: generic operations are not supported
+ --> tests/ui/generic_method.rs:5:12
+  |
+5 |     fn load<T>(&self, value: T) -> OperationResult<String>;
+  |            ^^^
+
+warning: unused import: `OperationResult`
+ --> tests/ui/generic_method.rs:1:21
+  |
+1 | use wip_interface::{OperationResult, interface};
+  |                     ^^^^^^^^^^^^^^^
+  |
+  = note: `#[warn(unused_imports)]` (part of `#[warn(unused)]`) on by default

crates/wip-interface/tests/ui/inherited_trait.rs

@@ -0,0 +1,8 @@
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+pub trait Inherited: Send {
+    fn load(&self) -> OperationResult<String>;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/inherited_trait.stderr

@@ -0,0 +1,13 @@
+error: WIP interface trait inheritance is not supported
+ --> tests/ui/inherited_trait.rs:4:22
+  |
+4 | pub trait Inherited: Send {
+  |                      ^^^^
+
+warning: unused import: `OperationResult`
+ --> tests/ui/inherited_trait.rs:1:21
+  |
+1 | use wip_interface::{OperationResult, interface};
+  |                     ^^^^^^^^^^^^^^^
+  |
+  = note: `#[warn(unused_imports)]` (part of `#[warn(unused)]`) on by default

crates/wip-interface/tests/ui/mixed_enum.rs

@@ -0,0 +1,9 @@
+use wip_interface::WipType;
+
+#[derive(WipType)]
+enum UnsupportedEnum {
+    Empty,
+    Payload { value: String },
+}
+
+fn main() {}

crates/wip-interface/tests/ui/mixed_enum.stderr

@@ -0,0 +1,5 @@
+error: a `WipType` enum must contain unit variants and/or single-field tuple variants; named-field and multi-field variants are unsupported
+ --> tests/ui/mixed_enum.rs:6:5
+  |
+6 |     Payload { value: String },
+  |     ^^^^^^^

crates/wip-interface/tests/ui/nested_option.rs

@@ -0,0 +1,8 @@
+use wip_interface::WipType;
+
+#[derive(WipType)]
+struct NestedOption {
+    values: Vec<Option<String>>,
+}
+
+fn main() {}

crates/wip-interface/tests/ui/nested_option.stderr

@@ -0,0 +1,5 @@
+error: `Option<T>` must appear directly as the DTO field type
+ --> tests/ui/nested_option.rs:5:13
+  |
+5 |     values: Vec<Option<String>>,
+  |             ^^^^^^^^^^^^^^^^^^^

crates/wip-interface/tests/ui/private_trait.rs

@@ -0,0 +1,8 @@
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+trait PrivateInterface {
+    fn load(&self) -> OperationResult<String>;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/private_trait.stderr

@@ -0,0 +1,15 @@
+error: a WIP interface trait must be public
+ --> tests/ui/private_trait.rs:3:1
+  |
+3 | #[interface]
+  | ^^^^^^^^^^^^
+  |
+  = note: this error originates in the attribute macro `interface` (in Nightly builds, run with -Z macro-backtrace for more info)
+
+warning: unused import: `OperationResult`
+ --> tests/ui/private_trait.rs:1:21
+  |
+1 | use wip_interface::{OperationResult, interface};
+  |                     ^^^^^^^^^^^^^^^
+  |
+  = note: `#[warn(unused_imports)]` (part of `#[warn(unused)]`) on by default

crates/wip-interface/tests/ui/tuple_dto.rs

@@ -0,0 +1,6 @@
+use wip_interface::WipType;
+
+#[derive(WipType)]
+struct TupleDto(String, String);
+
+fn main() {}

crates/wip-interface/tests/ui/tuple_dto.stderr

@@ -0,0 +1,5 @@
+error: `WipType` supports only structs with named fields
+ --> tests/ui/tuple_dto.rs:4:16
+  |
+4 | struct TupleDto(String, String);
+  |                ^^^^^^^^^^^^^^^^

crates/wip-interface/tests/ui/unsupported_type.rs

@@ -0,0 +1,8 @@
+use wip_interface::{OperationResult, interface};
+
+#[interface]
+pub trait UnsupportedType {
+    fn load(&self, pair: (String, String)) -> OperationResult<String>;
+}
+
+fn main() {}

crates/wip-interface/tests/ui/unsupported_type.stderr

@@ -0,0 +1,31 @@
+error[E0277]: the trait bound `(std::string::String, std::string::String): WipType` is not satisfied
+ --> tests/ui/unsupported_type.rs:5:26
+  |
+5 |     fn load(&self, pair: (String, String)) -> OperationResult<String>;
+  |                          ^^^^^^^^^^^^^^^^ the trait `WipType` is not implemented for `(std::string::String, std::string::String)`
+  |
+help: the trait `WipType` is implemented for `()`
+ --> src/lib.rs
+  |
+  | impl WipType for () {
+  | ^^^^^^^^^^^^^^^^^^^
+
+error[E0277]: the trait bound `(std::string::String, std::string::String): WipType` is not satisfied
+ --> tests/ui/unsupported_type.rs:5:26
+  |
+3 | #[interface]
+  | ------------ required by a bound introduced by this call
+4 | pub trait UnsupportedType {
+5 |     fn load(&self, pair: (String, String)) -> OperationResult<String>;
+  |                          ^^^^^^^^^^^^^^^^ the trait `WipType` is not implemented for `(std::string::String, std::string::String)`
+  |
+help: the trait `WipType` is implemented for `()`
+ --> src/lib.rs
+  |
+  | impl WipType for () {
+  | ^^^^^^^^^^^^^^^^^^^
+note: required by a bound in `wip_interface::__private::RecordDecoder::required`
+ --> src/lib.rs
+  |
+  |         pub fn required<T: WipType>(&mut self, name: &str) -> Result<T, CodecError> {
+  |                            ^^^^^^^ required by this bound in `RecordDecoder::required`

crates/wip-protocol/Cargo.toml

@@ -1,8 +1,12 @@
 [package]
 name = "wip-protocol"
-version = "0.1.0"
-edition = "2024"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
 description = "Transport-independent logical model and validation for WIP"
-license = "MIT OR Apache-2.0"
+license.workspace = true
+repository.workspace = true
+readme = "README.md"
+documentation = "https://docs.rs/wip-protocol"
 
 [dependencies]

crates/wip-protocol/LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

crates/wip-protocol/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

crates/wip-protocol/README.md

@@ -0,0 +1,23 @@
+# wip-protocol
+
+Transport-independent logical types and validation for the Web Interface Protocol (WIP).
+
+This crate defines the canonical Object and Interface Descriptor models, the three Core interaction request and response types, schema-neutral operation `Value`s, validators, protocol errors, and structural validation. It does not define an HTTP mapping, application DTOs, persistence, or network I/O.
+
+```toml
+[dependencies]
+wip-protocol = "0.1.0"
+```
+
+Interface identity is an exact `InterfaceReference { scope, name }` pair.
+`scope` is a canonical absolute Worldspace path and `name` is nonempty Unicode.
+Use `validate()` for shape, `validate_for_path()` for ancestor-or-self placement,
+and Object/interaction validation at response boundaries. Fetching needs no
+target Object path. Fetch responses and interface call targets carry optional
+opaque string `scope_ref` metadata, not a third identity field. Descriptors do
+not embed identity. See the repository's [migration guide](../../MIGRATION.md)
+for the breaking Rust and HTTP wire changes and deferred consumer semantics.
+
+See the [API documentation](https://docs.rs/wip-protocol) for the complete model and validation rules.
+
+Licensed under either of Apache-2.0 or MIT at your option.

crates/wip-protocol/src/error.rs

@@ -8,79 +8,65 @@ pub enum NameNamespace {
     TypeDeclaration,
     /// Operations in an interface descriptor.
     Operation,
-    /// Fields in a record declaration.
+    /// Fields in an inline or named record type.
     Field,
     /// Parameters in an operation declaration.
     Parameter,
-    /// Variants in an enum declaration.
-    EnumVariant,
-    /// Variants in a union declaration.
-    UnionVariant,
-    /// Fields supplied in a record value.
-    RecordValueField,
-    /// Arguments supplied in an operation call.
-    Argument,
-    /// Members in a logical JSON object.
-    JsonMember,
-    /// Descriptors in an interface observation.
-    InterfaceDescriptor,
+    /// Cases in an enum type.
+    EnumCase,
+    /// Cases in a union type.
+    UnionCase,
+    /// Child object names beneath one tree node.
+    ChildObject,
 }
 
-/// Structural kind of a logical protocol value.
+/// Structural kind of a schema-neutral logical value.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ValueKind {
-    /// String value.
-    String,
+    /// Unit value.
+    Unit,
     /// Boolean value.
     Boolean,
     /// Integer value.
     Integer,
     /// Floating-point number value.
     Number,
+    /// String value.
+    String,
     /// Byte sequence.
     Bytes,
-    /// List value.
-    List,
-    /// Key/value entry.
-    Entry,
     /// Record value.
     Record,
-    /// Enum value.
-    Enum,
-    /// Tagged-union value.
-    Union,
-    /// Logical JSON value.
-    Json,
+    /// List value.
+    List,
 }
 
 /// A typed segment identifying a declaration or value location.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum PathSegment {
-    /// Interface descriptor.
-    Interface(String),
+    /// Descriptor root.
+    Descriptor,
     /// Named type declaration.
     Declaration(String),
     /// Operation declaration or call.
     Operation(String),
     /// Record field declaration or value.
     Field(String),
-    /// Operation parameter declaration or argument.
+    /// Operation parameter or argument.
     Parameter(String),
-    /// Enum or union variant.
-    Variant(String),
-    /// List or JSON array index.
+    /// Enum or union case.
+    Case(String),
+    /// List index.
     Index(usize),
-    /// Entry key.
-    EntryKey,
-    /// Entry value.
-    EntryValue,
     /// Operation return value.
     Return,
-    /// JSON object member.
-    JsonMember(String),
+    /// Object at a Worldspace path.
+    Object(String),
+    /// Child object in an observation response.
+    Child(String),
 }
 
-/// Machine-readable reason why protocol validation failed.
+/// Machine-readable reason why logical protocol validation failed.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum ValidationErrorKind {
     /// A name occurred more than once in one namespace.
@@ -117,11 +103,15 @@ pub enum ValidationErrorKind {
         /// Missing field name.
         name: String,
     },
-    /// An enum or union value selected an undeclared variant.
-    UnknownVariant {
-        /// Unknown variant name.
+    /// An enum or union selected an undeclared case.
+    UnknownCase {
+        /// Unknown case name.
         name: String,
     },
+    /// A payload-bearing union case omitted `value`.
+    MissingUnionPayload,
+    /// A payload-free union case supplied `value`.
+    UnexpectedUnionPayload,
     /// An operation call contains an undeclared argument.
     UnknownParameter {
         /// Unknown parameter name.
@@ -132,44 +122,73 @@ pub enum ValidationErrorKind {
         /// Missing parameter name.
         name: String,
     },
-    /// An integer is outside the JavaScript-lossless range.
+    /// An operation is not declared by the descriptor.
+    UnknownOperation {
+        /// Unknown operation name.
+        name: String,
+    },
+    /// An integer is outside the interoperable safe range.
     IntegerOutOfRange {
         /// Rejected integer.
         value: i64,
     },
     /// A numeric value is NaN or infinite.
     NonFiniteNumber,
+    /// A JSON-interpreted value tree contains protocol bytes.
+    BytesInJson,
+    /// An object name is not a valid root or non-root path segment.
+    InvalidObjectName {
+        /// Rejected object name.
+        name: String,
+    },
     /// An object's ordered interface set contains a duplicate.
     DuplicateInterface {
-        /// Duplicate interface name.
-        name: String,
+        /// Duplicate structured interface reference.
+        reference: crate::InterfaceReference,
     },
-    /// An observation omits a descriptor named by its object.
-    MissingInterfaceDescriptor {
-        /// Missing interface name.
-        name: String,
+    /// The local interface name is empty.
+    EmptyInterfaceName,
+    /// A valid scope is not an ancestor-or-self of the target path.
+    InterfaceScopeMismatch {
+        /// Selected scope path.
+        scope: String,
+        /// Target Object path.
+        path: String,
     },
-    /// An observation contains a descriptor not named by its object.
-    UnexpectedInterfaceDescriptor {
-        /// Unexpected interface name.
-        name: String,
+    /// A string is not a canonical absolute Worldspace path.
+    InvalidPath {
+        /// Rejected path.
+        path: String,
     },
-    /// A call targets an interface other than the descriptor being used.
-    InterfaceMismatch {
-        /// Descriptor interface name.
+    /// An object name does not match the path where it was observed.
+    ObjectNameMismatch {
+        /// Name required by the observation path.
         expected: String,
-        /// Call target interface name.
+        /// Name supplied by the object.
         actual: String,
     },
-    /// An operation is not declared by the interface.
-    UnknownOperation {
-        /// Unknown operation name.
-        name: String,
+    /// Equivalent ref/validator observations disagree on object representation.
+    InconsistentObjectObservation {
+        /// Shared opaque object reference.
+        reference: String,
+    },
+    /// An observation omitted children before reaching the requested depth.
+    ChildrenMissingBeforeDepth {
+        /// Node depth where children were required.
+        depth: u32,
+    },
+    /// An observation included children at the requested depth boundary.
+    ChildrenAtDepthBoundary {
+        /// Boundary depth where children must be unobserved.
+        depth: u32,
+    },
+    /// A response refers to a different interface than its request.
+    InterfaceResponseMismatch {
+        /// Requested structured reference (boxed to keep validation errors small).
+        expected: Box<crate::InterfaceReference>,
+        /// Returned structured reference (boxed to keep validation errors small).
+        actual: Box<crate::InterfaceReference>,
     },
-    /// A no-return operation produced a value.
-    UnexpectedReturnValue,
-    /// An operation with a return declaration produced no value.
-    MissingReturnValue,
 }
 
 /// A validation failure with a typed path to the failing location.
@@ -211,30 +230,150 @@ impl Display for ValidationError {
 
 impl Error for ValidationError {}
 
-/// Stable category of an error returned by a protocol host runtime.
+/// One core interaction whose failure codes form a closed set.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ProtocolErrorCategory {
-    /// The request is structurally invalid.
-    InvalidRequest,
-    /// The target object is not published.
-    ObjectNotFound,
-    /// The target interface is not implemented by the object.
-    InterfaceNotFound,
-    /// The target operation is not declared by the interface.
-    OperationNotFound,
-    /// Supplied operation arguments are invalid.
-    InvalidArguments,
-    /// The implementation rejected the call for a domain reason.
-    OperationFailed,
-    /// The host encountered an internal failure.
-    Internal,
+pub enum ProtocolInteraction {
+    /// Observe one object and its indexable descendants to a requested depth.
+    Observe,
+    /// Fetch one interface descriptor by its structured reference.
+    FetchInterface,
+    /// Invoke one operation on a path-targeted object.
+    CallOperation,
 }
 
-/// Transport-independent protocol failure returned by a host runtime.
+/// Stable protocol failure code returned by a host.
+///
+/// This is the complete wire-level code set. A Client treats a malformed success
+/// or failure response, including a code disallowed for its interaction, as a
+/// Client-local `InvalidResponse`. An unsupported descriptor format is likewise
+/// a Client-local `UnsupportedDescriptorFormat`; neither condition is a code a
+/// Host can return.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ProtocolErrorCode {
+    /// The request is structurally invalid before an operation descriptor is fixed.
+    InvalidRequest,
+    /// The target object is not published.
+    NotFound,
+    /// The interface reference is not currently published.
+    InterfaceNotFound,
+    /// The selected interface is not on the current object.
+    InterfaceMismatch,
+    /// The selected operation is not declared by the current interface.
+    OperationNotFound,
+    /// Supplied arguments do not match the fixed operation declaration.
+    InvalidArguments,
+    /// The operation requires an object validator and none was supplied.
+    ValidatorRequired,
+    /// The supplied object validator does not match current state.
+    ValidatorMismatch,
+    /// A mutable interface requires its validator and none was supplied.
+    InterfaceValidatorRequired,
+    /// The supplied interface validator does not match the descriptor.
+    InterfaceValidatorMismatch,
+    /// A published operation is not permitted for the caller.
+    PermissionDenied,
+    /// A bounded protocol resource limit was exceeded.
+    ///
+    /// For `call_operation`, the Host guarantees that the operation was not run
+    /// or that all of its effects were rolled back.
+    ResourceLimitExceeded,
+    /// The Host encountered an internal failure.
+    ///
+    /// For `call_operation`, the Host guarantees that the operation was not run
+    /// or that all of its effects were rolled back.
+    Internal,
+    /// The Host cannot guarantee that the operation was not run or rolled back.
+    ///
+    /// A Client must not automatically retry because the operation may have
+    /// committed effects even though no success response was available.
+    OperationOutcomeUnknown,
+}
+
+impl ProtocolErrorCode {
+    /// Every canonical wire-level error code.
+    pub const ALL: [Self; 14] = [
+        Self::InvalidRequest,
+        Self::NotFound,
+        Self::InterfaceNotFound,
+        Self::InterfaceMismatch,
+        Self::OperationNotFound,
+        Self::InvalidArguments,
+        Self::ValidatorRequired,
+        Self::ValidatorMismatch,
+        Self::InterfaceValidatorRequired,
+        Self::InterfaceValidatorMismatch,
+        Self::PermissionDenied,
+        Self::ResourceLimitExceeded,
+        Self::Internal,
+        Self::OperationOutcomeUnknown,
+    ];
+
+    /// Whether a Host may return this code for `interaction`.
+    ///
+    /// `false` identifies an invalid error response; it does not turn that
+    /// response into another wire-level protocol failure.
+    #[must_use]
+    pub const fn is_allowed_for(self, interaction: ProtocolInteraction) -> bool {
+        use ProtocolErrorCode::{
+            InterfaceMismatch, InterfaceNotFound, InterfaceValidatorMismatch,
+            InterfaceValidatorRequired, Internal, InvalidArguments, InvalidRequest, NotFound,
+            OperationNotFound, OperationOutcomeUnknown, PermissionDenied, ResourceLimitExceeded,
+            ValidatorMismatch, ValidatorRequired,
+        };
+        use ProtocolInteraction::{CallOperation, FetchInterface, Observe};
+
+        match (interaction, self) {
+            (_, InvalidRequest | ResourceLimitExceeded | Internal) => true,
+            (Observe, NotFound) => true,
+            (FetchInterface, InterfaceNotFound) => true,
+            (
+                CallOperation,
+                NotFound
+                | InterfaceMismatch
+                | OperationNotFound
+                | InvalidArguments
+                | ValidatorRequired
+                | ValidatorMismatch
+                | InterfaceValidatorRequired
+                | InterfaceValidatorMismatch
+                | PermissionDenied
+                | OperationOutcomeUnknown,
+            ) => true,
+            (
+                _,
+                NotFound
+                | InterfaceNotFound
+                | InterfaceMismatch
+                | OperationNotFound
+                | InvalidArguments
+                | ValidatorRequired
+                | ValidatorMismatch
+                | InterfaceValidatorRequired
+                | InterfaceValidatorMismatch
+                | PermissionDenied
+                | OperationOutcomeUnknown,
+            ) => false,
+        }
+    }
+}
+
+/// Transport-independent protocol failure.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProtocolError {
-    /// Stable programmatic category.
-    pub category: ProtocolErrorCategory,
-    /// Human-readable diagnostic. Consumers must not branch on this text.
+    /// Stable programmatic code. Consumers must branch on this field.
+    pub code: ProtocolErrorCode,
+    /// Bounded human-readable diagnostic. Consumers must not branch on it.
     pub message: String,
 }
+
+impl Display for ProtocolError {
+    fn fmt(&self, formatter: &mut Formatter<'_>) -> fmt::Result {
+        write!(
+            formatter,
+            "protocol failure ({:?}): {}",
+            self.code, self.message
+        )
+    }
+}
+
+impl Error for ProtocolError {}