[ymote]

What this changes

An app may ship its own functions as WebAssembly modules in fns/*.wasm, and the host runs them for that app only. This PR is App Hub's side: the contract, the agent-tool rule and the store gate. OctoSense's runtime and wasm service are in OctoSense-org/OctoSense#364, which pins this branch.

• app-contract 1.7.0: KNOWN_CAPABILITIES gains wasm. (1.6.0, from Expose versioned host APIs and execute admitted app tools #138, is already on crates.io.) A function gets its input and returns its output; it reaches no file, network, clock or other app. The grant implies no other capability. The store shows "Run its own sandboxed functions on this device".
• app-policy: a tool may name host_method: "wasm.<function>" to run the app's own function. It needs the wasm capability. Unlike the reviewed shared host methods it has no risk floor and no private_data requirement, because the function sees only the arguments it is given. app-policy now asks for contract 1.7.
• store gate: .wasm becomes the one executable a bundle may carry, under these rules:
  • Location and name: only at fns/<name>.wasm, the name [a-z0-9_-] and at most 64 characters.
  • Contents: only a WebAssembly core module (magic and version 1).
  • Count: at most 8 per bundle.
  • Capability: only when the manifest declares wasm.
  • Warning: declaring wasm without any module.
  • Left to the host: a module's imports and exports, checked when it loads.
• Docs, English and Chinese:
  • PUBLISHING gains the functions check, the wasm capability row, and wasm.<function> in the host_method rules.
  • SUBMITTING lists wasm among the capabilities released stores refuse.
  • The READMEs say no release serves wasm yet.

Release

The crate goes to 1.7.0 with a CHANGELOG entry. Per the contract's release rules, it needs review from App Hub and one app owner (Rinx) before publish-app-contract runs. 1.7.0 is not published; until it is, a consumer patches crates.io's copy with this repository's revision, as the contract README describes.

How it was tested

• On main after Expose versioned host APIs and execute admitted app tools #138, cargo test --locked -p octosense-app-contract -p octosense-app-policy -p octosense-app-hub: 228 passed, 0 failed. New tests:
  • three gate tests for function modules;
  • one contract growth test;
  • one test for wasm.<function> as a host method.
• The contract crate copied out of the workspace, as app-contract.yml runs it:
  • cargo test --all-targets: 37 passed;
  • cargo test --doc: 2 passed;
  • cargo clippy --all-targets --no-deps -- -D warnings: clean.
• End to end, through OctoSense's wasm-lab build (Apps' own Rust functions in WebAssembly, behind the wasm-lab feature (ADR 0011) OctoSense#364):
  • on macOS, the system app os.wasmlab declared wasm and its agent's tools used host_method: "wasm.<function>", admitted by this policy;
  • the same app ran on an Android phone.
• Not tested: a store-installed app with fns/*.wasm running on a device. Today's OctoSense builds don't install from a catalog with a 1.6.0 app.

The design and measurements are in ADR 0011 (proposed), in OctoSense-org/OctoSense#364.

🤖 Generated with Claude Code

[ymote]

Local CI on b7fa3ab (this branch rebased on main e812331), macOS arm64, the steps of native-tools.yml (standalone, whose macOS runner is still queued) and app-contract.yml, with the sibling sources prepared and verified by Octoscript-Makepad 33dea2f1's runtime.py (makepad 32d6415f, octoscript 2e37d9e6):

PASS  build card-host + app-hub (release)  (79s)
PASS  contract, policy and hub tests (release)  (26s)
PASS  card-host CLI tests  (2s)
PASS  appstore lib (no default features)  (33s)
PASS  app-hub-app lib (no default features)  (47s)
PASS  card-host bin tests  (3s)
PASS  native bundled-font path  (3s)
PASS  contract: tests (standalone)  (14s)
PASS  contract: doc tests (standalone)  (1s)
PASS  contract: clippy (standalone)  (3s)

semver passed on GitHub for this contract source; the rebase changed nothing under crates/app-contract. Merging per the agreed order: this PR, then publishing app-contract 1.7.0, then repinning OctoSense#364.

🤖 Generated with Claude Code