ADR 0004 G3: apps offer tools end to end (+G8, G11, G12, G13, peer/input/reject)

.github/workflows/phone.yml

@@ -74,13 +74,34 @@ jobs:
         run: python3 tools/setup.py --check --cargo
       - name: The native apps' generated places match native-apps.json
         run: python3 tools/native_apps.py --check
+      # The shell's real-kernel test (crates/shell/src/host_tools/
+      # real_kernel_tests.rs: kernel -> app-peers broker -> the shell's relay
+      # -> News's host service -> the model's turn) needs an octos binary at
+      # the revision Cargo.lock pins; built once per revision and cached.
+      - name: The pinned octos revision
+        id: octos
+        run: echo "rev=$(python3 -c 'import importlib.util as u; s=u.spec_from_file_location("k","tools/kernel-artifact.py"); m=u.module_from_spec(s); s.loader.exec_module(m); print(m.octos_revision())')" >> "$GITHUB_OUTPUT"
+      # Outside target/: rust-cache restores and prunes target/.
+      - uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/octos-kernel/target/release/octos
+          key: octos-kernel-${{ runner.os }}-${{ steps.octos.outputs.rev }}
+      - name: Build octos (unless cached)
+        timeout-minutes: 45
+        run: |
+          if [ ! -x "$RUNNER_TEMP/octos-kernel/target/release/octos" ]; then
+            python3 tools/kernel-artifact.py --host --work "$RUNNER_TEMP/octos-kernel"
+          fi
       - name: Build Home, App Hub admission and runtime policy tests
         working-directory: phone
         timeout-minutes: 60
         run: cargo test --locked --features mobile-apps -p octosense-shell -p octosense-home -p octosense-app-policy -p octosense-app-hub -p octosense-appcard -p octosense-ai-host --no-run
       - name: Test Home, App Hub admission and runtime policy
         working-directory: phone
         timeout-minutes: 30
+        env:
+          # Runs the shell's real-kernel relay test instead of skipping it.
+          OCTOS_SHELL_TEST_KERNEL: ${{ runner.temp }}/octos-kernel/target/release/octos
         run: |
           # octosense-app-hub-app is App Hub's shared shell crate, a git
           # dependency with dev-dependencies: cargo cannot test it from here;

.sources

@@ -0,0 +1 @@
+../wt-2567/.sources

Cargo.toml

@@ -100,15 +100,15 @@ octosense-appstore = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub
 octosense-app-policy = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "e8601b80ce104db2e48208094714bdcffdce6b5a" }
 octosense-app-hub = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "e8601b80ce104db2e48208094714bdcffdce6b5a" }
 # --- octos: ONE source for every octos crate (octos-org/octos main at the
-# merge of octos#2616, the #2567 follow-ups).
+# merge of octos#2621, `peer/input/reject`; after #2616, the #2567 follow-ups).
 # Move octos-core, octos-cli and octos-research together; the Android kernel
 # artifact (liboctos.so) is built from this same revision.
-octos-core = { git = "https://github.com/octos-org/octos.git", rev = "acffad3b493b70d6620b57394265ec84d260ce13" }
-octos-cli = { git = "https://github.com/octos-org/octos.git", rev = "acffad3b493b70d6620b57394265ec84d260ce13", default-features = false }
+octos-core = { git = "https://github.com/octos-org/octos.git", rev = "c608384ddd217c0d857656488b3d93ba3df0dc5a" }
+octos-cli = { git = "https://github.com/octos-org/octos.git", rev = "c608384ddd217c0d857656488b3d93ba3df0dc5a", default-features = false }
 # The research engine (the metasearch, the SSRF-safe polite reader and the
 # toolbox scope) for the toolbox's `octos-engine` feature. Same source and
 # revision as above.
-octos-research = { git = "https://github.com/octos-org/octos.git", rev = "acffad3b493b70d6620b57394265ec84d260ce13", default-features = false }
+octos-research = { git = "https://github.com/octos-org/octos.git", rev = "c608384ddd217c0d857656488b3d93ba3df0dc5a", default-features = false }
 # --- AppCard's inline renderers.
 streaming-markdown-kit = { git = "https://github.com/Project-Robius-China/streaming-markdown-kit.git", branch = "main" }
 makepad-diagram-kit = { git = "https://github.com/Project-Robius-China/makepad-diagram-kit.git", branch = "main" }

apps/README.md

@@ -356,7 +356,7 @@ octos UI Protocol v1.
   kernel, a WebSocket or REST) and `octos-app-render` (streaming-markdown
   renderer).
 - **octos**: every octos crate comes from git `octos-org/octos` at the one
-  rev in the root `Cargo.toml` `[workspace.dependencies]` (today `acffad3b`,
+  rev in the root `Cargo.toml` `[workspace.dependencies]` (today `c608384d`,
   octos `main`), shared with `crates/kernel` and the shells. AppCard starts no kernel of its
   own: it connects to the shell's ([The octos kernel](#the-octos-kernel)).
 - **Makepad**: not vendored. Makepad, Octoscript and Octoscript-Makepad are
@@ -440,7 +440,7 @@ plus an entry in each shell's `system-apps.json`.
 | [OctoScript-App-Design-Flow](https://github.com/OctoSense-org/OctoScript-App-Design-Flow) | how to design, build, check and publish an app |
 | [OctoScript](https://github.com/OctoSense-org/OctoScript), [OctoScript-Makepad](https://github.com/OctoSense-org/OctoScript-Makepad), [makepad](https://github.com/OctoSense-org/makepad) | the language and runtime |
 | [Rinx](https://github.com/hagency-org/Rinx) | Matrix chats and mini apps, a native module; reaches the assistant through `crates/app-peers` |
-| [octos](https://github.com/octos-org/octos) | the agent kernel: run as a shell service by `crates/kernel`, configured by AI providers, used by AppCard and other consumers (one rev, `acffad3b`) |
+| [octos](https://github.com/octos-org/octos) | the agent kernel: run as a shell service by `crates/kernel`, configured by AI providers, used by AppCard and other consumers (one rev, `c608384d`) |
 
 ## Contributing
 

apps/README.zh-CN.md

@@ -315,7 +315,7 @@ octos UI Protocol v1 与 octos 通信。
   `octos-app-render`（流式 markdown 渲染）。
 - **octos**：所有 octos crate 都来自 git `octos-org/octos`，版本为根目录
   `Cargo.toml` 的 `[workspace.dependencies]` 中唯一的 rev（目前是 octos `main` 上的
-  `acffad3b`），与 `crates/kernel` 和 Shell 共用。AppCard 不再自己启动内核，而是连接 Shell 的内核
+  `c608384d`），与 `crates/kernel` 和 Shell 共用。AppCard 不再自己启动内核，而是连接 Shell 的内核
   （见 [octos 内核](#octos-内核)）。
 - **Makepad**：不内置。Makepad、Octoscript 和 Octoscript-Makepad 是仓库根目录下
   `.sources/` 中由 `tools/setup.py` 准备的检出，版本由 `native-runtime.lock.json`
@@ -388,7 +388,7 @@ Shell 的 `system-apps.json` 中加入它。
 | [OctoScript-App-Design-Flow](https://github.com/OctoSense-org/OctoScript-App-Design-Flow) | 如何设计、构建、检查和发布应用 |
 | [OctoScript](https://github.com/OctoSense-org/OctoScript)、[OctoScript-Makepad](https://github.com/OctoSense-org/OctoScript-Makepad)、[makepad](https://github.com/OctoSense-org/makepad) | 语言与运行时 |
 | [Rinx](https://github.com/hagency-org/Rinx) | Matrix 聊天与小程序，原生模块；通过 `crates/app-peers` 访问助手 |
-| [octos](https://github.com/octos-org/octos) | Agent 内核：由 `crates/kernel` 作为 Shell 服务运行，由 AI providers 配置，供 AppCard 等使用方使用（只用一个版本 `acffad3b`） |
+| [octos](https://github.com/octos-org/octos) | Agent 内核：由 `crates/kernel` 作为 Shell 服务运行，由 AI providers 配置，供 AppCard 等使用方使用（只用一个版本 `c608384d`） |
 
 ## 参与贡献
 

apps/appcard/README.md

@@ -42,7 +42,7 @@ docs/             Architecture, protocol, build and review notes.
 Every octos crate (`octos-core`, and on OpenHarmony `octos-cli` with the
 ~20 crates it pulls in) comes from **one** source: git
 `https://github.com/octos-org/octos.git` at the single rev in the repository's
-root `Cargo.toml` `[workspace.dependencies]` (today `acffad3b`, octos main),
+root `Cargo.toml` `[workspace.dependencies]` (today `c608384d`, octos main),
 shared with `crates/kernel` and both shells. octos's OpenHarmony-safe `nix`
 is patched in the root `[patch.crates-io]` (from octos `18fcd3f1`). There is
 no octos submodule; check the graph keeps one octos with

apps/appcard/README.zh-CN.md

@@ -39,7 +39,7 @@ docs/             架构、协议、构建与评审笔记。
 所有 octos crate（`octos-core`，以及 OpenHarmony 上的 `octos-cli` 和它引入的约
 20 个 crate）都来自**同一个**来源：git `https://github.com/octos-org/octos.git`，
 版本为仓库根目录 `Cargo.toml` 的 `[workspace.dependencies]` 中唯一的 rev（目前是
-octos main 上的 `acffad3b`），与 `crates/kernel` 和两个 Shell 共用。octos 中适配
+octos main 上的 `c608384d`），与 `crates/kernel` 和两个 Shell 共用。octos 中适配
 OpenHarmony 的 `nix` 在根目录的 `[patch.crates-io]` 中 patch（来自 octos `18fcd3f1`）。
 没有 octos submodule；可用
 `cargo tree --locked -p octos-app -i octos-core --target all --depth 0` 检查依赖图中只有一份 octos。

apps/news/bundle/manifest.json

@@ -3,7 +3,8 @@
     "storage",
     "net",
     "images",
-    "web"
+    "web",
+    "news"
   ],
   "id": "os.news",
   "integrity": {

apps/news/bundle/tools.json

@@ -0,0 +1,51 @@
+{
+  "schema": 1,
+  "tools": [
+    {
+      "name": "news.list",
+      "description": "List the stories the device collected from News's feeds and followed topics, newest first. Filter by topic, language, feed or time; page with limit and offset.",
+      "input_schema": {
+        "type": "object",
+        "properties": {
+          "since": { "type": "integer", "description": "Only stories fetched at or after this Unix time." },
+          "topic": { "type": "string", "maxLength": 200 },
+          "lang": { "type": "string", "maxLength": 16 },
+          "feed": { "type": "string", "maxLength": 200 },
+          "limit": { "type": "integer", "minimum": 1, "maximum": 100 },
+          "offset": { "type": "integer", "minimum": 0 }
+        },
+        "additionalProperties": false
+      },
+      "output_schema": {
+        "type": "object",
+        "properties": {
+          "total": { "type": "integer" },
+          "offset": { "type": "integer" },
+          "items": { "type": "array", "items": { "type": "object" } }
+        },
+        "required": ["total", "items"]
+      },
+      "risk": "read",
+      "shareable": true,
+      "implemented_by": "host-service"
+    },
+    {
+      "name": "news.read",
+      "description": "Read one collected story by its id: the story and its stored summary.",
+      "input_schema": {
+        "type": "object",
+        "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 128 } },
+        "required": ["id"],
+        "additionalProperties": false
+      },
+      "output_schema": {
+        "type": "object",
+        "properties": { "item": { "type": "object" }, "text": { "type": "string" } },
+        "required": ["item"]
+      },
+      "risk": "read",
+      "shareable": true,
+      "implemented_by": "host-service"
+    }
+  ]
+}