[ymote]

Draft. OctoSense ADR 0005, plan step 3: OctoSense, App Hub and Rinx now link one octosense-app-contract, from crates.io. App Hub changes no longer force a Rinx release, and no App Hub host alias is needed.

Independent of #204. This branch is origin/main plus three commits of its own; none of #204's commits or files are in it. It will need main merged in after #210 lands (#210 also moves the App Hub pin and touches script_apps.rs).

Commits

1. deps: one octosense-app-contract from crates.io
   • Adds the workspace dependency octosense-app-contract = "1". Cargo.lock pins 1.0.0 from crates.io.
   • The shell now takes its contract-level items from the contract: AppManifest::parse, HostLimits, digest_dir and MANIFEST_FILE. They are behind app-hub (through native-apps.json implies) and always present on mobile.
   • App Hub-only items stay on octosense-app-policy / octosense-app-hub: AgentBundle, ToolSpec, IsolateSettings, the Splash adapter and the Hub Store.
   • No www.github.com App Hub alias; main has none.
2. deps: the real commits. App Hub moves to 58c3c8ae (Docs: fix a dead anchor in local-ai.md #47 merged; its crates take the contract by version). Rinx moves to tag v1.1.0, which is 4b89097d (Runtime: OctoScript-Makepad 99c1e5ee (makepad d0a9def5), App Hub 46d67e51, System-Apps d30c67cb #49 merged).
3. shell: fill App Hub #38's ServiceCall.may_prompt, behaviour unchanged (until #204).
   • App Hub main includes App Hub AI providers system app and the llm host service #38, which adds ServiceCall.may_prompt. App Hub's sheet handler refuses a sheet when it is false; before AI providers system app and the llm host service #38 nothing read it.
   • Every ServiceCall OctoSense builds passes true: the shell's agent tool calls and the services' tests.
   • Isolates already get host_prompts: true from App Hub's isolate_settings.
   • So sheets are allowed exactly as today, and no new policy is added. Refusing sheets on background surfaces stays Host requests settle; background surfaces cannot raise sheets #204's work.

Verified locally

• One copy.
  • cargo tree -d from the root and from phone/: 0 duplicates of octosense-app-contract, octosense-app-policy, rinx or makepad-widgets.
  • cargo tree -i octosense-app-contract: only v1.0.0 from crates.io.
• Checks.
  • tools/setup.py --check --cargo, tools/native_apps.py --check and the tools unit tests: OK. Cargo.lock records v1.1.0 at 4b89097d.
  • tools/check-shell-graph.sh -p octosense and -p octosense-home: OK.
  • cargo build --locked -p octosense: OK.
  • Phone checks (cargo check --locked -p octosense-home with default, mobile-apps, and mobile-apps,app-appcard): OK.
• Tests.
  • Shell, phone and Home: cargo test --locked --features mobile-apps -p octosense-shell -p octosense-home -p octosense-app-policy -p octosense-app-hub -p octosense-appcard -p octosense-ai-host gives 985 passed, 0 failed.
  • Mail, news, llm services and ai-host: 145 passed, 0 failed.
• Not run: tools/ci-local.sh. The merge captain runs it.

Merge order

OctoSense-App-Hub#47 is merged (58c3c8ae). hagency-org/Rinx#49 is merged (4b89097d) and tagged v1.1.0. This PR goes next: after #210 lands, merge main in, re-run the checks, then tools/ci-local.sh.

🤖 Generated with Claude Code

[ymote]

Local CI passed on e847eec (tools/ci-local.sh --only desktop,phone,apps, 17m06s, Darwin arm64).

GitHub would run for this PR: desktop.yml, phone.yml, apps.yml. Merged on this local pass (macOS runner queue); GitHub CI runs on the merge commit on main.

Job	Step	Result	Time
ci-local / drift	The local mapping fits the workflows	PASS	-
desktop.yml / desktop	Prepare the pinned framework sources	PASS	0s
desktop.yml / desktop	Compile the desktop with the shared runtime	PASS	2m14s
desktop.yml / desktop	One copy of every shell source	PASS	-
desktop.yml / desktop	Desktop tools and scripts	PASS	10s
desktop.yml / desktop	One Makepad, App Hub, octos and Rinx in the locked graph	PASS	5s
desktop.yml / desktop	The native apps' generated places match native-apps.json	PASS	0s
phone.yml / home	Prepare pinned sources and the reviewed runtime patch	PASS	0s
phone.yml / home	Compile Home and its bundled modules	PASS	1m33s
phone.yml / home	Verify the single runtime graph	PASS	2s
phone.yml / home	The native apps' generated places match native-apps.json	PASS	0s
phone.yml / home	The pinned octos revision	PASS	-
phone.yml / home	Build octos (unless cached)	PASS	-
phone.yml / home	Build Home, App Hub admission and runtime policy tests	PASS	1m53s
phone.yml / home	Test Home, App Hub admission and runtime policy	PASS	6m01s
phone.yml / home	Two-lane scenario (real kernel, scripted model)	PASS	30s
apps.yml / services	python3 tools/setup.py	PASS	1s
apps.yml / services	Kernel service	PASS	4s
apps.yml / services	App peers	PASS	8s
apps.yml / services	AI providers config	PASS	2s
apps.yml / services	System toolbox (workflow templates)	PASS	1m12s
apps.yml / kernel-security	python3 tools/setup.py	PASS	1s
apps.yml / kernel-security	The pinned octos revision	PASS	0s
apps.yml / kernel-security	Build octos (unless cached)	PASS	-
apps.yml / kernel-security	Real-kernel tests	PASS	22s
apps.yml / apps	python3 tools/setup.py	PASS	0s
apps.yml / apps	Host services (Mail, AI providers, News)	PASS	53s
apps.yml / apps	Shell AI services (crates/ai-host)	PASS	1m35s
apps.yml / apps	AppCard runtime setup safeguards	PASS	0s
apps.yml / apps	AppCard clippy (own crates; shared runtime compiles)	PASS	13s
apps.yml / apps	AppCard transport and store	PASS	5s
apps.yml / apps	One Makepad, App Hub, octos and Rinx in the locked graph	PASS	3s

Notes:

• GitHub runs Python 3.12; this run used Python 3.9.6
• apps.yml:services runs on ubuntu-latest in GitHub; here on macOS, so #[cfg(target_os = "linux")] code in it is not exercised
• apps.yml:kernel-security runs on ubuntu-latest in GitHub; here on macOS, so #[cfg(target_os = "linux")] code in it is not exercised