Repository navigation
The photo host service: photocraft behind photo.* (ADR 0013) [skip ci] - #379
Merged
Merged
Conversation
ymote
force-pushed
the
feat/sheet-fill-kernel
branch
from
October 8, 2026 08:41
fe78cd9 to
f8668d9
Compare
ymote
force-pushed
the
feat/photo-engine-service
branch
from
October 8, 2026 08:41
2462395 to
c466e1e
Compare
ymote
force-pushed
the
feat/sheet-fill-kernel
branch
from
October 8, 2026 09:27
f8668d9 to
470ed7e
Compare
ymote
force-pushed
the
feat/photo-engine-service
branch
from
October 8, 2026 09:27
c466e1e to
6abd3d1
Compare
ymote
force-pushed
the
feat/sheet-fill-kernel
branch
from
October 8, 2026 09:31
470ed7e to
bf650ce
Compare
ymote
force-pushed
the
feat/photo-engine-service
branch
from
October 8, 2026 09:31
6abd3d1 to
405c21f
Compare
ymote
force-pushed
the
feat/sheet-fill-kernel
branch
from
October 8, 2026 09:52
bf650ce to
47bcca4
Compare
ymote
force-pushed
the
feat/photo-engine-service
branch
from
October 8, 2026 09:52
405c21f to
90e44c5
Compare
ymote
force-pushed
the
feat/sheet-fill-kernel
branch
from
October 8, 2026 10:08
47bcca4 to
b1c7cbb
Compare
ymote
force-pushed
the
feat/photo-engine-service
branch
from
October 8, 2026 10:08
90e44c5 to
0426e0e
Compare
apps/photo/host-service (octosense-photo-service): photocraft's own headless automation layer as a host service -- info, convert, run (the engine's command catalog: crops, adjustments, filters), commands and render, every call a fresh stateless session. File access is bound to the caller's host directory by photocraft's capability-rooted AuthorizedWorkspace, so the engine itself refuses separators, .., and escapes before any I/O. System apps only; at most 64 commands per run call; previews capped at 4096 px. The engine is pinned to the ymote/photocraft fork at eec4af65 (ADR 0013 family discipline); the shell registers the service on desktop beside the sheet service, with the dep in native-apps.json's App Hub implies. cargo test -p octosense-photo-service: 3 tests -- a real PNG through info (12x8), PNG->WebP, a Gaussian blur saved back, and a preview render, against an embedded fixture; the engine's workspace refusing escape paths; the caller gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ymote
force-pushed
the
feat/photo-engine-service
branch
from
October 8, 2026 10:25
0426e0e to
d64b009
Compare
Contributor
Author
|
Local CI passed on d64b009 ( GitHub would run for this PR: desktop.yml, phone.yml, apps.yml. Merged on this local pass (macOS runner queue); GitHub CI runs on the merge commit on main.
Notes:
Native GitHub acceptance passed on the same head: embedded-browser.yml. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third in the ADR 0013 stack (#377 → #378 → this; retarget before deleting base branches). Phase 1, engine #2.
apps/photo/host-service(octosense-photo-service, familyphoto): photocraft's own headless automation layer as a host service —info / convert / run / commands / render, every call a fresh stateless session. Containment is the engine's own: photocraft's capability-rootedAuthorizedWorkspacebound to the caller's host dir refuses separators,..and escapes before any I/O. Engine pinned toymote/photocraft@eec4af65. System apps only; ≤64 commands perrun; previews ≤4096 px.Verified: 3 tests — a real PNG (embedded fixture) through
info(12×8) → PNG→WebP → Gaussian blur saved back → preview render, plus the 500+-command catalog check; engine-side path refusal; caller gate.native_apps.py --check,setup.py --check --cargopass. (Maturity context: photocraft's own suite is 1,203 tests green — see ADR 0013's measurements.)🤖 Generated with Claude Code