Skip to content

Complete shared component hosting and declarative app capabilities - #457

Merged
ymote merged 37 commits into
mainfrom
fix/declarative-host-capabilities
Oct 10, 2026
Merged

ymote merged 37 commits into
mainfrom
fix/declarative-host-capabilities

Conversation

@ymote

@ymote ymote commented Oct 10, 2026 •

Copy link
Copy Markdown
Contributor

Admitted apps can call public host APIs without declaring their capability family, consistently across Splash, app-agent tools and Wasm components. Verified bundle/profile identity, device consent, OS permissions, account scope, trusted write review, storage jail/quota and inter-app tool sharing remain enforced. requires and host_api.required still determine compatibility.

This completes the shell's model, assistant, file, audio, calendar, location, Glance, backend-login and background-mail paths. Camera capture uses explicit audio/library options, with camera.capture_intent@1 for discovery; broader API availability cannot silently enable sound or photo export. Agents request research tools by exact agent.tools names. English/Chinese architecture, API and ADR guides distinguish source, device and release support.

Integration fixes:

  • Register the runtime ABI before admission, so App Hub recognizes compatible apps and installed apps reopen after a cold restart.
  • Pin merged App Hub Linux sandbox: run it on a real kernel; a cargo launch sandboxes only the app (#138) #199, including Peer link: prove a process app hears the system agent's lane live (ADR 0004 §6) #197's unavailable-app explanation. The shared card loader binds the admitted app identity before guest source runs, clears it on failed launch, and applies device consent. Native storage requires that identity; a storage folder alone is insufficient.
  • Bound optional compiled-cache reads to a 50 ms wait and two readers per process. Slow/busy/unreadable cache entries fall back to verified source compilation without rewriting the stalled entry. No detached warming readers remain; request and guest limits are unchanged.
  • Apply device consent when seating Glance cards and test the actual queued app identity in isolated admitted profiles.

The synthetic publisher release has four genuine GitHub attestations. A protected Hub workflow signed and verified an exactly reviewed dry-run catalog; the official public catalog is unchanged. Contract 1.11.0 is published. OctoSense #452/#454/#455, App Hub #192/#197/#199 and App Flow #183 are merged.

Validation at final candidate 8b09e05d:

  • macOS native host API fixture: 31/31 checks passed, including native storage identity, undeclared API discovery, contained binary writes, denied consent, and background write/prompt refusal. The patched runtime's real-card-start identity regression passed separately.
  • Fresh normal desktop: 11/11 checks passed through App Hub Search → Get → Install, cold restart and repeated component calls. Both apps retain independent counters and private notes; one declares no capabilities. Actual UI refusal of the optional App Hub agent was recorded. No manual cache preparation or deadline change; all owned processes exited. Binary SHA-256: e5c982aac60fe7cc3e88de441a038d1eff97759c9e6a9f070df5633f4a34eabc.
  • OnePlus 6 at the same clean source: 28/28 component assertions + 13/13 driver checks, and 31/31 native API assertions + 45/45 driver checks. Both fresh test packages were removed. The component APK embeds the exact source/runtime identity; native API provenance uses its clean-build receipt and APK hash, with no embedded source-stamp claim. No accounts, models, approval sheets or production Home were used.
  • Exact-head Mac/Linux CI: 52/52 steps passed, no failed or skipped steps, including Linux process isolation and the full Home/shell suites. GitHub Windows embedded-browser acceptance passed on this same head. The previous matrix (0c018f82) passed 51/52 steps and all 1,153 shell tests; its sole failure exposed the loader identity bug now repaired in App Hub Linux sandbox: run it on a real kernel; a cargo launch sandboxes only the app (#138) #199. The failed receipt is retained, not replaced with a passing result.
  • Cache resilience passed all 40 runtime tests. Camera widget logic passed 12/12. Hub Linux sandbox: run it on a real kernel; a cargo launch sandboxes only the app (#138) #199 passed 114 tests against plain Makepad; its patched-runtime identity branch passed in the integrated host.

Earlier committed receipts at clean source c5f0c5c1 record real catalog → Store → Splash tool → shared-component execution: macOS and OnePlus 6 each passed 28/28 native assertions, with 12/12 and 13/13 driver checks. These remain historical evidence, separate from the final candidate.

Proofs: publisher, admin catalog dry-run, contract publication.

No live-model, physical permission approval, real mail/calendar write, OpenHarmony-device, production Home-upgrade or released-archive acceptance is claimed by these fixtures. A GitHub-built desktop RC will receive separate archive acceptance before publication.

ymote and others added 19 commits October 9, 2026 21:06
A shared component (App Hub ADR 0003) is a component App Hub publishes
on its own; an app pins it by alias, id, exact version and BLAKE3 digest.
The wasm service now loads each one the app pins beside its fns/, from
octosense_appstore::components::resolved_in (a system app's from its
bundle, an installed app's from the shared store, checked against the
verified catalog and its digest on every load), and routes its exports
as wasm.<alias>.<function>. The app gets its own instance, under its own
grants, as for a component in its fns/; an app may call only shared
components. warm compiles them ahead too, and wasm.functions names the
component each function comes from.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…arative-host-capabilities

# Conflicts:
#	docs/wasm.md
#	docs/wasm.zh-CN.md
@ymote ymote changed the title Make app capability declarations descriptive across host and agent services Complete shared component hosting and declarative app capabilities Oct 10, 2026
@ymote
ymote force-pushed the feat/wasm-shared-components branch from 740e1f6 to 5dc972b Compare October 10, 2026 05:24
@ymote
ymote changed the base branch from feat/wasm-shared-components to main October 10, 2026 05:43
@ymote
ymote marked this pull request as ready for review October 10, 2026 06:41
@ymote

ymote commented Oct 10, 2026

Copy link
Copy Markdown
Contributor Author

Local CI passed on 8b09e05 (tools/ci-local.sh --only desktop,phone,apps --linux-host --offload, 13m59s, Darwin arm64; the ubuntu jobs and the macOS jobs' portable steps (their macOS steps ran here) on the Linux build host, Linux x86_64).

GitHub would run for this PR: desktop.yml, phone.yml, apps.yml. Merged on this local pass (macOS runner queue); GitHub CI runs on the merge commit on main.

Job Step Result Time
ci-local / drift The local mapping fits the workflows PASS -
desktop.yml / desktop Prepare the pinned framework sources PASS 0s
desktop.yml / desktop Compile the desktop with the shared runtime PASS 5m34s
desktop.yml / desktop Desktop tools and scripts PASS 14s
desktop.yml / desktop (linux) Prepare the pinned framework sources PASS 0s
desktop.yml / desktop (linux) One copy of every shell source PASS -
desktop.yml / desktop (linux) One Makepad, App Hub, octos and Rinx in the locked graph PASS 2s
desktop.yml / desktop (linux) The native apps' generated places match native-apps.json PASS 0s
desktop.yml / native-host-api Prepare the pinned framework sources PASS 1s
desktop.yml / native-host-api Build the native acceptance host and pinned Hub CLI PASS 9s
desktop.yml / native-host-api Signed app tool calls a real OS permission API PASS 3s
phone.yml / home Prepare pinned sources and the reviewed runtime patch PASS 1s
phone.yml / home Validate launcher icons and Apple asset catalogs PASS 4s
phone.yml / home Compile Home and its bundled modules PASS 3m13s
phone.yml / home (linux) Prepare pinned sources and the reviewed runtime patch PASS 0s
phone.yml / home (linux) Verify the single runtime graph PASS 2s
phone.yml / home (linux) The native apps' generated places match native-apps.json PASS 0s
phone.yml / home (linux) The pinned octos revision PASS -
phone.yml / home (linux) Build octos (unless cached) PASS -
phone.yml / home (linux) Build Home, App Hub admission and runtime policy tests PASS 3m10s
phone.yml / home (linux) Test Home, App Hub admission and runtime policy PASS 40s
phone.yml / home (linux) Two-lane scenario (real kernel, scripted model) PASS 27s
phone.yml / home (linux) Build opt-in AppCard tests PASS 2m45s
phone.yml / home (linux) Test opt-in AppCard PASS 2s
phone.yml / home (linux) Build craft-engine relay and system-chat tests PASS 2m45s
phone.yml / home (linux) Test craft-engine relay and system chat PASS 4s
phone.yml / home (linux) Build linked Terminal tests PASS 2m24s
phone.yml / home (linux) Test linked Terminal PASS 1s
phone.yml / home (linux) Build Wasm and runtime policy tests PASS 1m14s
phone.yml / home (linux) Test Wasm and runtime policy PASS 10s
apps.yml / services (linux) python3 tools/setup.py PASS 0s
apps.yml / services (linux) Shared system app interface PASS 0s
apps.yml / services (linux) Kernel service PASS 17s
apps.yml / services (linux) App peers PASS 28s
apps.yml / services (linux) AI providers config PASS 4s
apps.yml / services (linux) Connected provider protocols and Linux host adapter PASS 46s
apps.yml / services (linux) L0 in-card chat (sys.chat, host side) PASS 10s
apps.yml / services (linux) System toolbox (workflow templates) PASS 1m28s
apps.yml / kernel-security (linux) python3 tools/setup.py PASS 0s
apps.yml / kernel-security (linux) The pinned octos revision PASS -
apps.yml / kernel-security (linux) Build octos (unless cached) PASS -
apps.yml / kernel-security (linux) Real-kernel tests PASS 38s
apps.yml / apps (linux) python3 tools/setup.py PASS 0s
apps.yml / apps (linux) Host services (Mail, AI providers, News) PASS 2m01s
apps.yml / apps (linux) Connected accounts and Rinx editor PASS 1m32s
apps.yml / apps (linux) Shell AI services (crates/ai-host) PASS 2m56s
apps.yml / apps (linux) AppCard runtime setup safeguards PASS 0s
apps.yml / apps (linux) AppCard clippy (own crates; shared runtime compiles) PASS 28s
apps.yml / apps (linux) AppCard transport and store PASS 7s
apps.yml / apps (linux) One Makepad, App Hub, octos and Rinx in the locked graph PASS 2s
linux-host / sandbox (linux) python3 tools/setup.py PASS 0s
linux-host / sandbox (linux) Process sandbox on Linux (Landlock, seccomp) PASS 1m42s

Notes:

  • GitHub runs Python 3.12; this run used Python 3.9.6
  • GitHub runs Python 3.12; the Linux host used Python 3.14.4

Native GitHub acceptance passed on the same head: embedded-browser.yml.

@ymote
ymote merged commit 40ca21d into main Oct 10, 2026
6 of 9 checks passed
chrislearn pushed a commit to chrislearn/OctoSense that referenced this pull request Oct 12, 2026
…stands

Records what changed after the ADR was accepted: ADR 0014 components and
shared components are merged and in desktop 0.1.0-rc.4 (not in a Home
release); capabilities are declarations (makepad#117/OctoSense-org#118, OctoSense OctoSense-org#452,
OctoSense-org#457); OctoSense-org#313 holds milestone 1's renderer and tools, unreviewed and unmerged;
the product owner deferred the phone studio work on 10 October 2026.

Amends section 5: the checks, measurement and comparison are Rust crates that
build natively into App Hub's card-studio on the desktop and, with App Flow's
tools/octo wasm build, into components in the studio's own bundle on the
phone (intake, ocr, measure, compare, checks), within the wasm service's
limits; what stays shell code. Amends section 6 (what mod.studio keeps) and
section 7 (the tools OctoSense-org#313 ships; check/compare/critique as component
functions; the 256 KiB reply cap). A table of where each step of the flow
stands on 10 October 2026, the route for when the work resumes (proposed,
unassigned), what a phone will not do, the amended "what changes where", and
three added open questions.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant