feat(contract): bind the published Root ABI bundle — converge R-00056/69/72/74/79/179/180 - #3
Merged
Merged
Conversation
…contract-types-01, R-00056) Mirror the ADR-040 consumer surface byte-for-byte under docs/architecture/abi/ (pinned at LumioGameEngineArchitecture origin/main 1f2ead3), pin every mirror file in .baseline.sha256, and replace the blocked identity seam with the real binding: RootAbiBinding digest chain, AbiVersion(1), and the published POD types LumioStatus / LumioHandle / LumioBuffer / LumioCoreConfigV1. Mirror cross-check tests reject any drift between constants, mirror bytes, and the published bundleDigest; xtask now audits every .baseline.sha256 row. Capability bits (D-015), non-linux-x86_64-glibc layout (D-016) and OperationId (B-ABI-004: not applicable) stay deliberately unbound. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…types-03, R-00072) Add cargo xtask gen-contracts: derives generated_data.rs from the byte-pinned bundle mirror (type golden, struct/slot offset golden, layout-profile scalars); an xtask regression test rejects any hand edit by re-deriving. layout.rs compares the bound Rust PODs against the Golden with compile-time asserts, but only on the one certified profile linux-x86_64-glibc — every other target succeeds without asserting, per ADR-040 §7 (D-016 pending). StructSize becomes a real byte-size scalar. Tests cross-check every golden row against the mirror and were cross-checked to compile for the certified target (cargo check --target x86_64-unknown-linux-gnu). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…-contract-types-04, R-00074) verify_root_abi_bundle_digest_against completes the drift chain: CI sha256sum -c proves mirror bytes match the pin, the crate tests prove pin == published rootAbi.bundleDigest == the bound constant, and the new tests reject the previous published digest as a real drift sample plus any mixed-revision mirror set (all three indices must agree on one baselineId). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ct-types-02, R-00069) gen-contracts now derives the full 53-value ErrorCode table (including the ADR-046 kernel status band, Draft but published in ids/index.json on origin/main) from the byte-pinned ids mirror — the generator enforces Architecture ownership, Active status, uniqueness, and the int32 status range, and no numeric is hand-written anywhere. registry.rs serves ordered iteration plus by-id lookup; Capability stays unbound pending D-015 (its numerics are package-capability ordinals, not bit positions) and OperationId stays permanently empty (B-ABI-004: not applicable). The kernel mapping test drops its stale registry-is-empty guard; the mapping itself stays MappingBlocked until T-error-03 (R-00079). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…079) ADR-046 (Draft; values published in ids/index.json on origin/main) covers all 13 frozen ErrorCategory values: the 1044-1053 kernel band plus the adjudicated 1020/1029/1030. to_architecture_error_code becomes infallible and injective, resolving codes through the generated registry by id string so no numeric is written in kernel sources; MappingBlocked is gone and the mapping now sits inside the error hot path's zero-allocation window. Known gap (recorded on the card): the arena reports empty-slot hits on use paths as AlreadyReleased, which ADR-046 §2 expects to surface as InvalidHandle (1029); this mapping applies the release-path ruling (HandleDoubleRelease). Resolving the use path is a handle-module check-order question outside this card. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ed Header (T-ffi-04, R-00179) Transcribe the generated Header's lumio_core_api into a repr(C) provider table (field names, slot signatures and Option<extern fn> null slots follow the Header verbatim; version/struct_size come from the bundle Golden via gen-contracts, not literals). shutdown / last_error_detail slots run through ffi_boundary and the single error mapping — with init unpopulated no context can exist, so they return the registered InvalidHandle numeric, never an invented one. The C smoke calls through the slot function pointers and compiles the mirrored lumio_core.h standalone (its LUMIO_STATIC_ASSERT rows are the layout Golden); Rust-side table offsets are asserted only on the certified linux-x86_64-glibc profile (D-016), cross-checked via cargo check/clippy --target x86_64-unknown-linux-gnu. No C symbol is exported: the composition contract for handing this table to CoreEngine is unpublished, and lumio_core_init stays blocked on the opaque lumio_core_config_v1 body plus the by-value out_context question (raised upstream). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…blished surface (T-ffi-05, R-00180)
dump-symbols now derives entrySymbol/symbolPrefix from the mirrored bundle,
cross-checks them against the hardcoded Root symbol, and fails on ANY
lumio_-prefixed export outside the approved provider list (empty until the
provider composition contract is published) instead of only the Root symbol.
symbol_guard gains mirror_entry_symbol (guard == published bundle, either
JSON formatting) and a dependency-half test that only lumio-native-ffi may
declare cdylib/staticlib. Also fixes a latent scanner desync: a quote inside
a char/byte-char literal ('"', b'"') flipped the string stripper's parity,
which could both hide real identifiers and surface string contents as code —
covered by a regression test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… §7) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… (T-error-04 harness) The global count also saw libtest-harness allocations from other threads, which raced into the measurement window under machine load — observed twice after R-00079 widened the window to cover the mapping calls. Gate counting by a const-initialized thread-local so the assertion means 'this thread's hot path allocated nothing', with a self-check that a real allocation on the test thread is still counted. 0/60 failures quiet+loaded after the fix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
把上游
LumioGameEngineArchitecture已发布的 Root ABI Bundle（ADR-040，含 ADR-046 kernel status band；两者 Status 均为 Draft，但发布物已在上游origin/main，镜像钉在1f2ead3）真正绑定进本仓，收敛 7 张受波及卡；R-00083 按上游裁决（ADR-040 §7 / D-015）维持 BLOCKED，无代码改动。派单来源：架构仓 TD 2026-08-28 NativeCore 收敛盘点。改动清单（每卡一提交）
14ca3edR-00056：字节级镜像docs/architecture/abi/（钉 revision +.baseline.sha256钉 Hash）+ 身份绑定（RootAbiBinding digest 链、AbiVersion、LumioStatus/LumioHandle/LumioBuffer/LumioCoreConfigV1 POD）9f52ef3R-00072：cargo xtask gen-contracts生成 layout Golden；类型/表/槽位偏移断言，仅在认证档linux-x86_64-glibc上比对（D-016），交叉--target x86_64-unknown-linux-gnu编译验证3c599ebR-00074：漂移 Gate（baselineId + bundleDigest 三方链：CI sha256sum -c ↔ pin ↔ 发布 digest ↔ 常量；历史真实漂移样本作反例）8fd9bbaR-00069：ErrorCode 注册表 53 值全量生成绑定（含 kernel band）；Capability 维持不绑定（D-015）、OperationId 判不适用（B-ABI-004）ee03cb6R-00079：13 个 ErrorCategory 全量单射映射（1044–1053 + 1020/1029/1030），MappingBlocked移除，映射进入零分配窗口93c88afR-00179：按发布 Header 的 providerlumio_core_api表 + 槽位实现（shutdown/last_error_detail 返回注册 numeric；init 维持 BLOCKED）+ C smoke（镜像 Header 独立编译，其 static assert 即布局 Golden）c0174c7R-00180：符号负向 Gate 扩展（entrySymbol/symbolPrefix 从镜像绑定、lumio_* 前缀白名单、仅 ffi 允许 cdylib/staticlib）+ 修复扫描器字符字面量失步缺陷（含回归测试）8ec472f知识沉淀：repository-architecture.md 记录镜像消费机制验证证据（host x86_64-apple-darwin, rustc 1.94.0）
cargo fmt --all --check→ OKcargo clippy --workspace --all-targets -- -D warnings→ Finished, 0 warningscargo test --workspace→ 82 个测试组全部 ok，0 failedcargo build --workspace --benches→ Finishedcargo xtask check-dep-dag→ OK（10 crates）；dump-symbols→ lumio_* 未批准导出 0；check-baseline→ OKnode .spec/tools/spec-lint.mjs→ OK；spec-lint.test.mjs→ fail 0shasum -a 256 -c全部镜像）cargo check/clippy --target x86_64-unknown-linux-gnu（contract-types / native-ffi 全 target）→ 通过Known gaps
AlreadyReleased统一映射 1030；arena 使用路径的空槽命中按 ADR-046 §2 应显现为 1029，属 handle 模块检查顺序问题，已在 R-00079 卡面记录待裁决lumio_core_init维持 BLOCKED：core_config_v1body 未发布 + 发布签名的out_context按值传递无法回传结果（已上报上游）error_hot_path_does_not_allocate在满负载并行下观察到一次偶发（harness IO 分配竞入计数窗口，窗口设计先于本 PR 存在），复跑 7 次全绿沉淀落点
.spec/knowledge/standards/repository-architecture.md新增镜像消费机制条目；镜像更新流程见docs/architecture/abi/README.md。🤖 Generated with Claude Code