capability_module's requestModule was a Q_INVOKABLE that blocked on a
nested outbound IPC inside the QtRO source read loop; when the caller's
connection dropped during that nested pump, the source-side reply crashed
(SIGSEGV in CodecBase::send on a dangling connection).
Rewrite it as a Qt-free universal impl (CapabilityModuleImpl on
LogosTokenManagerContext) with interface:"universal" + concurrency:"multi",
so each call runs on a worker off the read stack and replies via a deferred
completion — eliminating the re-entrancy. The wire API is unchanged
(requestModule/registerRestriction), so it stays a drop-in broker.
The token store reads and arbitrary-module inform now go through the
LogosTokenManagerContext bridge (host-backed). m_restrictions is guarded by
a std::mutex (multi dispatch runs handlers concurrently) and the token is
minted from std entropy instead of QUuid. Unit tests reworked to drive the
impl directly with injected bridge stubs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
refactor capability module to work as an internal module proper instead of cosplaying as a app layer module
refactor capability module to work as an internal module proper instead of cosplaying as a app layer module
update flake
update flake
