The macOS doc-test job has been red since 2026-08-21: every module call came
back {"__logos_rpc_status__":"unauthorized"}, preceded in the daemon log by
capability_module rejecting the CLI's own requestModule handshake. Linux was
green throughout.
NOT MODULE ROT. A freshly-built test_basic_module failed identically to
accounts_module. Bisected on one macOS box, one variable, same CLI, same module:
liblogos 3893c833 (parent) -> "result":42
liblogos b2a9a0ba (#182) -> unauthorized
MECHANISM, from `nm -mu` on the logoscore binary:
pre-#182: TokenManager::instance() (from liblogos_core)
at-#182: TokenManager::instance() (from liblogos_module_client)
#182 made liblogos_core export ZERO TokenManager symbols -- they moved to
liblogos_protocol. macOS two-level namespace then rebound the CLI's imports to
the next image still statically absorbing a copy, so the CLI wrote its token
into one singleton while the runtime authorized against another. ELF cannot
show this: flat namespace collapses every definition onto the first-loaded
image, so Linux held the invariant by accident.
THE PIN IS THE BUG, not the linkage. The shared-runtime split landed as one pin
SET -- logos-protocol 2e3344a, logos-plugin-qt 1aa3e31, logos-liblogos b2a9a0b
(#182), logoscore-cli 2312a3a. This spec pinned the CLI at b92ade06
(2026-06-10) and overrode only logos-liblogos, manufacturing exactly the
half-migrated pairing the set exists to prevent. That pin's own commit (050f2d3)
called it "Temporary -- drop when the chain PRs merge"; nobody did. Dropping the
rev is the fix. logoscore master had already shed the deprecated
logos-module-client in its #48, so nothing there needs changing.
WHY THIS READ AS ONE FLAKY STEP rather than a total auth outage: "Call a method"
asserted on the bare string '"result"', which the unauthorized envelope also
contains. Both calls now assert values -- '"result":"hello"' and '"result":42'.
ALSO RETIRED: logos-accounts-module was archived on 2026-07-22. Both specs now
drive test_basic_module from logos-test-modules, via the
`#modules.$SYSTEM.<name>.lgx` attribute path the logoscore-cli doc-tests already
use. The module-runtime spec no longer clones a repo at all, so it loses its git
prerequisite and one step.
VERIFIED on aarch64-darwin against 959d11d9 -- the exact commit CI failed on:
34 passed, 0 failed (was 34 passed, 1 failed of 35), and zero "rejecting
unauthorized call" lines in the daemon log.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Qt-split retarget + protocol-version load gate
- Link the split SDK stack: logos-qt-sdk (LogosAPI/provider glue; the
logos_sdk alias now points at logos-qt-sdk::logos_qt_sdk, chaining
logos-protocol) + Qt-free logos-cpp-sdk headers.
- Protocol-version load gate (the first real consumer of module
metadata pre-load): ModuleManager reads the module's embedded
logos_protocol_version before runtime.load() and applies the one
compatibility rule — equal protocol MAJOR loads, different MAJOR is
refused with a diagnostic naming both versions, missing/unparseable
stamp (pre-protocol modules) loads permissively with a warning. The
decision logic is std-only (logos_core/protocol_gate.h) and unit
tested (refuse bumped major / warn-load legacy / silent minor skew).
- ModuleDescriptor.rawMetadata is now actually populated for runtimes.
* lock: pin extraction-chain branch revs for standalone CI
Temporary — drop when the chain PRs merge (re-lock against masters).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* doctest: pin logoscore-cli to its qt-split branch head
The doc-test builds logoscore-cli at latest master with only liblogos
overridden to the commit under test; master logoscore-cli cannot build
against qt-split liblogos. Pin the runtime to the chain branch
(logos-co/logos-logoscore-cli#43) so the doc-test exercises the
coherent stack. Temporary — revert to the unpinned URL when the chain
merges.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* host: surface the spawn auth token as a LogosAPI property
cdylib-authored modules run their own statically-linked protocol stack
whose TokenManager is a separate copy of the singleton; the generated Qt
glue reads this property (cross-image-safe, like modulePath) and seeds
the cdylib's stack via logos_module_accept_token so the module's
outbound calls authenticate.
* host: set the authToken property before registerObject
registerObject runs the provider object's init() — where the cdylib glue
reads the property. Setting it afterwards meant cdylib modules always saw
an empty token.
* lock: protocol+cpp-sdk merged to master — pins advance (protocol 9de4165, cpp-sdk f0fe8cb, qt-sdk 722e590)
* lock: qt-sdk#1 merged — pin advances to qt-sdk master
* gate: drop QJson from the Qt-free core — parse rawMetadataJson with nlohmann
The protocol-version load gate had pulled QJsonDocument/QJsonObject into
src/logos_core (Qt-free territory). logos-module now exposes the embedded
metadata as a compact JSON string, so the gate reads it via nlohmann and
the std::string extractMetadata overload.
* lock: logos-module b42805d (result-lm untracked)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
