25 Commits
Author SHA1 Message Date
Dario LipicarandClaude Opus 5 bc72ce3902 fix(deps): restore the view teardown hook, and pick up the deduplicated qt-sdk (#214)
* fix(deps): bump logos-view-module so generated view glue regains its teardown hook

#211 switched ui_qml glue generation from logos-qt-generator to
logos-view-generator, but the logos-view-module pin (1f95a75) PREDATES the
reconciliation that gave that emitter the module teardown hook. Measured on the
two revisions:

                                    emitter          context header
  1f95a75 (pinned until now)        0 aboutToUnload  0 maybeUiPluginAboutToUnload
  d6c8885 (this bump)               4 lines          2

So since #211 every view plugin built through this repo has silently lost
aboutToUnload(). It is silent by construction: a generated plugin missing the
hook builds, loads and runs, it is just never asked to finish. Nothing in the
build says a word -- which is the exact failure mode that motivated moving the
emitter and its header into ONE repo under ONE pin in the first place.

The bump also brings logos-view-generator's `--backend` validation: it now
refuses an unrecognised value instead of ignoring the flag, which
lib/modulePreConfigure.nix already documents and depends on.

Verified: nix build .#checks.aarch64-darwin.qml-integration passes on the bump.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): pick up the qt-sdk that no longer ships logos_ui_plugin_context.h

logos-qt-sdk#42 deleted its copy of the header (and the logos_qt_provider target
that existed only for it), leaving logos-view-module the sole owner. Two
LogosModule.cmake comments described the old world and are corrected.

The BEFORE-ordering of LOGOS_VIEW_INCLUDE_DIR stays. It is no longer what
decides which copy wins -- there is only one copy now -- but this repo pins the
two repos independently, and an older qt-sdk pin (a rollback, a branch, a
consumer overriding the input) brings the duplicate straight back. Belt-and-
braces now, load-bearing again the moment those pins disagree.

Verified with the view-module bump in the same branch:
  nix build .#checks.aarch64-darwin.qml-integration   PASS
  nix build .#checks.aarch64-darwin.qt-host-repoint   PASS

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-22 21:02:03 -03:00
Dario Gabriel LipicarandClaude Opus 5 fe4f26cecf feat: build ui_qml glue with logos-view-generator, not logos-qt-generator
modulePreConfigure.nix switches the `--backend ui` invocation to
logos-view-generator (logos-view-module), which now owns that emitter and
the logos_ui_plugin_context.h it pairs with.

THE REASON THIS IS NOT COSMETIC. This builder pins logos-qt-sdk at 4a1104c,
which predates b7b82e5 — the commit that added the module teardown hook to
the ui emitter. At 4a1104c BOTH halves lack it, so every build has been
green and self-consistent, and the hook has NEVER REACHED A SINGLE SHIPPED
ui_qml MODULE. Measured on the same module, before and after, by loading the
built plugin with QPluginLoader and dumping its QMetaObject:

    BASELINE                      MIGRATED
      initLogos(LogosAPI*)          unloadFinished()      [signal]
                                    initLogos(LogosAPI*)
                                    int aboutToUnload()   [invokable]

So this delivers the hook for the first time rather than preserving it.

LOGOS_VIEW_INCLUDE_DIR is added BEFORE the qt-sdk root in
LogosModule.cmake, so the emitter and its header resolve from ONE pin. That
ordering is load-bearing until logos-qt-sdk stops installing its copy of
logos_ui_plugin_context.h — anything going through logos_module() is safe;
a hand-run cmake putting LOGOS_QT_SDK_ROOT first would silently get the
wrong header. Called out in the code rather than left implicit.

Blast radius is 7 modules, not one: package_manager_ui, chat_ui, wallet_ui,
test_uiqml_probe, test_fullapi_ui, calc_ui_cpp and templates/ui-qml-backend
all match ui_qml + interface:universal. None override aboutToUnload(), and
the base default is Synchronous, so every one answers 0 and no host waits —
the change is additive. Only package_manager_ui was built end to end.

Three assertions in tests/test-module-pre-configure.nix pin the binary
choice; repointing at logos-qt-generator fails them. Also corrects a comment
there that claimed "the ui backend still legitimately uses qt-sdk's".

7/7 checks green, 399 unit tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-22 19:59:50 -03:00
Dario LipicarandClaude Opus 5 8cd62c7427 feat: take the view templates from logos-view-module (#203)
* fix(cmake): one LogosModule.cmake, the union of the two that had diverged

There were two copies — here and in logos-plugin-qt — and the received wisdom
that "the builder's shadows the backend's" is wrong. Selection is BY MODULE
CLASS, and each copy was missing what the other had:

  mkLogosModule.nix:79      tests the BUILDER root, always true, so CORE
                            modules take this copy;
  buildCppPlugin.nix:191    tests the MODULE'S OWN src, almost never true, so
                            every ui_qml module falls through to the backend's.

This copy had no REP_FILE, no logos_replica_factory, no LogosViewPluginBase — a
core module passing REP_FILE had it silently swallowed into
MODULE_UNPARSED_ARGUMENTS. The backend's had no generated_code/*.cpp glob, no
metadata.json configure_file, no LOGOS_API_STYLE and no Rust static-lib block.

Merged as a strict union, 721 -> 888 lines. logos_find_qt stays a macro(): the
function() form is the older one, and the macro IS the mingw fix. The four
LogosView*.in templates come along because the replica-factory function
resolves them as siblings through CMAKE_CURRENT_FUNCTION_LIST_DIR.

Prerequisite for relocating the view-plugin templates, not a cleanup — that
move cannot be reasoned about while two files disagree about what a view module
even is.

Verified: a core module (test_basic_module_cpp) and a ui_qml module
(test_fullapi_ui) both build through this copy, and all five of the builder's
own checks pass, including rust-native-dep, which is what exercises the
LOGOS_MODULE_RUST_STATIC_LIBS block the merge carried.

NOTE this de-duplicates nothing yet: buildCppPlugin.nix still routes ui_qml at
the backend's copy, so every in-tree REP_FILE consumer still compiles against
logos-plugin-qt's. Flipping that routing, and having the backend re-export this
file, is the follow-up.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(qml): resolve interface_dependencies in the QML pipeline

buildCppPlugin.nix never resolved interface_dependencies, so a ui_qml module's
interfaces reached the generator only through cpp-generator's own re-read of
metadata.json — invisible to the plugin backend, and silently skipping any entry
with an `input:` (a cross-repo interface), which can only be resolved to a path
by the builder.

Now resolved and passed as interfaceDeps, exactly as mkLogosModule.nix does for
core modules. Needed because the qt consumer wrappers are now emitted per
dependency and per interface by the backend, which has to be told what they are.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: retire interface "provider"; throw instead of generating nothing

Drops providerCodegen and the PROVIDER_HEADER plumbing in LogosModule.cmake.

autoCodegen ends in a catch-all `else ""`, so simply deleting the branch would
make `interface: "provider"` mean "generate no glue at all": the module builds
green and is then un-callable from every consumer, with nothing in the log to
say why. It throws instead, naming the replacement.

tests/test-module-pre-configure.nix covers exactly that: a mutation control
confirms the suite fails with `expected expression to throw, but it succeeded
with ""` when the throw is removed. 258 -> 265 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: parse and validate metadata.json#host_services (C2)

A closed set — token_registry, token_delivery, dynamic_calls — parsed and
VALIDATED, unlike the older `capabilities` field, which parseMetadata.nix never
reads. A security decision must not ride on a key nothing looks at, which is why
this is a new field rather than a new meaning for that one.

Two tiers, and the distinction is the point:

  * token_registry / token_delivery are TRUST-ROOT — a module holding them can
    enumerate the token store or hand authority to an arbitrary target — so they
    are additionally restricted to a hardcoded allowlist of module names
    (capability_module). Hardcoded rather than configurable: an allowlist a
    module could extend from its own metadata would not be an allowlist.
  * dynamic_calls is elevated but NOT name-restricted, because a third-party
    module that genuinely forwards untyped calls (a webview shell) has to be
    able to ask for it.

An unknown service name is refused OUTRIGHT rather than filtered out: it means
the module believes it holds a privilege that does not exist, and silently
dropping the entry hides that from whoever wrote it. Same reasoning as
lp_grant_host_services, which rejects an unknown name wholesale and leaves the
existing grant untouched.

The declaration is advisory. Authority is the host's grant, pushed into the
module's own image over the module-impl C ABI.

265 -> 273 tests. The allowlist case carries a mutation control: with the
trust-root check removed the suite fails with `expected expression to throw, but
it succeeded with ... "name":"sneaky_module","host_services":["token_registry"]`,
so the test genuinely guards the boundary rather than restating it. Includes the
bypass attempt of mixing a permitted service in with a restricted one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: emit cdylib glue with logos-qt-host-generator, not qt-sdk's stale copy

B1 relocated the cdylib Qt-plugin glue generator to logos-plugin-qt (the Qt
plugin BACKEND owns the glue; the SDK does not), but universalCodegen and
cdylibCodegen still called `logos-qt-generator` from logos-qt-sdk, which ships
an OLDER copy of the same emitter. Both copies compile and both emit working
glue, so nothing failed — the builds simply used stale glue.

That is not theoretical. It is why the Phase C host-services grant never
reached a module: the new glue reads the `hostServices` property and forwards
it across the C ABI, the old one does not, and every build stayed green while
capability_module refused every requestModule for want of a grant that was
delivered to its process and then dropped on the floor.

Measured: `hostServices` appears 4 times in logos-plugin-qt's copy and 0 times
in logos-qt-sdk's. After the switch the built capability_module plugin
references logos_module_grant_host_services twice (the export plus the glue's
call) where it previously referenced it once.

Threads the plugin-qt FLAKE (not its lib — the generator is a package of it)
from flake.nix through lib/default.nix into buildCppPlugin, mkLogosModule and
mkLogosModuleTests, and puts logos-qt-host-generator on PATH everywhere
logos-qt-generator already was. `--backend ui` still uses qt-sdk's generator:
the view backend has not moved.

logos-test-modules ipc-tests: FAIL -> PASS, which is the end-to-end proof that
a universal capability_module now mints tokens under a host-granted privilege.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix: thread logos-plugin-qt through the ui_qml build path too

mkLogosQmlModule imports buildCppPlugin at its OWN call site, separate from
lib/default.nix's, and that one was left unwired — so every ui_qml module with a
C++ backend hit `logos-plugin-qt = null` and failed to evaluate.

Caught by the regression batch: logos-accounts-ui went from building to FAIL
while all five test-modules checks passed, which is the shape of a defect in one
module CLASS rather than in the generator switch itself.

logos-accounts-ui builds again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test: pin the cdylib glue to the maintained generator

The existing assertion ("universal still emits the cdylib Qt glue") checked for
the string `logos-qt-generator` and so failed the moment the builder switched to
`logos-qt-host-generator` — the test doing its job. Retargeted at the invariant
that actually matters (`--backend cdylib` is still emitted) and extended into a
drift guard:

  * both codegen paths MUST name logos-qt-host-generator
  * neither may fall back to `logos-qt-generator ` (trailing space, so it cannot
    match the host generator; `--backend ui` still legitimately uses qt-sdk's)

Worth the four assertions because the failure they catch is invisible: both
copies of the emitter compile and both produce loadable glue, so reverting to
qt-sdk's would emit stale glue and stay green — which is precisely how the
host-services grant went undelivered for a whole phase.

265 -> 277 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* test(fixtures): declare universal authoring where the fixture already claimed it

The `core-universal-module` fixture is named "universal", is described as a
"Universal interface module fixture (mirrors logos-accounts-module pattern)",
and sits under a test section headed "Universal interface core module" -- but
it carried no `interface` key at all, so parseMetadata resolved it to
"legacy". The fixture was not testing the thing its name claims. The real
logos-accounts-module is `interface: universal`.

Declare `interface: universal` on the three `type: core` fixtures whose
legacy-ness was incidental, and pin the value so it cannot silently regress:

  core-universal-module  mirrors logos-accounts-module (universal)
  core-module            mirrors the minimal template (universal)
  extlib-module          mirrors the external-lib template and the real
                         vendor-extlib core modules (storage/wallet/libp2p/
                         blockchain) -- all universal

No `type: core` module in the workspace is still legacy-authored.

The other four legacy fixtures are LEFT legacy on purpose, and are now pinned
with an assertion + the evidence, so the coverage is deliberate instead of
accidental:

  ui-qml-backend-module  mirrors logos-package-manager-ui, which is STILL
                         legacy; the universal ui_qml shape is already covered
                         on disk by the ui-qml-backend TEMPLATE
  qml-module             QML-only: no C++ backend to derive a contract from;
  module-with-deps       mkLogosQmlModule never reads `interface`, and
                         universal+ui_qml routes to uiCodegen which demands a
                         .rep neither fixture has
  ui-module              `type: ui` has no template and one real instance
                         (logos-basecamp), which is legacy

These are metadata-parse fixtures only -- none of the three edited fixtures
contains any C++, so this is a metadata-shape correction, not a code port.
No fixture in this repo held a hand-written Qt plugin to migrate.

Verified: all 5 checks run BY NAME (default, qml-integration, rust-native-dep,
static-extlib, test-framework-integration) pass before and after. `default`
goes 277 -> 284 assertions, exactly the 7 added. qml-integration,
static-extlib and test-framework-integration produce byte-identical store
paths to baseline. rust-native-dep's path changes only because mkLogosModule
embeds the builder's own flake source (its fixture src is byte-identical:
xa6m5ci38fc5adcbi0hfyqvgzrmyr3j9) -- attributed by rebuilding with the change
stashed. Positive control: reverting core-universal-module to legacy makes
`default` FAIL on the new assertion, so it bites.

NOT verified: no plugin is built from any edited fixture (they are metadata
only), so there is no `lm methods` surface to diff -- the method-surface check
does not apply here. Nothing downstream of this repo was rebuilt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: hand buildHeaders the qt generator, so a contract can drive the wrapper

`contractLidl` already reached buildHeaders on every call — the qt backend just
declined to read it outside cross-compilation. What was missing was the tool:
logos-qt-generator went into buildPlugin's extraNativeBuildInputs and nowhere
near buildHeaders, so the contract-driven branch could not have run even if it
had been selected.

Passing it is the whole change on this side. `logosQtGenerator` is already the
BUILD-platform binary (buildSystemFor), which is what a cross build needs from
a pure tool role, and the backend puts only the generator its selected emitter
actually uses on PATH — so an lp variant and a contract-less module keep the
derivation they had.

Deliberately NOT passed to moduleIncludeLp: logos-qt-generator has no lp
backend. The lp wrapper still comes from logos-cpp-generator's lp emitter,
which is not the legacy Qt one and is not what this migration is about.

buildCppPlugin — the ui_qml pipeline — is left on the legacy path and now says
why. It computes no `lidl` output for the module it builds, so it has no
contract to hand over; and it costs nothing today, because mkLogosQmlModule
reads `moduleLib` and never `moduleInclude`, so that derivation is never
realised. A ui_qml module is a leaf and nothing consumes its client wrapper.
Fixing it therefore starts with giving that pipeline a contract, not with
adding a flag here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: link the Qt host runtime from logos-qt-host, not logos-qt-sdk

The Qt host runtime -- LogosAPI, LogosAPIProvider, LogosProviderBase and the
legacy PluginInterface -- moved out of logos-qt-sdk into logos-plugin-qt, where
it ships as the `logos-qt-host` CMake package. LogosModule.cmake now takes it
from LOGOS_QT_HOST_ROOT and links logos-qt-host::logos_qt_host; mkLogosModule,
buildCppPlugin, mkLogosModuleTests and the module dev shell all pass that root.

logos-qt-sdk is NOT dropped. It stays required for the Qt-typed headers that
were never part of the host runtime -- logos_qt_lp_bridge.h and logos_qt_wire.h,
which the generated Qt consumer wrappers #include by name, and
logos_ui_plugin_context.h -- and for the logos-qt-generator that emits them. Its
include dirs are kept, but AFTER the host runtime's, so the host headers win the
five names the two roots share.

mkLogosModuleTests now also passes -DLOGOS_QT_HOST_ROOT to logos-test-framework,
whose LogosTest.cmake already prefers it and falls back to LOGOS_QT_SDK_ROOT.

logos-plugin-qt's logos-protocol input gains a `follows` (as logos-qt-sdk's
already had). Building logos-qt-host makes that input load-bearing for the first
time, and a second logos-protocol on the link line would mean a second
TokenManager singleton.

Nothing here fails open. A LOGOS_QT_HOST_ROOT with no runtime under it is a
FATAL_ERROR rather than a fall-through to logos-qt-sdk; a host package that
resolves without defining its target is a FATAL_ERROR rather than a plugin
linked without a runtime; and the legacy logos-qt-sdk fallback, which stays
available while other consumers migrate, announces itself in the configure log.
The new `qt-host-repoint` check pins all four selection paths plus both guards.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(b2b): probe logos-qt-sdk by a header it owns, and drop the qt-sdk fallback

Two changes, both forced by logos-qt-sdk no longer forwarding the host runtime's
headers.

The presence probe tested ${LOGOS_QT_SDK_ROOT}/cpp/logos_api.h or
include/cpp/logos_api.h. Neither exists any more: the host split moved
logos_api.h out of qt-sdk's cpp/, and the forwarder that kept it in include/cpp/
is gone. A correct root would have been reported as "logos-qt-sdk not found"
while CMake was looking straight at it. It now probes logos_qt_wire.h, which
this SDK does own -- along with logos_qt_lp_bridge.h and
logos_ui_plugin_context.h, the only reason the root is still required at all.
(The source branch was already dead on arrival: qt-sdk's cpp/ has held no
logos_api.h since B1, so LOGOS_QT_SDK_IS_SOURCE could never be TRUE.)

The legacy fallback -- no LOGOS_QT_HOST_ROOT means take the host runtime from
logos-qt-sdk's forwarding package -- is deleted. Its premise is false now, and
what it would do instead is worse than failing: find_package(logos-qt-sdk)
still succeeds and its INTERFACE target still chains logos-qt-host, so the
build would work by accident through one more hop while the include path it set
up (${LOGOS_QT_SDK_ROOT}/include{,/cpp,/core}) contained none of the headers it
was chosen for. LOGOS_QT_HOST_ROOT is now the one source, and its absence is a
FATAL_ERROR that says so.

test-qt-host-repoint.nix follows: its test 3 asserted the fallback happened and
was announced; it now asserts the fallback is gone -- a build with no
LOGOS_QT_HOST_ROOT aborts even with a good logos-qt-sdk root present. Test 3b is
new and pins the probe fix directly: that same run must NOT say "logos-qt-sdk
not found", and a qt-sdk root scaffolded the way the real prefix now looks
(logos_qt_wire.h, no logos_api.h) is still found.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: LogosModule.cmake is this repo's, and every module type now gets it

logos-plugin-qt shipped a second copy of cmake/LogosModule.cmake, and which
one a module configured with was decided by its TYPE:

  buildCppPlugin.nix set LOGOS_MODULE_BUILDER_ROOT only when the MODULE's own
  repo carried a cmake/LogosModule.cmake. No module does, so every ui_qml
  plugin fell through to the value logos-plugin-qt's lib/default.nix sets --
  its own root -- while mkLogosModule's core path used this repo's copy.

Both compiled, so the two drifted with nothing to say so: this copy carried
A1's union (the generated_code/*.cpp glob, LOGOS_API_STYLE, the metadata
configure_file, Go/Rust static-lib linking, the external-library FATAL_ERRORs,
logos_find_qt as a Windows-safe macro) while plugin-qt's had B2b's addition of
logos_qt_arg_decode.{cpp,h} to the host-runtime source list -- which
qt_provider_object.cpp's dispatch needs, and whose absence is a link error, not
a configure error. That file is ported here.

Routing: both nix entry points now pass LOGOS_MODULE_BUILDER_ROOT
unconditionally, so a ui_qml plugin and a core module configure with the same
file. The old module-local branch is gone with it -- an unconditional value is
what makes "there is one copy" a property of the code rather than of what
happens to be on disk -- and a missing file now throws instead of falling back
to something that quietly configures differently.

logos_module() prints the file it came from, so a future fork shows up in any
configure log rather than after a phase of debugging.

Verified: counter, counter_qml, logos-storage-ui, logos-package-manager-ui,
test_fullapi_ui, logos-accounts-ui, logos-blockchain-ui, logos-wallet-ui and
logos-evm-wallet-ui (ui_qml) plus test_basic_module_cpp and capability_module
(core) all build, and their configure logs name this file. Checks by name:
default, qml-integration, qt-host-repoint, static-extlib OK; rust-native-dep
and test-framework-integration fail identically at the pre-change baseline
(this repo's own lock pins a logos-protocol without TokenManager::forIdentity,
so logos-qt-host will not compile from it -- green in the workspace closure).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: read the view templates from their owner, and check the ABI they declare

Two changes, one theme: nothing in this build should be able to pick a second
copy of a file without saying so.

1. cmake/LogosView*.in are deleted. They now live once, in logos-plugin-qt's
   cmake/, and _logos_module_add_replica_factory takes the directory from
   LOGOS_VIEW_TEMPLATE_DIR (cache variable, then environment) instead of
   probing for a sibling of this .cmake file.

   The sibling probe is what made the duplication possible: it meant the
   templates had to sit next to LogosModule.cmake, but logos-plugin-qt's
   rep-file-plugin fixture instantiates them too and cannot depend on this
   repo, so it kept a byte-identical copy. logos-plugin-qt is the only place
   both consumers can read one copy from; see its cmake/README.md.

   There is no fallback. An unset variable, or a directory missing any of the
   four templates, is a FATAL_ERROR naming what it wanted.

2. A new `view-interface-abi` check, in CI.

   LogosViewPlugin and LogosViewReplicaFactory are declared TWICE and always
   will be: module side in logos-plugin-qt's templates, host side in
   logos-view-module-runtime's headers. They cannot share a header — a module
   plugin has to compile against Qt alone, and logos-view-module-runtime
   depends on logos-plugin-qt, so the include could only point the wrong way.
   They bind at runtime through the IID string, and a mismatch there is silent
   the whole way: both sides compile, the plugin loads, qobject_cast returns
   nullptr, the view is blank.

   Until now the only thing holding those two in agreement was a comment
   asking a human to keep them in sync — which had already rotted (it pointed
   at src/, the headers are in include/) and prevented none of the five
   duplicate-source defects in this refactor.

   This repo depends on logos-plugin-qt AND on logos-view-module-runtime, and
   is the only one that does, so the comparison lives here. tests/
   view-interface-abi.py extracts the IID and the ordered pure-virtual list
   from both sides and fails on any difference — including a class rename,
   which would otherwise turn the comparison into a vacuous pass.

   Proven by mutation: adding an argument to enableRemoting on the module side,
   bumping the IID on the host side, and renaming the host-side class each turn
   the check red with a specific message; reverting each turns it green.

Note: like the already-red rust-native-dep and test-framework-integration
checks, view-interface-abi does not evaluate until this repo's logos-plugin-qt
pin advances past the commit that adds packages.<sys>.logos-view-templates. It
says exactly that, and names logos-plugin-qt as the input to move.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(view-abi): check the class that actually binds at runtime, and let it run

The guard had two independent faults; either one alone made it decorative.

1. IT DID NOT CATCH WHAT IT NAMED. The script read `#define <Name>_iid` and
   the `virtual ...;` list inside `class <Name>`. Both of those are the
   abstract shape. The runtime binding is declared on the CONCRETE class the
   template also contains — @LOGOS_FACTORY_CLASS@, with Q_OBJECT,
   Q_PLUGIN_METADATA and Q_INTERFACES — and that class was never inspected.
   Two mutations that both reach production were run against it and it stayed
   green on both:

     Q_PLUGIN_METADATA(IID LogosViewReplicaFactory_iid)
       -> Q_PLUGIN_METADATA(IID "logos.view.replica_factory/2.0")
     Q_INTERFACES(LogosViewReplicaFactory) deleted

   It now parses every class in the file, finds the ones deriving from the
   interface, and requires: at least one exists (so a dropped base class or a
   rename cannot make the comparison vacuous); a QObject-derived one has
   Q_OBJECT; a QObject-derived one names the interface in Q_INTERFACES; and
   any Q_PLUGIN_METADATA IID resolves to the IID the HOST casts on.

   Two more windows were open and are now closed: the argument of
   Q_DECLARE_INTERFACE was only checked for EXISTENCE, though it is the string
   qobject_cast compares and need not be the #define — it is now resolved
   through the file's #defines and compared both across sides and against that
   side's own #define; and the interface's own base list, which is its vtable
   layout, was not compared at all.

   Proven by mutation, 12 cases, each reverted to green afterwards: the 2
   above, plus a changed Q_DECLARE_INTERFACE IID, a dropped interface base, a
   renamed interface, a dropped Q_OBJECT, a base added to the interface, a
   *ViewPluginBase that stops implementing LogosViewPlugin, the 2 the old
   guard already caught (regression), and 2 null controls — a comment edit and
   a reflowed declaration — which must stay GREEN and do.

   The nix wrapper also sets `set -o pipefail` explicitly and folds stderr
   into $out. `... | tee $out` takes tee's exit status; that it worked at all
   depended on stdenv happening to set pipefail, which is not a thing a guard
   should rest on.

2. IT COULD NOT EXECUTE. With no overrides — the CI condition — the check
   EVAL-THREW: this flake pinned logos-plugin-qt at b8b9b414, which predates
   packages.<sys>.logos-view-templates. So the step was unconditionally red
   from the day it landed, camouflaged by test-framework-integration being red
   beside it for the same stale pin.

   Both logos-plugin-qt and logos-plugin-core (the same repo, selected per
   module type — a split pin gives core and ui modules two different
   LogosModule.cmake and two Qt host runtimes) now name rev fcf5a29 in the
   URL, not just in the lock, so `nix flake update` cannot walk them back onto
   a master that still lacks those outputs.

   That bump fixes the EVAL failure for all three affected checks.
   view-interface-abi is now GREEN with no overrides. rust-native-dep and
   test-framework-integration now evaluate and build, and fail later on an
   unrelated pre-existing problem: logos-qt-host does not compile against the
   pinned logos-protocol, whose TokenManager has no forIdentity /
   isolateIdentity. That is the same failure logos-plugin-qt's own #qt-host
   check has at fcf5a29 with its own lock and no overrides, so it is not
   introduced here and cannot be fixed here.

CI: qt-host-repoint is added — it is hermetic and it existed without ever
being listed. rust-native-dep is deliberately still not listed, with the
reason recorded next to it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(view-abi): follow bases transitively, or the guard watches an empty window

Implementor detection matched only the immediate base clause, so one level of
indirection skipped every concrete-class check — and the "no implementors"
backstop did not fire either, because the helper base still counted as an
implementor in its own right.

That is not a hypothetical shape. lidl_gen_ui.cpp emits every real ui_qml
plugin deriving from LogosViewPlugin INDIRECTLY, via <Rep>ViewPluginBase, so
for that half of the pair the window this guard exists to watch was empty in
production.

Resolve each class's transitive base set through the other classes in the file
before testing membership, and make the QObject check transitive with it. The
two mutations that escaped — an indirect base with the IID bumped to /2.0, and
an indirect base with Q_INTERFACES deleted — now fail, each naming its own
cause; indirection alone stays green and reports both implementors.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): bump the B3/B4 stack, and rev-pin the inputs update cannot reach

Moves every input this builder shares with the SDK codegen stack onto the
revisions that stack has actually pushed:

  logos-protocol             03842db -> c8bab12  feat/per-client-token-store
  logos-cpp-sdk              e3744fb -> a04b278  feat/sdk-codegen-b3-d11
  logos-qt-sdk               c6be61d -> 8a06b87  feat/sdk-codegen-b3-d11
  logos-plugin-qt            fcf5a29 -> cc24fa1  feat/b4-qt-host-windows-target
  logos-plugin-core          fcf5a29 -> cc24fa1  same rev, per the type split
  logos-view-module-runtime  471dd56 -> 5510acd  feat/sdk-codegen-b4-qt-host
  logos-standalone-app       288fec2 -> 39f4f2b  feat/sdk-codegen-b4-qt-host
  logos-test-framework       eb1600c -> c382ab1  feat/sdk-codegen-b4-test-framework

Every one of those is a BRANCH TIP, not master. Six of them were plain
`github:logos-co/<repo>` urls, so `nix flake update` would have relocked them
onto master and the bump would silently not have happened -- the update
succeeds, the lock changes, and the rev is still wrong. They are rev-pinned
here for the same reason logos-plugin-qt already was. Each is a fast-forward
from its own master (03842db, e3744fb, c6be61d, 8846fc5, 471dd56, 288fec2 and
eb1600c are ancestors of their targets), so pinning gives up nothing; drop the
revs as the branches land.

logos-plugin-qt/-core go to cc24fa1, the tip of feat/b4-qt-host-windows-target,
NOT to the sibling feat/b4-qt-host-windows-target-8ccb1fc. The sibling
re-baselines onto 8ccb1fc and drops the LogosModule.cmake repoint and the
view-templates commit, so its flake exposes no packages.<sys>.logos-view-templates
and `view-interface-abi` would hit its own throw instead of running. cc24fa1
carries the old fcf5a29 pin's content under rebased shas (4c581a6/e4ea357/fcf5a29
are fe780a6/34704d1/3d7e3e6 there).

logos-test-framework's pin is the least obvious and the one worth keeping: this
branch teaches mkLogosModuleTests to pass -DLOGOS_QT_HOST_ROOT, and it is
LogosTest.cmake on c382ab1 that prefers it -- master's copy knows only
LOGOS_QT_SDK_ROOT, so a master lock links the unit tests against the wrong
runtime root without failing.

The follows keep one logos-protocol on the link line: root, logos-plugin-qt,
logos-plugin-core, logos-qt-sdk and logos-cpp-sdk all resolve to c8bab12.

All seven checks build on aarch64-darwin: default, qml-integration,
qt-host-repoint, rust-native-dep, static-extlib, test-framework-integration,
view-interface-abi.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat(metadata): codegen.consumer_api_style, gated on how the image gets tokens

Lets a module declare its CONSUMER type surface independently of its provider
packaging. A cdylib-packaged module can now hold Qt-typed dependency wrappers —
the combination that was previously inexpressible, and the only reason
`interface: "provider"` and `--provider-header` are still alive.

The enabling codegen landed first (logos-cpp-sdk 620f2e1, logos-qt-sdk 6b88630):
a default-constructible Qt umbrella and a consumer binding that takes an
explicit origin instead of a LogosAPI. An earlier attempt at this key FAILED
because it was added without that codegen, so its only reachable outcome was a
compile error inside generated code. It is meaningful now.

── The predicate ───────────────────────────────────────────────────────────

    packagedAsCdylib = interface == "cdylib"
                    || (interface == "universal" && type != "ui_qml")

character-for-character what modulePreConfigure.autoCodegen branches on when it
decides to emit the module-impl C ABI, so the two cannot drift.

The distinction is NOT "this image has no LogosAPI" — a cdylib module's plugin
does contain one, in the Qt glue that receives tokens. What separates the two
worlds is where the image's own TokenManager is FILLED:

  cdylib-packaged : logos_module_accept_token -> lp_token_save, same image.
                    An origin-bound wrapper's null sync hook costs nothing.
  Qt plugin       : only LpBridge::syncTokens, installed exclusively by
                    forTarget(api, …). An origin-bound wrapper there would be
                    silently unauthenticated — the exact defect syncTokens
                    exists for.

Measured with `nm -gU`, not argued: `logos_module_accept_token` is defined in
exactly the shapes the predicate calls true, across six real plugins.
`universal` + `ui_qml` is the trap — it looks cdylib-shaped but uiCodegen emits
only view glue, so it is a Qt object holding a LogosAPI. Excluded.

`--binding origin` is not selectable from metadata at all: it is derived as
`isQt && packagedAsCdylib` in the backend, an AND no key can reach from the
wrong side. What a key CAN express wrongly is the mirror move — `lp` on a Qt
plugin — unsafe for the identical reason, and refused at eval naming the key.

Verified additive on seven modules spanning legacy/core, universal/core,
universal/ui_qml and QML-only: `diff -r` clean, narHash identical where
comparable, and `test_qml_only` byte-identical by store path. Note compiled
modules cannot share a store path across any builder edit, since mkLogosModule
bakes LOGOS_MODULE_BUILDER_ROOT — narHash is the honest comparison.

Three mutation controls, each failing loudly: removing the eval throw, nulling
the backend's own assertion, and dropping the packagedAsCdylib conjunct from
`originBound` — the last being the one that pins the token-mirror hazard rather
than just the lp refusal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): take the backend that honours consumer_api_style

08ae7ac added the metadata key but this repo still pinned logos-plugin-qt at
cc24fa1c, which predates 2d25069's `originBound` derivation. Both backend
inputs resolved there, so the key parsed and validated and then reached a
backend that ignored it: a module asking for Qt-typed consumers still got
lp-typed wrappers, and failed to compile with a type mismatch 20 errors deep
rather than anything naming the key.

Both `logos-plugin-qt` and `logos-plugin-core` move — they are two inputs onto
the same repo, selected by module type, and a split pin would give core and ui
modules different backends.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): take the SDKs that carry the origin-bound consumer codegen

The backend pin (723244b) was necessary but not sufficient. consumer_api_style
= "qt" on a cdylib emits `new LogosModules()` against the Qt umbrella, which is
default-constructible only from logos-cpp-sdk 620f2e1; and the wrapper it
constructs binds through LpBridge::forOrigin, which arrives with logos-qt-sdk
aca2951. Pinned at a04b278 / 8a06b87 the key resolved, reached a backend that
honoured it, and then failed at

    no matching constructor for initialization of 'LogosModules'

in generated code — three pin levels away from anything naming the feature.

Recording the chain, because it took four bumps to find: a module's consumer
surface is decided by test-modules -> module-builder -> {plugin-qt, cpp-sdk,
qt-sdk}, and every level has to move together. Each intermediate state built
something; none of them built the right thing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: refuse a core module that ships a plugin with no interface

`interface` defaults to "legacy", and legacy generates no glue. For a CONSUMER
that is correct: a ui_qml view plugin is never loaded by liblogos, and a fixture
that only builds tests has nothing to expose. For a module that ships a plugin
liblogos loads and other modules call, it is the silent form of exactly what the
`provider` branch already throws for — the module builds green and is
un-callable from every consumer, with the first symptom arriving at runtime in a
different process.

`main` is the discriminator, and measurement is why. `type` alone cannot do it:
of the modules that reach autoCodegen with no interface, the ten ui_qml ones are
consumers and test_framework_module is core but ships no plugin at all — it has
no plugin source, only calculator.{h,cpp}, and exists to drive mkLogosModuleTests.
Gating on `type == "core"` would have thrown for it. A provider ships a plugin,
so it names one in `main`; that fixture's `main` was vestigial and is dropped
here, which is also the honest description of what it always was.

Both directions checked, not just the quiet one: with the vestigial `main` put
back, test-framework-integration fails to evaluate with this message; with it
dropped, the same attribute evaluates and the check builds. The workspace still
evaluates on aarch64-darwin (624 packages) and x86_64-windows (386).

Depends on logos-test-modules retiring test_ipc_module, which was the last
module this would have thrown for.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(metadata): drop `dynamic_calls`, which broke the grants it sat beside

`dynamic_calls` was listed as a host service and is not one. It gated nothing
and could not: the by-name path is ungated at every layer, so any module could
always make dynamic calls without asking.

What the declaration actually did was break the asking module. `hostServiceBit`
(logos_protocol.cpp:109-111) recognises exactly `token_registry` and
`token_delivery`; `lp_grant_host_services` returns LP_ERR_INVALID_ARG on the
first entry it does not recognise (:695-702), which fails the WHOLE grant. So a
module asking for `dynamic_calls` alongside a real service silently lost the
real one — the opposite of the "ADVISORY … an ungranted module gets
LP_ERR_UNSUPPORTED" the comment here promised.

Removed from `known` rather than made inert, so asking is now a build error
instead of a silent downgrade. No module in the tree declares it.

The supported surface for by-name calls is LogosModules::dynamic(target) plus
LpClient::getMethods(), added in logos-cpp-sdk alongside this. Neither needs a
grant, which is the whole point.

Two tests move with it. The "accepted for any module" case becomes an
assertThrows. The "allowlist is not bypassed by mixing in a permitted service"
case loses its premise — both remaining services are trust-root, so there is no
"permitted for anyone" name left to mix, and keeping the old form would have
passed for the wrong reason (unknown name, not the allowlist). It now pins that
asking for BOTH trust-root services does not slip past.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* ci: use logos-co/setup-nix-cache-action for Nix setup and caching

Replaces the per-repo installer + cachix pair with the shared action, which
installs Nix with the Logos Attic cache (cache.nix.logos.co) preconfigured and
publishes what the job builds — master to the public cache, every other ref to
ci.

Each converted job also gains

    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}

because ATTIC_TOKEN_PUBLIC only exists inside that environment. Without it the
secret resolves empty on master and publishing is silently skipped — the job
still passes, so the omission would not show up as a failure.

The action installs Nix itself on every runner, macOS included. That is a
deliberate reversal of the workaround these files carried: the comments here
said cachix/install-nix-action collides with the runner's pre-existing _nixbld
users (eDSRecordAlreadyExists), so DeterminateSystems' installer was used
instead. It no longer reproduces — logos-delivery-module has already been
converted the plain way and its `build-and-test (macos-latest)` leg passes.
Keeping the workaround would have meant a second installer plus a duplicated
substituter/key block in ten files, guarding against something two green runs
say does not happen. If it ever recurs it fails loudly at install, which is
recoverable; the silent-skip above is the failure mode worth engineering
against.

One property is deliberately NOT carried over: the old cachix step ran with
`continue-on-error: true` so a failed cache push could not fail a job whose
tests passed. The action exposes no equivalent, and adding one here would also
swallow genuine setup failures now that the same step installs Nix rather than
only publishing at the end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs: align guides and skills with the universal codegen pipeline

The docs/ set, the authoring skills and the CMakeLists template still told
authors to write `interface: "provider"` classes with LOGOS_METHOD, or claimed
the builder runs `logos-cpp-generator --from-header` to emit the Qt glue. The
universal path is three steps — `--header-to-lidl` to derive the contract, then
`logos-qt-host-generator --backend cdylib` for the plugin glue, then
`logos-cpp-generator --lidl --backend cdylib` for the C-ABI exports — and
`--from-header` drives the separate `interface: "cdylib"` authoring path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* feat: take the view templates from logos-view-module

The LogosView*.in templates moved out of logos-plugin-qt, which is now limited
to making a cdylib loadable by logos-module-loader-qt. Add logos-view-module as
an input and read them from there.

- view-interface-abi now reads logos-view-module's logos-view-templates and
  diffs it against logos-view-module-runtime's host headers. The throw fallback
  named logos-plugin-qt and told the reader to bump that pin; it names
  logos-view-module now.
- This repo supplies LOGOS_VIEW_TEMPLATE_DIR itself, since the backend no
  longer does, via the extraCmakeFlags/extraEnv seams already carrying
  LOGOS_CPP_SDK_ROOT and the other four roots. Both channels are load-bearing:
  the cmake flag drives the nix build, the env var is what a dev shell resolves
  when someone runs cmake by hand.
- Indexed through common.buildSystemFor, NOT the raw system: logos-view-module
  publishes only the four native systems, while this repo's systems list adds
  x86_64-windows, so a raw index would EVAL-fail the Windows leg.
- LogosModule.cmake's hard error named logos-plugin-qt as the caller that
  passes the variable; it names this repo now.

The input is left on master rather than rev-pinned: the output does not exist
on any pushed branch yet, so view-interface-abi hits the throw until the move
lands and the pin can be set. Verified locally with
--override-input logos-view-module path:...

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): pin logos-view-module at the merged template move

logos-view-module#2 merged as 1f95a75, so packages.<sys>.logos-view-templates
now exists on its master and the input no longer has to sit unpinned.

Rev-pinned for the same reason logos-plugin-qt is: `nix flake update` must not
be able to walk this back to a commit without that output, which
view-interface-abi and every ui_qml plugin build need.

view-interface-abi now passes with NO --override-input, which is what the
unpinned state could not demonstrate.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): pin logos-standalone-app at the branch that absorbed master

The last pin on this branch that walked master backward. master's b960f44 had
bumped logos-standalone-app to e582e6c; this branch pinned 39f4f2b, which is on
feat/sdk-codegen-b4-qt-host only and does not contain it — so merging would
have reverted the hot-reload fix (#36) and the capability-bundling removal.

That branch has now absorbed master (logos-standalone-app b67eddd, `nix build
.#default` green) and this pins the result, exactly as logos-view-module-runtime
was handled in 8484fbb.

Every root input on this branch now CONTAINS master's rev: cpp-sdk, plugin-qt,
plugin-core, protocol, qt-sdk, test-framework, standalone-app and
view-module-runtime all check out as ancestors. Nothing walks master backward
any more.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): track master for every input whose PR has merged

logos-protocol (#59), logos-cpp-sdk (#138), logos-plugin-qt (#19) and
logos-qt-sdk (#33) have all landed, so the four rev pins bridging to them are
retired and each stale rationale is rewritten to name the PR that closed it.

logos-plugin-core moves in lockstep with logos-plugin-qt — it is the same repo
under a second input name, and a split pin would put two logos-qt-hosts in one
closure.

All four were SQUASH-merged, so `merge-base --is-ancestor <pin> master` is
correctly false while the content is in master. Every retirement was confirmed
against master's FILES via gh api, not ancestry.

The qt-sdk pin is worth a note: nothing makes logos-qt-sdk `follows` anywhere, so
one revision across consumers was upheld by hand-pinning the same rev — and it
had already drifted (this repo pinned aca2951 while logos-test-framework and
logos-basecamp pinned 8a06b870). Tracking master makes it structural.

Kept: logos-test-framework @ c382ab1 (master's LogosTest.cmake still knows only
LOGOS_QT_SDK_ROOT, not LOGOS_QT_HOST_ROOT — verified, 0 hits) and logos-rust-sdk
@ 0b4b8ed (no confirmed upstream merge).

All 7 checks build on aarch64-darwin and the flake evaluates on all 4 systems.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): retire four more pins, now that their PRs have merged

Takes this flake from five rev pins to one.

* logos-test-framework c382ab1 -> master. The pin existed because master's
  cmake/LogosTest.cmake knew only LOGOS_QT_SDK_ROOT, so an unpinned input made
  `test-framework-integration` link the unit tests against the wrong runtime
  root. logos-test-framework#6 merged and master now has LOGOS_QT_HOST_ROOT
  (6 references) — the exact gap the comment named.
* logos-standalone-app b67eddd -> master (13b81c9, #37). The host shell for
  ui_qml `nix run` / integration tests carries the qt-host repoint, the
  hot-reload fix (#36) and the capability-bundling removal on master now.
* logos-view-module-runtime 3ef779c -> master (b9a6778f, #25). Master no longer
  rev-pins logos-plugin-qt itself, so both sides of the view ABI check are back
  in step.
* logos-view-module 1f95a75 -> master. 1f95a75 IS that repo's master tip (the #2
  merge), so this pin was already a no-op.

Every rationale is rewritten to name the PR that closed it rather than deleted.
All four upstreams were SQUASH-merged, so the old revs are not ancestors of the
new masters even though their content is in them; the retirements were confirmed
against master's FILES.

Relocked with an explicit --update-input per retired input, NOT a bare
`nix flake lock`: that does not re-resolve an input which is already locked, even
once its url stops carrying a rev, and it silently walked pins backward twice
earlier today. All eight now read master — view-module-runtime b9a6778f,
view-module 1f95a75f, standalone-app 13b81c9e, test-framework 5f75c941,
cpp-sdk 95d7b3a9, protocol f4407ff4, plugin-qt 9b2c64e5, qt-sdk 19c844f2.

logos-rust-sdk @0b4b8ed stays: no merged upstream confirmed for it.

All 7 checks build, including test-framework-integration — the one that would
actually catch a mislocked test-framework rather than compile around it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): retire the last rev pin, logos-rust-sdk

This flake now pins nothing by rev.

0b4b8ed was kept on the grounds that no merged upstream could be confirmed for
it. That was wrong: it is an ANCESTOR of logos-rust-sdk's master (7c65d31), so it
was never waiting on anything — just behind. Unlike every other pin here it also
carried no stated reason; the comment beside it explains the `follows` that cuts
the rust-sdk -> module-builder test cycle, not the rev.

Master adds exactly two commits over it, neither touching what this builder
consumes (logos-lidl-gen and the SDK source the crate links):
  671bcc6 chore(lidl-gen): delete the dead gen_provider example (#39)
  7c65d31 ci: use logos-co/setup-nix-cache-action for Nix setup and caching (#40)

checks.rust-native-dep — the one that compiles a Rust module through lidl-gen —
rebuilds from source against rust-sdk master and passes, as do `default` and
view-interface-abi.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): take the rust-sdk that emits the 11th module-impl export

logos-rust-sdk#41 merged (52f0c6f), so its provider scaffold now emits
logos_module_grant_host_services — the one module-impl C ABI export it was
missing.

That is what broke this branch's cross-language doctests. Since ed50731 the
cdylib Qt glue comes from logos-plugin-qt's logos-qt-host-generator, and the
protocol bump turned on that glue's LOGOS_PROTOCOL_VERSION_MINOR >= 3 call to
the export. logos-protocol only declares it; each language backend owes the
definition, and logos-cpp-sdk had one where logos-rust-sdk did not. Every Rust
plugin therefore linked a call with no definition — not a link error on ELF, but
nixpkgs' -Wl,-z,now forces eager binding, so the module's host process aborted at
dlopen. It died AFTER the token exchange, so the runtime reported a successful
load and only the post-load registry snapshot showed the module gone, which is
why it looked like the dependency resolver dropping the Rust module.

doctests/cross-language-composition.test.yaml: 19 passed, 0 failed — including
the assertion that failed in CI (load-module cpp_frontdesk_module listing
rust_orchestrator_module) and every typed call across the boundary in both
directions. checks.rust-native-dep also builds.

Caveat: this was verified on macOS, which links plugins -undefined
dynamic_lookup and so never binds the symbol at all — that is exactly why the
bug was invisible there and fatal on Linux. What macOS proves is that nothing
regressed and the qt-sdk/cpp-sdk skew is gone; the ubuntu doc-tests are what
confirm the Rust modules now load.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): take the rust-sdk that calls grant_host_services publicly

logos-rust-sdk#42 merged (a3d0d71). #41 had emitted
`logos_rust_sdk::ffi::lp_grant_host_services(...)`, but `mod ffi` is private, so
every Rust module generated against protocol >= 0.3 failed to COMPILE with
error[E0603] — which is why this branch's doctests went from "the Rust module
does not load" to "Build it FAILED". #42 routes the call through a public
wrapper, matching how the crate already exposes save_token.

checks.rust-native-dep rebuilds a real Rust module through the generator against
a3d0d71 and passes, and doctests/cross-language-composition.test.yaml is 19
passed / 0 failed — including the load-module assertion that started this and
every typed call across the C++/Rust boundary in both directions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-20 00:31:52 -03:00
Dario LipicarandClaude Opus 5 d256a42faa feat(windows): give a cross Rust module winpthreads, headers and archive (#200)
nixpkgs builds mingw-w64 against mcfgthread, so winpthreads is a separate
package on no default path. Plenty of vendored C assumes the standard
mingw environment, where it is simply present. aws-lc-sys is the case
that surfaced this, and it matters because a module cannot route around
it: aws-lc-rs arrives through third-party crates (reqwest ->
hyper-rustls -> rustls, and the alloy stack), and Cargo features are
additive, so a consumer cannot switch rustls to `ring` from its own
manifest.

Two halves, and the first alone is a trap:

- Headers. Without them the build dies on `fatal error: sched.h: No such
  file or directory`, which reads like the platform is unsupported when
  it is only unwired. cc-rs appends CFLAGS_<triple>/CXXFLAGS_<triple> to
  the compiler invocations it drives, so this reaches build-script C
  without touching the Rust compile.

- The archive. With <sched.h> reachable, aws-lc compiles aws-lc's
  thread_pthread.c, and the plugin link then wants pthread_rwlock_*,
  pthread_once, pthread_key_create, sched_yield. winpthreads goes in as a
  buildInput so its lib/ lands on NIX_LDFLAGS, and LogosModule.cmake's
  WIN32 branch names `pthread`.

Adding `pthread` to that branch is free for modules that do not need it:
ld pulls archive members on demand. Verified — keystore_module's Windows
plugin imports no libwinpthread and stages no pthread DLL, and both its
targets still build.

The linker half of this same story (`-L native=<pthreads>/lib` for
windows-gnu std) landed in #197; this completes it. Native builds are
untouched: every branch is guarded by `rustCrossTarget != null`.

Note for review: the resulting image carries both libmcfgthread-2.dll
(libstdc++) and libwinpthread-1.dll (aws-lc). Both are thin layers over
Win32 primitives and coexist in ordinary mingw distributions, but the
DLL has not yet been exercised on real Windows — a green link is not a
green run.

Verified: chat_module cross-builds to a 40MB PE32+ x86-64 plugin
exporting qt_plugin_instance / qt_plugin_query_metadata_v2, with the
crypto stack (aws-lc-rs, rustls, de-mls, libchat) really linked in and
libwinpthread-1.dll staged into its DLL closure.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-14 18:50:34 -03:00
Dario LipicarandClaude Opus 5 95869a1ced feat(windows): cross-compile Rust modules to x86_64-pc-windows-gnu (#197)
A `codegen.rust` module could not be built for Windows. Two independent
halves were missing.

**The crate compile.** The Rust toolchain has to RUN on the builder and
merely TARGET Windows, so it is taken from the build system with
`targets = [ "x86_64-pc-windows-gnu" ]` rather than from the cross set —
asking the cross set for `rust-bin` evaluates `targetPackages.threads.package`,
which only the MinGW branch defines. That choice then has a consequence:
nixpkgs' `cargoBuildHook` derives `--target` from the stdenv's HOST
platform, so left alone it silently builds for the BUILDER and yields a
perfectly good Linux archive that cannot link into a PE. The cross case
therefore drives cargo directly. Alongside that, `CC_/CXX_/AR_<triple>`
are set so cc-rs compiles build-script C for Windows too, `nix.rust`
build packages resolve from `buildPackages` (they are host tools), and
`lidl-gen` resolves from the build system (it is a generator, not a
shipped artifact).

**The plugin link.** `LogosModule.cmake` chose the native libraries Rust's
`std` leaves undefined with a two-way `if(APPLE)/else()`, so "else" meant
"Linux" and put `pthread dl` on the Windows link line — `dl` does not
exist on Windows, and `pthread` lives in a separate mingw_w64-pthreads
package that is not on the sysroot search path. The new `elseif(WIN32)`
list is derived from the archive's own undefined symbols rather than
guessed, and the finished DLL's import table confirms all of it is
reachable and none of it redundant.

Every cross branch keys off `rustCrossTarget != null`, and
`buildSystemFor` is the identity on native systems, so native builds take
exactly the path they did before.

Verified: keystore_module and token_list_module both produce PE32+ x86-64
plugin DLLs exporting qt_plugin_instance / qt_plugin_query_metadata_v2,
with the Rust crypto and TLS stacks (eth-keystore, coins-bip39,
alloy-signer-local; ring, rustls, webpki, hyper, reqwest) really linked
in, and both still build for x86_64-linux unchanged.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-14 14:45:47 -03:00
9d3b7cc1f5 feat(windows): give mkLogosModule an x86_64-windows target (#194)
* feat(windows): give mkLogosModule an x86_64-windows target

Routes every package-set construction in the builder through one helper,
common.mkPkgs, and teaches that helper the "x86_64-windows" pseudo-system.
This is the leverage point for the whole module ecosystem: modules do not
construct pkgs themselves, so fixing it here lets all ~40 of them target
Windows without each re-deriving the cross plumbing.

x86_64-windows cannot be produced by `import nixpkgs { system = ...; }` --
a cross derivation's `system` attribute is its BUILD platform, so it needs
localSystem/crossSystem plus the mingw overlays, which is exactly what
logos-nix.lib.mkWindowsPkgs wraps. logos-nix was already an input of this
flake but was never threaded into the lib; it now reaches common.nix via
lib/default.nix, and the pseudo-system is only advertised when it is
present, so a caller without it is unaffected.

Ten sites moved: common.nix, buildCppPlugin.nix x2, mkLogosQmlModule.nix
x2, mkLogosModuleTests.nix, mkLogosModule.nix x4. `systems` and
`forAllSystems` moved into the let block, since an attribute set is not
recursive and both now reference each other.

The Rust path keeps its rust-overlay via mkPkgsWith, which THROWS for a
Windows target rather than silently dropping the overlay and handing back a
package set that is not what the caller asked for. Rust modules on Windows
were already out of scope; this makes that explicit at eval time instead of
producing a subtly wrong build.

Verified: logos-capability-module evaluates unchanged on aarch64-darwin and
now also evaluates for x86_64-windows.

* feat(windows): split host tools from target artifacts in the builder

Follow-up to the x86_64-windows target: getting the pseudo-system to
EVALUATE was not enough, because several things the builder puts on the
build machine were being taken from the TARGET package set.

* common.buildSystemFor names the system a build for a target actually runs
  on (identity natively, x86_64-linux for x86_64-windows). Host tools now
  come from there.

* logos-cpp-sdk's default output serves two roles at once -- it carries the
  logos-cpp-generator BINARY and the target headers/CMake package. Under
  cross those must come from different package sets, so the 15 consumers
  are now split by role: everything landing in nativeBuildInputs (plus
  buildHeaders and the moduleLidl generator invocation) takes the new
  logosSdkBuild, while every -DLOGOS_CPP_SDK_ROOT / LOGOS_CPP_SDK_ROOT /
  buildInputs slot keeps the untouched target logosSdk. Getting this
  backwards is worse than the failure it fixes: it would SUCCEED and link
  the wrong architecture. mkLogosModuleTests is the proof case -- same
  derivation, logosSdkBuild in nativeBuildInputs, logosSdk in buildInputs.

  (The symptom was "logos-cpp-generator: command not found" rather than an
  exec-format error because logos-cpp-sdk/nix/bin.nix:39 guards the copy on
  the unsuffixed name with no else, so a mingw build silently ships an
  EMPTY bin/. Worth fixing there too.)

* pkgs.jq -> pkgs.buildPackages.jq: jq is target-typed as well and runs in
  preConfigure.

* extraCmakeFlags now prepend pkgs.logosQtCrossCmakeFlags, which point Qt at
  its host TOOL packages (repc et al). Absent -- and so empty -- natively,
  hence no isWindows guard. The symptom is misleading: CMake names
  Qt6RemoteObjects, but the target config resolves fine and it is
  Qt6RemoteObjectsTools that is missing.

capability-module now gets through evaluation, generation and Qt discovery.
It does NOT build yet: Qt 6.11.1 then hits a duplicate imported-target error
in Qt6EntryPointMinGW32Target.cmake, which is a Qt-on-MinGW CMake issue
rather than a Logos one.

* fix(windows): make logos_find_qt a macro, and pass the header contract

Two changes that together get a module cross-building.

1. logos_find_qt was a function(). Qt's mingw Qt6EntryPointMinGW32Target.cmake
   guards itself with a bare include_guard(), which CMake scopes to the most
   recent FUNCTION scope, while add_library(IMPORTED) creates a DIRECTORY-scoped
   target. So the guard variable died at endfunction() while the target
   survived, and the next find_package(Qt6) -- via logos-protocol's or
   logos-qt-sdk's find_dependency -- re-entered and hit "cannot create imported
   target EntryPointMinGW32".

   This is upstream Qt: QTCREATORBUG-32887, confirmed by a Qt maintainer,
   never fixed in qtbase (the file is byte-identical 6.7 through dev). Qt's own
   fix was consumer-side, converting a function to a macro for exactly this
   reason (qt-creator 9ded3246). Every other target file in that tree guards on
   TARGET existence, which is scope-proof.

   The two PARENT_SCOPE qualifiers had to go: under a macro they would have
   written to logos_module's CALLER.

2. Threads a per-module header contract through to the backend's buildHeaders,
   so a legacy module without a derived LIDL can still produce typed headers
   when the plugin cannot be introspected. See logos-plugin-qt.

* fix(windows): find and ship external libraries under mingw

LogosModule.cmake's EXT_LIB_NAMES listed only .dylib/.so/.a, so every
module declaring nix.external_libraries failed to cross-compile with
"External library '<x>' ... was not found in .../lib" -- which reads like
a staging bug rather than a missing filename spelling.

On Windows a shared library is TWO files: you LINK the import library
(lib<x>.dll.a under mingw) and SHIP the .dll. Both are now searched.

The runtime copy needed care of its own: the import library's name ends
in ".a", so the existing `NOT MATCHES "\\.a$"` test would classify it as
a static archive and skip the copy -- producing a plugin that links
cleanly and then fails to load with no DLL beside it. When a .dll.a or
.lib was linked, the companion .dll is resolved and copied instead, and
its absence is a hard error rather than a silent omission.

Unblocks logos-package-downloader-module and every other external-library
module under cross.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(deps): re-pin the L1-L5 inputs to their merged revs

logos-nix (L1); logos-protocol, logos-module (L2); logos-cpp-sdk,
logos-plugin-qt, logos-plugin-core, nix-bundle-lgx, logos-design-system (L3);
logos-qt-sdk, nix-bundle-logos-module-install (L4); and logos-view-module-runtime
(L5) are all on their default branches now, so the lock can name the merged revs
instead of the pre-merge branch tips it was resolving against while those PRs
were open.

Deliberately NOT repinned, because they carry no Windows work and are not part
of this chain: rust-overlay, logos-standalone-app, logos-test-framework, and
logos-rust-sdk (which is pinned to an explicit rev in flake.nix).

Co-authored-by: Cursor <cursoragent@cursor.com>

* test: update the systems assertion for the x86_64-windows pseudo-system

550c7c9 appended "x86_64-windows" to common.systems but left
tests/test-common.nix asserting four entries, so the unit-test derivation threw:

    error: FAIL systems has 4 entries: expected 4, got 5

This is NOT a consequence of re-pinning logos-nix. The list is

    [ 4 native ] ++ lib.optional (logos-nix != null) "x86_64-windows"

and flake.nix passes that input unconditionally, so the count has been 5 since
550c7c9 regardless of which logos-nix rev is locked -- verified by evaluating
common.systems at 1cc41fa, the commit before the re-pin, which also gives 5. The
only reason it surfaced now is that this branch had no CI run between 550c7c9
and the PR being opened.

Asserts membership of the pseudo-system as well as the count, so the two cannot
drift apart again silently, and records what makes the fifth entry a pseudo-
system: a cross derivation's `system` is its BUILD platform, so it evaluates
anywhere and realises on x86_64-linux.

Verified: nix build .#checks.aarch64-darwin.default -> 257 tests passed.
Co-authored-by: Cursor <cursoragent@cursor.com>

* test: assert the extlib copy contract against the code, not a comment

1cc41fa reflowed the sentence "static archives are linked in, no runtime copy
needed" onto two lines. tests/test-static-extlib.nix grepped for that exact
prose, so the check failed on a comment rewrap while the behaviour it claimed to
cover was untouched:

    PASS: .a names added to find_library NAMES list
    PASS: copy_if_different is guarded by NOT EXT_LIB_FILENAME MATCHES
    <exit 1>

Like the systems assertion, this predates the re-pin: it breaks on 1cc41fa's tree
regardless of which revs are locked, and only surfaced now because the branch had
no CI run between that commit and the PR.

Test 3 now asserts the contract instead of the prose -- EXT_RUNTIME_LIB stays
empty for a plain .a and the copy is guarded on it -- so a reflow cannot break it
and a behaviour change cannot slip past it.

Adds Test 3b for the hazard 1cc41fa actually introduced, which nothing covered: a
mingw IMPORT library lib<x>.dll.a ends in ".a", so the static-archive guard would
skip it and ship a plugin that links clean and then cannot load. The regex script
now pins both halves of that overlap -- .dll.a matches the narrow pattern AND the
broad one, a real .a matches only the broad one -- which is the whole reason the
.dll.a arm must be tested first.

Verified: nix build .#checks.aarch64-darwin.static-extlib passes.
Co-authored-by: Cursor <cursoragent@cursor.com>

* chore(deps): re-pin logos-standalone-app to the lock that matches its runtime

This flake pins logos-view-module-runtime itself and forces it on
logos-standalone-app via `follows`, so that bumping it for module testing needs
no standalone release. That is deliberate, but it means standalone gets a
view-module-runtime its OWN lock knows nothing about.

At 592af8aa that paired a new LogosQmlBridge with a pre-deferred-events
logos-qt-sdk (09365f5e), and the doc-tests failed to LINK:

    undefined reference to `LogosAPIClient::eventSubscriptionState(unsigned long long) const'
    undefined reference to `LogosAPIClient::onEventWhenAvailable(...)'
    undefined reference to `LogosAPIClient::pendingEventSubscriptions() const'
    undefined reference to `LogosAPIClient::whenObjectAvailable(...)'

288fec2 brings standalone's lock onto the same SDK layer this flake uses --
logos-qt-sdk c6be61d0 on both sides now -- so the forced runtime and the SDK it
needs agree. Nothing in this flake had to reach further into standalone's
dependency graph to achieve it.

Note this failure was NOT specific to the Windows work: it needed only the
view-module-runtime bump, which this branch happens to be the first to carry.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-11 18:07:50 -03:00
Dario LipicarandClaude Opus 5 01bb03f91f chore: stop producing and requesting the std header variant (#175)
Every module was building a third `headers-std` derivation (a full
logos-cpp-generator run) that nothing ever consumed. buildPlugin.nix
picks a dep's headers with `dep."headers-${apiStyle}"`, and apiStyle is
only ever "lp" (cdylib / core universal) or "qt" (everything else) —
the "std" branch has been unreachable since lp replaced it. Measured:
the recursive derivation closure of a built module contains zero
headers-std, and no revision of buildPlugin.nix ever selected "std".

So drop the producer (`moduleIncludeStd`) and both output aliases
(`<name>-headers-std` and `headers-std`).

The std rung also sat in the middle of the dep-resolution fallback
chain (`headers-lp = ps.headers-lp or ps.headers-std or ps.headers-qt
or ...`). Rather than let it collapse to headers-qt, the lp chain now
throws: handing Qt-typed wrappers to a module whose own codegen ran
with `--api-style lp` fails deep inside a generated source file with a
wall of unrelated-looking Qt type errors. The throw names the dep and
says to rebuild/re-pin it against a current builder. It is lazy, so it
only fires when an lp consumer actually reads `headers-lp` — a Qt
consumer with the same stale dep still resolves to headers-qt exactly
as before.

buildCppPlugin.nix gets the same treatment. Its struct had no
headers-lp entry at all, so an lp consumer reaching that path died with
"cannot coerce a set to a string" from the header copy; now it gets the
same actionable message. (In practice everything built through there is
a ui_qml view module, which is always typed "qt".)

The generator still accepts `--api-style std`; removing that is a
separate step, ordered after this lands and is re-pinned.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-07-30 21:25:13 -03:00
Alejandro Cabeza Romero 5302512d67 Improve docs. 2026-06-18 15:25:00 +02:00
Alejandro Cabeza RomeroandClaude Sonnet 4.6 898d7bf49a uppercase the lib name in LOGOS_EXT_ROOT_<NAME> to match shell env var convention
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-18 15:25:00 +02:00
Alejandro Cabeza RomeroandClaude Sonnet 4.6 b76f3f9e01 resolve external lib store paths in dev shell via LOGOS_EXT_ROOT_<name> to bypass hardcoded ./lib/ dir
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-18 15:25:00 +02:00
Dario LipicarandClaude Opus 4.8 03ad946f19 Builder-driven Rust codegen: no build.rs, trivial flake (#125)
* feat(builder): builder-driven Rust codegen — no build.rs, trivial flake

A Rust cdylib module's module-impl C ABI scaffold and staticlib are now
produced by mkLogosModule itself, driven by metadata.json's codegen.rust —
exactly as the builder already runs the C++ generator. The author writes no
build.rs and the module's flake.nix / CMakeLists.txt shrink to the same shape
a C++ module uses.

metadata:
  "codegen": {
    "lidl": "rust-lib/<name>.lidl",
    "rust": { "crate": "rust-lib", "staticlib": "<libname>" }
  }

mkLogosModule, when codegen.rust is present:
  - runs logos-lidl-gen --provider <lidl> [--dep ...] to emit the scaffold,
    feeding it the SAME resolved concrete + interface deps the C++ generator
    gets (concrete -> modules().<dep>; interface -> a bind()-able client);
  - injects the scaffold at generated/provider_gen.rs and buildRustPackages
    the crate to a staticlib;
  - stages the archive into lib/ (preConfigure) and sets
    -DLOGOS_MODULE_RUST_STATIC_LIBS so the new LogosModule.cmake block links it
    (plain link + protocol re-mention + frameworks/pthread — mirrors the Go
    static-archive path).

logos-lidl-gen is read from the MODULE's flakeInputs.logos-rust-sdk, NOT a
builder input: logos-rust-sdk already depends on this builder (for its tests),
so a builder->rust-sdk input edge would be a cycle. The module needs
logos-rust-sdk in its inputs regardless (the crate links the SDK), so reading
it from flakeInputs adds no new edge.

Verified: a minimal codegen.rust module builds with a trivial flake + trivial
CMakeLists (no build.rs), loads under lm, and returns add(5,3)=8 / greet over
a logoscore daemon.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* builder: codegen.rust.author_trait for rust-first modules

A rust-first module declares its contract trait in the crate (the .lidl is
derived from it), so the generated scaffold must NOT also emit the trait.
codegen.rust.author_trait = true makes mkLogosModule pass --no-trait to
logos-lidl-gen --provider, eliminating the last reason such a module needed a
hand-written build.rs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* doctest: migrate the cross-language Rust modules off build.rs

The two cross-language composition doc-tests hand-wrote a build.rs in each
Rust module to run the generator. With codegen.rust (+ author_trait for the
rust-first modules) the builder does that, so drop every build.rs:

  - rust_ledger (lidl-first)      → codegen.rust
  - rust_orchestrator (rust-first) → codegen.rust + author_trait
  - rust_auditor (rust-first)      → codegen.rust + author_trait

Each module loses its build.rs, its logos-lidl-gen build-dependency, its
buildRustPackage/preConfigure flake plumbing, and its find_library/link
CMakeLists — flake.nix and CMakeLists.txt shrink to the C++ shape (one extra
logos-rust-sdk input for the generator). The dep contracts are now resolved by
the builder from the deps' published .lidl (no manual deps/ copy), so the typed
clients are named by the metadata dependency (modules().cpp_counter_module /
modules().cpp_gateway_module). The rust-first --from-rust .lidl-derivation step
stays — that's authoring, not build.rs.

Verified: the rust-first orchestrator (author trait + a dependency + a typed
event) builds via the builder and introspects correctly (tally/whoami +
tally_changed). Pins logos-rust-sdk to the --no-trait commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* builder: rust-first derives the .lidl from the trait (codegen.rust.trait)

Replace codegen.rust.author_trait with codegen.rust.trait (the contract trait
name). When set, the builder runs logos-lidl-gen --from-rust over the crate
source to DERIVE the .lidl at build time — exactly as a universal C++ module
derives its contract from the impl header — then generates the scaffold with
--no-trait and publishes the derived .lidl as packages.<sys>.lidl. The .rs file
is the single source of truth: a rust-first module commits no .lidl and runs no
manual derive step.

- new bindings: rustTrait / rustDeriveMode / rustSource, the derivedLidl
  derivation, rustLidlPath, and lidlStaging (stages the derived .lidl into the
  build tree before the Qt-glue codegen reads codegen.lidl).
- modulePreConfigure.compose gains a preCodegen hook (runs before codegen).
- the published #lidl output uses the derived .lidl in rust-first mode.

Verified: a rust-first module committing ONLY src/lib.rs (with a dependency and
a typed event) builds, introspects (methods + event), and publishes a correct
derived contract.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* doctest: rust-first modules commit only the trait (codegen.rust.trait)

With the builder deriving the .lidl from the trait, the cross-language doctests
drop the manual 'derive the .lidl' step, the committed .lidl, and the separate
logos-lidl-gen tool build. rust_orchestrator and rust_auditor now declare
codegen.rust.trait and commit only their .rs — single source of truth.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* builder: own the Rust generator + SDK so the module flake matches C++

A Rust module's flake.nix no longer needs a logos-rust-sdk input — it becomes
identical to a C++ module's (just logos-module-builder). The builder now owns
logos-rust-sdk and provides BOTH halves a Rust module needs:

  - logos-lidl-gen (the generator it runs), and
  - the SDK source the crate links — staged as ../logos-rust-sdk-src so the
    crate's path-dep on logos-rust-sdk resolves against the SAME rev the
    generator came from (zero generator/runtime skew, the way C++ already gets
    both generator and runtime from the builder).

logos-rust-sdk depends BACK on this builder for its own tests, so its
logos-module-builder input (and the other branch-pinned test inputs) are cut
with follows in flake.nix to break the would-be cycle — we only consume its
lidl-gen package + source tree, never its tests. Also exposes #rust-sdk-src so
a module can stage the SDK to generate its Cargo.lock.

Backward compatible: a module that still uses a git dep + a logos-rust-sdk
flake input keeps building (the builder ignores the redundant input; the crate
uses its git dep; the staged SDK goes unused).

Verified: a module with a C++-shaped flake.nix (no logos-rust-sdk) and a
path-dep crate builds, derives its contract, and loads.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* doctest: Rust modules drop the logos-rust-sdk input (C++-shaped flake)

Now that the builder owns logos-rust-sdk and provides both lidl-gen AND the SDK
source, the cross-language doctests' Rust modules carry no logos-rust-sdk input:
their flake.nix is identical to a C++ module's. The crate depends on the SDK as
a path dep on ../logos-rust-sdk-src — staged from the builder's #rust-sdk-src
output (the SAME rev the generator came from, so no skew). The build step stages
it before `cargo generate-lockfile`; the builder re-stages it for the compile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* builder: infer staticlib from Cargo.toml + drop codegen.lidl for rust-first

Two redundant codegen fields a Rust module had to repeat are now inferred:

  - staticlib: read from the crate's Cargo.toml ([lib].name, else [package].name
    with - -> _). codegen.rust.staticlib still overrides if present.
  - codegen.lidl: no longer needed for a rust-first module. The .lidl is derived
    from the trait and staged at generated_code/<name>.lidl, where cdylibCodegen
    now reads it (the builder owns the path). Still required for lidl-first
    (contract-first) modules, where it names the committed contract.

So a rust-first module's codegen shrinks to `rust: { crate, trait }`.

Verified: a module with `codegen: { rust: { crate, trait } }` (no lidl, no
staticlib) builds, derives its contract, and loads.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* doctest: trim redundant codegen fields from the Rust modules

The builder now infers staticlib from Cargo.toml and (for rust-first) owns the
.lidl path, so:
  - rust_orchestrator / rust_auditor (rust-first): codegen shrinks to
    `rust: { crate, trait }` — no lidl, no staticlib.
  - rust_ledger (lidl-first): keeps its committed `lidl`, drops `staticlib`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-15 19:59:35 -03:00
Dario LipicarandClaude Opus 4.8 33bcd1c5d6 Qt split: inject logos-qt-sdk + logos-protocol, stamp logos_protocol_version into module metadata (#113)
* Wire the Qt-split SDK stack + stamp the protocol version into modules

- New inputs logos-protocol and logos-qt-sdk, injected into both build
  pipelines (mkLogosModule + buildCppPlugin): modules now link
  logos-qt-sdk (which chains logos-protocol) while the Qt-free
  logos-cpp-sdk provides the std headers + code generator.
- cmake/LogosModule.cmake synced with logos-plugin-qt's (it had
  drifted): three-root resolution (LOGOS_CPP_SDK_ROOT /
  LOGOS_QT_SDK_ROOT / LOGOS_PROTOCOL_ROOT), links
  logos-qt-sdk::logos_qt_sdk + logos-cpp-sdk::logos_headers.
- Protocol-version stamp: the logos-protocol semver (parsed from
  logos_protocol.h) is injected into each module's metadata.json before
  moc embeds it (modulePreConfigure.stampProtocolVersion, jq). liblogos
  reads it pre-load to decide compatibility; modules from older
  builders lack the field and load as legacy.

Builder-based modules need only a flake.lock bump — no metadata.json or
source changes.

* fix: rebase LogosModule.cmake qt-split patch onto master's copy

The previous commit synced this file from logos-plugin-qt's lineage, which
silently dropped master-only blocks the universal-module path depends on:
the generated_code/ glob (compiles the generated glue + provider dispatch
into the plugin), the metadata.json configure_file for AUTOMOC, the
LOGOS_API_STYLE selection, static-archive external libs, and the Go/cgo
whole-archive block. Universal modules built without any Qt-plugin glue
(no QTMETADATA) and capability_module dlopen-failed on a missing impl
vtable, killing the token flow and with it all cross-module IPC.

This restores master's file and re-applies only the qt-split changes:
logos_module_context.h detection for the Qt-free base SDK, qt-sdk/protocol
root resolution, qt-sdk source-layout sources, the split include dirs, and
exported-target linking (logos-qt-sdk::logos_qt_sdk / logos-protocol /
logos-cpp-sdk::logos_headers).

Verified: logos-test-modules--tests check passes end-to-end with this
builder (universal modules load, capability token flow works, IPC green).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* lock: pin extraction-chain branch revs for standalone CI

Temporary — drop when the chain PRs merge (re-lock against masters).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(tests): thread qt-sdk/protocol roots into mkLogosModuleTests

logos-test-framework's LogosTest.cmake now resolves three SDK roots
(qt split); the test builder passes -DLOGOS_QT_SDK_ROOT /
-DLOGOS_PROTOCOL_ROOT and the packages on buildInputs. flake.lock pins
logos-test-framework to its qt-split branch (logos-co/logos-test-framework#4)
— temporary, drop when the chain merges.

Verified: the test-framework-integration check passes locally with these
changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: forward logos-protocol/logos-qt-sdk to the inner mkLogosModuleTests import

mkLogosModuleTests.nix gained required logos-protocol/logos-qt-sdk args
in b24c2b0, but only lib/default.nix's import was updated — the second
import inside mkLogosModule.nix (the per-module auto-tests path) still
passed the old arg set, failing evaluation for any module flake whose
checks go through mkLogosModule with this builder.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: forward logos-protocol/logos-qt-sdk through the QML module path

Same class as the mkLogosModuleTests fix: mkLogosQmlModule's own
buildCppPlugin import (and default.nix's pass-through to it) dropped the
new args, so every ui_qml module evaluated with logos-protocol = null
('expected a set but found null' at buildCppPlugin.nix:124) — breaking
basecamp's plugins and the basecamp/tutorial doctests under the chain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* lock: protocol call-error channel + CallError out-param typed wrappers

* lock: protocol+cpp-sdk merged to master — pins advance (protocol 9de4165, cpp-sdk f0fe8cb, qt-sdk 722e590)

* lock: qt-sdk#1 merged — pin advances to qt-sdk master

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-12 20:45:37 -03:00
Dario LipicarandClaude Opus 4.8 aa5b5d354d External-library doc-tests + per-platform vendored binaries (#112)
* feat: per-platform vendored binaries in mkExternalLib

A vendored external library could only ship one platform's binary: two
platforms sharing an extension (linux x86_64 vs aarch64, both libfoo.so)
collide in lib/. Commit each platform's binary under lib/<nix-system>/
(x86_64-linux, aarch64-linux, x86_64-darwin, aarch64-darwin) and the build
selects the subdir matching pkgs.stdenv.hostPlatform.system.

Contained to mkExternalLib.nix (new src arg + a selection branch before the
null fallback); src threaded through mkLogosModule.nix and buildCppPlugin.nix.
The selected binary flows through the existing flake-input staging path, so no
CMake or logos-plugin-qt change. Flat single-platform vendoring is unchanged.

Documented in docs/external-libraries.md (Nix system strings, distinct from
.lgx variant labels; raw nix-develop+cmake does not descend into the subdirs).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(doctests): executable external-library doc-tests + Pages publish

Add four YAML doc-tests under doctests/ — the logos-tutorial / logos-doctest
approach — each scaffolding a real universal module that wraps the same tiny
libgreet a different way, building it against the commit under test, loading it
in a logoscore daemon, and asserting `call greet_module hello` returns
"hello from libgreet":

  1. wrap-external-lib-1-source            source compiled into the plugin
  2. wrap-external-lib-2-prebuilt-binaries prebuilt binary vendored per-platform
  3. wrap-external-lib-3-external-source   external source built with `make`
  4. wrap-external-lib-4-nix-flake         library from an external Nix flake

.github/workflows/doctests.yml runs them via `nix run github:logos-co/logos-doctest`
with `--release-for logos-module-builder=<sha>` (matrix ubuntu/macos), and
publishes the two-column HTML report per-ref/per-os to gh-pages with a PR
comment — mirroring logos-cpp-sdk's doctests.yml. Skipped on forks.

All four pass locally on aarch64-darwin against the PR commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat: fail loudly when a configured external library is missing

logos_module() used to emit message(WARNING ...) and keep going when a
configured external library could not be found at build time — on macOS
-undefined dynamic_lookup then let the plugin link anyway, producing a
silently broken module. Turn the three not-found paths (EXTERNAL_LIBS,
go_build static archives, LINK_TARGETS) into message(FATAL_ERROR ...) so a
missing/failed external dependency aborts the build with an actionable
message instead of a silent warning.

Guarded by test-static-extlib.nix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(doctests): use portable builds (lgx-portable, cli-portable, bundle-dir)

Switch the run/package steps in all four external-library doc-tests to the
portable distribution path — the form real users ship: portable LGX
(`.#lgx-portable`), portable package manager (`#cli-portable`), and the
self-contained logoscore bundle (`#cli-bundle-dir`, binary at bin/logoscore).

Validated locally on aarch64-darwin: case 1 21/21 and case 2 (per-platform
vendored binary) 19/19, each ending in
`call greet_module hello -> "result":"hello from libgreet"`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-09 14:18:03 -03:00
Dario Lipicar b3f1d658f0 Extend universal modules with module context (#96)
* pick API style in logos-cpp-generator

* bump cpp-sdk
2026-05-19 15:42:24 -03:00
Dario Lipicar b0e41abf3e bump dependencies (#88)
* bump dependencies

* fix flake.nix
2026-05-07 15:12:02 -03:00
pablo 3d3a6830e5 fix: support static libraries (.a) in EXTERNAL_LIBS
Add .a to the search pattern and skip the runtime copy step for static archives since they are linked into the plugin binary at build time
2026-04-16 11:33:22 -04:00
Khushboo Mehta c32230c17b feat: new UI modules qith qml running in process and backedn as a Qt plugin that can be loaded into a separate process 2026-04-10 18:07:21 +02:00
Iuri Matias 3621564419 fix common issues found with new modules
fix common issues found with new modules

fix common issues found with new modules
2026-04-07 15:47:12 -04:00
Iuri Matias 48f86a6abf extract qt plugin specific logic into its own library to allow easy swapping with different plugin tech 2026-03-28 18:01:28 -04:00
Khushboo Mehta 2f82594548 feat: improvements in the builder
1. embed the lgx bundler into the flake.nix so directly calling nix build .#lgx gives us a lgx pakcage out of the box
2. Remove metada.json file in case cpp libraries
2026-03-26 11:37:03 +01:00
Iuri Matias c77b80e8fe support new provider abstraction 2026-03-20 21:02:59 +00:00
Iuri Matias f1a8d74aef use logos-module for interface instead of liblogos 2026-03-20 08:50:50 -04:00
Iuri Matias f13d273fd4 remove need for metadata.json 2026-01-26 14:51:22 -05:00
Iuri Matias c5ebea8e9f various fixes to get logos-chat-module to work
various fixes to get logos-chat-module to work

test

test

test

test

test

test

test

test
2026-01-23 12:41:45 -05:00
Iuri Matias ddf6b3961e test module builder 2026-01-23 08:50:17 -05:00