2 Commits

Include renames

Author	SHA1	Message	Date
Dario Gabriel LipicarandClaude Opus 5	42460e5b2a	fix(tokens): separate INBOUND from OUTBOUND, without moving a single byte ... A grant one way was a grant both ways. TokenManager was ONE flat map with no direction tag, written from both sides of every relationship: LogosAPIClient stored the token it will PRESENT to a callee under the CALLEE's name, and a token RECEIVED from a caller was stored under the CALLER's name. Same key namespace, last write wins. Measured on the shipped fleet with two ordinary modules doing nothing unusual: one grant A -> B leaves the SAME token value under both opposite-meaning keys, and the never-granted B -> A call then succeeds. Silently. A.callOther(B, ping) CALL_OK T1 A holds token for B? val=7685c776-... T1 B holds token for A? val=7685c776-... <-- one value, two meanings B.callOther(A, ping) CALL_OK <-- never granted WHY THE LAYOUT COULD NOT CHANGE. TokenManager's layout is a cross-package ABI: the host ALLOCATES the object and module/UI-plugin images MUTATE it through their own statically-linked accessors — and host and modules ship as separate .lgx that mix versions at runtime by design. The header's ABI-safety note is about ALLOCATION ("no consumer allocates one, none needs sizeof"); the hazard is MUTATION. Splitting into three members took sizeof 32 -> 64 and moved m_mutex 24 -> 56. QMutex::fastTryLock() compare-exchanges at this+24, which in that layout is m_inbound's QHash d-pointer. Empty, the old code silently borrows the hash's pointer slot as a mutex and puts it back, so it LOOKS fine; non-empty, the exchange fails and lockInternal() interprets the QHash Data* as a QMutexPrivate* and futex-waits on it — hung forever, inside a token-store write, on the module host's Qt main thread. No crash, no log line, no timeout that recovers. Reproduced by calling the shipped 0.6 plugin's own saveToken on a 0.7 object: exit=124. So direction lives in the KEY NAMESPACE instead. Outbound is the bare peer name (byte-identical to master); inbound is "\x01in\x01" + caller. m_tokens@16, m_mutex@24, sizeof 32 — measured identical to master in every shipped image, pinned by a static_assert against a reference struct that fires if a member is added. Two things a key namespace forces that separate members did not: every door REFUSES a key carrying the namespace character, or a wire-supplied caller name could forge across the direction boundary; and credential() is DERIVED from bootstrapKeys() rather than cached, because a cached field reads empty on a store another image wrote and then refuses every push. AN ANCHOR KEY IS NO LONGER SPELLED AS A MODULE NAME. scanIssuedTokens' m_tokens loop offered every matched key unconditionally while the m_store loop deliberately never offers, so "an anchor must never name a caller" was enforced on one side only. A module announcing itself as "core" — which logos-rust-sdk did unprompted — therefore authorized as kind:module name:core. The rule generalises: a store may only name a caller with a key it alone can write. Implemented as a masked operand, so the comparison count is unchanged; RefusingToNameAnAnchorKeyCostsNoComparison pins that via logos::tokenComparisonCount(). lp_token_save / lp_token_save_for now return LP_ERR_INVALID_ARG on a reserved key instead of LP_OK. Only the return code was wrong; saveToken already refused. PROTOCOL 0.8: logos_module_accept_inbound_token joins the module-impl C ABI (12 exports). onInit keeps logos_module_accept_token for the module's own anchor — that one IS outbound, and merging the two paths is what reintroduces the bug. Supersedes the field-split approach; the semantics are unchanged from it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-24 11:16:33 -03:00
Dario Gabriel LipicarandClaude Opus 5	6c24fcb132	feat(caller): resolve who is calling, and declare the export that carries it ... A module can now learn which module is calling it. Not via the LIDL — this is not part of any module's interface, and the callee already has the identity from the token the call carried; the only question was surfacing it. So it is ambient: logos::currentCaller(), no declared parameter, no contract change, no per-method opt-in. WHAT THIS PR CONTAINS * LogosCaller — Unknown | HostAnchor | Module{name, instance?} | Derived{parent, leaf} | Operator{name} — std-typed and Qt-free. * CallerScope, an RAII save/restore around a thread-local STACK. Not a slot: A calling B calling back into A on one thread must nest, and an exception thrown from a handler must still pop. * resolveCaller, replacing the bool fold in ModuleProxy. It reads the INBOUND store #69 made direction-pure — the only store that may legitimately name a caller. * logos_module_set_call_caller DECLARED, and MINOR 5 -> 6. WHY AMBIENT, AND WHY IT MUST CROSS AN IMAGE BOUNDARY LogosProviderObject::callMethod is a vtable slot, and this codebase avoids vtable changes on purpose. But the deeper reason is measured, not stylistic: nm on real binaries shows the host and the module plugin EACH define ModuleProxy::callRemoteMethod and TokenManager::instance, each with its own function-local static at a distinct address, and neither with a single undefined reference to the other's. Mach-O is TWOLEVEL; PE has no interposition. A thread_local opened host-side is NOT the one a handler reads. Since --backend qt is now refused outright, every module is a cdylib and the C ABI push is the only path, not a fallback. The pull is only safe through QMetaObject::invokeMethod on the host's LogosAPI, because metaObject()/qt_metacall are virtual and the vptr was written by the host's constructor — LogosAPI is duplicated across images too, meta-object included, so a direct call would bind to the plugin's copy and read the plugin's TLS, silently empty forever. A dynamic property cannot carry it either: one process-global slot, so two overlapping concurrency:"multi" calls from different callers would clobber each other. Nothing here is spelled "verified". capability_module checks only that an asserted name EXISTS as a key, so the strongest honest word is token-bound. HostAnchor carries no name because core and capability_module hold one token VALUE under two keys by construction. Unknown is the fail-closed value and is always in-band, never spelled by absence. The constant-time fold survives: the matched key is accumulated into a fixed-width buffer with no data-dependent branch, verified at the instruction level (csel, not a branch) with the comparison count invariant. THE BUMP IS SAFE BECAUSE THE BACKENDS WENT FIRST logos-protocol only DECLARES this ABI; every backend owes the definition, and that gap shipped twice. logos-cpp-sdk#147 and logos-rust-sdk#47 already define logos_module_set_call_caller, gated on >= 0.6 and therefore inert until this lands. Verified on x86_64-linux: with this tree as the protocol, BOTH backends at master pass their ABI checks and define the export; manifest reports 0.6.0 with 11 exports. No repo is red at any point. Rule 6 is now normative on a point the two backends had silently diverged on — a present-but-unreadable "instance" is dropped and the module still identified — each having pinned its own answer with a passing test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-22 17:28:00 -03:00