Repository navigation
[Product] Extract the provider-free Service State model into a focused crate #178
Description
Bounded outcome
Extract the canonical provider-free Service State model and its pure derivations into a deep agent-browser-service-model workspace crate. Keep filesystem persistence, process observation, browser execution, HTTP, MCP, dashboard, and runtime-owner joins as CLI adapters.
Proposed product lane
PL-PLATFORM
Acceptance evidence
- The crate owns the canonical Service State records, pure derivations, wire-contract invariants, and deterministic model behavior behind one coherent module interface.
- CLI callers consume the extracted module without a second model or duplicated decisions.
- An architecture guard rejects upward imports from the crate into cli/src/native, runtime, browser, HTTP, MCP, filesystem, or platform providers.
- Focused crate tests and affected CLI adapter tests pass locally.
- The focused edit and test loop is measured against a recorded baseline. Acceleration is claimed only if the evidence supports it.
- Source changes enter main through the protected pull-request workflow.
Dependencies and non-goals
- P204 / issue [Governance] Make ordinary CI path-selected and reserve comprehensive runs #174 owns scripts/ci/rust-tests.sh, validation selection, CI workflow, and its current documentation transition. P205 will not edit those surfaces until P204 publishes an integration checkpoint; P204 remains the coordination writer for shared catalog and roadmap changes during that transition.
- P197 remains the challenge-lane owner and retains its own generated service-request and challenge consumer surfaces.
- The first extraction does not move service_store, process observation, runtime-owner joins, profile-lease execution, browser launch, or runtime effects into the crate.
- No browser, provider, credential, installed-runtime, development-runtime, staging, production, or release effect is authorized.
Activity
ecochran76 commentedon Sep 17, 2026
P205 checkpoints published on platform/p205-service-model-crate through b638529.
Completed locally:
Focused crate and affected CLI tests are green. GitHub CI remains intentionally skipped. P204 still owns shared validation, roadmap, runbook, and active-lane files, so P205 has not edited those surfaces.
ecochran76 commentedon Sep 17, 2026
Additional P205 architecture checkpoints are published through 7d26ff6.
The service-model crate now also owns the complete profile-access authorization kernel, entity provenance, BrowserProfile, browser host, profile origin and class, registration, and source projection records. The former 1,606-line CLI policy implementation is now a narrow named re-export plus one failure-projection adapter test.
Current local evidence: 25 focused crate tests pass in 0.67 seconds on the warm target; strict crate Clippy passes; nested Service State round-trip, collection wire contract, profile-policy repository mutation, privacy projection, and configured-overlay tests pass. Duplicate-definition scans find the moved profile symbols only in the crate. No GitHub CI was dispatched or monitored.
P204 PR #179 remains open and still owns shared validation and roadmap files, so P205 continues to preserve that boundary.
ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 5 is published at
5ec21c9aonplatform/p205-service-model-crate.The provider-free service-model crate now canonically owns the session/tab family:
BrowserSession,BrowserTab, stable tab handles and trace filters, actor/lease/cleanup/lifecycle enums, profile selection and lease disposition, and their wire constants. The CLI retains session expiry, disconnect handling, profile selection, handle refresh, and aggregate mutation as adapters behind compatibility re-exports.Local evidence: 4 focused crate tests; CLI collection wire-contract and nested aggregate round-trip; handle refresh, stale-session expiry, and child disconnect isolation tests; architecture guard plus fixtures; formatting; strict workspace Clippy with warnings denied; duplicate-definition and diff checks. All passed. GitHub CI was intentionally skipped per operator direction. No browser, provider, runtime, install, staging, production, or release effect occurred.
Next architecture order: extract the provider-free remote-view record family before
BrowserProcess, soViewStreamand route-controller fencing have one downward canonical owner without moving provider orchestration.ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 6 is published at
5f31796eonplatform/p205-service-model-crate.The service-model crate now owns the provider-free presentation record family and pure controller fencing: durable handoffs and receipts, display allocations, routes, route-pool entries, acquisition rollback snapshots, viewer leases, view streams, provider/input enums, and retained-allocation candidate records. The module is deliberately named
presentation; the architecture guard reservesremote_viewfor effect adapters.Local evidence passed: 5 focused crate tests; CLI wire, nested aggregate, durable handoff, controller epoch and ABA fencing tests; human-takeover and expired-viewer adapter tests; architecture guard plus fixtures; formatting; strict workspace Clippy; duplicate-definition and diff checks. GitHub CI was intentionally skipped. No browser, provider, runtime, install, staging, production, or release effect occurred.
Next packet: the provider-free BrowserProcess closure, keeping OS observation and retained-owner authority in CLI adapters.
ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 7 is published at
7faee2f8onplatform/p205-service-model-crate.The service-model crate now owns the BrowserProcess durable closure: browser health and observations, record provenance, protected-owner observation, service process identity, and the provider-free recorded process identity.
cli/src/process_identity.rsre-exports the record while retaining all platform observation,/proc, namespace, PID, executable, handle, signaling, and cleanup behavior. The protected-owner decoder still rejectsoperationalAuthority=true.Local evidence passed: 5 focused crate groups; CLI wire and nested aggregate tests; health-evidence and protected-owner projection tests; exact start-token and PID-reuse tests; architecture guard plus fixtures; formatting; strict workspace Clippy; duplicate-definition and diff checks. GitHub CI was intentionally skipped. No process, browser, provider, runtime, install, staging, production, or release effect occurred.
The next architectural decision is which remaining cohesive durable family removes the most aggregate dependency depth without creating a second incomplete Service State owner.
ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 8 is published at
6239055bonplatform/p205-service-model-crate.The service-model crate now owns site policy, pacing, provider inventory, and challenge records plus the pure interaction/provider decision kernel. The CLI selects records from Service State and delegates deterministic interaction risk, pacing, provider selection, capability gaps, and challenge strategy through one crate seam. Built-in site catalogs, URL matching, configuration precedence, persistence, monitoring, transport projection, and provider/challenge effects remain CLI adapters.
Local evidence passed: 5 focused crate tests; CLI collection and stable wire tests; provider/challenge model tests; access-plan provider-fit, missing-capability, and pacing/risk tests; configured overlay and built-in precedence tests; site-policy/provider config tests; architecture guard plus fixtures; formatting; strict workspace Clippy; deletion and forbidden-content checks. GitHub CI was intentionally skipped. No provider execution, credential, browser, runtime, install, staging, production, or release effect occurred.
Next prerequisites: neutralize request provenance, terminal outcome, and failure-recourse records before moving the cohesive job/event/incident model family.
ecochran76 commentedon Sep 17, 2026
Checkpoint 9 is published at
1a80f87a(refactor: extract service outcome records).The provider-free model crate now owns request provenance, terminal outcomes, failure recourse, and deterministic failure classification. CLI code retains environment observation, ingress capture, session attribution, and response decoration. This clears the dependency seam for a cohesive
ServiceJob/ServiceEvent/ServiceIncidentpacket.Local evidence:
No GitHub CI was dispatched or monitored, per direction. No runtime, browser, provider, install, staging, production, or release effect was performed.
ecochran76 commentedon Sep 17, 2026
Checkpoint 10 is published at
625b43fa(refactor: extract service activity records).The provider-free crate now owns canonical
ServiceJob,ServiceEvent, andServiceIncidentrecords, lifecycle enums, and stable wire-value constants. The CLI retains Service State joins, incident derivation, queue mutation, persistence, clocks, timeouts, retention, monitoring, activity projection, and transport behind the compatibility facade.Local evidence:
No GitHub CI was dispatched or monitored. No runtime, browser, provider, install, staging, production, or release effect was performed.
ecochran76 commentedon Sep 17, 2026
Checkpoint 11 is published at
8a6db978(refactor: extract service monitor records).The provider-free crate now owns
SiteMonitor, monitor target/state enums, legacy defaults, and stable state values. Scheduling, clocks, probes, job admission, persistence, failure mutation, incident derivation, and Service State joins remain CLI adapters.Local evidence:
The remaining aggregate inventory was also reassessed. The advisory opaque
BrowserCapabilityRegistrystays deferred; control-plane/reconciliation snapshots are the next clean packet, followed by the profile-lifecycle authorization record closure.No GitHub CI was dispatched or monitored. No monitor probe or runtime effect was performed.
ecochran76 commentedon Sep 17, 2026
Checkpoint 12 is published at
3b3eabfb(refactor: extract service operational snapshots).The provider-free crate now owns passive
ServiceReconciliationSnapshotandControlPlaneSnapshotdurable records. Status computation, health observation, timestamps, queue/browser counts, queue-capacity validation, state mutation, persistence, and transport remain CLI adapters.Local evidence:
Next gate is the profile-lifecycle authorization record closure and deterministic registration kernel. Physical observations, proof construction, effect settlement, runtime commands, and state mutation stay outside that extraction.
No GitHub CI was dispatched or monitored. No reconciliation or runtime effect was performed.
ecochran76 commentedon Sep 17, 2026
Checkpoint 13 is published at
1e2f8f58(refactor: extract profile lifecycle authorization).The provider-free crate now owns lifecycle authorization, proof, and minimal effect-receipt records plus deterministic authorization registration. Registration enforces the assurance floor, canonical targets, exact error codes, identical replay idempotency, and conflicting-ID rejection.
The authority boundary remains intact: fresh physical observation, proof construction, grace-time checks, current-policy fencing, effect settlement, recovery, clocks, repository mutation, and runtime commands remain CLI adapters.
Local evidence:
No GitHub CI was dispatched or monitored. No profile eviction, browser close, or runtime effect was performed.
Next gate: resolve the principal-provenance seam against the existing Lease Authority crate before extracting profile-lease durable records.
ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 14 is published at
7d439cbf1eb170d238cbd8141161523a4d353de5(platform/p205-service-model-crate).The service-model crate now owns the principal-continuity recourse enum plus six passive profile-lease records and three schema constants. It directly reuses Lease Authority principal provenance; all projections, authentication, runtime joins, reconciliation effects, persistence, and failure handling remain CLI adapters.
Local evidence: 79 service-model tests passed; 67 focused CLI tests matching
profile_leasepassed; strict workspace Clippy with warnings denied passed; formatting, architecture guard, guard fixtures, duplicate-definition scan, and diff checks passed.No GitHub CI was dispatched or monitored. No browser, profile, runtime, provider, install, staging, production, or release effect occurred.
Next gate: reassess the remaining
ServiceStateaggregate edges and select one closed provider-free family. Draft capability data and runtime transactions remain explicitly deferred.ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 15 is published at
ff4c42157589dc107f3665663d04dc11f50ea692.The service-model crate now owns the passive browser-retirement plan, receipt, contamination report, and schema constants. Process/runtime-owner checks, evidence hashing, planning, clocks, repository CAS, mutation, and command transport remain CLI adapters.
Local evidence: 83 model-crate tests passed; 17 focused CLI tests matching
browser_retirementpassed; strict workspace Clippy with warnings denied passed; formatting, architecture guard, guard fixtures, duplicate-definition scan, and diff checks passed. One test-only reference-level compile miss was corrected and the bounded rerun passed.Aggregate reassessment: 29 of 44
ServiceStatefields are now downward-owned; 15 still block P2. The next closed packet is the passive profile-policy migration entry/report family. Runtime/effect transactions and the draft capability registry remain deferred.No GitHub CI was dispatched or monitored. No browser retirement, process signal, profile, runtime, provider, install, staging, production, or release effect occurred.
ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 16 is published at
76dd0095f8921b7fcb95f0a9aed91b8fd6164621.The service-model crate now owns the passive profile-policy migration entry/report records and schema constant. Classification, legacy materialization, migration ID hashing, schema stamping, aggregate mutation, codec/staging, persistence, and filesystem I/O remain CLI responsibilities.
Local evidence: 88 model-crate tests passed; all 26 CLI Service State migration tests passed; the nested aggregate round-trip and workstation access-axis migration tests passed; strict workspace Clippy with warnings denied passed; formatting, architecture guard, fixtures, duplicate-definition scan, and diff checks passed.
No GitHub CI was dispatched or monitored. No migration application, repository write, profile, browser, runtime, provider, install, staging, production, or release effect occurred.
Next gate: review recovery and reset terminal receipts as separate passive closures, then evaluate the presentation-capacity kernel without moving recovery execution or environment-derived joins.
ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 17 is published at
a30d8a74d676db195caadb92d8ee43461f7b7795.The model crate now owns the terminal profile-recovery and profile-reset receipts, their shared acquisition-state and reset-scope enums, and both receipt schema constants. Plans, evidence joins, sealing, verification, replay decisions, repository mutation, runtime effects, acquisition retry, and command transport remain CLI adapters.
Local evidence: 98 service-model tests passed; all 37 profile recovery/reset workflow tests passed; a new populated Service State receipt-map round trip passed; the mixed-version recovery-artifact reader passed; strict workspace Clippy with warnings denied passed; formatting, architecture guard, guard fixtures, duplicate-definition scan, and diff checks passed.
No GitHub CI was dispatched or monitored. No recovery, reset, repository write, profile, browser, runtime, provider, install, staging, production, or release effect occurred.
Next gate: evaluate presentation-capacity authority as a deep provider-free kernel, keeping environment-derived Service State joins and provider/runtime effects in CLI adapters.
ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 18 is published at
31ba9bcf.The presentation-capacity deep-module interface is now frozen before implementation. The selected design uses explicit domain methods plus one concrete immutable
PresentationCapacityObservationsenvelope. The CLI remains responsible for Service State and environment joins; the model crate will own capacity policy, precedence, queueing, transition, dispatch, reconciliation, projection, serde, and error compatibility.This architecture session has relinquished all bug-fix issue custody to the maintainer-designated terminal 28 session. P205 will not edit, triage, validate, or close bug-fix issues.
Reassessment: P204 is now contained in
origin/main, so its shared validation dependency is available. P205 is 34 mainline commits behind and 19 commits ahead after this checkpoint. The next architecture gate is to reconcile currentorigin/maininto P205, update the stale P204 dependency status in the P205 plan, and then implement the provider-free presentation-capacity kernel. No GitHub CI or runtime effect is in scope.ecochran76 commentedon Sep 17, 2026
P205 Checkpoint 19 is published. The accepted architecture commits are:
ff9bba8d— provider-free presentation-capacity model kernel12cdcc2c— Service State adapter and caller cutoverc4c62882— acceptance checkpoint3c0f53c9— current exact head after absorbing the non-overlapping P204 mainline shutdown commitsThe model crate now owns the complete presentation-capacity durable record family and deterministic policy: serde/default compatibility, constructor validation, ordinary and bound admission, pressure and reserves, browser exclusion, conflict precedence, queue aging/dispatch, transitions, quarantine, binding reflection, reconciliation, warnings, and projections. The CLI module now owns only qualified inventory and Service State observation joins plus delegation.
Local evidence: all 117 service-model tests passed; 5 CLI capacity adapter tests passed; 61 presentation-focused, 99 service-health-focused, and 36 configured-focused CLI tests passed; the production inventory outage fence and all 3 route-switch tests passed; CLI check, strict workspace Clippy, formatting, diff checks, the architecture guard and fixtures, duplicate-definition scan, and forbidden-upward-reference scan passed.
No GitHub CI was dispatched or monitored. No browser, profile, provider, install, staging, production, release, or shared-runtime effect occurred. CI is now disabled on current main by the independently owned P204 lane; P205 merely merged those non-overlapping mainline commits and does not claim their acceptance.
Bug-fix issue custody remains fully relinquished to terminal 28. This architecture session did not edit, triage, validate, or close bug-fix issues.
Next P205 gate: replace the remaining public transitional field mutations in inventory refresh, presentation lifecycle, abandoned-browser retirement, resource inspection, retained-state guards, and the inventory-failure path with typed model operations and immutable accessors. Then make the capacity authority fields private.