Implementation plan: morphir-host Phase A, part 3 (Registry, Pool, CLI off the daemon session)

[DamianReeves]

morphir-host Phase A, part 3: Registry, Pool, and the CLI off the daemon session Implementation Plan

This discussion is the implementation plan for Phase A, part 3 of the host library work. Design: #949 (checkpoints 5, 10, 14, 18 and 19). Earlier plans: #976 (part 1) and #983 (part 2). Tracking: epic #958, Phase A #959.

The body holds the overview. Each task is a separate comment below, in order.

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Resolve providers with a portable morphir_host::Registry, reuse workbench guests with a portable morphir_host::Pool, keep the daemon's error texts across channels, and move every remaining CLI extension path off morphir-daemon's registry, typestate session, and actor.

Architecture: morphir-host gains Registry, the GuestSource trait, Resolved, and Pool<K> (checkpoints 5, 14, 19). It depends on morphir-core for IR version matching and stays wasm32-clean. morphir-host-native gains NativeSource (next to NativeChannel) and InstalledSource. ChannelError gains a cause, so a transport failure that began as an I/O or JSON error keeps its text at the daemon boundary (part 2 ruling R8). The umbrella CLI builds a morphir_host::Registry, calls resolved sources, and serves the workbench through Pool. After this plan the CLI depends on morphir-daemon only for DaemonError text mapping; part 4 removes the daemon's registry, typestate session, actor, and transport copies.

Tech Stack: Rust 2024 (rust-version = "1.98"), async-trait 0.1, async-lock 3 (portable async mutex), morphir-core (format versions), morphir-distribution, morphir-common, morphir-extension-sdk, tokio (tests and native only).

Spec: discussion 949, checkpoints 5, 10, 14, 18, 19 (local .dev/docs/superpowers/specs/2026-09-23-morphir-host-library-design.md). Part 1 plan #976, part 2 plan #983 and their closing checkpoints. Tracking: epic #958, Phase A #959, finos/morphir-rust#238 (Registry), finos/morphir-rust#239 (Pool), #963 (rest).

---

Scope of this plan

In part 3:

• ChannelError and HostError::Channel carry a cause so I/O and JSON texts survive (part 2 R8).
• Registry, GuestSource, Resolved, ProviderMetadata, ProviderOrigin, InvocationPolicy, InvocationMode, CapabilityMetadataScope in morphir-host, ported from the daemon with the same rules and texts.
• NativeSource and InstalledSource in morphir-host-native. NativeSource stays native because in-process guests run on a blocking worker (spawn_blocking), as NativeChannel does.
• Pool<K> in morphir-host, with the 8 behaviours of the workbench's SessionReuseInvoker.
• CLI: registry, compile, generate, extension list, playground catalog, workbench invoker, and the UI workspace provider move to the host crates. builtin_provider, open_*_session, open_loaded, installed_loaded, session_failure, failed_session_message, and ui/provider/sessions.rs are deleted.
• The two missing CLI tests from part 2 (UI installed workspace provider; installed provider rejected-call text).

Part 4 gets its own plan: delete the daemon's ExtensionRegistry, typestate Session, kameo actor, ExtensionSession/SpawnedProcessSession/SpawnedProcessTransport, ExtismTransport, NativeMepTransport, activate_transport, ExtensionResponseExt, and move ConnectedDaemonSession to an HTTP Channel. Those are now used only inside morphir-daemon and its tests.

Decisions this plan makes inside the spec

1. GuestSource is a trait with one connect method that returns a boxed GuestConnection. The registry never activates anything itself.
2. Pool is keyed by provider id and stores a fingerprint ("{id}@{version}:{origin:?}:{mode:?}", as today). A CallError::Failed plays the role of the daemon's SessionLost: evict, reopen once, retry once. CallError::Rejected keeps the session.
3. Registry errors are HostError::Invalid(text) with the daemon's texts. At the CLI boundary they pass through DaemonError::from, so the Extension error: prefix stays (part 2 R6).
4. ChannelCause::{Transport, Io, Json}. From<HostError> for DaemonError maps a Channel error with cause Io or Json to DaemonError::Other(anyhow!(message)), whose display is the message unchanged, so the CLI prints IO error: ... again instead of Extension error: IO error: ....

Global Constraints

• morphir-host must pass cargo check -p morphir-host --target wasm32-unknown-unknown and must not depend on tokio (except dev), morphir-daemon, morphir-host-native, morphir-distribution, or any language binding. It may depend on morphir-core (checkpoint 19) and a portable async mutex (async-lock).
• morphir-host-native must not depend on morphir-daemon.
• Every trait a browser client implements keeps MaybeSend plus the paired cfg_attr(async_trait) attributes.
• Resolution rules and texts are unchanged: language or target filter, advertised IR version normalization, installed over built-in, ambiguity and no-match texts, duplicate-id text, invocation policy.
• Wire sequences unchanged. Existing CLI error texts unchanged, now including the IO error: ... / JSON error: ... texts part 2 R8 changed.
• The workbench keeps: one guest per provider id reused across compile and generate, evict and retry once on a lost session, keep the session on a rejection, abandon after a timeout, replacement when the provider fingerprint changes, one-shot calls for direct (native typed) providers, the 120 s invocation timeout.
• Commits: Conventional Commits. No AI attribution, no Co-Authored-By. Plain English docs, no em dashes.
• Local process tests flake in parallel on this machine; judge real-process failures with --test-threads=1.

Review Focus

1. Resolution drift. A provider that resolved before must resolve the same way (same provider, same mode, same texts). Pinned by porting all 20 daemon provider_registry tests to morphir-host in task 2.
2. A pool that keeps a dead guest or drops a live one. Pinned by the 8 ported workbench behaviours in task 4 and the CLI playground tests in task 7.
3. Lost I/O text again. Pinned by the task 1 test that an I/O-rooted channel failure displays IO error: ... through DaemonError::from.
4. Weaker validation for installed providers. InstalledSource::connect must return the same CheckedConnection as activate. Pinned by the task 3 parity test and the traversal test in the umbrella.
5. Held locks across await points in Pool that block unrelated providers. Pinned by the task 4 test a_slow_provider_does_not_block_another.

---

File map

finos/morphir-rust (ecosystem/morphir-rust/):

File	Responsibility
crates/morphir-host/src/channel.rs, src/error.rs	ChannelCause, cause on ChannelError and HostError::Channel
crates/morphir-host/src/registry.rs, src/registry/types.rs	Registry, GuestSource, Resolved, metadata and policy types
crates/morphir-host/src/pool.rs	Pool<K>
crates/morphir-host/tests/registry.rs, tests/pool.rs	Ported behaviour tests
crates/morphir-host-native/src/installed.rs, src/native.rs	InstalledSource, NativeSource
crates/morphir-daemon/src/error.rs	From<HostError> keeps I/O and JSON texts

finos/morphir (umbrella):

File	Responsibility
crates/morphir/src/extensions.rs, src/extensions/guest.rs	Registry built from host sources; calls through Resolved
crates/morphir/src/commands/{compile.rs, compile/prepare.rs, generate.rs, extension.rs}	Use morphir_host registry types
crates/morphir/src/commands/ui/provider/playground.rs	Catalog and invoker on host types
crates/morphir/src/commands/ui/provider/pool.rs	New PooledInvoker (replaces sessions.rs)
crates/morphir/src/commands/ui/provider/extension.rs	Installed workspace provider through InstalledSource, with a test

Branches and pull requests

1. Tasks 1 to 4: one finos/morphir-rust branch from origin/main (feat/morphir-host-registry-pool). One PR after a whole-branch review. Refers to CLI Structure #238, CLI Structure #239.
2. Tasks 5 to 7: one umbrella branch from origin/main after that PR merges. Pin the submodule to the merge commit. Refers to feat(cli): run compile, generate and probe through morphir-host #963, Phase A: host library in the CLI #959.

Tasks

1. Task 1: Keep the cause of a channel failure
2. Task 2: Registry and GuestSource in morphir-host, NativeSource in morphir-host-native
3. Task 3: InstalledSource in morphir-host-native
4. Task 4: Pool<K> in morphir-host
5. Task 5: CLI registry and one-shot calls on host sources
6. Task 6: Workbench through Pool
7. Task 7: Compatibility suites, CHANGELOG, PR
8. After part 3

[DamianReeves]

Task 1: Keep the cause of a channel failure

Files:

• Modify: crates/morphir-host/src/channel.rs, src/error.rs, src/jsonrpc.rs, src/testing.rs, src/probe.rs (any ChannelError/HostError::Channel construction)
• Modify: crates/morphir-host-native/src/{native.rs, extism/channel.rs, process/channel.rs, process/child.rs} and tests constructing ChannelError
• Modify: crates/morphir-daemon/src/error.rs, src/extensions/process/describe.rs
• Test: crates/morphir-host/tests/connection.rs, crates/morphir-daemon/src/error.rs (unit)

Interfaces:

• Produces:

  /// What a transport failure began as.
  #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
  pub enum ChannelCause {
      /// The transport itself failed: a timeout, a closed pipe the host detected, a stopped guest.
      #[default]
      Transport,
      /// An I/O error. The message starts with `IO error: `.
      Io,
      /// A JSON encoding or decoding error. The message starts with `JSON error: `.
      Json,
  }
  pub struct ChannelError { pub message: String, pub state: ChannelState, pub cause: ChannelCause }
  HostError::Channel { message: String, state: ChannelState, cause: ChannelCause }
  impl ChannelCause { pub fn of(error: &HostError) -> Self } // Io -> Io, Json -> Json, Channel{cause} -> cause, else Transport

• From<ChannelError> for HostError copies cause. Every place that turns a HostError into a ChannelError (for example ProcessChannel::fail, ExtismChannel's indeterminate) sets cause: ChannelCause::of(&error). Combined messages ("; process cleanup also failed", "; transport abort also failed") keep the first error's cause.

• From<HostError> for DaemonError: Json -> Json, Io -> Io, Channel { cause: Io | Json, message, .. } -> DaemonError::Other(anyhow::anyhow!(message)), else Extension(text).

• Step 1: Write the failing tests

  • Host (tests/connection.rs): a MemoryChannel that fails receive with ChannelError { message: "IO error: broken pipe".into(), state: ChannelState::Stopped, cause: ChannelCause::Io }; the call fails with CallError::Failed(HostError::Channel { cause: ChannelCause::Io, .. }).
  • Daemon (src/error.rs unit test): DaemonError::from(HostError::Channel { message: "IO error: broken pipe".into(), state: ChannelState::Stopped, cause: ChannelCause::Io }).to_string() == "IO error: broken pipe"; with cause: ChannelCause::Transport the text is "Extension error: IO error: broken pipe" (unchanged behaviour for transport causes); a JSON cause keeps "JSON error: ...".
  • Host-native (src/process/channel.rs unit test, unix): a ProcessChannel whose guest exits at once; send of a request fails and the error's cause is Io when the write hit EPIPE (skip-assert the cause if the race yields "closed stdout before a response frame", which is a Transport cause; assert one of the two outcomes with its matching cause).

• Step 2: Run them and see them fail (cargo test -p morphir-host -p morphir-host-native -p morphir-daemon --lib --tests): compile errors on cause.

• Step 3: Implement the type, the of helper, every construction site (list them with rg -n 'ChannelError \{|HostError::Channel \{' crates), and the daemon mapping. MemoryChannel::fail keeps taking a ChannelError. Daemon anyhow is already a dependency.

• Step 4: Run cargo test -p morphir-host -p morphir-host-native, cargo test -p morphir-daemon --lib --tests -- --test-threads=1, clippy on the three crates with --all-targets --all-features -- -D warnings, the wasm32 check, fmt.

• Step 5: Commit feat(host): keep what a transport failure began as.

[DamianReeves]

Task 2: Registry and GuestSource in morphir-host, NativeSource in morphir-host-native

Files:

• Create: crates/morphir-host/src/registry.rs, src/registry/types.rs
• Modify: crates/morphir-host-native/src/native.rs (add NativeSource), src/lib.rs
• Create: crates/morphir-host/tests/registry.rs
• Modify: crates/morphir-host/Cargo.toml (add morphir-core = { path = "../morphir-core" }), src/lib.rs, src/testing.rs (a FakeSource)

Interfaces:

• Produces:

  #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
  pub enum ProviderOrigin { Builtin, Installed }
  #[derive(Debug, Clone, Copy, PartialEq, Eq)]
  pub enum InvocationPolicy { PreferDirect, ProtocolOnly }
  #[derive(Debug, Clone, Copy, PartialEq, Eq)]
  pub enum InvocationMode { NativeDirect, NativeMep, ProcessMep, WasmMep }
  #[derive(Debug, Clone, Copy, PartialEq, Eq)]
  pub enum CapabilityMetadataScope { Complete, PersistedFrontendBackend }
  
  /// A provider the registry can resolve and connect to.
  #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
  #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
  pub trait GuestSource: MaybeSend + Sync {
      fn info(&self) -> &ExtensionInfo;
      fn capabilities(&self) -> &ExtensionCapabilities;
      fn origin(&self) -> ProviderOrigin;
      fn capability_metadata_scope(&self) -> CapabilityMetadataScope;
      /// The mode this source uses under `policy`.
      fn invocation_mode(&self, policy: InvocationPolicy) -> InvocationMode;
      /// The built-in extension behind a direct or native protocol source.
      fn native(&self) -> Option<&NativeExtension> { None }
      /// Start the guest and return a checked, unopened connection.
      async fn connect(&self, workspace: &Path) -> Result<Box<dyn GuestConnection>, HostError>;
  }
  
  // In morphir-host-native, next to NativeChannel:
  pub struct NativeSource { extension: NativeExtension }
  impl NativeSource { pub fn new(extension: NativeExtension) -> Self }
  // origin Builtin; scope Complete; PreferDirect -> NativeDirect, ProtocolOnly -> NativeMep; native() -> Some(&extension);
  // connect -> Box::new(CheckedConnection::new(JsonRpcConnection::new(NativeChannel::new(&extension), ExpectedChecks::new(channel.expectation()))))
  
  pub struct Registry { /* BTreeMap<(ProviderOrigin, String), Arc<dyn GuestSource>> */ }
  impl Registry {
      pub fn new() -> Self;
      pub fn register(&mut self, source: Arc<dyn GuestSource>) -> Result<(), HostError>;
      pub fn resolve_frontend(&self, language_id: &str, ir_version: &str, policy: InvocationPolicy) -> Result<Resolved, HostError>;
      pub fn resolve_backend(&self, target: &str, ir_version: &str, policy: InvocationPolicy) -> Result<Resolved, HostError>;
      pub fn providers(&self) -> Vec<ProviderMetadata>;
  }
  #[derive(Clone)]
  pub struct Resolved { /* Arc<dyn GuestSource>, InvocationMode, role */ }
  impl Resolved {
      pub fn info(&self) -> &ExtensionInfo;
      pub fn capabilities(&self) -> &ExtensionCapabilities;
      pub fn frontend(&self) -> Option<&FrontendCapability>;
      pub fn backend(&self) -> Option<&BackendCapability>;
      pub fn capability_metadata_scope(&self) -> CapabilityMetadataScope;
      pub fn origin(&self) -> ProviderOrigin;
      pub fn invocation_mode(&self) -> InvocationMode;
      pub fn native(&self) -> Option<&NativeExtension>;          // Some for NativeDirect and NativeMep
      pub fn supports_workspace_discovery(&self) -> bool;         // daemon rule, both scopes
      pub fn fingerprint(&self) -> String;                        // "{id}@{version}:{origin:?}:{mode:?}"
      pub async fn connect(&self, workspace: &Path) -> Result<Box<dyn GuestConnection>, HostError>;
  }
  pub struct ProviderMetadata { /* Arc<dyn GuestSource> */ }  // info, capabilities, capability_metadata_scope, origin, preferred_invocation_mode

• Step 1: Port the tests first. Copy the 20 tests from crates/morphir-daemon/tests/provider_registry.rs into crates/morphir-host/tests/registry.rs, adapting fixtures to testing::FakeSource in morphir-host (the registry rules need only metadata). Tests that need a real built-in (invocation_policy_selects_direct_or_native_protocol_mode, the protocol-only session test, resolved_typed_views_expose_only_the_corresponding_native_handle) go to crates/morphir-host-native/tests/native_source.rs with NativeSource over the SDK DocFrontend (a source with configurable info, capabilities, origin, scope, and mode, whose connect returns a JsonRpcConnection over a MemoryChannel). Replace protocol_only_resolution_exposes_a_native_mep_session_through_shutdown with an equivalent that opens Session::open(resolved.connect(..)) and closes it. Keep every asserted text.
• Step 2: Run and see them fail (cargo test -p morphir-host --test registry).
• Step 3: Implement by moving register_provider, normalize_advertised_releases, normalize_requested_ir_version, normalize_ir_version, select_provider, the candidate formatting, and the frontend and backend filters from crates/morphir-daemon/src/extensions/registry.rs into registry.rs, replacing DaemonError::Extension(text) with HostError::Invalid(text). Add NativeSource to morphir-host-native.
• Step 4: Run cargo test -p morphir-host -p morphir-host-native, clippy, cargo check -p morphir-host --target wasm32-unknown-unknown, docs, fmt. The daemon still has its own registry and must still pass unchanged.
• Step 5: Commit feat(host): resolve providers with a portable Registry.

[DamianReeves]

Task 3: InstalledSource in morphir-host-native

Files:

• Create: crates/morphir-host-native/src/installed.rs
• Modify: crates/morphir-host-native/Cargo.toml (move morphir-common from dev to normal), src/lib.rs
• Test: crates/morphir-host-native/tests/installed_source.rs

Interfaces:

• Produces:

  pub struct InstalledSource { home: MorphirHome, snapshot: InstalledExtensionSnapshot /* + cached info, capabilities */ }
  impl InstalledSource { pub fn new(home: MorphirHome, snapshot: InstalledExtensionSnapshot) -> Self; pub fn snapshot(&self) -> &InstalledExtensionSnapshot; }
  // origin Installed; scope PersistedFrontendBackend; mode ProcessMep or WasmMep by snapshot runtime, ignoring policy;
  // connect: activate_installed_snapshot(&home, &snapshot) then activate(artifact, workspace), returning the CheckedConnection boxed.
  // Errors: "Failed to verify installed provider '{id}': {error}" and "Failed to activate installed provider '{id}': {error}"
  // as HostError::Invalid texts, so callers can keep today's CLI wording.

• Step 1: Test first. Reuse tests/support/activation.rs fixtures (process and WASM artifacts installed into a temp home) to prove: resolution picks the installed source over a built-in; connect opens a session whose negotiated capabilities match the installed metadata; the persisted-capability lock rejects drift (same text as activate); WASM and process modes are reported correctly.
• Step 2 to 5: fail, implement, run (cargo test -p morphir-host-native -- --test-threads=1, clippy, fmt), commit feat(host-native): installed extensions as registry sources.

[DamianReeves]

Task 4: Pool<K> in morphir-host

Files:

• Create: crates/morphir-host/src/pool.rs, crates/morphir-host/tests/pool.rs
• Modify: crates/morphir-host/Cargo.toml (add async-lock = "3"), src/lib.rs

Interfaces:

• Produces:

  /// Warm guests, one per key, reused across calls.
  pub struct Pool<K> { /* async_lock::Mutex<HashMap<K, Arc<Slot>>> */ }
  impl<K: Eq + Hash + Clone + MaybeSend + Sync> Pool<K> {
      pub fn new(config: HostConfig) -> Self;
      /// Call `method` on the guest for `key`, opening it with `open` when there is none,
      /// or when `fingerprint` differs from the cached one. A failed call evicts the guest,
      /// opens a new one, and retries once. A rejected call keeps the guest.
      pub async fn call<P, R, F, Fut>(&self, key: &K, fingerprint: &str, open: F, method: &str, params: &P) -> Result<R, CallError>
      where P: Serialize + Sync, R: DeserializeOwned, F: Fn() -> Fut, Fut: Future<Output = Result<Box<dyn GuestConnection>, HostError>>;
      /// Forget the guest for `key` and close it in the background of the caller.
      pub async fn abandon(&self, key: &K);
  }

  One lock guards the map only; each slot has its own lock around its Session, so a slow provider does not block another. A second failure after the retry evicts and returns CallError::Failed.
• Step 1: Port the 8 behaviours as tests (fake connections over MemoryChannel, counting opens): two calls share one open; a generate reuses the session the compile opened (same key); a failed call is retried once on a new guest; a retry that also fails surfaces and clears the slot (next call opens again); a rejection keeps the session; abandon forgets it; a changed fingerprint replaces it; plus a_slow_provider_does_not_block_another (a call on key A that waits on its channel does not delay a call on key B; use a channel whose receive awaits a oneshot the test releases later). The "sessionless" behaviour stays in the CLI invoker (direct providers never reach the pool).
• Step 2 to 5: fail, implement, run (cargo test -p morphir-host, wasm32 check, clippy, fmt), commit feat(host): reuse warm guests with a Pool. Then the whole-branch review, CHANGELOG entries (Added: Registry, GuestSource, Pool in morphir-host; NativeSource and InstalledSource in morphir-host-native; Changed: ChannelError and HostError::Channel carry a cause), push and PR.

[DamianReeves]

Task 5: CLI registry and one-shot calls on host sources

After the morphir-rust PR merges. Umbrella branch from origin/main; pin the submodule to the merge commit.

Files:

• Modify: crates/morphir/src/extensions.rs, src/extensions/guest.rs, src/commands/compile.rs, src/commands/compile/prepare.rs, src/commands/generate.rs, src/commands/extension.rs, src/commands/ui/provider/playground.rs (catalog and resolution only), src/commands/ui/provider/extension.rs

Interfaces:

• extension_registry_for(installed, only) -> Result<morphir_host::Registry, CliError>: same selection rules (Gleam alias, opt-in Elm, only filter), registering morphir_host_native::NativeSources and InstalledSources (MorphirHome from MorphirHome::resolve() or passed in; keep today's call sites' behaviour). Registration errors keep their texts.

• invoke_frontend, invoke_backend, invoke_workspace_discovery take &morphir_host::Resolved. NativeDirect uses resolved.native() typed handles through blocking as today; other modes call guest::call_once(resolved.connect(workspace).await?, ...). Delete builtin_provider and GuestSource in guest.rs (replaced by Resolved::connect).

• commands/compile.rs provider_supports_incremental and cache_key take &Resolved (resolved.frontend().incremental, info().id, info().version).

• commands/extension.rs run_extension_list and invocation_mode_name use morphir_host::{ProviderOrigin, InvocationMode}.

• ui/provider/extension.rs invoke_installed uses InstalledSource::new(home, snapshot).connect(workspace).

• Registry errors in CLI messages pass through DaemonError::from (unchanged texts).

• Step 1: Tests first. Add the two missing tests from part 2:

  • an_installed_provider_rejecting_compile_keeps_the_rejected_text (unix; install a process fixture that answers compile with an RPC error; assert Provider '<id>' rejected 'morphir.frontend.compile': Extension error: RPC error -32001: does not compile).
  • the_installed_workspace_provider_discovers_through_the_host in ui/provider/extension.rs (unix; install a workspace-capable process fixture; discover() returns its snapshot).
    Run them against the current code first: both must pass (they pin today's behaviour).

• Step 2: Rewire as listed. Run cargo test --locked --package morphir (full), cli_integration -- --test-threads=2, fmt, clippy.

• Step 3: Commit feat(cli): resolve providers with the morphir-host registry.

[DamianReeves]

Task 6: Workbench through Pool

Files:

• Create: crates/morphir/src/commands/ui/provider/pool.rs (PooledInvoker)
• Delete: crates/morphir/src/commands/ui/provider/sessions.rs
• Modify: crates/morphir/src/commands/ui/provider/playground.rs, ui/provider/mod.rs, crates/morphir/src/extensions.rs (delete open_frontend_session, open_backend_session, open_loaded, installed_loaded, session_failure, failed_session_message)

Interfaces:

• ExtensionInvoker methods take &Resolved. PooledInvoker { pool: Pool<String> } implements it: NativeDirect goes one-shot through crate::extensions::invoke_*; every other mode calls pool.call(&id, &resolved.fingerprint(), || resolved.connect(workspace), method, &request), mapping CallError to today's texts ("Provider '{provider}' failed during '{method}': {error}" for failures; the rejected text from guest). abandon(provider) calls pool.abandon.

• NativePlaygroundProvider::in_workspace wires Arc::new(PooledInvoker::new(host_config())).

• Step 1: Tests. Port the CLI-level parts of the 8 sessions.rs behaviours to pool.rs tests where they depend on CLI mapping (direct providers go one-shot; timeouts abandon; a lost guest reopens once), using a resolved native Gleam provider under ProtocolOnly for the protocol path. Keep every playground.rs test passing (a_slow_extension_yields_a_timeout_diagnostic must still assert abandoned).

• Step 2: Implement, delete sessions.rs and the daemon session helpers. rg -n 'morphir_daemon::' crates/morphir/src must show only DaemonError (and protocol::methods if still used; prefer morphir_extension_sdk::protocol::methods).

• Step 3: Run full cargo test --locked --package morphir, playground tests, fmt, clippy; commit feat(cli): serve the workbench from a morphir-host pool.

[DamianReeves]

Task 7: Compatibility suites, CHANGELOG, PR

• Run mise run ci:fetch-published-bundles && cargo build --locked --release --package morphir && mise run test:host-compatibility and the published bundle tests (generate_extension, generate_openapi_extension, python_extension, rust_extension with the CI env mapping). Linux-only Elm and scala-elm run in PR CI.
• CHANGELOG [Unreleased] ### Changed: the pin move; providers resolve through morphir-host; the workbench reuses guests through morphir-host; the IO error: ... / JSON error: ... texts are restored.
• Commit docs(changelog): record the host registry and pool, then the whole-branch review, push, PR.

[DamianReeves]

After part 3

Part 4 (daemon cleanup) starts from: morphir-daemon's ExtensionRegistry, typestate Session, actor, ExtensionSession, SpawnedProcessSession/SpawnedProcessTransport, ExtismTransport, NativeMepTransport, activate_transport, ExtensionResponseExt, and ConnectedDaemonSession are used only inside the daemon and its tests. Port the tests that pin behaviour to the host crates, add an HTTP Channel for ConnectedDaemonSession (checkpoint 3 keeps HTTP as a way to reach an extension), then delete the rest.

[DamianReeves]

Tasks 1 to 4 shipped in finos/morphir-rust#271 (squash-merged as 8c10fe6): ChannelCause, the portable Registry and GuestSource, NativeSource and InstalledSource, and Pool<K>. Review changes to the plan's interfaces that tasks 5 and 6 follow: CallError is #[non_exhaustive] with a new Open variant for open failures; Resolved::native() is Some only under NativeDirect; Resolved::fingerprint() includes a source incarnation, so a same-version reinstall opens a new pooled guest; InstalledSource::activate returns a typed InstalledSourceError so the CLI keeps its error texts. Tasks 5 to 7 continue on the umbrella branch feat/morphir-host-cli-registry, based on milestone/v0.4.0-beta.9.

[DamianReeves]

Part 3 is complete.

Merged pull requests:

• feat(host): portable provider registry, guest sources and warm-guest pool morphir-rust#271, merged as 8c10fe6 (Registry, GuestSource, NativeSource, InstalledSource, Pool, ChannelCause)
• feat(cli): resolve providers and serve the workbench through morphir-host #995, merged into milestone/v0.4.0-beta.9 as 4abe35c (CLI resolves providers through the morphir-host Registry; the workbench serves guests from a morphir-host Pool through PooledInvoker with the five-minute idle stop; sessions.rs and the daemon session helpers are removed; CI now runs on pull requests into milestone/** branches)

What changed for users: the IO error: ... and JSON error: ... texts are restored, the playground's rejected-call text now matches morphir compile, a guest is replaced on a same-version reinstall, and the five-minute idle stop is kept. This ships in the v0.4.0-beta.9 release (draft PR #994).

Deferred to part 4:

• delete the daemon's ExtensionRegistry, typestate Session, session actor, transports, and ExtensionResponseExt
• move ConnectedDaemonSession onto an HTTP Channel
• split CallError::Open into connect and handshake variants so the CLI's start-failure side channel can go
• idle eviction as a Pool policy instead of the CLI sweep
• retry policy for decode failures in Pool

[DamianReeves]

This plan is complete. Further tracking of the host library work is in beads (morphir-opua.1 and its children); the GitHub issues under #958 link to the beads.