WS3 closeout: the exception register reaches empty (1 → 0) — by re-layer, not by the activation shed - #7175

Closed

BenKurrek wants to merge 101 commits into

mainfrom

Commits on Aug 3, 2026

refactor(contracts): move extension runtime descriptors to a neutral contract (WS3)

BenKurrek
and
claude
committed
93007af
refactor(sandbox): merge the sandbox lane into one crate (WS3)

BenKurrek
and
claude
committed
737cf50
docs(target-architecture): record the WS3 corrections with their evidence

BenKurrek
and
claude
committed
adbbb58
chore(sandbox): drop imports the merge left unused

BenKurrek
and
claude
committed
38be2e2
fix(ci): let the Reborn PR planner plan guidance edits and crate deletions

BenKurrek
and
claude
committed
925e7e6
fix(arch): give the retained resource exceptions an owning issue, not a wave

BenKurrek
and
claude
committed
5ed3ac5
test(contracts): pin the asset-path validator that moved into extension_contracts

BenKurrek
and
claude
committed
50be425
test(coverage): re-capture the host_runtime floor and floor the new sandbox lane

BenKurrek
and
claude
committed
84af779
docs(target-architecture): record the coverage ratchet as a move-sensitive gate

BenKurrek
and
claude
committed
bce21dc
Merge origin/main into ws3/sandbox-and-mcp

BenKurrek
and
claude
committed
5be9872
fix(extension-manager): repoint ironhub onto the moved ExtensionAssetPath

BenKurrek
and
claude
committed
8d89b41
test(coverage): exempt the WS3 move's no-region lines and record the gate

BenKurrek
and
claude
committed
50712f0
docs(sandbox,mcp): correct the wiring inventory and record the projection cost

BenKurrek
and
claude
committed
a723345
refactor(extensions): move the skill-install executor to extension_support (WS3)

BenKurrek
and
claude
committed
9a250ff
docs(sandbox): record that the Docker fail-closed switch is wired to nothing

BenKurrek
and
claude
committed
86b05a8
docs(host_runtime): record the executor/adapter seam in crate guidance

BenKurrek
and
claude
committed
f50504c
refactor(host_runtime): keep the install-input error path log-free

BenKurrek
and
claude
committed
e07b3b0
ci(coverage): re-capture the host_runtime floor for the WS3 executor move

BenKurrek
and
claude
committed
8be0715
refactor(wasm): move wit/ inside its owning crate (Wave 3)

BenKurrek
and
claude
committed
482bea4
build(wasm): rebuild first-party artifacts for the moved wit/ path

BenKurrek
and
claude
committed
21533fd
docs(target-arch): record the WS7 artifact-rebuild cost of guest path edits

BenKurrek
and
claude
committed
80daab9
Merge remote-tracking branch 'origin/main' into wave3/wit-move
BenKurrek
committed
5a1b315

Commits on Aug 4, 2026

Merge origin/main into ws3/sandbox-and-mcp

BenKurrek
and
claude
committed
f9b4ae7
Merge origin/main into ws3/first-party-tools

BenKurrek
and
claude
committed
25e9aab
ci(planner): classify the path classes that blocked the wit/ move

BenKurrek
and
claude
committed
1f66b58
refactor(host-runtime): split obligations into its three chartered owners (WS3)

BenKurrek
and
claude
committed
96d0d46
refactor(operator,contracts): route operator secrets through a product_contracts port (WS3)

BenKurrek
and
claude
committed
452a2d6
test(sandbox): put the Docker security check behind the fail-closed gate

BenKurrek
and
claude
committed
ec1ba88
docs(reborn): stop calling the unwired script lane an execution lane

BenKurrek
and
claude
committed
6150a3f
fix(ci): pin the WIT scope probes and the embedded-asset owner pairing

BenKurrek
and
claude
committed
756205f
docs(host-runtime): state the obligation visibility rule as it holds

BenKurrek
and
claude
committed
043bc6c
fix(architecture): put the operator secrets boundary entry on the right rule

BenKurrek
and
claude
committed
c735e0c
docs(sandbox): state the Docker-gate claim as the search that checks it

BenKurrek
and
claude
committed
93ab9e6
Merge remote-tracking branch 'origin/main' into ws3/sandbox-and-mcp
BenKurrek
committed
d249a1d
merge(ws3): sandbox lane + mcp contracts flip (#7065)
BenKurrek
committed
ae1162a
merge(wave3): move wit/ inside its owning crate (#7084)
BenKurrek
committed
b4925fd
merge(ws3): move the skill-install executor to extension_support (#7080)
BenKurrek
committed
e3a9724
merge(ws3): route operator secrets through a product_contracts port (#7096)
BenKurrek
committed
177eee8
merge(ws3): split obligations into its three chartered owners (#7090)
BenKurrek
committed
9ea9cf1
fix(coverage): re-anchor the exemptions the merge shifted
BenKurrek
committed
935ffe1
Merge origin/main (#7094 Wave 2 close-out) and re-baseline the WS3 numbers
BenKurrek
committed
75909be
refactor(layers): re-layer processes -> kernel and skills -> substrates (WS3/WS4)
BenKurrek
committed
8e299a7
docs(target-arch): close the WS3/WS4 rows this work satisfies, with evidence
BenKurrek
committed
29aac22
Merge origin/main into the consolidated WS3/WS4 branch
BenKurrek
committed
4512e03
ci(coverage): recapture the two composed floors from a real measurement
BenKurrek
committed
939af48
fix(network): compile the test rewrite seam out of production builds (WS3)
BenKurrek
committed
2349548
docs(coverage): verify the extension_support floor drop is composition, independently

BenKurrek
and
claude
committed
9fbffd1
fix(host_runtime): collapse a duplicated obligation predicate and quiet a background warn!

BenKurrek
and
claude
committed
3c3189c
fix(ci): a shipped package prompt is an asset, not prose — it was selecting no lane

BenKurrek
and
claude
committed
af14776
fix(harness): refresh the latency-runner lockfile after the sandbox consolidation

BenKurrek
and
claude
committed
ba79cb6
fix(skills): stop rejecting inline bundle installs and stop dropping url conflicts

BenKurrek
and
claude
committed
b57ac8e
refactor(capabilities): split host.rs along its six workflows (WS3 Row 2)

BenKurrek
and
claude
committed
05534b6
docs(target-arch): retract the "W7 is Wave 5" premise and tighten the ALLOWLIST baseline

BenKurrek
and
claude
committed
f2e69ad
Merge branch 'ws3/row2-hostsplit' into ws3/consolidated
BenKurrek
committed
8355cef
test(architecture): fix drifted ratchet baselines and fail on slack (#7147)

BenKurrek
and
claude
committed
85f55ee
Merge remote-tracking branch 'origin/main' into ws3/consolidated
BenKurrek
committed
aaf6515
docs(checklist): strike the egress-threat text the same row already retracted

BenKurrek
and
claude
committed
05fc53f
ci(composition): bound composition's absolute production LOC (#7151)

BenKurrek
and
claude
committed
31726cc
refactor(host_runtime): shed the catalog defaults downward (WS3 row 3)

BenKurrek
and
claude
committed
61fece8
fix(operator): name the port call in LlmKeyStoreError::Store

BenKurrek
and
claude
committed
def71bf
Merge branch 'ws3/row3-catalog' into ws3/consolidated
BenKurrek
committed
5079ca6
test(architecture): inventory same-layer dependency edges (#7149)

BenKurrek
and
claude
committed
324a1f6
revert(skills): restore the hidden-field install guards — the review finding was wrong

BenKurrek
and
claude
committed
05ad65a
test(architecture): census LLM-vendor names in the contracts family (#7150)

BenKurrek
and
claude
committed
f417a40
Merge remote-tracking branch 'origin/main' into ws3/consolidated
BenKurrek
committed
a2f9623
test(architecture): make the two new gates visible to CI's test-name filter

BenKurrek
and
claude
committed
ca4acb3
docs(target-architecture): record the four enforcement additions and two findings

BenKurrek
and
claude
committed
1a60f01
Merge origin/main into ws/enforcement-gates-7147

BenKurrek
and
claude
committed
24f96ab
fix(capabilities): make the auth-required enrichment total, dropping its unreachable!

BenKurrek
and
claude
committed
966061f
refactor(capabilities): return the authorization policy helpers to authorize

BenKurrek
and
claude
committed
7ba9c4e
fix(docs,ci): correct the guest WIT path and delete a test that never ran

BenKurrek
and
claude
committed
68ac1dd
test(host-api): pin the process-sandbox capability literal as a valid id

BenKurrek
and
claude
committed
7f242ae
Merge origin/main into ws/enforcement-gates-7147
BenKurrek
committed
54ceefd
test(ci): pin the pre-commit staged-path selector after the WIT move

BenKurrek
and
claude
committed
f4f1236
Merge remote-tracking branch 'origin/main' into ws/enforcement-gates-7147
BenKurrek
committed
f39d086
chore(ci): re-seed composition loc_ceiling at the merged-tree count (44392)

BenKurrek
and
claude
committed
1e971dc
Merge remote-tracking branch 'origin/main' into ws3-consolidated-merge
BenKurrek
committed
c16d0f2
chore(ci): move the absolute-mass record with its re-seeded ceiling (44392)

BenKurrek
and
claude
committed
9b4536c
Merge remote-tracking branch 'origin/main' into ws3-consolidated-merge
BenKurrek
committed
54e6757
WS5: repoint conversations' turn vocabulary to host_api; record the sever fork

BenKurrek
and
claude
committed
ace2fa7
Merge ws3/consolidated (54e6757414) into ws5/conversations-turns-sever
BenKurrek
committed
20fcf8a
WS5: record the trigger-poller bound mapping and the step-1 blocker

BenKurrek
and
claude
committed
57971c2
WS3: lanes consume a narrow reserve/reconcile/release port (#7067)

BenKurrek
and
claude
committed
790b739
Merge remote-tracking branch 'origin/ws3/consolidated' into ws3-governor-merge
BenKurrek
committed
7a89c2b
WS5: descend SubmitTurnResponse to host_api::turn; record the port-inversion shape

BenKurrek
and
claude
committed
caa9fc8
Merge remote-tracking branch 'origin/main' into ws3-consolidated-merge
BenKurrek
committed
8b901f4
WS10: convert the loud path-keyed gates to inventory keying before the family moves

BenKurrek
and
claude
committed
2153f0b
WS10: pin the hermetic suite's WebUI frontend resolution

BenKurrek
and
claude
committed
f858cfb
fix(ci): restore the entry tail the exemptions-union resolution dropped

BenKurrek
and
claude
committed
ccf284c
WS10: classify the repo-root scripts this PR touches in the test planner

BenKurrek
and
claude
committed
23cabea
WS10: name the new gates so the Code Style lane actually runs them

BenKurrek
and
claude
committed
d13fe3f
docs(ws10): record the two gate defects this PR's own CI surfaced

BenKurrek
and
claude
committed
3038fdf
Merge remote-tracking branch 'origin/main' into ws3-consolidated-merge
BenKurrek
committed
2ce58fa
WS5: sever conversations -> turns by port inversion; register 4 -> 3

BenKurrek
and
claude
committed
cac037b
chore(ci): exempt the consolidation's internal-move re-attributions that failed changed-coverage

BenKurrek
and
claude
committed
6563d80
Merge remote-tracking branch 'origin/ws3/lane-governor-port' into ws/waves-0-4-batch
BenKurrek
committed
6769fd9
Merge remote-tracking branch 'origin/ws5/conversations-turns-sever' into ws/waves-0-4-batch
BenKurrek
committed
35388b1
Merge remote-tracking branch 'origin/ws10/loud-path-inventory' into ws/waves-0-4-batch
BenKurrek
committed
108344c
Merge remote-tracking branch 'origin/ws/enforcement-gates-7147' into ws/waves-0-4-batch
BenKurrek
committed
6e82bc2
chore(arch): reconcile the same-layer inventory and downgrade pins with the batch's re-layers

BenKurrek
and
claude
committed
89080c5
refactor(layers): re-layer extension_support -> runtimes; the exception register reaches empty (1 -> 0)

BenKurrek
and
claude
committed
21222c6