The default feature set builds service.rs for tests only; clippy -D warnings
flagged the wrapper dead there.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The doc comment on ForeignReasoningState made schemars emit a oneOf; a plain
comment keeps the closed set one enum.
Finding refusal-schema-split.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ProviderCall no longer holds the caller's invocation (the claim does), so no
path from a call, Debug included, reaches foreign reasoning state: the call
carries the filtered request and a receipt template. TransportResult::transported
takes its identity from the receipt.
complete no longer returns an error for a result the service refuses (wrong
provider tag, wrong drop count, validate_against failing, not transported): it
records a Provider-kind stand-in failure and releases the slot, so the caller
gets a typed answer and a retry replays it instead of ReplayConflict/Capacity.
Findings call-debug-shows-foreign-state and refused-completion-wedges-slot.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
InputItem::ReasoningState and TransportEventPayload::ReasoningState carry the
connector's own bytes as MessagePack bin. TransportService owns the provider
tag: partition_reasoning is the one place foreignness is decided, begin refuses
foreign state in the in-flight exchange (ForeignReasoningState), drops and
counts it earlier (receipt.foreign_reasoning_dropped), and complete gates the
receipt's provider and count. A backend now receives a ProviderCall holding
only the filtered request and builds its result through call.transported, so it
can neither see foreign state nor write receipt identity.
TransportResult::transcript_items hands a completed result back as items the
caller replays verbatim.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each frame is a cultnet.operation_request.v0 / operation_response.v0
(service gamecult.model.connector, operation invoke) over loopback
TcpFramed, carrying the kit's sealed per-caller envelope: named
MessagePack only, unknown fields refused, binary ciphertext, JSON Schema
published from the types (ruling connector-v3-wire-cultnet-operation).
v2 is deleted with its fixtures (ruling connector-v3-only). The request is
provider-neutral, with max_output_tokens required; failure kinds, stop
reasons and usage are typed, and Policy is three typed refusals. Golden
v3 frames pin the carriage and envelope.
Spec eureka-body:cut_spec:cut-connector-contract-v3.r2; reports h1-h2;
Soul s2 holds (verdict eureka-body:verdict:cut-connector-contract-v3.s2).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The v2 contract, encrypted envelope and framing, client, caller admission
and replay, and the serve loop move into the model-connector crate behind
one ProviderBackend trait, relicensed AGPL-3.0-only by the sole copyright
holder (ruling connector-kit-relicense-agpl). Same schema ids and wire bytes
as v2, pinned by golden fixtures generated from fd7cec4. The Codex backend
is not ported (ruling codex-connector-park).
Serve owns the frame bounds: it measures the sealed envelope, refuses
configurations that cannot deliver their payload bound, answers over-bound
payloads and over-long ids with v2 refusals, and never records or replays
an undeliverable result.
Spec eureka-body:cut_spec:cut-connector-kit-lift.r1; reports h1-h5;
Soul s5 holds (verdict eureka-body:verdict:cut-connector-kit-lift.s5).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
