feat(resource): add runtime protocol SDK and semantic invalidations

Cargo.toml

@@ -2,8 +2,8 @@
 # `package.version` out of this file as the single source of truth for the
 # build, and a virtual root has no `[package]` to read.
 [workspace]
-members = ["crates/agent-spec", "crates/st2-wire", "crates/demo-resolver-wasm"]
-default-members = [".", "crates/agent-spec", "crates/st2-wire"]
+members = ["crates/agent-spec", "crates/st2-resource-protocol", "crates/st2-wire", "crates/demo-resolver-wasm"]
+default-members = [".", "crates/agent-spec", "crates/st2-resource-protocol", "crates/st2-wire"]
 
 [package]
 name = "st2"
@@ -33,6 +33,7 @@ notify = "8"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
+st2-resource-protocol = { path = "crates/st2-resource-protocol" }
 st2-wire = { path = "crates/st2-wire" }
 tempfile = "3"
 toml = "0.9"

crates/agent-spec/src/profile.rs

@@ -36,7 +36,7 @@ pub const AGENT_GOAL_SCHEME: &str = "dev.schickling.agent-goal";
 /// Maximum resolver module bytes admitted by both catalog transactions and the wasm runtime.
 pub const DEFAULT_MODULE_LIMIT_BYTES: usize = 16 * 1024 * 1024;
 /// Descriptor ABI implemented by this host.
-pub const PROFILE_DESCRIPTOR_ABI_VERSION: u32 = 2;
+pub const PROFILE_DESCRIPTOR_ABI_VERSION: u32 = 3;
 /// Maximum canonical compact JSON bytes accepted for one binding selector.
 pub const DEFAULT_SELECTOR_LIMIT_BYTES: usize = 16 * 1024;
 
@@ -1091,7 +1091,7 @@ mod tests {
     use super::*;
 
     const VALID_DESCRIPTOR_JSON: &str = r#"{
-        "abiVersion": 2,
+        "abiVersion": 3,
         "capabilities": ["resolve", "read", "observe"],
         "selectorSchema": {
             "type": "object",
@@ -1157,7 +1157,7 @@ mod tests {
     }
 
     #[test]
-    fn valid_v2_descriptor_and_nested_selector_validate() {
+    fn valid_v3_descriptor_and_nested_selector_validate() {
         let descriptor = valid_descriptor();
         assert_eq!(descriptor.abi_version, PROFILE_DESCRIPTOR_ABI_VERSION);
         assert_eq!(descriptor.runtime.topology, RuntimeTopology::Shared);
@@ -1171,7 +1171,7 @@ mod tests {
 
     #[test]
     fn descriptor_rejects_unknown_abi_capability_and_fields() {
-        let unknown_abi = VALID_DESCRIPTOR_JSON.replace("\"abiVersion\": 2", "\"abiVersion\": 9");
+        let unknown_abi = VALID_DESCRIPTOR_JSON.replace("\"abiVersion\": 3", "\"abiVersion\": 9");
         assert!(
             ProfileDescriptor::from_json(unknown_abi.as_bytes())
                 .unwrap_err()
@@ -1187,7 +1187,7 @@ mod tests {
         );
 
         let unknown_field =
-            VALID_DESCRIPTOR_JSON.replace("\"abiVersion\": 2,", "\"abiVersion\": 2, \"extra\": true,");
+            VALID_DESCRIPTOR_JSON.replace("\"abiVersion\": 3,", "\"abiVersion\": 3, \"extra\": true,");
         assert!(
             ProfileDescriptor::from_json(unknown_field.as_bytes())
                 .unwrap_err()

crates/agent-spec/tests/profile_wasm.rs

@@ -74,7 +74,7 @@ fn descriptor_module(payload: &[u8], reported_len: usize) -> WasmResolver {
 }
 
 const VALID_DESCRIPTOR: &str = r#"{
-  "abiVersion": 2,
+  "abiVersion": 3,
   "capabilities": ["resolve", "read", "observe"],
   "selectorSchema": {
     "type": "object",
@@ -112,12 +112,12 @@ fn current_rss_bytes() -> u64 {
 }
 
 #[test]
-fn valid_v2_descriptor_executes_and_resolve_only_module_stays_passive() {
+fn valid_v3_descriptor_executes_and_resolve_only_module_stays_passive() {
     let descriptor = descriptor_module(VALID_DESCRIPTOR.as_bytes(), VALID_DESCRIPTOR.len())
         .describe_once()
         .expect("describe call succeeds")
         .expect("descriptor is present");
-    assert_eq!(descriptor.abi_version, 2);
+    assert_eq!(descriptor.abi_version, 3);
 
     assert!(
         WasmResolver::load(Path::new(DEMO_WASM_PATH))

crates/st2-resource-protocol/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "st2-resource-protocol"
+version = "0.1.0"
+edition = "2024"
+description = "Resource Profile runtime wire types, framing, and codecs shared by st2 hosts and runtimes."
+license = "MIT"
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"