Skip to content

Add GitHub PR and Vista WASIp2 Resource providers - #415

Merged
schickling-assistant merged 3 commits into
mainfrom
schickling-assistant/2026-09-02-wasip2-github-pr-vista-providers
Sep 2, 2026
Merged

Add GitHub PR and Vista WASIp2 Resource providers#415
schickling-assistant merged 3 commits into
mainfrom
schickling-assistant/2026-09-02-wasip2-github-pr-vista-providers

Conversation

@schickling-assistant

Copy link
Copy Markdown
Contributor

Problem

The universal WASIp2 Resource executor supports GitHub Issue and PTY Stats, but downstream catalogs also observe GitHub pull requests and Vista artifacts. Those profiles cannot migrate away from the removed host runtime { argv ... } form without equivalent closed capabilities and components.

Goal

Provide read-only GitHub PR and Vista providers through the canonical st2:resource-provider/provider@0.1.0 ABI, with exact capability scope, bounded effects, cancellation, deadlines, and stable snapshot contracts.

Decisions

  • Keep HTTP and command execution in host capabilities. Keep normalization, snapshot schemas, topics, facts, and digest suppression in guest components.
  • Bind GitHub conditional cache state to the caller's exact prior digest. Reject paginated CI responses instead of publishing incomplete state.
  • Scope Vista to one declared slug/version before spawn. Use an observedAt-free carrier for stable digest suppression.
  • Require the companion Vista CLI artifact get command. Do not add a compatibility fallback.

Verification

Focused Cargo tests cover provider semantics, scope denial before effects, cancellation/deadlines, process-group cleanup, exact prior-digest cache binding, pagination rejection, and catalog grammar.

The Nix wasip2-resource-providers and wasip2-resource-executor checks are the final local package gates. A broad flake run reached 664 passing library tests but hit two existing parallel Codex app-server fixture races; both failing tests pass in isolation.

Complexity

The new capability modules are required trust boundaries. Each component can import only its declared read-only host capability.

Concerns

The Vista provider requires a Vista CLI that implements vista artifact get <slug> v<version> --output json. Downstream integration must prove that exact command before enabling the profile.

Friction & bottlenecks

The broad Nix gate repeatedly exposed existing parallel filesystem/socket fixture races. Focused provider gates avoid treating those unrelated failures as provider regressions.

Follow-ups

  • Cut over the downstream catalog profiles and validate the packaged Vista command end to end.

References

Posted on behalf of @schickling
field value
agent_identity dev3.direct.omp.2cshu64q
session dev3.2cshu64q
agent_persona generalist
agent_supervisor unavailable
agent_tool OMP
agent_tool_version 18.0.9
agent_runtime OMP 18.0.9
tooling_profile dotfiles@b607597

@schickling-assistant

Copy link
Copy Markdown
Contributor Author

@codex review

Posted on behalf of @schickling
field value
agent_identity dev3.direct.omp.2cshu64q
session dev3.2cshu64q
agent_persona generalist
agent_supervisor unavailable
agent_tool OMP
agent_tool_version 18.0.9
agent_runtime OMP 18.0.9
tooling_profile dotfiles@b607597

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 2, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-02T11:05:07.585333Z 65b8614 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6bb66b0293

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +281 to +283
.map_or_else(
|| Utc::now().to_rfc3339_opts(SecondsFormat::Secs, true),
|prior| prior.observed_at.clone(),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep snapshots stable when the cache is cold

After a supervisor/process restart, SnapshotCache is empty even though the observation request still carries the persisted prior digest. An unchanged PR is therefore fetched without a prior, this branch generates a new observedAt, and the component computes a different snapshot digest and publishes all initial topics. Thus every restart can rewrite an unchanged snapshot and spuriously wake bindings; omit this volatile field from the carrier/digest or persist enough source state to compare against the prior snapshot.

Useful? React with 👍 / 👎.

@schickling-assistant
schickling-assistant marked this pull request as ready for review September 2, 2026 09:37
agent-identity: dev3.direct.omp.2cshu64q
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.0.9
agent-runtime: OMP 18.0.9
tooling-profile: dotfiles@b607597
agent-identity: dev3.direct.omp.2cshu64q
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.0.9
agent-runtime: OMP 18.0.9
tooling-profile: dotfiles@b607597
agent-identity: dev3.direct.omp.2cshu64q
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.0.9
agent-runtime: OMP 18.0.9
tooling-profile: dotfiles@b607597
@schickling-assistant
schickling-assistant force-pushed the schickling-assistant/2026-09-02-wasip2-github-pr-vista-providers branch from 6bb66b0 to 65b8614 Compare September 2, 2026 10:58
@schickling-assistant

Copy link
Copy Markdown
Contributor Author

@codex review

Posted on behalf of @schickling
field value
agent_identity dev3.direct.omp.2cshu64q
session dev3.2cshu64q
agent_persona generalist
agent_supervisor unavailable
agent_tool OMP
agent_tool_version 18.0.9
agent_runtime OMP 18.0.9
tooling_profile dotfiles@b607597

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 65b861439d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +143 to +149
fn begin(&self, context: CapabilityContext<'_>) -> Self::Invocation {
let prior_digest = match context.phase() {
CapabilityPhase::Describe => None,
CapabilityPhase::Observe(request) => {
request.prior_digest.as_ref().map(|digest| *digest.as_bytes())
}
};

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Deny capability calls during descriptor execution

When a catalog-selected component calls the GitHub import from its describe export, this invocation maps CapabilityPhase::Describe to a missing prior digest but does not retain or enforce the phase, so GitHubPrInvocation::get still performs live DNS and HTTP requests before any binding is activated. Preserve the phase and return Denied from operational imports during description; VistaModule::begin has the same omission and can spawn its configured command from describe.

Useful? React with 👍 / 👎.

@schickling-assistant
schickling-assistant merged commit 9522b7a into main Sep 2, 2026
2 checks passed
@schickling-assistant
schickling-assistant deleted the schickling-assistant/2026-09-02-wasip2-github-pr-vista-providers branch September 2, 2026 12:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant