Skip to content

build(deps): bump the patch-updates group with 6 updates - #2

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/patch-updates-ef1ebc19bd
Closed

build(deps): bump the patch-updates group with 6 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/patch-updates-ef1ebc19bd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the patch-updates group with 6 updates:

Package From To
clap 4.6.1 4.6.2
alloy-primitives 1.6.0 1.6.1
alloy-sol-types 1.6.0 1.6.1
alloy-chains 0.2.35 0.2.36
http-body-util 0.1.3 0.1.4
syn 2.0.118 2.0.119

Updates clap from 4.6.1 to 4.6.2

Release notes

Sourced from clap's releases.

v4.6.2

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Changelog

Sourced from clap's changelog.

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Commits
  • 0fe0be3 chore: Release
  • 480af9d docs: Update changelog
  • 2b3ddd0 Merge pull request #6340 from liskin/fix-completion-escape
  • 7ffe739 fix(complete): Do not suggest options after "--"
  • d47fc4f test(complete): Options suggested after escape (--)
  • See full diff in compare view

Updates alloy-primitives from 1.6.0 to 1.6.1

Release notes

Sourced from alloy-primitives's releases.

alloy-core v1.6.1

What's Changed

New Contributors

Full Changelog: alloy-rs/core@v1.6.0...v1.6.1

Changelog

Sourced from alloy-primitives's changelog.

1.6.1 - 2026-07-16

Bug Fixes

  • [sol-macro] Derive namespaced custom types (#1152)
  • [syn-solidity] Strip namespaces from custom types in EIP-712 formatting (#1146)
  • [json-abi] Dedup canonical signatures (#1151)
  • [dyn-abi] Correct packed encoded size for Function (#1149)
  • [sol-macro] Fix UDT NAME constant generation stringify typo (#1145)
  • Fix(dyn-abi): avoid nested zero-sized
  • [json-abi] Preserve anonymous event full signatures (#1141)
  • [sol-macro] Derive Default for dynamic arrays of non-Default elements (#1129)
  • [sol-macro] Derive builtin traits on overloaded event/error enums (#1118)
  • [primitives] Reject underflowing native signed ints (#1139)
  • [dyn-abi] Error on primitive EIP-712 data (#1138)
  • [dyn-abi] Require tuple match arity (#1137)
  • [dyn-abi] Enforce signed int string width (#1136)
  • [dyn-abi] Validate EIP-712 fixed bytes length (#1135)
  • [sol-macro-expander] Propagate extra_derives to the functions enum (#1124)
  • [dyn-abi] Validate event topic count before decoding body (#1122)
  • Switch to proc-macro-error3 (#1121)
  • Reject extra event topics during decoding (#1112)
  • Disable proptest default features (#1110)
  • [EIP-712] PropDef::parse supports extra whitespaces (#1102)
  • [dyn-abi] Allow self-referential struct types in EIP-712 canonicalize (#1103) (#1105)

Dependencies

  • [deps] Bump actions/checkout from 6.0.2 to 7.0.0 in the ci-weekly group across 1 directory (#1130)

Features

  • [primitives] Use foldhash for fixed-size maps (#1153)
  • Allow customizing keccak cache size (#1115)
  • Keccak cache stats (#1114)
  • [primitives] Add Signature v_byte helper (#1111)

Miscellaneous Tasks

  • Release 1.6.1
  • Disable rustc-hash nightly feature (#1132)
  • Group weekly dependabot updates (#1127)

Other

  • Set rust-toolchain inputs explicitly (#1131)

Performance

  • Optimize bloom membership checks (#1134)

... (truncated)

Commits
  • ae40cc4 chore: release 1.6.1
  • 24e3053 fix(sol-macro): derive namespaced custom types (#1152)
  • 3203fa6 fix(syn-solidity): strip namespaces from custom types in EIP-712 formatting (...
  • ca7508b fix(json-abi): dedup canonical signatures (#1151)
  • e63cf6f feat(primitives): use foldhash for fixed-size maps (#1153)
  • 7dc38ba fix(dyn-abi): correct packed encoded size for Function (#1149)
  • 2df1477 fix(sol-macro): fix UDT NAME constant generation stringify typo (#1145)
  • c133daf fix(dyn-abi): avoid nested zero-sized
  • cd07f92 fix(json-abi):
  • ea33d7a fix(sol-macro): derive Default for dynamic arrays of non-Default elements (#1...
  • Additional commits viewable in compare view

Updates alloy-sol-types from 1.6.0 to 1.6.1

Release notes

Sourced from alloy-sol-types's releases.

alloy-core v1.6.1

What's Changed

New Contributors

Full Changelog: alloy-rs/core@v1.6.0...v1.6.1

Changelog

Sourced from alloy-sol-types's changelog.

1.6.1 - 2026-07-16

Bug Fixes

  • [sol-macro] Derive namespaced custom types (#1152)
  • [syn-solidity] Strip namespaces from custom types in EIP-712 formatting (#1146)
  • [json-abi] Dedup canonical signatures (#1151)
  • [dyn-abi] Correct packed encoded size for Function (#1149)
  • [sol-macro] Fix UDT NAME constant generation stringify typo (#1145)
  • Fix(dyn-abi): avoid nested zero-sized
  • [json-abi] Preserve anonymous event full signatures (#1141)
  • [sol-macro] Derive Default for dynamic arrays of non-Default elements (#1129)
  • [sol-macro] Derive builtin traits on overloaded event/error enums (#1118)
  • [primitives] Reject underflowing native signed ints (#1139)
  • [dyn-abi] Error on primitive EIP-712 data (#1138)
  • [dyn-abi] Require tuple match arity (#1137)
  • [dyn-abi] Enforce signed int string width (#1136)
  • [dyn-abi] Validate EIP-712 fixed bytes length (#1135)
  • [sol-macro-expander] Propagate extra_derives to the functions enum (#1124)
  • [dyn-abi] Validate event topic count before decoding body (#1122)
  • Switch to proc-macro-error3 (#1121)
  • Reject extra event topics during decoding (#1112)
  • Disable proptest default features (#1110)
  • [EIP-712] PropDef::parse supports extra whitespaces (#1102)
  • [dyn-abi] Allow self-referential struct types in EIP-712 canonicalize (#1103) (#1105)

Dependencies

  • [deps] Bump actions/checkout from 6.0.2 to 7.0.0 in the ci-weekly group across 1 directory (#1130)

Features

  • [primitives] Use foldhash for fixed-size maps (#1153)
  • Allow customizing keccak cache size (#1115)
  • Keccak cache stats (#1114)
  • [primitives] Add Signature v_byte helper (#1111)

Miscellaneous Tasks

  • Release 1.6.1
  • Disable rustc-hash nightly feature (#1132)
  • Group weekly dependabot updates (#1127)

Other

  • Set rust-toolchain inputs explicitly (#1131)

Performance

  • Optimize bloom membership checks (#1134)

... (truncated)

Commits
  • ae40cc4 chore: release 1.6.1
  • 24e3053 fix(sol-macro): derive namespaced custom types (#1152)
  • 3203fa6 fix(syn-solidity): strip namespaces from custom types in EIP-712 formatting (...
  • ca7508b fix(json-abi): dedup canonical signatures (#1151)
  • e63cf6f feat(primitives): use foldhash for fixed-size maps (#1153)
  • 7dc38ba fix(dyn-abi): correct packed encoded size for Function (#1149)
  • 2df1477 fix(sol-macro): fix UDT NAME constant generation stringify typo (#1145)
  • c133daf fix(dyn-abi): avoid nested zero-sized
  • cd07f92 fix(json-abi):
  • ea33d7a fix(sol-macro): derive Default for dynamic arrays of non-Default elements (#1...
  • Additional commits viewable in compare view

Updates alloy-chains from 0.2.35 to 0.2.36

Changelog

Sourced from alloy-chains's changelog.

0.2.36 - 2026-07-13

Commits

Updates http-body-util from 0.1.3 to 0.1.4

Release notes

Sourced from http-body-util's releases.

http-body-util-v0.1.4

What's Changed

  • Add Fused body combinator that always returns None once completed.
  • Add BodyExt::into_stream() to convert a body into a Stream.
  • Add Full::into_inner() to get the full Buf.
  • Add InspectFrame and InspectErr combinators.
Commits

Updates syn from 2.0.118 to 2.0.119

Release notes

Sourced from syn's releases.

2.0.119

  • Preserve attributes on tail-call expressions in statement position (#1994)
  • Parse field-representing types builtin in type position (#1996)
Commits
  • 3295f9e Release 2.0.119
  • 6ae9c18 Merge pull request #1996 from dtolnay/fieldrepresenting
  • 8ebd963 Parse field-representing types builtin
  • 540ccf8 Drop unneeded lifetime on covariant Cursor in verbatim::between
  • aa05887 Merge pull request #1995 from dtolnay/cursor
  • b7160d3 Reduce forking for Verbatim construction
  • efdc925 Merge pull request #1994 from dtolnay/tailcall
  • de6424c Preserve attribute on tail-call expression in statement position
  • 050dd73 Stricter const move closure grammar
  • c7d514b Merge pull request #1992 from dtolnay/scanconstmove
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch-updates group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [clap](https://github.com/clap-rs/clap) | `4.6.1` | `4.6.2` |
| [alloy-primitives](https://github.com/alloy-rs/core) | `1.6.0` | `1.6.1` |
| [alloy-sol-types](https://github.com/alloy-rs/core) | `1.6.0` | `1.6.1` |
| [alloy-chains](https://github.com/alloy-rs/chains) | `0.2.35` | `0.2.36` |
| [http-body-util](https://github.com/hyperium/http-body) | `0.1.3` | `0.1.4` |
| [syn](https://github.com/dtolnay/syn) | `2.0.118` | `2.0.119` |


Updates `clap` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.1...clap_complete-v4.6.2)

Updates `alloy-primitives` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/alloy-rs/core/releases)
- [Changelog](https://github.com/alloy-rs/core/blob/main/CHANGELOG.md)
- [Commits](alloy-rs/core@v1.6.0...v1.6.1)

Updates `alloy-sol-types` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/alloy-rs/core/releases)
- [Changelog](https://github.com/alloy-rs/core/blob/main/CHANGELOG.md)
- [Commits](alloy-rs/core@v1.6.0...v1.6.1)

Updates `alloy-chains` from 0.2.35 to 0.2.36
- [Release notes](https://github.com/alloy-rs/chains/releases)
- [Changelog](https://github.com/alloy-rs/chains/blob/main/CHANGELOG.md)
- [Commits](alloy-rs/chains@v0.2.35...v0.2.36)

Updates `http-body-util` from 0.1.3 to 0.1.4
- [Release notes](https://github.com/hyperium/http-body/releases)
- [Commits](hyperium/http-body@http-body-util-v0.1.3...http-body-util-v0.1.4)

Updates `syn` from 2.0.118 to 2.0.119
- [Release notes](https://github.com/dtolnay/syn/releases)
- [Commits](dtolnay/syn@2.0.118...2.0.119)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: alloy-primitives
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: alloy-sol-types
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: alloy-chains
  dependency-version: 0.2.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: http-body-util
  dependency-version: 0.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: syn
  dependency-version: 2.0.119
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 18, 2026
@dependabot
dependabot Bot requested a review from mfw78 as a code owner July 18, 2026 08:44
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 25, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 25, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/patch-updates-ef1ebc19bd branch July 25, 2026 16:58
mfw78 added a commit that referenced this pull request Jul 27, 2026
Combined replacement for the two split Dependabot PRs (#1, #2). The
crates re-export types from each other and must move in lockstep;
bumping only one produces 'mismatched types' between wasmtime::Error
and wasmtime_internal_core::error::error::Error.

Source changes required by v45:

- wasmtime::Error no longer implements std::error::Error, so the
  anyhow::Context trait no longer applies to Result<_, wasmtime::Error>.
  Switch to wasmtime's own error::Context trait, which provides the
  same .context() method on those Results.

- Config::async_support is deprecated and a no-op in v45 (async support
  is always enabled when the component-model feature is on). Drop the
  call.
mfw78 added a commit that referenced this pull request Jul 27, 2026
…lities) (#6)

* docs: add 0.1 to 0.2 migration guide

* wit: rename web3:runtime to nexum:runtime, unify error model, add identity/clock/random/http/query-module

* chore: rename crate nxm-engine to nexum-engine; bump to 0.2.0

* build: update justfile and CI for nexum-runtime + nexum-engine rename

* docs: rename to nexum:runtime, unify error model, mark non-server platforms as planned

* runtime: update engine + example to 0.2 WIT

- Engine main.rs targets world `shepherd` (formerly `shepherd-module`),
  generates against nexum:runtime@0.2.0 + shepherd:cow@0.2.0.
- Replaces per-domain error records (JsonRpcError, MsgError, StoreError,
  ApiError, bare String) with unified HostError + HostErrorKind across
  every host impl.
- Adds Identity host stub (was missing in 0.1 despite being doc'd).
- Adds chain::request_batch stub that falls back to per-call dispatch.
- Renames feed_get/feed_set -> read_feed/write_feed.
- Drops separate cow + order interfaces, replaced by single cow_api with
  request and submit_order.
- Block ts in test event is now ms (1_700_000_000_000) per types.wit
  documented unit.
- Example module targets event-module world, matches Event::Tick instead
  of Event::Timer, returns HostError from init/on_event.

* example: drop empty-name guard from init

The guard was inconsistent: missing 'name' key silently defaulted to 'unknown'
and returned Ok, but an explicit empty string returned Err — and both paths
logged a success-shaped 'name=...' line BEFORE the guard ran.

The example is a hello-world; a config-validation guard belongs in a real
module, not a starter. Drop it.

Resolves PR #6 finding #9.

* ci: add wit deps sync check

Both wit/nexum-runtime/ and wit/shepherd-cow/deps/nexum-runtime/ are
committed to the tree; the latter is regenerated by 'just sync-wit'.
Without a CI guard, a contributor can edit one without the other and
the divergence only surfaces at runtime (interface-mismatch on module
instantiation) — not at build time.

The new job re-runs the same copy that 'just sync-wit' does, then fails
if the deps tree differs from the freshly-copied canonical.

Resolves PR #6 finding #8.

* docs/01: align identity::sign to personal_sign semantics

The shipped wit/nexum-runtime/identity.wit defines sign() as
personal_sign — host MUST prepend the EIP-191 prefix
('\x19Ethereum Signed Message:\n<len>') before hashing. docs/01
described it as 'sign raw bytes' which is a transaction-signing
footgun (a raw signer can be tricked into signing EIP-155 / EIP-712
payloads disguised as plain bytes) AND diverges from the WIT — two
compliant hosts implementing different specs produce mutually
unverifiable signatures.

Align docs/01 to the WIT. Note that raw-bytes signing, gated by an
explicit capability, is on the 0.3 roadmap.

Resolves PR #6 finding #1.

* docs: align chain::request-batch and http WIT snippets to shipped types

Both snippets in the migration guide and docs/01 showed
list<tuple<string, string>> shapes that don't match the shipped WIT.
Adopters who copy the doc snippets get wit-bindgen type errors against
the real interfaces.

- chain::request-batch now uses the nominal record rpc-request and
  variant rpc-result (matching wit/nexum-runtime/chain.wit).
- http now uses the nominal record header and adds the timeout-ms field
  (matching wit/nexum-runtime/http.wit), plus *.domain wildcard syntax
  in the allowlist example and the docstring on how non-2xx surfaces.

Resolves PR #6 findings #2 and #3.

* docs: defer typed config-value variant to 0.3

The shipped wit/nexum-runtime/types.wit ships 0.1's stringly-typed
`type config = list<tuple<string, string>>`, but five doc locations
plus the migration TL;DR promised a typed `config-value` variant for
0.2 (string/integer/boolean/list). Per architectural triage, defer the
typed variant to 0.3 alongside the manifest parser work — the typing
story lands as one coherent feature.

Updates: docs/00, docs/01, docs/02 (two places), docs/08, migration
guide TL;DR row + 'Typed config' subsection.

Resolves PR #6 finding #4.

* docs/migration: replace cargo-nexum vapor with real commands

§9 verification checklist referenced 'cargo nexum check' and 'cargo
nexum run --mock'; §11 promised 'cargo nexum migrate --from 0.1' as
shipping with 0.2. None of these exist — there is no cargo-nexum crate
in the workspace.

Rewrite §9 to use real `cargo` + `just` invocations. Drop the §11
codemod promise; the sed cheat sheet in §8 already does the mechanical
work. Add a clear 'no cargo-nexum toolchain in 0.2; coming in 0.3' note
so adopters set the right expectation.

Resolves PR #6 finding #7.

* wit+engine: import clock/random/http in event-module; add host impls

The new 0.2 capability interfaces (clock, random, http) shipped as
standalone WIT files but were not imported by any world, so modules
built against event-module / shepherd could not 'use' them. Their
existence was advertised in the migration guide but was structurally
unreachable.

- event-module.wit: add 'import clock', 'import random', 'import http'
  (grouped as ambient host services after the six core primitives).
  shepherd world inherits via 'include event-module'. query-module
  remains intentionally sandboxed (no caps, no chain, no network).
- Engine: add host impls for clock (SystemTime + monotonic_baseline:
  Instant), random (getrandom 0.4 fill), http (returns Unsupported
  for 0.2; real fetch is 0.3 — allowlist enforcement lands with #6).
- Cargo.toml: add getrandom 0.4, plus serde 1 + toml 1 (for #6).

Resolves PR #6 finding #5.

* engine: minimal nexum.toml manifest parser with [capabilities] enforcement

Per architectural triage, ship minimal manifest enforcement in 0.2 and
defer optional-capability trap stubs to 0.3. The migration guide §3
promised four mechanisms; this commit lands the two security-critical
ones (required-capability check + http allowlist enforcement) plus the
deprecation warning, and explicitly defers per-import trap stubs.

Manifest schema (parsed in crates/nexum-engine/src/manifest.rs):
  [module]        name, version, component (sha256; parsed, not yet verified)
  [capabilities]  required (validated against KNOWN_CAPABILITIES; engine rejects unknown names)
                  optional (parsed + logged; trap-stub fallback is 0.3)
  [capabilities.http]  allow (exact host or *.suffix wildcard)
  [config]        TOML scalars flattened to strings (typed variant on 0.3 roadmap)

CLI: nexum-engine <component.wasm> [<nexum.toml>]. If the second arg is
omitted, the engine looks for nexum.toml next to the .wasm. If neither
exists, it emits the deprecation warning and proceeds with empty config
and empty allowlist (= effectively denies all HTTP).

http::fetch now performs the per-module allowlist check (host extracted
via a stdlib URL parser, exact or *.suffix match). Allowlist denial
returns HostError { kind: Denied }; real network fetch is still 0.3.

Includes unit tests for extract_host and host_allowed.

Resolves PR #6 finding #6.

* style: cargo fmt (nightly)

CI rustfmt (nightly) collapses several multi-line signatures that the
hand-formatted code had as multi-line.

* rename WIT package nexum:runtime -> nexum:host (resolve engine/runtime naming overload)

The 0.2 release shipped two similarly-named things — `nexum-engine` (the
Rust crate hosting WASM components) and `nexum:runtime` (the WIT
package). Both contain 'runtime' or a synonym, but they're at different
layers: engine = implementation, runtime = contract.

Worse, README.md described the engine crate as 'Host runtime —
wasmtime-based component loader' — explicitly calling the *engine*
'runtime' while a sibling directory was literally named `nexum-runtime`.

The word 'runtime' overwhelmingly means 'the thing that runs code' in
programming usage; putting it on the contract side inverted the
convention. Rename the WIT package to `nexum:host` — the host-imports
surface a guest sees. Distinction becomes self-documenting:

  engine (nexum-engine)  = a concrete implementation
  host   (nexum:host)    = the WIT contract every engine implements

Touchpoints:
- wit/nexum-runtime/ -> wit/nexum-host/ (12 files renamed via mv)
- wit/shepherd-cow/deps/nexum-runtime/ -> wit/shepherd-cow/deps/nexum-host/
  (regenerated by 'just sync-wit'; also covered by CI guard)
- Every 'package nexum:runtime@0.2.0' -> 'package nexum:host@0.2.0' (12 files)
- Every 'use nexum:runtime/...' -> 'use nexum:host/...' (shepherd-cow WIT)
- Every 'nexum::runtime::...' -> 'nexum::host::...' (engine + example Rust)
- justfile sync-wit paths
- .github/workflows/ci.yml wit-deps-sync paths
- All design docs (00..08), migration guide
- README.md + docs/00 add an explicit 'Engine vs. host' callout so the
  distinction is directly apparent to a new reader.
- A few stray 'host runtime' prose mentions in docs/05 and docs/07
  changed to 'host engine' for consistency.

Migration guide updated so a 0.1 -> 0.2 reader never encounters the
mid-development 'nexum:runtime' name — the new package is `nexum:host`
end-to-end.

Build + run smoke clean; nightly rustfmt clean.

* wit: drop deps/ vendoring; list both packages explicitly in bindgen

The 0.2 release vendored a copy of wit/nexum-host/ under
wit/shepherd-cow/deps/nexum-host/ because the engine's bindgen target
(shepherd:cow/shepherd) imports from nexum:host via 'include', and
wit-parser's default cross-package resolution looks at <pkg>/deps/.
Maintained by 'just sync-wit' + a CI guard to catch drift.

That whole pipeline was treating the symptom rather than the cause.
Both bindgen macros (wasmtime::component::bindgen! and
wit_bindgen::generate!) accept 'path' as an array of dirs, each
holding one package. Listing both packages explicitly resolves the
cross-package reference natively with no vendored copy.

Changes:
- crates/nexum-engine/src/main.rs: bindgen path is now
  ["../../wit/nexum-host", "../../wit/shepherd-cow"]; world fully
  qualified as "shepherd:cow/shepherd".
- modules/example/src/lib.rs: world fully qualified as
  "nexum:host/event-module". Path stays single (the example doesn't
  import shepherd:cow).
- wit/shepherd-cow/deps/ deleted entirely (12 files).
- justfile: sync-wit recipe removed; build-runtime renamed to
  build-engine (clearer; matches the engine vs host vocabulary
  established earlier); check + run no longer depend on sync-wit.
- .github/workflows/ci.yml: wit-deps-sync job removed (nothing to
  sync, nothing to drift).
- docs/migration/0.1-to-0.2.md: checklist item about vendored deps
  rewritten to point at the new bindgen pattern.

Result: 1 source of truth per WIT package, zero ceremony to keep them
aligned, ~360 fewer lines of vendored bytes in the repo.
mfw78 pushed a commit that referenced this pull request Jul 27, 2026
Audit reference: milestone-rubric-grant-audit-2026-06-25.md, Major #1.
Vendored rubric mandates `strum::IntoStaticStr` (with
`#[strum(serialize_all = "snake_case")]`) on every error enum so
`error_kind` labels on the `shepherd_chain_request_total` /
`shepherd_cow_api_*` counters stay in lock-step with the Rust source
of truth instead of growing a `match err { ... => "connect" ... }`
ladder per call site.

Enums covered on this milestone (the ones present on dev/m2-base):
- `nexum_engine::host::cow_orderbook::CowApiError`
- `nexum_engine::host::provider_pool::ProviderError`
- `nexum_engine::manifest::error::ParseError`
- `nexum_engine::engine_config::EngineConfigError`

Also adds `#[non_exhaustive]` to `CowApiError` and `ProviderError`
(audit Major #2). The other two already carried it.

`strum = "0.26"` lands as a direct dep on nexum-engine. The
workspace-deps hoist (audit P1, Major #5) is intentionally a separate
judgment call left to Bruno; this commit ships the substantive rubric
fix without coupling to the broader Cargo.toml restructure.
mfw78 pushed a commit that referenced this pull request Jul 27, 2026
12 review threads addressed end-to-end. Net diff is -720 lines despite
adding ~200 lines of new helpers + tests, because the WitBindgenHost
adapter deduplication alone wipes ~400 lines.

Per-thread:

  #1 (balance-tracker architecture): refactored to match the M3
  host-trait+adapter split the other 4 modules use. Created
  `strategy.rs` with `on_block(&impl Host, ...)`, moved check_one /
  fetch_balance / parse_balance_hex / parse_settings into it,
  converted parse_config to use SDK config helpers + typed
  HostError instead of String. Added 3 MockHost-driven tests
  covering first-seen-above-threshold, below-threshold-persist,
  and error-does-not-abort-loop.

  #2 + #3 (WitBindgenHost dedup): new
  `shepherd_sdk::bind_host_via_wit_bindgen!()` declarative macro.
  Single source of truth in `crates/shepherd-sdk/src/wit_bindgen_macro.rs`;
  the 4 trait impls + convert_err / sdk_err_into_wit / convert_level
  collapse to one macro invocation per module. Migrated all 5
  modules (twap-monitor, ethflow-watcher, price-alert, stop-loss,
  balance-tracker). Each module's lib.rs lost ~80 lines.

  #4 (scale_decimal + config_get dup): new `shepherd_sdk::config`
  with `get_required`, `get_optional`, `scale_decimal`, and a
  typed `ConfigError` enum (host-neutral). price-alert + stop-loss
  consume the SDK helpers; their local duplicates were deleted.
  Module-level decimal-parsing tests removed (covered by 7 SDK
  tests + 4 proptest cases now).

  #5 (Chainlink dup): new `shepherd_sdk::chain::chainlink` with
  `read_latest_answer(host, chain_id, oracle, domain) -> Option<I256>`.
  Encapsulates the eth_call → parse → ABI decode flow + Warn
  logging. price-alert + stop-loss now call the helper; their
  local AggregatorV3 sol! definitions + read_oracle / on_block
  oracle plumbing was deleted. SDK ships with 3 StubHost tests
  covering happy path, host error, and garbage-hex.

  #6 (WIT world capability elision): added new "Capability
  enforcement vs. the WIT world" section to ADR-0009 documenting
  that price-alert + balance-tracker compile against the
  shepherd:cow/shepherd supertype but their manifests omit
  cow-api, and that boot success depends on wasm-tools' unused-
  import elision. Flagged as load-bearing; M5 macro hardening
  path documented.

  #7 (poll-time revert classification inert): filed COW-1082 for
  the host-side fix (forward structured eth_call error data into
  HostError.data; analogous to COW-1075 for orderbook).

  #8 (classify_api_error retry-default unbounded): filed COW-1083
  for the rate-limit / max-retry follow-up on the backoff: marker.

  #9 (RetryAction::Backoff dead variant): no code change; replied
  to thread clarifying it is reserved API surface waiting on a
  richer upstream retry_hint shape (open question for mfw78).

  #10 (no proptest anywhere): added `proptest` to shepherd-sdk
  dev-dependencies. New `crates/shepherd-sdk/src/proptests.rs`
  with 6 properties covering eth_call_params/parse_eth_call_result
  round-trip, parse_eth_call_result rejection on unquoted input,
  config::scale_decimal round-trip + sign-preservation, U256 LE
  byte round-trip, and no-panic guards for decode_revert_hex +
  gpv2_to_order_data marker dispatch.

  #11 (ethflow chain capability least-privilege): moved `chain`
  from required to optional in `modules/ethflow-watcher/module.toml`,
  mirroring the M2 mirror fix already applied.

  #12 (ADR-0009 test-count census): dropped the "145 host tests
  (twap 20, ethflow 12, ...)" breakdown; kept the qualitative
  claim. CI is now the authoritative count.

Drive-by: alloy-sol-types moved from regular to dev-dependencies in
price-alert and stop-loss now that the Chainlink ABI helper is
inside shepherd-sdk and the modules only use sol! in their test
helpers.

Validation:
- cargo test --workspace: every crate green; 5 modules + SDK + sdk-test + engine all pass. 8 host tests gained on balance-tracker; 6 proptest props gained on shepherd-sdk; 3 Chainlink helper tests gained.
- cargo clippy --workspace --all-targets -- -D warnings: clean.
- cargo fmt --check: clean.
- cargo build --target wasm32-wasip2 --release for all 5 modules: clean.
- Zero em-dashes in source code added.
mfw78 pushed a commit that referenced this pull request Jul 27, 2026
The supervisor's dispatch path is per-chain by construction
(`dispatch_block(block)` filters modules by `block.chain_id`
matching their `[[subscription]]` table), and the COW-1071 WS
reconnect tasks own one per-chain backoff timer each. Multi-chain
isolation is therefore structural, not derived. This PR locks the
guarantee into the test suite with two new integration tests + a
supervisor.rs docstring stating the invariant explicitly.

## New tests

`multi_chain_dispatch_isolates_modules_by_chain`:
- Boot two `example` modules with different `[[subscription]]`
  chain_ids (1 + 100).
- Dispatch a block on chain 1 -> only module-a receives it
  (dispatched=1, alive_count=2 unchanged).
- Dispatch a block on chain 100 -> only module-b receives it.
- Validates: subscription filter is per-chain; a block on one
  chain does not even enter modules subscribed to a different
  chain.

`multi_chain_poisoned_module_does_not_affect_other_chains`:
- Boot fuel-bomb (always-traps) on chain 1 + example (healthy)
  on chain 100, with `PoisonPolicy::new(2, 60s)`.
- Trap bomb #1 on chain 1 -> bomb dies, poisoned=0, example
  untouched.
- Dispatch on chain 100 -> example receives (1/1).
- Wait 1.1 s (bomb backoff window), trap bomb #2 -> poisoned=1.
- Dispatch on chain 100 again -> example STILL receives.
- Validates: a permanently-poisoned module on one chain does not
  consume restart slots, fuel, or scheduling attention from
  modules on any other chain.

Total wall-clock ~1.2 s for the second test (one backoff window).

## supervisor.rs docstring

The module-level comment now articulates the multi-chain isolation
invariant explicitly so a future reader of the dispatch path knows
the property is load-bearing.

## What this proves

Supervisor side (dispatch fast-path):
- Per-module `alive`, `failure_count`, `next_attempt`, `poisoned`
  are independent of which chain triggered the event.
- Subscription filter excludes mismatched modules before any
  dispatch / restart logic runs.

Upstream side (already proven by COW-1071's architecture):
- `open_block_streams` spawns one task per chain; tasks share no
  state. A chain-A WS drop changes only chain-A's task state.
- `open_log_streams` is per-(module, chain) -> even tighter
  isolation than block streams.

## Out of scope

- A unit test that "fakes a WS drop" on chain A while chain B
  keeps yielding. Requires mocking `ProviderPool::subscribe_blocks`
  which today goes through real alloy / tokio infrastructure. The
  COW-1064 (E2E 4-6h testnet) and COW-1031 (7-day soak) will
  exercise this path against live RPCs.
- Per-chain configurable backoff / health-window. Today the
  reconnect policy is workspace-wide; per-chain tuning is a 0.3
  follow-up.

## Workspace impact

- `cargo test --workspace` -> 163 host tests + 6 doctests passing
  (was 161 + 6; +2 from the new integration tests).
- `cargo clippy --all-targets --workspace -- -D warnings` clean.
- `cargo fmt --all --check` clean.

Linear: COW-1073. Ninth M4 issue landed; stacks on #42 (COW-1072).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants