Module host_conformance 

Host-side conformance (SPEC.md §11.1; issue #14) — the dual of the provider-facing suite.

Where run_conformance drives an adversarial provider and asserts the suite catches it, this drives the reference host (contextgraph_host::Host) against adversarial providers — in-process ones, plus short-lived stdio child fixtures for the transport-level scenarios (the handshake and a crash mid-query) — the host-side equivalent of the provider fixture’s --misbehave modes, and asserts the host upholds the rules that bind it.

Each check is adversarial by construction: it points the host at a provider that tries to make it fail, asserts the host catches it, AND points it at a well-behaved counterpart it must accept — so a check passes only if the host discriminates, never vacuously. It is the same principle as .github/scripts/conformance-red.sh, here internal to each check.

Rules checked:

• H3 (§3, §3.1) — the host side of the version-family rule: a provider whose handshake_ack declares a mismatched major family is rejected with a named HostError::VersionMismatch, never a hang or a panic, and a same-family provider still handshakes. This is the dual of §3’s provider- facing handshake check (which asserts a provider replies with an ack): here it is the host that must reject a wrong-family ack, and do so promptly — “no hang” is an explicit assertion, driven under a harness-level tokio::time::timeout so a stall is a distinct, failing outcome.
• B2 (§7) — a provider whose frames sum over max_tokens is dropped-with-report, never silently truncated.
• B4 (§7) — a provider returning more than max_frames frames is dropped-with-report.
• C1/C2 (§4) — an egress: true provider is not queried before consent, and its query payload is never transmitted.
• C6 (§4) — a provider declaring an off-machine egress scope with no recorded receipt is refused with a typed scope error; the payload is not transmitted.
• F5 bytes (§6.2) — a file-provenance digest is verified against the source bytes over a trusted local fixture the harness controls (via verify_file_provenance): a matching digest verifies, a tampered one is caught.
• R3 (§11) — the compose/render path delimits frame content as quoted material inside a <frame> fence, never spliced as instructions.
• Composition audit (§11 R3; issue #15) — the reference composer (compose_for_prompt) packs a multi-provider, over-budget, duplicate-content frame set into a within-budget prompt and emits an audit that explains every included and excluded frame (budget, dedup), while a within-budget duplicate-free set drops nothing.
• Crash isolation (§11 robustness; the crash-consistency contract that one provider’s failure never poisons a query_all) — a provider that dies mid-query surfaces as HostError::ProviderCrashed and is excluded, while a healthy provider fanned out concurrently beside it still returns its frames and the fan-out still completes. The well-behaved counterpart is a healthy stdio provider in the same fan-out, proving the exclusion is real discrimination — not a stdio leg that simply never contributes.

Honest residual (not checked here)

C4, C7, C8 bind the host’s HTTP transport — treating every non-loopback provider as egress, requiring TLS, and never logging credentials. Exercising them needs a real (non-loopback, TLS) network peer the in-process harness cannot stand up, so they stay in §11.1’s residual list. R3 is now checked on two fronts: HCHECK_CONTENT_QUOTING for the delimiting-and-escaping contract (a content-embedded </frame> cannot break out), and HCHECK_COMPOSITION_AUDIT for the full reference composition module — global budget packing, cross-provider dedup, and an audit that explains every drop (issue #15).

Constants

HCHECK_BUDGET_DROP

HCHECK_COMPOSITION_AUDIT

HCHECK_CONSENT_GATE

HCHECK_CONTENT_QUOTING

HCHECK_CRASH_ISOLATION

HCHECK_FRAME_LIMIT

HCHECK_PROVENANCE_BYTES

HCHECK_SCOPE_RECEIPT

HCHECK_VERSION_REJECT

The stable host-side check names, so reports and callers agree on identifiers.

Functions

run_host_conformance

Run every host-binding check against the reference host, returning a typed ConformanceReport — the host-side analogue of run_conformance. A passed() verdict means the host caught every adversarial provider and accepted every well-behaved one.