# Plugin Refactor Todos
Active plugin refactor work should stay in coherent, reviewable slices. Older
slice ledgers are archived in `../../archive/`; the previous active ledger is
`../../archive/plugin_refactor_todos_26-5-31_after-bind-observe-task-admission.md`.
## Current State
- `src/plugin` owns the untrusted Wasm boundary: policy validation, ABI
vocabulary, runtime lifecycle, host-import sessions, workspace I/O,
operational diagnostics, and trace shapes.
- Guest-visible workspace reads use only the task-based `workspace.observe`
start/poll/take ABI. Task work is reserved during an active update, sealed
after successful return, and later executed by the runtime-owned task queue.
- Successful-return batches keep editor effects, deferred workspace I/O, and
workspace observation tasks paired by plugin identity. Public and crate-local
splits at that boundary now return named part structs instead of positional
tuples.
- Runtime scheduling keeps successful-return owner work paired with
observe-task scheduling evidence until the matching owner boundary consumes
it.
- Paired owner publication validates the editor-effect queue and workspace I/O
worker queue before mutating either owner. Per-queue admissions retain the
sealed batch with the queue storage borrow until publication. Successful
publication returns named count-shaped evidence; failures keep retryable
owner work paired.
- Task-style workspace observation keeps filesystem work behind successful
guest return. Sealed task batches validate all queue reservations before any
pending work is published, then carry the validated queue storage through
enqueue. The observe-task boundary is split under
`host/workspace_io/observe_tasks/` by batch, queue, error, report, and
reservation ownership.
- The generated-to-Alma decode boundary is now split under
`src/plugin/abi/decode/` by responsibility: facade, validated decode limits,
closed diagnostic fields, redacted decode errors, bounded scalar proofs,
workspace-path proofs, WIT capability references, buffer edit requests, and
tests.
- The host-import boundary is now split under `src/plugin/host/import/` by
responsibility: facade, snapshot capture, active session mutation,
successful-return/discard batches, resource vocabulary, and layered errors.
- The effect boundary is now split under `src/plugin/host/effect/` by
responsibility: facade, admission limits, commit errors, effect/proposal
vocabulary, pending/sealed batch transitions, discard/drain reports, and
tests.
- The static config boundary is now split under `src/plugin/policy/config/` by
responsibility: facade, registry and enabled-entry proofs, config entries,
identity grammar, WIT-world proof, component-path validation, proposal
policy, and tests.
- The next work should keep tightening existing task/resource, queue-error, and
owner-publication invariants. Wiring the real loaded-plugin owner loop is a
separate design boundary.
## Guardrails
- Do not add a synchronous guest-visible `workspace.observe` import.
- Do not widen workspace capabilities until task/resource scheduling is
integrated through a real owner-loop boundary.
- Keep authorization centralized in `PluginHostAuthority` and
`CapabilityAtom`; do not add adapter-local grant logic.
- Keep queue mutation, retryable sealed work, cancellation, and discard paths
owner-mediated. Prefer APIs that keep authority proofs paired until an owner
boundary consumes them.
- Preserve redaction by construction in debug, display, operational events, and
runtime trace output.
- Same-plugin proof pairing must be enforced at the constructor boundary; do
not rely on debug-only checks for proof identity invariants.
## Active Slice
- Complete: archived the previous active todo ledger with its state summary.
- Complete: replaced the remaining tuple-shaped successful-return and owner
batch split APIs with named boundary values:
`PluginHostImportBatchesParts`, `PluginHostOwnerBatchesParts`, and the
crate-local owner/task split returned by
`PluginHostImportBatches::into_owner_and_workspace_observe_tasks`.
- Complete: updated runtime, ECS owner-publication, trace, and host-import
tests/call sites to consume named fields instead of tuple positions. Runtime
behavior, queue admission, redaction, and scheduling semantics are unchanged.
- Complete: replaced retryable low-level enqueue error tuple splits with named
part structs for `PluginIntentQueueEnqueueError`,
`PluginWorkspaceIoWorkerEnqueueError`, and
`PluginWorkspaceObserveTaskEnqueueError`. This is an intentional public API
break for the plugin host queue-error surface; retry, discard, redaction, and
queue admission behavior are unchanged.
- Complete: replaced the remaining authority-bearing tuple splits in the
active-update, task-resource authority, and Wasmtime revocation cleanup
paths with named part structs. This intentionally breaks
`WasmtimePluginRevocationCleanup::into_parts`; lifecycle revocation,
runtime-owned task cleanup, update setup, and resource-table behavior are
unchanged.
- Complete: replaced the remaining public Wasmtime observe-task enqueue
mismatch identity tuples with named borrowed identity pairs, and changed the
private workspace I/O request-ledger split to a named `into_parts` value.
This intentionally breaks the two Wasmtime enqueue mismatch accessor return
types; runtime behavior, redaction, retry/discard behavior, and diagnostics
are unchanged.
- Complete: replaced the remaining non-test drained effect request tuple split
with `DrainedPluginEffectRequests`. This intentionally breaks
`DrainedPluginEffectReport::into_requests`; ECS owner publication behavior is
unchanged, and the drained plugin identity now stays with the named request
batches.
- Complete: added a named consuming split for `PluginOwnerQueueEnqueueError`.
Retryable owner-queue failures now expose `PluginOwnerQueueEnqueueErrorParts`
with the closed queue rejection and paired owner work. Runtime behavior,
redaction, queue admission, retry, and discard semantics are unchanged.
- Complete: bound owner-queue admissions to their admitted sealed batches and
target queue storage. Intent and workspace I/O owner publication now keeps
the batch inside the admission proof until success, while paired admission
failures recover the original owner-work proof without mutating either queue.
Runtime behavior, redaction, retry, discard, and queue saturation semantics
are unchanged.
- Complete: split the 2,433-line `src/plugin/host/import.rs` into
responsibility-owned submodules under `src/plugin/host/import/`. This is a
mechanical organization slice; host-import behavior, capability checks,
redaction, queue admission, and public re-exports are unchanged.
- Complete: split the 3,774-line `src/plugin/host/workspace_io.rs` into a
facade plus responsibility-owned modules under `src/plugin/host/workspace_io/`.
Deferred batch ownership, commit errors, access proofs, budget accounting,
reports, task results, task queue mutation, and worker queue scheduling now
have separate module owners. Runtime behavior, capability surfaces,
diagnostics, and public plugin re-exports are unchanged.
- Complete: split the 1,679-line
`src/plugin/host/workspace_io/observe_tasks.rs` into
`observe_tasks/mod.rs` plus responsibility-owned modules for pending/sealed
task batches, queue and limit ownership, queue errors, enqueue, discard, and
cancellation reports, and RAII reservation accounting. Runtime behavior,
task reservation semantics, redaction, queue admission, and public plugin
re-exports are unchanged.
- Complete: split `src/plugin/host/effect.rs` into a facade plus
responsibility-owned modules under `src/plugin/host/effect/`. Effect
admission limits, commit errors, raw effect/proposal vocabulary,
pending/sealed transitions, discard/drain reports, and tests now have
separate module owners. `PendingPluginUpdateBatch::push` is now internal to
the effect boundary so callers use typed admission methods instead of
constructing the raw storage enum. Runtime behavior, redaction, owner
publication, and public plugin re-exports are unchanged.
- Complete: split `src/plugin/trace.rs` into a facade plus domain modules under
`src/plugin/trace/`. The event envelope and trace class vocabulary,
effect/status payloads, workspace payloads, proposal receipt payloads, shared
display adapters, and tests now have separate module owners. Runtime
behavior, trace display output, redaction, runtime-trace goldens, and public
plugin re-exports are unchanged.
- Complete: split the 10,850-line `src/plugin/runtime/wasmtime.rs` into
`runtime/wasmtime/mod.rs` plus responsibility-owned modules for runtime and
instance orchestration, scheduled-update and revocation proofs, store-local
host-import state, typed update resources, workspace observe-task resources,
execution guards, runtime errors, and tests. Runtime behavior, public plugin
re-exports, capability checks, queue admission, redaction, and diagnostics
are unchanged.
- Complete: split the 1,149-line `src/plugin/policy/config.rs` into
`policy/config/mod.rs` plus responsibility-owned modules for registry
validation and enabled-entry proofs, static config entries, stable identity
grammar, current WIT-world proof, component-path validation, proposal review
policy, and tests. Runtime behavior, schema shape, validation semantics,
diagnostics, redaction, and public plugin re-exports are unchanged.
- Complete: split the 998-line `src/plugin/abi/decode.rs` into
`abi/decode/mod.rs` plus responsibility-owned modules for validated decode
limits, closed diagnostic fields, redacted decode errors, bounded scalar
proofs, workspace-path proofs, WIT capability refs, buffer edit requests, and
tests. Runtime behavior, guest validation, redaction, and public plugin
re-exports are unchanged.
## Backlog
- Integrate scheduled update, paired owner publication, bounded observe-task
execution, and workspace I/O execution into the real loaded-plugin owner loop
when that orchestration boundary exists.
- Add guest-driven scheduling subscriptions after stable owner-published event
shapes exist.
- Define a repo-wide operation error taxonomy before broad plugin operation
envelopes.
- Extend runtime trace replay goldens whenever event classes, proposal owners,
workspace outcomes, or task outcomes grow.
- Consider fuzz or corpus coverage for manifest parsing, WIT decode, workspace
path validation, and capability references when example tests stop covering
the input surface.
- Repeat the identity-string audit when adding new outer presentation,
telemetry, or Wasmtime adapter surfaces.
## Latest Slice
- `refactor(plugin): Split workspace observe task modules` mechanically moves
the host-owned observe-task boundary from one file into
`workspace_io/observe_tasks/mod.rs`, `batch.rs`, `queue.rs`, `error.rs`,
`report.rs`, and `reservation.rs`. The split follows invariant ownership:
successful-return task batches, queue mutation and limits, closed queue
diagnostics, redacted reports, and RAII reservation accounting. Runtime
behavior, task ids, reservation lifetime, queue admission, cancellation,
redaction, and public plugin re-exports are unchanged.
- Source records updated: `docs/plugins/runtime.md`, `src/plugin/docs.md`, and
`src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin::host::workspace_io::tests`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo check --workspace --locked`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused test, clippy, and full workspace test emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path. The default locked check also emitted existing
feature-gated plugin-runtime dead-code warnings.
- `refactor(plugin): Bind owner queue admissions` strengthens the ECS paired
owner-publication boundary. `PluginIntentQueue` and
`PluginWorkspaceIoWorkerQueue` admissions now own the admitted sealed batch
plus the queue storage borrow until publication, so owner publication no
longer depends on a separate shape token followed by a later
`push_admitted` convention. If workspace I/O admission rejects after intent
admission succeeds, the intent admission is consumed back into its sealed
batch and the original `PluginHostOwnerBatches` proof is rebuilt for retry.
The admission proofs are `#[must_use]` to reject silent drops of unpublished
work by future crate-internal callers.
Runtime behavior, queue saturation behavior, redaction, retry, and discard
semantics are unchanged.
- Source records updated: `docs/plugins/runtime.md`,
`docs/plugins/security.md`, `docs/plugins/testing.md`,
`src/plugin/docs.md`, and `src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin::host::import::tests`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo test -p alma --all-features plugin_owner_queue`
- `cargo test -p alma --all-features plugin::host::workspace_io::tests`
- `cargo check --workspace --locked`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused tests, clippy, and full workspace tests emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path. The default locked check also emitted existing feature-gated
plugin-runtime dead-code warnings.
- `refactor(plugin): Split ABI decode boundary modules` mechanically moves the
generated-to-Alma decode boundary from one long file into
`abi/decode/mod.rs`, `limits.rs`, `field.rs`, `error.rs`, `scalar.rs`,
`workspace_path.rs`, `capability.rs`, `buffer_edit.rs`, and `tests.rs`. The
organization follows invariant ownership: validated runtime limits, closed
diagnostic vocabulary, redacted errors, scalar proofs, workspace path
normalization, capability reference decoding, buffer edit decoding, and
tests. Runtime behavior, validation semantics, redaction, and public plugin
re-exports are unchanged.
- Source records updated: `docs/plugins/runtime.md`, `src/plugin/docs.md`, and
`src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin::abi::decode::tests`
- `cargo test -p alma --all-features host_import_decode_error_emits_redacted_operational_event`
- `cargo check --workspace --locked`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused tests, clippy, and full workspace tests emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path. The default `cargo check --workspace --locked` path also
emitted existing feature-gated plugin-runtime dead-code warnings.
- `refactor(plugin): Split policy config boundary modules` mechanically moves
the static plugin config boundary from one long file into
`policy/config/mod.rs`, `registry.rs`, `entry.rs`, `identity.rs`,
`world.rs`, `component.rs`, `proposal.rs`, and `tests.rs`. The organization
follows invariant ownership: registry uniqueness and enabled load proofs,
untrusted config schema and grant projection, identity grammar, ABI-world
proof, component path shape, proposal policy, and tests. Runtime behavior,
schema drift surface, validation, diagnostics, redaction, and public plugin
re-exports are unchanged.
- Source records updated: `docs/plugins/runtime.md`, `src/plugin/docs.md`, and
`src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin::policy::config::tests`
- `cargo test -p alma --all-features --test plugin_schema`
- `cargo check --workspace --locked`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused all-feature tests, schema tests, clippy, and full workspace
tests emitted the existing `block v0.1.6` future-incompatibility warning
from the tracked Bevy/wgpu dependency path. The default
`cargo check --workspace --locked` path also emitted existing
feature-gated dead-code warnings from the plugin runtime stepping-stone
surface.
- `refactor(plugin): Name successful-return batch splits` archives the completed
observe-task admission ledger and recreates this active todo file around the
successful-return/owner split hardening slice.
- `PluginHostImportBatches::into_parts` and
`PluginHostOwnerBatches::into_parts` now return named part structs.
`PluginHostImportBatches::into_owner_and_workspace_observe_tasks` now returns
a named crate-local owner/task split. This is an intentional public API break
in the plugin host surface; no runtime behavior or diagnostics changed.
- Source records updated: `docs/plugins/runtime.md`, `src/plugin/docs.md`, and
`src/plugin/refactor_notes.md`.
- Checks run so far:
- `cargo fmt --all`
- `cargo test -p alma --all-features host_import_batches_split_owner_work_as_one_identity_proof`
- `cargo test -p alma --all-features plugin::host::import::tests`
- `cargo test -p alma --all-features component_workspace_observe_task`
- `cargo test -p alma --all-features scheduled_update_owner`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused tests, clippy, and full workspace tests emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path.
- `refactor(plugin): Name retryable enqueue splits` continues the named
boundary migration for retryable queue errors:
`PluginIntentQueueEnqueueError::into_parts`,
`PluginWorkspaceIoWorkerEnqueueError::into_parts`, and
`PluginWorkspaceObserveTaskEnqueueError::into_parts` now return named part
structs instead of `(source, batch)` tuples. This is an intentional public API
break in the plugin host queue-error surface. Runtime behavior, queue
admission, retry/discard behavior, and diagnostics are unchanged.
- Source records updated: `docs/plugins/runtime.md`,
`docs/plugins/security.md`, `docs/plugins/testing.md`,
`src/plugin/docs.md`, and `src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin_intent_queue_saturation_keeps_retryable_batch`
- `cargo test -p alma --all-features sealed_workspace_observe_task_batch_rejects_cross_queue_without_losing_batch`
- `cargo test -p alma --all-features sealed_workspace_io_worker_enqueue_error_can_retry_batch`
- `cargo test -p alma --all-features plugin::host::workspace_io::tests`
- `cargo test -p alma --all-features ecs::plugin::tests`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused tests, clippy, and full workspace tests emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path.
- `refactor(plugin): Name runtime authority splits` continues the named
boundary migration for the remaining authority-carrying tuple splits:
`PluginActiveUpdate::into_parts`,
`PluginWorkspaceObserveTaskResourceAuthority::into_parts`,
`WasmtimePluginRevocationCleanup::into_parts`, and adapter-local Wasmtime
update resource splits now return named boundary structs. This is an
intentional public API break for `WasmtimePluginRevocationCleanup`; runtime
behavior, revocation cleanup, task-resource authority, and diagnostics are
unchanged.
- Source records updated: `docs/plugins/runtime.md`,
`docs/plugins/security.md`, `docs/plugins/testing.md`,
`src/plugin/docs.md`, and `src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin_active_update_captures_snapshot_and_handles_together`
- `cargo test -p alma --all-features workspace_observe_task_requests_commit_only_after_successful_return`
- `cargo test -p alma --all-features component_revoke_state_cleans_workspace_observe_tasks`
- `cargo test -p alma --all-features update_resources_preserve_typed_view_and_buffer_reps`
- `cargo fmt --all --check`
- `cargo test -p alma --all-features plugin::runtime::wasmtime::tests`
- `cargo test -p alma --all-features plugin::host::import::tests`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused tests, clippy, and full workspace tests emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path.
- `refactor(plugin): Name enqueue mismatch identities` closes the tuple-split
audit for remaining non-test plugin surfaces found in this pass:
`WasmtimeWorkspaceObserveTaskEnqueueError::instance_state_mismatch_identities`
and
`WasmtimeWorkspaceObserveTaskEnqueueError::batch_identity_mismatch_identities`
now return named borrowed identity-pair structs. The private
`PluginWorkspaceIoRequestLedger` split now returns named ledger parts. This
is an intentional public API break for the two Wasmtime enqueue mismatch
accessors; runtime behavior, queue admission, retry/discard behavior,
redaction, and operational reporting are unchanged.
- Source records updated: `docs/plugins/runtime.md`,
`docs/plugins/security.md`, `docs/plugins/testing.md`,
`src/plugin/docs.md`, and `src/plugin/refactor_notes.md`.
- Checks run for this slice so far:
- `cargo fmt --all`
- `cargo test -p alma --all-features wasmtime_observe_task_enqueue`
- `cargo test -p alma --all-features plugin::host::workspace_io::tests`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused tests, clippy, and full workspace tests emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path.
- `refactor(plugin): Name drained effect request split` closes the remaining
non-test tuple split found in the plugin boundary audit:
`DrainedPluginEffectReport::into_requests` now returns
`DrainedPluginEffectRequests` with named buffer-edit and status-message owner
batches plus the drained plugin identity. This is an intentional public API
break for the plugin effect host surface. ECS owner publication behavior,
redaction, and diagnostics are unchanged.
- Source records updated: `docs/plugins/runtime.md`,
`docs/plugins/security.md`, `docs/plugins/testing.md`,
`src/plugin/docs.md`, and `src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features drained_effect_requests_name_owner_batches_and_identity`
- `cargo test -p alma --all-features ecs::plugin::tests`
- `cargo test -p alma --all-features plugin::host::effect::tests`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused tests, clippy, and full workspace tests emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path.
- `refactor(plugin): Name owner queue failure split` extends the named-boundary
migration to the ECS paired owner-publication error:
`PluginOwnerQueueEnqueueError::into_parts` now returns
`PluginOwnerQueueEnqueueErrorParts` with named `queue_error` and
`owner_batches` fields. Runtime behavior, redaction, retry/discard behavior,
and queue admission are unchanged.
- Source records updated: `docs/plugins/runtime.md`,
`docs/plugins/security.md`, `docs/plugins/testing.md`,
`src/plugin/docs.md`, and `src/plugin/refactor_notes.md`.
- Checks run for this slice so far:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin_owner_queue`
- `cargo test -p alma --all-features scheduled_update_owner`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused tests, clippy, and full workspace tests emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path.
- `refactor(plugin): Split host import boundary modules` mechanically moves
the host-import boundary from one long file into `host/import/mod.rs`,
`snapshot.rs`, `session.rs`, `batches.rs`, `resource.rs`, `error.rs`, and
`tests.rs`. Responsibility boundaries now match the invariants already used
by the code: captured authority, active session mutation, successful-return
proofs, resource-table vocabulary, and layered rejection mapping. Runtime
behavior, capability surfaces, diagnostics, and public plugin re-exports are
unchanged.
- Source records updated: `docs/plugins/runtime.md`, `src/plugin/docs.md`, and
`src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin::host::import::tests`
- `cargo check --workspace --locked`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused test, clippy, and full workspace test emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path.
- Helen initially blocked the split because `session.rs` imported
`PluginHostImportSnapshot` through a facade re-export gated to tests and
`plugin-runtime`. The session now imports the sibling `snapshot` module
directly, and the default `cargo check --workspace --locked` path compiles.
That default check emits existing feature-gated dead-code warnings.
- Helen then passed read-only review with a P2 observation that gating the
crate-internal task-resource authority re-export was unnecessary facade
churn. The re-export is preserved; only its default-build unused-import lint
is cfg-suppressed.
- `refactor(plugin): Split workspace I/O boundary modules` mechanically moves
the workspace I/O boundary from one long file into `host/workspace_io/mod.rs`,
`batch.rs`, `error.rs`, and `tests.rs`, while preserving the existing
responsibility modules for access proofs, request budgets, reports,
observe-task results, observe-task queue mutation, and worker queue
scheduling. `WorkspaceAccessKind` moved into `access.rs` because operation
kind is part of the access-proof vocabulary. Runtime behavior, public
re-exports, capability checks, queue admission, and diagnostics are
unchanged.
- Source records updated: `src/plugin/docs.md` and
`src/plugin/refactor_notes.md`.
- Checks run for this slice so far:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin::host::workspace_io::tests`
- `cargo check --workspace --locked`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused test, default check, clippy, and full workspace test emitted the
existing `block v0.1.6` future-incompatibility warning from the tracked
Bevy/wgpu dependency path. The default check also emitted existing
feature-gated dead-code warnings.
- `refactor(plugin): Split host effect boundary modules` mechanically moves
the effect boundary from one file into `host/effect/mod.rs`, `limit.rs`,
`error.rs`, `proposal.rs`, `batch.rs`, `report.rs`, and `tests.rs`.
Responsibility boundaries now match the existing invariants: non-zero
admission limits, closed commit errors, internal effect/proposal vocabulary,
pending-to-sealed successful-return transitions, and drained/discarded owner
evidence. `PendingPluginUpdateBatch::push` is now private to the effect
boundary, so public callers use typed admission methods and cannot construct
the raw storage enum. Runtime behavior, redaction, owner publication, and
public plugin re-exports are unchanged.
- Source records updated: `docs/plugins/runtime.md`, `src/plugin/docs.md`, and
`src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin::host::effect::tests`
- `cargo check --workspace --locked`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused test, clippy, and full workspace test emitted the existing
`block v0.1.6` future-incompatibility warning from the tracked Bevy/wgpu
dependency path. The default check also emitted existing feature-gated
dead-code warnings.
- `refactor(plugin): Split trace boundary modules` mechanically moves the
trace vocabulary from one file into `trace/mod.rs`, `event.rs`, `effect.rs`,
`workspace.rs`, `proposal.rs`, `display.rs`, and `tests.rs`. Responsibility
boundaries now match the stable trace domains: event attribution and class,
drained effect/status payloads, workspace I/O and observe-task payloads,
proposal receipts, shared redacted display adapters, and replay golden tests.
Runtime behavior, public plugin re-exports, display strings, redaction, and
goldens are unchanged.
- Source records updated: `docs/plugins/runtime.md`, `src/plugin/docs.md`, and
`src/plugin/refactor_notes.md`.
- Checks run for this slice:
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin::trace::tests`
- `cargo check --workspace --locked`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused test, default check, clippy, and full workspace test emitted the
existing `block v0.1.6` future-incompatibility warning from the tracked
Bevy/wgpu dependency path. The default check also emitted existing
feature-gated dead-code warnings.
- `refactor(plugin): Split Wasmtime adapter modules` mechanically moves the
Wasmtime runtime adapter from one file into `runtime/wasmtime/mod.rs`,
`adapter.rs`, `error.rs`, `execution.rs`, `resources.rs`, `schedule.rs`,
`store.rs`, `workspace_observe.rs`, and `tests.rs`. Responsibility
boundaries now match the existing invariants: runtime/instance orchestration,
redacted error projection, guest execution deadlines, typed resource-table
reps, scheduled-update proofs, store-local host-import state, and
workspace-observe task resources. Runtime behavior, public plugin
re-exports, capability checks, queue admission, redaction, diagnostics, and
component fixtures are unchanged.
- Source records updated: `docs/plugins/runtime.md`, `src/plugin/docs.md`, and
`src/plugin/refactor_notes.md`.
- Checks run for this slice so far:
- `cargo check -p alma --features plugin-runtime`
- `cargo fmt --all`
- `cargo test -p alma --all-features plugin::runtime::wasmtime::tests`
- `cargo fmt --all --check`
- `git diff --check`
- `cargo check --workspace --locked`
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo test --workspace --all-features`
- The focused check and test emitted the existing `block v0.1.6`
future-incompatibility warning from the tracked Bevy/wgpu dependency path.
The default locked check also emitted existing feature-gated dead-code
warnings.
## Recommended Next Slice
- Reassess before designing the real loaded-plugin owner loop that integrates
scheduled update, paired owner publication, bounded observe-task execution,
and workspace I/O execution.
- If staying mechanical, reassess `runtime/wasmtime/tests.rs` before editing.
The next split should be by reusable fixture responsibility, not by line
count.