mlua-swarm 0.17.0

Swarm engine host built on mlua — long-running stateful runtime with Role/Verb gate, CapToken, 3-stage pipeline, and Middleware overlay.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138

//! Cross-platform AgentProvider contract: the same logical Agent and result
//! contract bind through Claude Code and Codex without platform data entering
//! the Blueprint.

use mlua_swarm::blueprint::resolve_bound_agents;
use mlua_swarm::{
    attest_bound_agents, binding_requests, AgentProviderCapability, AgentProviderManifest,
    BindingDigest, Blueprint, ManifestBindingProvider,
};

fn shared_blueprint() -> Blueprint {
    serde_json::from_value(serde_json::json!({
        "schema_version": "0.1.0",
        "id": "cross-platform-provider",
        "flow": {"kind": "seq", "children": []},
        "agents": [{
            "name": "reviewer",
            "kind": "operator",
            "spec": {"operator_ref": "main-ai"},
            "profile": {
                "system_prompt": "Review the change against the declared contract.",
                "model": "reasoning-medium"
            },
            "runner": {
                "backend": "ws_operator",
                "variant": "mse-reviewer",
                "tools": ["Read", "Grep"]
            },
            "verdict": {
                "channel": "part",
                "values": ["PASS", "BLOCKED"]
            }
        }]
    }))
    .expect("shared Blueprint must deserialize")
}

fn provider(
    provider_id: &str,
    revision: &str,
    resolved_model: &str,
    effective_tools: &[&str],
) -> ManifestBindingProvider {
    ManifestBindingProvider::new(AgentProviderManifest {
        provider_id: provider_id.to_string(),
        provider_revision: Some(revision.to_string()),
        capabilities: vec![AgentProviderCapability {
            launch_variant: Some("mse-reviewer".to_string()),
            resolved_model: Some(resolved_model.to_string()),
            effective_tools: effective_tools
                .iter()
                .map(|tool| tool.to_string())
                .collect(),
            capability_snapshot_digest: Some(BindingDigest::sha256(format!(
                "{provider_id}:{revision}"
            ))),
        }],
    })
}

#[tokio::test]
async fn claude_code_and_codex_bind_the_same_agent_contract_through_one_if() {
    let blueprint = shared_blueprint();
    let mut claude_bound = resolve_bound_agents(&blueprint).expect("resolve Claude snapshot");
    let mut codex_bound = resolve_bound_agents(&blueprint).expect("resolve Codex snapshot");

    let claude_request = binding_requests(&claude_bound);
    let codex_request = binding_requests(&codex_bound);
    assert_eq!(claude_request, codex_request);

    let claude_unbound = attest_bound_agents(
        &provider(
            "mse-provider-claude-code",
            "claude-plugin-1",
            "claude-sonnet-4",
            &["Grep", "Read", "Write"],
        ),
        &mut claude_bound,
        false,
    )
    .await
    .expect("Claude Code provider must satisfy the shared request");
    assert!(claude_unbound.is_empty());
    let codex_unbound = attest_bound_agents(
        &provider(
            "mse-provider-codex",
            "codex-plugin-1",
            "gpt-5-codex",
            &["Grep", "Read", "Shell"],
        ),
        &mut codex_bound,
        false,
    )
    .await
    .expect("Codex provider must satisfy the shared request");
    assert!(codex_unbound.is_empty());

    let claude = &claude_bound[0];
    let codex = &codex_bound[0];
    assert_eq!(claude.agent, codex.agent);
    assert_eq!(claude.agent.verdict, codex.agent.verdict);
    assert_eq!(
        claude.attestation.as_ref().unwrap().request_digest,
        codex.attestation.as_ref().unwrap().request_digest
    );
    assert_eq!(
        claude.attestation.as_ref().unwrap().provider_id,
        "mse-provider-claude-code"
    );
    assert_eq!(
        codex.attestation.as_ref().unwrap().provider_id,
        "mse-provider-codex"
    );
    assert_ne!(claude.binding_digest, codex.binding_digest);
}

#[tokio::test]
async fn either_platform_still_fails_closed_when_a_shared_tool_is_missing() {
    let blueprint = shared_blueprint();
    let mut bound = resolve_bound_agents(&blueprint).expect("resolve shared snapshot");
    // A receipt that IS present but contradicts the request (missing Grep)
    // fails even in non-strict mode — "attestation is optional, but never
    // wrong".
    let error = attest_bound_agents(
        &provider(
            "mse-provider-codex",
            "codex-plugin-1",
            "gpt-5-codex",
            &["Read"],
        ),
        &mut bound,
        false,
    )
    .await
    .expect_err("missing Grep must be rejected by common Core validation");
    assert!(error.to_string().contains("missing requested tools"));
    assert!(bound[0].attestation.is_none());
}