Merge delivery/through-the-composition-interface: Codex's follow-ups after the #1128 squash

Brings in ba15066 (native host federation), efb61fd (pre-start admission of
selected workloads) and eee37c1 (hop routes through composition
configuration; authority at cac1f6b). 625e66f's tree is the squash 672416b,
so only those three commits' changes are merged.

Conflicts are resolved keeping both sets of fixes:
- One composition connection per run (compositionHost) instead of the
  per-attempt CloseTransport.
- A ready delivery builds its frontend before the delivery lock. Admission
  builds nothing and keeps the payload already published.
- nativeHostServices uses the fail-closed HostImplements.
- NativeWorkload.Declared/DeferFrontend and the runtime-start seam are kept,
  now that admission consumes them.
- The admission tests name the host's delivery endpoint.
- All three authority libraries are pinned at cac1f6b.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: antoinetoussaint-byte

AGENTS.md

@@ -8,7 +8,7 @@
 
 - **Module:** `github.com/codefly-dev/cli`
 - **Repository:** `https://github.com/codefly-dev/cli`
-- **Language:** Go 1.27.2 (`go.mod` is the source of truth — see [Bump the Go version](docs/runbooks/bump-go-version.md))
+- **Language:** Go 1.27.3 (`go.mod` is the source of truth — see [Bump the Go version](docs/runbooks/bump-go-version.md))
 
 The CLI is the primary interface for codefly. It orchestrates agent lifecycles, manages the
 daemon, runs services with their dependency graphs, and exposes an MCP server for AI tool

cmd/doctor_federation_test.go

@@ -0,0 +1,47 @@
+package cmd
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/codefly-dev/cli/pkg/environments"
+	"github.com/codefly-dev/core/resources"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDoctorReportsNativeFederationWithoutRequestingAFile(t *testing.T) {
+	workspace := testWorkspaceYAML + `environments:
+    - name: local
+      host:
+          coordinate: owner/local/host
+          component: backend
+          domain: owner
+          audience: host
+          trust_domain: host.local
+          delivery: backend/api/grpc
+`
+	for _, delivery := range []string{"backend/api/grpc", "other/api/grpc"} {
+		t.Run(delivery, func(t *testing.T) {
+			dir := singleServiceWorkspace(t, strings.ReplaceAll(workspace, "backend/api/grpc", delivery), []string{"federation"}, nil)
+			report := runReadiness(t, workspaceReadinessOptions{dir: dir})
+			if delivery == "other/api/grpc" {
+				requireCode(t, report, codeConfigurationMissing, "fail")
+				return
+			}
+			requireNoCode(t, report, codeConfigurationMissing)
+			requireNoCode(t, report, codeConfigurationDirMissing)
+			require.Contains(t, reportJSON(t, report), "container runs and deployments still require authored federation")
+		})
+	}
+}
+
+func TestDoctorNativeFederationDoesNotCoverAnotherConsumer(t *testing.T) {
+	host := &resources.Service{Name: "api", WorkspaceConfigurationDependencies: []string{"federation"}}
+	host.WithModule("backend")
+	other := &resources.Service{Name: "worker", WorkspaceConfigurationDependencies: []string{"federation"}}
+	other.WithModule("backend")
+	env := &environments.Environment{Host: &environments.EnvironmentHost{Coordinate: "owner/local/host", Domain: "owner", Delivery: "backend/api/grpc"}}
+	require.True(t, nativeFederationCoversScope(env, []*resources.Service{host}))
+	require.False(t, nativeFederationCoversScope(env, []*resources.Service{host, other}))
+	require.False(t, nativeFederationCoversScope(env, nil))
+}

cmd/doctor_workspace.go

@@ -9,6 +9,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"sort"
 	"strings"
 	"sync"
@@ -1090,6 +1091,14 @@ func checkConfigurationSources(ctx context.Context, ws *resources.Workspace, env
 	if provided != nil {
 		declared := ownConfigurationNames(wsCfgDir)
 		byName, own, composed := classifyProvidedConfigurations(provided, declared)
+		// Doctor has no selected runtime. Report native-only supply as a warning,
+		// and exempt no other service that also requires the authored group.
+		if byName[environments.FederationConfiguration] == nil && provided.Ambiguous[environments.FederationConfiguration] == nil &&
+			nativeFederationCoversScope(env, scope) {
+			required = slices.DeleteFunc(required, func(name string) bool { return name == environments.FederationConfiguration })
+			report.add("", "workspace configuration federation", "warn",
+				"derived from host for the native delivery service; container runs and deployments still require authored federation values", "")
+		}
 		reportWorkspaceConfigurationDirectory(wsCfgDir, relCfgDir, required, byName, own, report)
 		if len(composed) > 0 {
 			report.add("", "composed module configurations", "ok",
@@ -1117,6 +1126,26 @@ func checkConfigurationSources(ctx context.Context, ws *resources.Workspace, env
 	return append(toResolve, checkServiceConfigurationSources(ctx, env, profiles, profile, scope, report)...), provided
 }
 
+// nativeFederationCoversScope requires every declaring consumer to be the
+// delivery host. A generated host group never satisfies a sibling's requirement.
+func nativeFederationCoversScope(env *environments.Environment, scope []*resources.Service) bool {
+	if env == nil || env.DeclaresLocalK3d() {
+		return false
+	}
+	found := false
+	for _, service := range scope {
+		if !slices.Contains(service.WorkspaceConfigurationDependencies, environments.FederationConfiguration) {
+			continue
+		}
+		group, err := environments.NativeHostFederation(env.Host, service)
+		if err != nil || group == nil {
+			return false
+		}
+		found = true
+	}
+	return found
+}
+
 // reportWorkspaceConfigurationDirectory reports the workspace's own
 // configuration directory. Only what nobody provides — a name no module
 // ships, or one two modules disagree on — is what the directory would have to

cmd/run/artifact_cache_test.go

@@ -267,7 +267,7 @@ func TestTheDeliveryHostReceivesItsFederationSurfaceFromTheHostBlock(t *testing.
 	require.NoError(t, err)
 	require.Empty(t, groups, "a host that does not declare federation is handed none of it")
 
-	_, err = federationGroup(&environments.EnvironmentHost{Coordinate: "obin/local/dev"})
+	_, err = environments.NativeHostFederation(&environments.EnvironmentHost{Coordinate: "obin/local/dev", Delivery: "saas/accounts/rest"}, accounts)
 	require.ErrorContains(t, err, "host.domain")
 }
 

cmd/run/extend.go

@@ -72,6 +72,14 @@ func watchForExtensions(ctx context.Context, flow *orchestration.Flow, baseline
 		case <-ctx.Done():
 			return
 		case <-signals:
+			workspace, loadErr := common.LoadWorkspace(ctx)
+			if loadErr == nil {
+				loadErr = flow.CheckRoutingSnapshot(ctx, workspace)
+			}
+			if loadErr != nil {
+				cli.Warning("the running composition was not changed: %v", loadErr)
+				continue
+			}
 			if err := withdrawDroppedRoots(ctx, flow, pinned); err != nil {
 				cli.Warning("composition withdrawal is incomplete; the next SIGUSR1 retries it: %v", err)
 				continue
@@ -122,6 +130,9 @@ func withdrawDroppedRoots(ctx context.Context, flow *orchestration.Flow, pinned
 	if err != nil {
 		return fmt.Errorf("reload the workspace: %w", err)
 	}
+	if err = flow.CheckRoutingSnapshot(ctx, workspace); err != nil {
+		return err
+	}
 	roots, err := CompositionRoots(ctx, workspace)
 	if err != nil {
 		return err
@@ -155,6 +166,9 @@ func extendRunningWorkspace(ctx context.Context, flow *orchestration.Flow, basel
 	if err != nil {
 		return fmt.Errorf("reload the workspace: %w", err)
 	}
+	if err = flow.CheckRoutingSnapshot(ctx, workspace); err != nil {
+		return err
+	}
 	roots, err := CompositionRoots(ctx, workspace)
 	if err != nil {
 		return err