Repository navigation
fix(run): a binding to a module outside the run no longer stops startup - #1165
Merged
Merged
Conversation
#1158 made native admission refuse the whole run when a module's binding targets a module the run does not select ("binding runtime-admission targets runtime, which has no selected local identity workload"). A local run composes a unit and only the modules it consumes, so every module playground composing a subset (a store's playground without runtime and tracing) could not start, and excluding the configurations did not help. The run now withholds such a binding from the module's delivered manifest, in renderDelivery, so admission and every ready delivery agree: the authority's document carries no grant through it, the authority refuses a call through it by name, and the run says so ("<target> is not part of this run"). Nothing is granted in its place and no identity is declared for an unselected workload. A binding to a module the run selects but declares to no authority (the host's own) is still refused at admission, before any manifest is sent. Tests: a binding to a module outside the run is withheld at admission and on the ready delivery, every selected module is still admitted with its own workloads only, and a binding to a selected module is kept; the host case still refuses before sending (sabotage-checked: without the withholding the unselected case fails with the reported error). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…the host Review r53 of 193494a: withholding a binding to a module outside the run dropped what the local authority supports on purpose, an audience the run does not supervise (the default fixture's model stand-in, a playground's bridge to its model provider). The authority decides a binding at call time, so before #1158 such a binding was delivered and served. A binding is now delivered as declared whatever it targets. A binding to a module nothing composes grants nothing, and the authority refuses a call through it by name ("audience X is not composed"). Admission keeps #1158's refusal for exactly one target, the host's own module, which the run declares to no authority; a module selected only through services with no identity workload (a datastore) is no longer refused. The selection is read once per admission for both decisions, and a binding outside the run is reported once per module and binding, not on every start. Tests: a binding to a module outside the run, to an identity-less selected module and to a selected module is delivered unchanged, every selected module with an identity workload is admitted with its own workloads only, and the outside-the-run warning is logged exactly once across two admissions; the host binding is still refused before anything is sent. Sabotage-checked: #1158's broader refusal fails the outside and datastore cases, and dropping the once-guard fails the warning count. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
antoinetoussaint-byte
changed the title
This was referenced Oct 26, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
#1158 (c5a106e) made native admission refuse a whole run when one module's binding targets a module the run does not deliver:
A local run starts a unit plus only the modules that unit consumes. That means every module playground composing a subset could not start. The document store's playground without runtime and tracing is one example. Excluding the configurations didn't help.
The fix (revised after review r53)
Bindings are delivered as declared. This is how it worked before #1158. The local authority checks a binding when a call is made. It serves the call when the binding's target is composed, either by this run or by the fixture's stand-in for a process the run does not supervise (for example, the default fixture's
modelbridge to a model provider). When nothing composes the target, it refuses the call by name: "audience X is not composed".Startup refusal only for the host's own module. The run declares the host to no authority, so a binding to it can never be served. Admission refuses it before sending any manifest. A module selected only through services with no identity (a datastore) is no longer refused.
Warning once per binding. The run reads the selected-services list once per admission. When a binding targets a module outside the run, the run logs a warning that names the target and the authority's call-time refusal. It logs it once per (module, binding), not on every start.
Security: nothing is granted by the run. Only selected workloads get identities. A binding to a target that nothing composes grants nothing, and there is no fallback to a broader identity.
The first revision (193494a) dropped such bindings from the delivered manifest instead. That lost fixture stand-in targets, so this revision replaces it.
Classification: fix at the owner, the launcher's admission check. The authority is unchanged.
Tests
TestAdmissionDeliversBindingsOutsideTheRunAsDeclared, with three targets: outside the run (missing), a selected module with no identity (store), and a selected module (beta).alphaandbetaare admitted, each with its own workload.TestAdmissionRefusesBindingToHostBeforeSending: a binding to the host is still refused before anything is sent.missingandstorecases.Commands run locally:
go vet ./cmd/run/: cleango test -race -count=1 ./cmd/run/: okgolangci-lint run ./cmd/run/...: 0 issues (local v2.15.0; CI pins v2.14.0)Not verified: a live playground run against a local authority with a fixture stand-in.
🤖 Generated with Claude Code