[antoinetoussaint-byte]

Follow-up to #1161 and codefly-dev/core#837. Also covers r46's major on #1161.

Why

proto:0.0.17 names two images: the first has the old Python facade plugin, which renders every RPC as unary, and the republished one streams. A machine that cached the first keeps it. codefly-dev/core#838 moves the companion to 0.0.18, so the streaming facade ships under a fresh tag. Core also gains a CI check that refuses an unbumped companion change.

Change

1. Core pin → core#838's head 9386c6bf (v0.19.7-0.20261025230614-9386c6bf7521). Only go get, no tidy; go.sum gains the two new lines.
2. .github/workflows/companions.yaml, verify job ("Verify embedded companion tags": daily at 06:00 and on release):
   • runs CODEFLY_GENERATE_QUALIFY=1 go test ./cmd/generate -count=1 -run '^TestGenerateClientPythonStreaming$' against the companion pulled fresh on the runner;
   • on failure, prints docker images --digests for ghcr.io/codefly-dev/proto, so the run names the image it qualified.
     A tag republished with different content passes the registry presence check before it and fails here. actionlint is clean.
3. Adaptations to core past 200e819 (core#836), which the bump brings in:
   • cmd/generate/contract_surface.go: composition.ProtobufProcedures now takes the endpoint (it also checks the endpoint's package).
   • pkg/gitops/wire_kits_test.go: core's new kit fixture roles-grant-bindings reads assistant/documents-audience and assistant/replica-audience. The kit's environment now supplies both, as documents. That fixture holds a role's spelled-out scope at the one audience that underwrites it. With two different audiences the derivation refuses it as ambiguous (I checked: role installer grants documents:read, which is underwritten at documents and model-gateway), so documents for both is the faithful value.

Order

1. Merge core#838.
2. Dispatch this repo's Companions workflow with core_ref = that merge commit, to publish proto:0.0.18.
3. Re-pin here to the merge commit if it differs (core uses merge commits, so 9386c6bf stays reachable either way).
4. Merge this.

The new verify step runs on schedule and release only, so it does not run on this PR.

Evidence

• go build ./..., go vet ./..., go test ./cmd/generate/ ./pkg/... pass locally. pkg/gitops was red on the bumped core before the kit edit and green after; it is green on main with the old core.
• Not run locally: the new verify step against 0.0.18, which is not published yet. TestGenerateClientPythonStreaming passed locally against the published 0.0.17 (sha256:46e8b398) when test(generate): a Python client streams all four RPC shapes through the companion #1161 landed.

Classification

Fix. Version discipline lives in core (#838); this repo takes the version and qualifies the published image on its standing gate. The two adaptations follow core's API change and fixture; neither works around one.

🤖 Generated with Claude Code