feat(accounts): serve the published host interfaces as adapters — rung 1, with the gap list

.github/workflows/ci.yml

@@ -457,6 +457,8 @@ jobs:
         run: codefly generate contracts saas-starter --check
       - name: Check derived source operations
         run: codefly generate runnables saas-starter --check
+      - name: Check generated libraries are reproducible with the pinned CLI
+        run: bash scripts/ci/check-generated-libraries.sh
 
   module-package:
     name: Immutable module package

AGENTS.md

@@ -184,6 +184,9 @@ Skills in `.claude/skills/`, loaded when the task calls for them:
 
 ## Building, testing, and CI
 
+- CI and local runtime qualification use released Codefly CLI **v0.1.215**,
+  pinned in `scripts/ci/install-codefly.sh`. It resolves the Codefly-owned
+  `egress` dependency and exports the multi-package host-interface contract.
 - Canonical **service** gate: `codefly ci run`. It owns lint, compile/typecheck,
   tests, dependency/vuln audit, SBOM, and container build for every service in
   the graph. See [RELEASE_GATES.md](./RELEASE_GATES.md).

configuration_defaults_test.go

@@ -120,9 +120,22 @@ func moduleDefaultFiles(group string) []string {
 			names = append(names, name)
 		}
 	}
+	// A document group (read with WorkspaceConfigurationDocument) is one YAML
+	// document, <group>.yaml, which is how Codefly reads a configuration
+	// document; its default is a document that states at least one key.
+	name := group + ".yaml"
+	if data, err := os.ReadFile(filepath.Join(moduleConfigLocalDir, name)); err == nil && statesADocument(data) {
+		names = append(names, name)
+	}
 	return names
 }
 
+// statesADocument reports whether data is one YAML mapping with at least one key.
+func statesADocument(data []byte) bool {
+	var document map[string]any
+	return yaml.Unmarshal(data, &document) == nil && len(document) > 0
+}
+
 // repoRootMirrorsModule verifies the repo-root entry for name is a symlink that
 // resolves to the module default of the same name. shipsDefault(workspace, …)
 // alone is too weak: os.ReadFile follows the link, so it also passes a symlink
@@ -234,11 +247,12 @@ func assertSecretDefaultIsPlaceholder(t *testing.T, name string) {
 
 func TestEveryDeclaredGroupShipsALocalDefault(t *testing.T) {
 	for _, group := range declaredWorkspaceConfigGroups(t) {
-		// CLI supplies this group per native run. An authored path (even an
-		// empty placeholder) conflicts with its render-owned declaration.
-		if group == "artifact-cache" {
+		// The CLI supplies these groups: artifact-cache per native run, egress
+		// from the environment's egress declaration. An authored path (even an
+		// empty placeholder) conflicts with its CLI-owned declaration.
+		if group == "artifact-cache" || group == "egress" {
 			for _, directory := range []string{moduleConfigLocalDir, workspaceConfigLocalDir} {
-				for _, suffix := range []string{".env", ".secret.env"} {
+				for _, suffix := range []string{".env", ".secret.env", ".yaml"} {
 					path := filepath.Join(directory, group+suffix)
 					if _, err := os.Lstat(path); !os.IsNotExist(err) {
 						t.Errorf("CLI-owned group %s must have no authored default at %s", group, path)
@@ -250,7 +264,7 @@ func TestEveryDeclaredGroupShipsALocalDefault(t *testing.T) {
 		// The base-synced location is what a base-synced consumer inherits.
 		moduleDefaults := moduleDefaultFiles(group)
 		if len(moduleDefaults) == 0 {
-			t.Errorf("declared config group %q has no default under the base-synced module subtree: add a %s/%s.env (or .secret.env) that assigns at least one variable, so a base-synced solution inherits it instead of dying at runtime-init with \"no configuration found for %s\"",
+			t.Errorf("declared config group %q has no default under the base-synced module subtree: add a %s/%s.env (or .secret.env, or a .yaml document) that assigns at least one variable, so a base-synced solution inherits it instead of dying at runtime-init with \"no configuration found for %s\"",
 				group, moduleConfigLocalDir, group, group)
 		}
 		// Each module default this group ships must be mirrored by a repo-root

configurations/local/fixture-grants.yaml

@@ -0,0 +1 @@
+../../module/configurations/local/fixture-grants.yaml

go.mod

@@ -1,9 +1,9 @@
 module github.com/codefly-dev/agents/modules/saas-starter
 
-go 1.27.0
+go 1.27.3
 
 require (
-	github.com/codefly-dev/core v0.18.0
+	github.com/codefly-dev/core v0.19.7-0.20261025161440-4e7f8ef01ed2
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -16,20 +16,20 @@ require (
 	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/go-openapi/analysis v1.0.0 // indirect
-	github.com/go-openapi/errors v0.22.8 // indirect
+	github.com/go-openapi/errors v0.22.9 // indirect
 	github.com/go-openapi/jsonpointer v1.0.1 // indirect
 	github.com/go-openapi/jsonreference v1.0.2 // indirect
 	github.com/go-openapi/loads v0.25.3 // indirect
 	github.com/go-openapi/spec v1.0.1 // indirect
 	github.com/go-openapi/strfmt v0.27.2 // indirect
-	github.com/go-openapi/swag/conv v0.29.1 // indirect
-	github.com/go-openapi/swag/jsonutils v0.29.1 // indirect
-	github.com/go-openapi/swag/loading v0.29.1 // indirect
-	github.com/go-openapi/swag/mangling v0.29.1 // indirect
-	github.com/go-openapi/swag/pools v0.29.1 // indirect
-	github.com/go-openapi/swag/stringutils v0.29.1 // indirect
-	github.com/go-openapi/swag/typeutils v0.29.1 // indirect
-	github.com/go-openapi/swag/yamlutils v0.29.1 // indirect
+	github.com/go-openapi/swag/conv v0.29.2 // indirect
+	github.com/go-openapi/swag/jsonutils v0.29.2 // indirect
+	github.com/go-openapi/swag/loading v0.29.2 // indirect
+	github.com/go-openapi/swag/mangling v0.29.2 // indirect
+	github.com/go-openapi/swag/pools v0.29.2 // indirect
+	github.com/go-openapi/swag/stringutils v0.29.2 // indirect
+	github.com/go-openapi/swag/typeutils v0.29.2 // indirect
+	github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@@ -41,14 +41,14 @@ require (
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/yoheimuta/go-protoparser/v4 v4.14.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/exp v0.0.0-20260820142414-ca536658362e // indirect
+	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
 	golang.org/x/net v0.60.0 // indirect
-	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/term v0.46.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect
-	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
+	google.golang.org/grpc v1.84.0 // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 )