[antoinetoussaint-byte]

This SDK now builds on Core main b81d92e6feda and host v0.0.103. accounts.Client gains a Datasources() facade beside Audit(), so a consumer connecting and calling a host-owned API source no longer imports gen/. The branch is rebased onto main after #44, and #45's uncached MintModuleWorkContext is kept.

This cannot also build against Core v0.19.5. Core 22ddde98 ("no build seal in a Work Context") removed ApprovedBuild from SealSource and deleted ErrNoApprovedBuild. v0.19.5 is not its descendant and still requires SealSource.ApprovedBuild. So WorkContextSources can satisfy one interface or the other, never both: at v0.19.5 the build fails with *WorkContextSources does not implement workcontext.SealSource (missing method ApprovedBuild). The floor is therefore Core's pseudo-version v0.19.6-0.20261018051341-b81d92e6feda. MVS never selects v0.19.5 beside it. The floor should move to the first Core tag containing 22ddde98.

Changes, classified (AGENTS.md)

All are fixes at the owner, none is a hack:

• Core floor → b81d92e6feda; WorkContextSources.ApprovedBuild removed. Core's verifier no longer asks an issuer for a build. That method's only correct "bears no execution" answer was the sentinel Core deleted, so it goes, with no local sentinel. sealed_test.go and the conformance helper stop setting the Execution Core removed from StartInput. This is the Core the v0.0.103 gateway itself requires.
• gen/ regenerated from released module-saas-starter v0.0.103 (2cb00737) through buf.gen.yaml, buf v1.73.0, protoc-gen-go v1.36.11 and protoc-gen-connect-go v1.20.0. It reproduces byte-for-byte; main's recorded 9ab36e7 tree also reproduced. SOURCE.txt records v0.0.103. Nothing in gen/ was hand-edited.
• conformance/hostgateway re-bound to v0.0.103. Host af5cef9a (starter#1120) serves the three mints on the gateway's workload endpoint only; the public endpoint answers 404. The harness now serves the real gateway through the host's own workloadListener, as a native run's workload server does. That is a fifth unexported binding, listed in the file and in the harness's AGENTS.md. Two expectations change, both stated by that host commit: accounts' Unauthenticated on the work-context mint is now 401 / ErrInvalidCredentials (was 502), and that mint no longer checks the internal token. The two operation mints still do, and the test still asserts that. moduleauthority's fake gateway and TestTheBrokerRefusesAWrongPerimeterCredential follow (the latter now exercises the operation mint). Seams.Gateway's doc now names the workload endpoint.
• accounts.Client.Datasources() covers the 10 listed RPCs, with the same shape as AuditClient. Every message, enum, enum value and oneof wrapper they reach is re-exported in accounts/types.go under its generated name, e.g. &accounts.AddSourceRequest{Config: &accounts.AddSourceRequest_Api{…}} and accounts.ApiOAuth2Config_GRANT_AUTHORIZATION_CODE. That list is complete with pooling across packages switched off, i.e. accounts names everything itself.
• CI: host-gateway-conformance installs the newer of the SDK's and the gateway's go directive. The job installed Go from the SDK's go.mod (1.27.0) under setup-go's GOTOOLCHAIN=local. Host v0.0.103's gateway requires go 1.27.2, so the job refused to build (requires go >= 1.27.2 (running go 1.27.0)). This fixes the tool that owns the step; it is not a workaround in the harness.
• internal/apiboundary now reaches oneof wrappers. A oneof field's type is an unexported interface nothing can alias. The gate used to report that interface and stop; now it walks the exported wrappers implementing it and requires each to be re-exported. A new oneof fixture proves this: disabling the change turns TestGateCatchesKnownBypasses red with isOneofThing_Choice.

Reuse, and what was deliberately not built

• datasource/ already wraps DatasourceService ergonomically. Its Invoke/Lookup mint effect IDs and classify ErrOutcomeUnknown. A second, independent client would be a second mechanism. The two are layered instead:
  • datasource's response-encoding client moves unchanged to internal/connectresponse, and both facades bind their generated client to it, so a Connect error reads the same through either.
  • Datasources() is documented as the raw contract, and datasource.Invoke/Lookup as the effect-safe way to call an operation.
• No facade for the service's other 24 RPCs (UpdateSource, SyncSource, DeleteSource, GitHub App setup, domains, delegations, triggers, reconciliation, receipt pruning).
• No change to the uncached mint (c4a25cd), apart from resolving its conflict with feat(moduleauthority): serve core's three live-authority sources to a callee's verifier #44's ErrNoHostStateToMintFor, which it now shares.

Breaking changes

• (*moduleauthority.WorkContextSources).ApprovedBuild is removed (Core removed the interface method).
• Generated symbols removed against v0.1.3, all by host af5cef9a: ModuleMintWorkContextRequest.Upstream/.Manifest and their getters; SolutionBackendBinding; SolutionRegistration.Backend; SolutionFrontendBinding.ContractVersion; SolutionRegistrationStatus_SOLUTION_REGISTRATION_STATUS_INCOMPATIBLE. No hand-written facade exposed them, and moduleauthority never sent Upstream/Manifest.
• Generated interfaces gain UpdateSource (DatasourceService) and GetRetainedSolutionFrontend (SolutionRegistryService). This breaks only implementers that don't embed Unimplemented…Handler.
• The Core floor is a pseudo-version, and a consumer pinned to Core v0.19.5 is raised past it.

Docs changed

README.md, CHANGELOG.md, AGENTS.md, .github/workflows/ci.yml, conformance/hostgateway/AGENTS.md, .claude/skills/api-boundary-triage/SKILL.md and .claude/skills/refresh-generated-api/SKILL.md.

• CHANGELOG.md also gains a v0.1.3 heading over the entries that tag already shipped (it was tagged at 14fe024 without one).
• Both skills now say go test -count=1 ./internal/apiboundary/: the gate loads code through go list, so a cached run reports the tree as it was before an edit.

Verified

• Root module (there are no others outside testdata/) at Core b81d92e6feda: go build, go vet, go test -count=1, go test -race and gofmt all clean.
• conformance/hostgateway/run.sh <host@v0.0.103> -race: 9 tests ran and passed.
• codefly-dev/solution-runtime-go main (14afd95), with this tree replacing its b7169d3 pin, resolves Core b81d92e6feda and passes go build, go vet and go test ./....
• Core v0.19.5: fails as described above, by design.
• CI on the final head: test, gen-drift and host-gateway-conformance all pass.
• b7169d3, which the force-push un-references, is still served by proxy.golang.org (.info and .zip both 200), so solution-runtime-go v0.0.15 keeps resolving.

Not verified

• The cell path: the waypoint-authenticated authenticatedWorkloadListener wraps the mints in a cell. The harness uses the native-run workloadListener.
• Datasources() against a real host. The tests use an httptest Connect server (procedure, unwrap, Connect error with ErrorInfo preserved, one subtest per method) and nothing more.
• Moving solution-runtime-go's pin to a default-branch commit. That's for after this merges.

🤖 Generated with Claude Code