[antoinetoussaint-byte]

Closes #66. Supersedes #67 (see below).

Summary

ResolveNetworkInstance took eligibility from whatever workspace FindWorkspaceUp found above the process. A composed module run from its own checkout, a released tag resolved into CODEFLY_MODULE_CACHE, or a solution's tag finds its producer's workspace.codefly.yaml first. That file says nothing about the composition the process runs in:

• module-saas-starter declares the module as saas-starter in saas-starter-dev, not saas, so every query failed with cannot find module <saas>. Services that resolve their own endpoint at boot exited, which is why no released host above 0.0.93 boots.
• robin, annotations, documents, model and runtime declare the same module name as platform-core does. Their producers' workspaces were trusted: selection ran against the producer's declarations, and in local the native address was derived from the producer's workspace name (review probe: port 43292 instead of the composition's 42032).
• core-solutions' solutions import their platform by release. Loading that workspace fails (requires host resolution) before any carrier is read.

The rule (internal/enclosing, used by every reader that falls back to the workspace on disk):

• With CODEFLY__WORKSPACE injected: a found workspace counts only if its file declares that name. A workspace with another name is never loaded; only its name is decoded. Core's EnvironmentVariableManager.SetIdentity sets this variable for every agent-run service, and the booted processes carried CODEFLY__WORKSPACE=platform-core.
• With nothing injected: no composition started the process (a local tool, a plain go test or go run; codefly run and codefly test both inject it), so the workspace found is the only one there is and is used as found. That is today's behaviour, held by TestAProcessNoCompositionStartedUsesTheWorkspaceAsFound. A plain codefly run at a composition root injects the root's own name, so it matches.
• The name is compared exactly as written, so a name that differs only in case does not count.
• A workspace file that does not decode cannot name itself, so under an injected composition it does not count and the injected carrier still answers. When no carrier was injected either, the refusal (endpoint, configuration fallback, fixture lookup) carries the file's decode error, because that file may have been the composition's own. With nothing injected, the decode error is returned as before.
• A workspace that counts must also carry the queried module, by core's Workspace.Member. Modules composed through workspaces: or solutions: count, and the native address is computed under the composition's name.
• Anything else is answered as a workspace-free process is: from the injected carrier. An absent carrier returns ErrEndpointCarrierAbsent; a malformed one is refused as malformed. When a counted workspace does not carry the module (a typo at a composition root), the refusal still names the modules it does carry: does not compose module <x>, present: [...].

The same rule now decides the other workspace readers:

• the local configuration and secret files behind Configuration / Secret;
• the packages fixture.Selected().Principal resolves;
• the name codefly.Workspace reports when no identity is injected. That name is now read from the file without composing it, so a local tool under a solution's tag gets its name rather than a composition error.

The container-context note in the issue is a different defect, and main already fixes it. v0.3.1 refused a workspace-free process in local or unset environments with ErrNoDeclaredEndpoints behind its deployed() gate. #62 removed that gate. Putting the gate back fails TestDeployedProcessResolvesItsCarrierWithoutAWorkspace, TestDeployedProcessRefusesAnAbsentCarrierWithTheSentinel and TestLocalProcessWithoutAWorkspaceRefusesAMalformedCarrier.

Docs changed:

• README.md: endpoint resolution, the composition rule, the other readers.
• AGENTS.md: the "deployed process has no workspace" rule, and the fixture/ row, which pointed at a file that moved. AGENTS.md was 205 lines on main, failing TestAgentContextRootStaysWithinItsBudget since fix(workcontext)!: core's verifier is not re-exported; a verifier's keys come from an admitted endpoint, on the host's literal transport rule #53. It is now 200: the coverage-gate table duplicated the dual-module-change skill's "Coverage, which is two different gates", so it became a pointer to the skill.
• scripts/allowed-imports.txt gains root github.com/codefly-dev/sdk-go/internal/enclosing. The deny-by-default gate refuses the new internal import without it. It is this module's own package and imports only core resources.

Why not #67. #67 makes the earlier one-line decision with a hand-rolled name loop. It also truncates workcontext/AGENTS.md from 422 lines to 7. #67 should be closed.

Fix or hack

Fix, at the owner of endpoint resolution. Which composition a process runs in comes from what the runtime injects, and membership comes from core's own predicate; neither is a second implementation. The AGENTS.md and allowlist changes are documentation and gate bookkeeping, not behaviour.

Test plan

• go test ./... and (cd workcontext && go test ./...)
• go test -race ./... and (cd workcontext && go test -race ./...)
• golangci-lint run in each module (0 issues)
• go mod tidy clean in each module; scripts/check-one-implementation.sh ok

endpoint_foreign_workspace_test.go covers four layouts:

• a module checkout;
• a module-cache tag;
• a same-name producer tag (F1);
• a solution tag importing its platform by release (F2).

Each layout first asserts what trusting its workspace would do: refuse the module, carry it under the producer's name, or fail to load. The cases then run across environments local, unset and production, carriers from runtime and embedded sources, and every reference form. Every case resolves the carrier, refuses an absent one with the sentinel, refuses a malformed one as malformed, and never reads the producer's configuration files.

endpoint_composition_root_test.go covers a root (platform-obin) that imports platform-core through workspaces: and adds wiki through solutions:, with the composition injected and with nothing injected (F3, F4):

• selection judges both modules first (a private endpoint is refused even with a carrier present);
• the native address is computed under the root's name;
• a typo's refusal names the carried modules.

Also: TestFixturePrincipalReadsOnlyTheInjectedComposition and TestWorkspaceNamesAWorkspaceOnlyTheCLICanCompose (F5). The pre-existing TestEndpointResolutionFallsBackToDeterministicLocalWorkspace now requires the instance before dereferencing it (F6). The shared test helpers clear any ambient CODEFLY__WORKSPACE.

Mutations, each run against the whole root module and fixture, with no panics:

mutation	failing tests
ignore the injected name	the 4 foreign-workspace endpoint/config tests and the fixture test (same-name and solution-tag layouts)
trust the found workspace (main's behaviour)	the 3 foreign-workspace endpoint tests and the typo-diagnostic test
carries rejects members composed from another workspace	both composition-root selection tests
carries always false	15 tests, now all reported (F6)
drop the present-modules diagnostic	TestACompositionRootNamesWhatItCarriesWhenAModuleIsUnknown
fixture reads the found workspace	TestFixturePrincipalReadsOnlyTheInjectedComposition
Workspace() composes the file	TestWorkspaceNamesAWorkspaceOnlyTheCLICanCompose
configuration reads the found workspace	TestAComposedModuleUnderItsOwnWorkspaceReadsNoProducerConfiguration
compare the name case-insensitively	TestACompositionRootCountsOnlyUnderTheExactInjectedName
load an undecodable file anyway	TestAnUndecodableWorkspaceFileIsReportedNotTrusted
drop the decode error from the refusal	TestAnUndecodableWorkspaceFileIsReportedNotTrusted

Local end-to-end proof (local override, no release)

The setup:

• released CLI 0.1.185;
• obin-ai/platform-core main b095b29, which pins saas 0.0.94;
• codefly-dev/module-saas-starter v0.0.94 (9f6a4aa);
• run as codefly run service frontend --fixture dev-admin --headless --runtime-context native, each run under its own --naming-scope.

The SDK comes from an uncommitted code/go.work (use . <sdk-go checkout>) in each Go service; the go-grpc agent honours a source-owned code/go.work, not one at the repository root. accounts/code/fixtures/seed.go moved to fixture.Selected() locally (see below).

run	saas resolved from	sdk-go	result
checkout	codefly.local.yaml resolve.saas.path: <v0.0.94 checkout>/module	de65fa9	telemetry, accounts, auth-gateway, frontend Running; frontend ✓ Ready, GET / 200; accounts JWKS 200
module cache	…/module-cache/codefly-dev/module-saas-starter/v0.0.94/module	de65fa9	telemetry, accounts, auth-gateway, frontend Running
checkout	same as the first row	a1885cc (previous head)	Running, the same as the first row
checkout	same as the first row	main 1ce8b27	telemetry: Codefly collector gRPC endpoint is unavailable: cannot find module <saas> in <saas-starter-dev>, present: [saas-starter], run exit 1 (the reviewer reproduced this too)

On de65fa9, telemetry and accounts ran with:

• CODEFLY__WORKSPACE=platform-core and CODEFLY__MODULE=saas;
• their working directory under the checkout whose workspace.codefly.yaml is name: saas-starter-dev;
• dep github.com/codefly-dev/sdk-go (devel).

Telemetry logged OpenTelemetry collector listening on Codefly gRPC endpoint …. Accounts logged fixtures applied fixture=dev-admin, then its gRPC, REST, module-authority and Connect servers started.

The host needs one change to build on this SDK, regardless of this PR. #65 moved the fixture API, so module/services/accounts/code/fixtures/seed.go:185 must change codefly.Fixture() to fixture.Selected().

Not verified

• The same-name producer and solution-tag layouts end to end. Neither is in the frontend's dependency closure, so this boot does not exercise them; they are covered by the unit tests and mutations above.
• Container runtime context, end to end. It fails before any SDK code runs. The go-grpc agent 0.1.54's container build does not mount a module-cache service's source directory, so go mod download fails with chdir to cwd (…/services/telemetry/code) … no such file or directory. That belongs to the go-grpc agent / CLI container runner.
• The receipts Postgres store tests skipped locally (no CODEFLY_TEST_POSTGRES_DSN); CI runs them.
• No deployed (Kubernetes) environment was exercised. That path is unchanged: no workspace is on disk there.

🤖 Generated with Claude Code