docs: accept metadata-generated module SDK design

[nikstern]

Accept ADR-0176 as a design, with coherent commit tokens, bounded response semantics, scalar JSON encoding, root generation-input hashing, and explicit File entity identity. Documentation only; no SDK implementation or migration work.

Merge authorization

Final documentation corrections are published. On 2026-09-10 the user explicitly authorized merging documentation-only PRs despite unrelated workspace-test blockers. The pre-push hook was skipped for this documentation-only publication after formatting, clippy, and readability checks passed; full workspace tests failed on Postgres container startup (WaitContainer(StartupTimeout)). No runtime changes or infrastructure fixes were added. Temper proof ingestion remains denied with no matching permit policy; no successful proof registration is claimed.

Verification

Three full panel rounds and arbitration are preserved. User authorized the prepared terminal patch and targeted verification on 2026-09-10. Independent targeted verification matched the approved patch byte-for-byte and passed with no findings; historical panels retain their original reviewed commits.

Preserved verification evidence. This report distinguishes targeted checks from pending full-workspace completion.

Decisions & Tradeoffs

Decision

Keep the existing host path documented as the current implementation until migration completes.

Came up because the PR marked ADR-0099 Superseded while ADR-0157 remained Proposed.

Options: retain contradictory statuses; declare the runtime migrated; distinguish accepted replacement design from current implementation.

Chose explicit design and implementation status because approval does not implement the SDK.

Where: PR #412, docs/adrs/0099-local-wasm-tdata-host-path.md and docs/adrs/0176-metadata-generated-typed-module-data-sdk.md (originally numbered 0157).

Full-panel corrections

Decision: carry complete read tokens over the ABI, reserve acknowledgement capacity before dispatch, state the existing result-omission rule consistently, and renumber this design ADR-0176.

Came up because round one identified contradictions between the exact ABI and its guarantees, and ADR-0157 collisions on current main.

Options: weaken entity-token validation and acknowledgement guarantees; leave conflicting prose; align the concrete request, capacity reservation, and result promises.

Chose to align the concrete contract because the existing intended guarantees require those fields and reservations. No runtime implementation is added. ADR-0176 was verified unused on main aa22bf1. Interrupted execution is explicitly an unknown outcome, not a failed-write acknowledgement.

Where: PR #412, docs/adrs/0176-metadata-generated-typed-module-data-sdk.md, Sub-Decisions 4 and 8; ADR-0099 supersession link.

ABI wording completion

Decision: Use the existing pre-dispatch capacity error for response-byte exhaustion and state the scalar JSON payload shape explicitly.

Came up because round two found an undefined return for failed byte reservation and a mismatch between the named tagging mode and wire examples.

Options: add another ABI mechanism; leave the cases undefined; clarify the existing error code and object shape.

Chose the existing -3 capacity error and a named value field for scalar payloads because these complete the already-proposed contract without new capabilities or runtime code.

Where: PR #412, ADR-0176 Sub-Decision 4.

Scope constraint: This PR accepts a design. Review rounds may correct contradictions in that design; they do not authorize SDK implementation, migration tooling, broader architecture changes, or unrelated improvements.

Human-authorized terminal pass

Decision: Clarify root generation-input hashing and File-operation identity, then end the full-panel loop with targeted verification.

Came up because arbitration after three rounds identified these remaining contract inconsistencies without a need for new capabilities.

Options: continue the full-panel loop; leave the ambiguities; apply the prepared documentation patch with targeted verification.

Chose the prepared patch because the user authorized it on 2026-09-10 and reiterated no scope creep. Root compilation inputs exclude their generated outputs; File open calls identify the entity type. No runtime implementation or architecture expansion is included. Original panel records retain their reviewed commits.

Where: PR #412, ADR-0176 Sub-Decisions 1 and 4; Temper Ask en-01a08869-9373-7063-a217-271bb8a34531.

Original contributor work retained. Merge preparation: GPT-6 in Codex; terminal verification: independent Codex reviewer.

Greptile Summary

Accepts ADR-0176 as the target design for a metadata-generated typed module data SDK while explicitly retaining ADR-0099 as the current implementation pending migration.

• Defines metadata locking, generated module grants, a versioned WASM data ABI, bounded response and stream handling, commit-token consistency, and File entity identity.
• Records the ARN-477 intent, plan, specification, and design tradeoffs for this documentation-only effort.

Confidence Score: 5/5

The documentation-only PR appears safe to merge.

No blocking failures remain.

Important Files Changed

Filename	Overview
docs/adrs/0176-metadata-generated-typed-module-data-sdk.md	Accepts and comprehensively specifies the target generated SDK, host ABI, authorization, consistency, batching, File streaming, compatibility, and rollout design.
docs/adrs/0099-local-wasm-tdata-host-path.md	Marks ADR-0099 as superseded at the design level while clearly preserving it as the current implementation until migration.
docs/efforts/ARN-477/decisions.md	Records the documentation corrections and tradeoffs that finalized ADR status, ABI semantics, generation hashing, and File identity.
docs/efforts/ARN-477/intent.md	Defines the effort as design acceptance and clarification without runtime implementation or deployment.
docs/efforts/ARN-477/plan.md	Captures the documentation verification and review plan.
docs/efforts/ARN-477/spec.md	States the accepted target design and distinguishes it from the still-deployed ADR-0099 path.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    M[Locked application metadata] --> G[Generate typed module SDK and binding]
    G --> W[Compile and package WASM artifact]
    W --> V[Publication and activation verification]
    V --> H[Versioned module data host ABI]
    H --> S[Shared governed application data service]
    O[External OData adapter] --> S
    S --> A[Authorization, dispatch, persistence, projection, and audit]
    H --> F[Native File stream handles]

Loading

_{Reviews (5): Last reviewed commit: "docs: finalize SDK digest and File ident..." | Re-trigger Greptile}

[rita-aga]

Superseded by #460, the maintainer-hosted PR for the exact same head a476741. Documentation and contributor commits are unchanged; this discussion and review history remain part of ARN-477. The replacement allows required workflows to access repository secrets without exposing them to a fork.

[rita-aga]

Final review evidence under the approved arbitration decision

Original contributor commit: a476741d5724b0bc0b309df5284599ca3cc293aa. Three full rounds and arbitration are preserved in the record below. Rita approved scoped final documentation corrections and targeted final verification without a fourth full panel; the existing decision covers both #411 and #412. The final targeted Codex review has no unresolved findings. This records that decision honestly; it does not claim three reviewers ran on this final commit.

The shared workflow/validator correction is being delivered in arni-labs/stack#19 and #461. No merge is claimed here.