docs: accept metadata-generated module SDK design - #458
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| ScalarV1 = | ||
| Boolean(bool) | ||
| | Int64(i64) | ||
| | Double(f64) |
There was a problem hiding this comment.
Double(f64) does not define finite-only validation even though the ABI requires JSON encoding. Generated callers can construct NaN or infinity, which JSON cannot represent, so implementations could reject otherwise type-correct requests or encode them differently. Please specify that doubles must be finite and add this case to the scalar conformance requirements.
Knowledge Base Used: WebAssembly capability system
Prompt To Fix With AI
This is a comment left during a code review.
Path: docs/adrs/0176-metadata-generated-typed-module-data-sdk.md
Line: 284
Comment:
**Non-Finite Doubles Undefined**
`Double(f64)` does not define finite-only validation even though the ABI requires JSON encoding. Generated callers can construct `NaN` or infinity, which JSON cannot represent, so implementations could reject otherwise type-correct requests or encode them differently. Please specify that doubles must be finite and add this case to the scalar conformance requirements.
**Knowledge Base Used:** [WebAssembly capability system](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/wasm-capability-system.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
| file_operations = ["metadata_read", "version_read", "content_read"] | ||
|
|
||
| [wasm_modules.data.budgets] | ||
| max_calls = 32 |
There was a problem hiding this comment.
max_calls has no defined accounting unit for batches. Because a batch crosses the ABI once but executes many operations, production and simulation could charge either one call or one call per item. This can allow hidden fan-out or inconsistent budget enforcement. Please define whether each batch item consumes this budget and align that rule with the operation-budget language in Sub-Decision 10.
Knowledge Base Used: WebAssembly capability system
Prompt To Fix With AI
This is a comment left during a code review.
Path: docs/adrs/0176-metadata-generated-typed-module-data-sdk.md
Line: 167
Comment:
**Batch Call Accounting Undefined**
`max_calls` has no defined accounting unit for batches. Because a batch crosses the ABI once but executes many operations, production and simulation could charge either one call or one call per item. This can allow hidden fan-out or inconsistent budget enforcement. Please define whether each batch item consumes this budget and align that rule with the operation-budget language in Sub-Decision 10.
**Knowledge Base Used:** [WebAssembly capability system](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/wasm-capability-system.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.2 participants
Replaces fork PR #412 (STACK_TOKEN gates require in-repo branch).
Accept ADR-0176 as a design, with coherent commit tokens, bounded response semantics, scalar JSON encoding, root generation-input hashing, and explicit File entity identity. Documentation only; no SDK implementation or migration work.
Merge authorization
Final documentation corrections are published. On 2026-09-10 the user explicitly authorized merging documentation-only PRs despite unrelated workspace-test blockers. The pre-push hook was skipped for this documentation-only publication after formatting, clippy, and readability checks passed; full workspace tests failed on Postgres container startup (
WaitContainer(StartupTimeout)). No runtime changes or infrastructure fixes were added. Temper proof ingestion remains denied withno matching permit policy; no successful proof registration is claimed.Verification
Three full panel rounds and arbitration are preserved. User authorized the prepared terminal patch and targeted verification on 2026-09-10. Independent targeted verification matched the approved patch byte-for-byte and passed with no findings; historical panels retain their original reviewed commits.
Preserved verification evidence. This report distinguishes targeted checks from pending full-workspace completion.
Decisions & Tradeoffs
No decisions
Decision
Keep the existing host path documented as the current implementation until migration completes.
Came up because the PR marked ADR-0099 Superseded while ADR-0157 remained Proposed.
Options: retain contradictory statuses; declare the runtime migrated; distinguish accepted replacement design from current implementation.
Chose explicit design and implementation status because approval does not implement the SDK.
Where: PR #412, docs/adrs/0099-local-wasm-tdata-host-path.md and docs/adrs/0176-metadata-generated-typed-module-data-sdk.md (originally numbered 0157).
Full-panel corrections
Decision: carry complete read tokens over the ABI, reserve acknowledgement capacity before dispatch, state the existing result-omission rule consistently, and renumber this design ADR-0176.
Came up because round one identified contradictions between the exact ABI and its guarantees, and ADR-0157 collisions on current main.
Options: weaken entity-token validation and acknowledgement guarantees; leave conflicting prose; align the concrete request, capacity reservation, and result promises.
Chose to align the concrete contract because the existing intended guarantees require those fields and reservations. No runtime implementation is added. ADR-0176 was verified unused on main aa22bf1. Interrupted execution is explicitly an unknown outcome, not a failed-write acknowledgement.
Where: PR #412, docs/adrs/0176-metadata-generated-typed-module-data-sdk.md, Sub-Decisions 4 and 8; ADR-0099 supersession link.
ABI wording completion
Decision: Use the existing pre-dispatch capacity error for response-byte exhaustion and state the scalar JSON payload shape explicitly.
Came up because round two found an undefined return for failed byte reservation and a mismatch between the named tagging mode and wire examples.
Options: add another ABI mechanism; leave the cases undefined; clarify the existing error code and object shape.
Chose the existing
-3capacity error and a namedvaluefield for scalar payloads because these complete the already-proposed contract without new capabilities or runtime code.Where: PR #412, ADR-0176 Sub-Decision 4.
Scope constraint: This PR accepts a design. Review rounds may correct contradictions in that design; they do not authorize SDK implementation, migration tooling, broader architecture changes, or unrelated improvements.
Human-authorized terminal pass
Decision: Clarify root generation-input hashing and File-operation identity, then end the full-panel loop with targeted verification.
Came up because arbitration after three rounds identified these remaining contract inconsistencies without a need for new capabilities.
Options: continue the full-panel loop; leave the ambiguities; apply the prepared documentation patch with targeted verification.
Chose the prepared patch because the user authorized it on 2026-09-10 and reiterated no scope creep. Root compilation inputs exclude their generated outputs; File open calls identify the entity type. No runtime implementation or architecture expansion is included. Original panel records retain their reviewed commits.
Where: PR #412, ADR-0176 Sub-Decisions 1 and 4; Temper Ask en-01a08869-9373-7063-a217-271bb8a34531.
Original contributor work retained. Merge preparation: GPT-6 in Codex; terminal verification: independent Codex reviewer.
Greptile Summary
Accepts ADR-0176 as the target design for a metadata-generated, typed module-data SDK while retaining ADR-0099 as the deployed implementation pending migration.
max_calls.Confidence Score: 4/5
The documentation is safe to merge after considering two non-blocking contract clarifications for scalar encoding and batch budget accounting.
The design consistently separates acceptance from implementation and preserves the current host path, but two independently actionable ambiguities could otherwise produce divergent future SDK and host implementations.
Files Needing Attention: docs/adrs/0176-metadata-generated-typed-module-data-sdk.md
Important Files Changed
Flowchart
%%{init: {'theme': 'neutral'}}%% flowchart LR Metadata[Canonical CSDL, IOA, capabilities] --> Lock[Immutable dependency lock] Lock --> Manifest[Module SDK manifest and grant] Manifest --> SDK[Generated typed SDK] SDK --> WASM[Bound WASM artifact] WASM --> ABI[Versioned data host ABI] ABI --> Authority[Host authority and capability gate] Authority --> Service[Shared governed data service] OData[External OData adapter] --> Service Service --> Runtime[Actor, persistence, projection, and File paths]Prompt To Fix All With AI
Reviews (1): Last reviewed commit: "docs: finalize SDK digest and File ident..." | Re-trigger Greptile
Context used: