registry: verify service api_version against entrypoint source #191

New issue

Closed

opened 2026-09-08 02:03:11 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:11 +00:00

Owner

Registry P0 compatibility hardening.

validate_service_entrypoint() statically verifies published service name/version agreement but does not verify the registry api_version against literal PluginMetadata(api_version=...) or a canonical module API-version constant. Runtime compatibility catches loaded mismatches later, leaving the fast registry validator with a false-green.

Acceptance:

deterministic RED for a service entrypoint whose source declares a different API version than plugins.json;
accept literal metadata API versions and canonical API_VERSION / plugin-scoped *_API_VERSION constants;
fail closed when source API version cannot be verified;
preserve existing name/version checks;
focused registry tests, full compatibility/Nix/package gates, exact-head protected merge.

Registry P0 compatibility hardening. `validate_service_entrypoint()` statically verifies published service name/version agreement but does not verify the registry `api_version` against literal `PluginMetadata(api_version=...)` or a canonical module API-version constant. Runtime compatibility catches loaded mismatches later, leaving the fast registry validator with a false-green. Acceptance: - deterministic RED for a service entrypoint whose source declares a different API version than `plugins.json`; - accept literal metadata API versions and canonical `API_VERSION` / plugin-scoped `*_API_VERSION` constants; - fail closed when source API version cannot be verified; - preserve existing name/version checks; - focused registry tests, full compatibility/Nix/package gates, exact-head protected merge.

nsaspy closed this issue

2026-09-08 02:03:11 +00:00

nsaspy referenced this issue from a pull request that will close it,

2026-09-08 02:19:39 +00:00

coding: fail closed on changing dirty-state evidence #385