fix(dispatcher): pin control metadata repair and cover strict provider contract #359

Merged

karsten merged 3 commits from fix/dispatch-control-contract into main

2026-11-12 12:29:56 +00:00

karsten commented

2026-11-12 10:59:33 +00:00

Owner

Depends on Plugins PR harness/plugins#93 (311395c082072b2b51245f2496cf886aa762e9fe). Please retain normal CI/review gates; do not merge integration before the plugin fix is reviewed.

Changes

Pin Plugins commit 311395c082072b2b51245f2496cf886aa762e9fe; dispatcher-plugin.ts SHA256 0e81f2d95ae25fc33bea6043e753451cac6dbe175caebcd0a13137a1c46cc335. All other source hashes unchanged.
Test minimal requestId controls and exact 12-field strict-provider payload through getJsonSchemaToolParameters and validateToolArguments.
Verify meaningful steering/authority extras, worker sessions, foreign conversation and foreign execution remain rejected before store mutation.

Verification

On current main (6a96812) plus this change: normal npm run build and npm run typecheck pass; scripts/test-targeted.mjs test/dispatcher*.test.ts passes 143/143 with checked-in pin (no local override).
Prior full-suite log: 1946 pass, 2 fail, 1 skip. Both failures reproduced on unchanged baseline: api-credential unsafe-directory fixture depends on umask (0077 masks 0755 to safe 0700; passes with 022); plugin-assets provenance ENOENT disappears after normal plugins:assets build. Candidate rerun of both files with normal prerequisites and umask022: 11/11 pass. No TypeSafe tests re-run; no runtime changes or restart.

Source changes do not activate runtime. Main must use native lifecycle after gated integration.

Depends on Plugins PR https://git.vanillacore.net/harness/plugins/pulls/93 (311395c082072b2b51245f2496cf886aa762e9fe). Please retain normal CI/review gates; do not merge integration before the plugin fix is reviewed. ## Changes - Pin Plugins commit 311395c082072b2b51245f2496cf886aa762e9fe; dispatcher-plugin.ts SHA256 0e81f2d95ae25fc33bea6043e753451cac6dbe175caebcd0a13137a1c46cc335. All other source hashes unchanged. - Test minimal requestId controls and exact 12-field strict-provider payload through getJsonSchemaToolParameters and validateToolArguments. - Verify meaningful steering/authority extras, worker sessions, foreign conversation and foreign execution remain rejected before store mutation. ## Verification On current main (6a96812) plus this change: normal npm run build and npm run typecheck pass; scripts/test-targeted.mjs test/dispatcher*.test.ts passes 143/143 with checked-in pin (no local override). Prior full-suite log: 1946 pass, 2 fail, 1 skip. Both failures reproduced on unchanged baseline: api-credential unsafe-directory fixture depends on umask (0077 masks 0755 to safe 0700; passes with 022); plugin-assets provenance ENOENT disappears after normal plugins:assets build. Candidate rerun of both files with normal prerequisites and umask022: 11/11 pass. No TypeSafe tests re-run; no runtime changes or restart. Source changes do not activate runtime. Main must use native lifecycle after gated integration.

karsten added 1 commit

2026-11-12 10:59:33 +00:00