coulomb/hub-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add hub runtime and extension contract
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / pytest-smoke (push) Failing after 0s
Details

Browse source
This commit is contained in:
tegwick 2026-08-21 10:58:03 +02:00
parent fce19f193f
commit 7e1ec03f0c
44 changed files with 3875 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

44
docs/conformance.md Normal file
View file

@ -0,0 +1,44 @@
# Hub-extension conformance
`hub_core.conformance` is the reusable Tier 2/3 harness scaffold for contract
version 0.1.0. It drives only public HTTP ports, so a FastAPI `TestClient`, an
`httpx.Client`, or another compatible target can be used without importing the
runtime implementation.
The harness mutates its target. Run it against a disposable instance or a
dedicated test namespace:
```bash
hub-core api --host 127.0.0.1 --port 8010
hub-core conformance --base-url http://127.0.0.1:8010
hub-core conformance --base-url http://127.0.0.1:8010 --json
```
## Implemented profile
| ID | Tier | Automated evidence |
| --- | --- | --- |
| C1 | 2 | Packaged descriptor, manifest, and catalog validate against Draft 2020-12 schemas |
| C3 | 2 | Runtime health probe returns healthy |
| C4 | 2 | Repeated manifest registration is reported as a duplicate |
| C5 | 2 | Cataloged progress/interaction events are accepted; wrong-family and unknown events are rejected |
| C6 | 2 | Contract and scenario fixtures reject secret-shaped keys, credentialed database URLs, and private keys |
| C8 | 2 | Registry response propagates the request correlation identifier |
| F2 | 3 | Progress and interaction fixture events appear only in their respective projections |
| F3 | 3 | Authority fixtures appear in projections with declared rebuild sources and provenance hashes |
The projection scenario is shipped in the wheel as
`fixtures/projection-rebuild.json`. Correlation and time fields are generated
per run, allowing the harness to identify its own evidence without relying on
global row counts.
## Deliberately open checks
C2 registry resolution, C7 raw-port configuration policy, C9 dependency-aware
readiness, C10 version negotiation, F1 registry audit history, F4 `/api/v2`
consumer smokes, F5 MCP projection binding, F6 policy fail-closed behavior, F7
telemetry rejection, and F8 migration metadata isolation require ports or
absorption slices that are not part of the T04 minimal vertical. Tenant
isolation also remains open because the 0.1 runtime has no tenant identity or
authorization context yet. These gaps must not be interpreted as passing; the
harness reports only the implemented profile above.