From 654d37d530bac068dc34b6841b2bb83410a35e5b Mon Sep 17 00:00:00 2001 From: mfw78 Date: Thu, 23 Jul 2026 14:52:48 +0000 Subject: [PATCH] docs(videre-host): note admission-check boundaries Document the opt-in precondition on admit_worker/admit_provider (a manifest omitting [venue] is admitted unconditionally) and the post-instantiation, pre-init ordering of the registry export-divergence check. --- crates/videre-host/src/handshake.rs | 6 ++++++ crates/videre-host/src/registry.rs | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/crates/videre-host/src/handshake.rs b/crates/videre-host/src/handshake.rs index a1aa23d7..2544bd49 100644 --- a/crates/videre-host/src/handshake.rs +++ b/crates/videre-host/src/handshake.rs @@ -44,6 +44,9 @@ fn parse Deserialize<'de>>(owner: &str, value: &toml::Value) -> anyh /// Admit one provider: a `[venue]` section, when present, must be the /// adapter shape with a non-empty version set. +/// +/// Opt-in: a manifest omitting `[venue]` is admitted unconditionally, an +/// intentional silent opt-out for non-venue keepers. pub(crate) fn admit_provider(provider: &str, sections: &ExtensionSections) -> anyhow::Result<()> { let Some(value) = sections.get(SECTION) else { return Ok(()); @@ -91,6 +94,9 @@ pub(crate) fn verify_exported_versions( /// `[venue] body_versions` set contains that version. Every installed /// venue is a legal runtime submit target, so one non-decoding adapter /// refuses the keeper. +/// +/// Opt-in: a manifest omitting `[venue]` is admitted unconditionally, an +/// intentional silent opt-out for non-venue keepers. pub(crate) fn admit_worker( worker: &str, sections: &ExtensionSections, diff --git a/crates/videre-host/src/registry.rs b/crates/videre-host/src/registry.rs index 88a44392..d00f5b14 100644 --- a/crates/videre-host/src/registry.rs +++ b/crates/videre-host/src/registry.rs @@ -746,6 +746,11 @@ impl ProviderKind for VenueAdapterKind { .await .map_err(anyhow::Error::from) .context("read adapter body-versions")?; + // Post-instantiation, pre-init: an export cannot be called before + // instantiating, so unlike the pre-compile manifest-section + // predicates in `supervisor.rs` a buggy or malicious adapter fully + // instantiates, running any instantiation side effects, before this + // divergence check catches the mismatch. crate::handshake::verify_exported_versions(venue_id.as_str(), &declared, exported)?; match bindings .call_init(&mut store, &config)