diff --git a/crates/temper-authz/src/context.rs b/crates/temper-authz/src/context.rs index 36eb26f5d..086d8c52b 100644 --- a/crates/temper-authz/src/context.rs +++ b/crates/temper-authz/src/context.rs @@ -250,7 +250,7 @@ impl SecurityContext { self } - /// Attach ADR-0040 action-context provenance to the principal entity. + /// Attach ADR-0161 action-context provenance to the principal entity. /// /// Cedar policies can then match on `principal.action_context`, for /// example `principal.action_context == "composite:Apps.Fork"`. diff --git a/crates/temper-jit/src/table/builder.rs b/crates/temper-jit/src/table/builder.rs index bf48afc67..ed42ab2c5 100644 --- a/crates/temper-jit/src/table/builder.rs +++ b/crates/temper-jit/src/table/builder.rs @@ -75,7 +75,7 @@ impl TransitionTable { .push(i); } - // ADR-0045 / ADR-0047: collect per-state-variable overflow metadata. + // ADR-0166 / ADR-0047: collect per-state-variable overflow metadata. let mut state_var_metadata = std::collections::BTreeMap::new(); for sv in &automaton.state { if sv.overflow_inline_max_bytes.is_some() || sv.overflow_ttl_seconds.is_some() { diff --git a/crates/temper-jit/src/table/types.rs b/crates/temper-jit/src/table/types.rs index e18fe1ffe..bce557416 100644 --- a/crates/temper-jit/src/table/types.rs +++ b/crates/temper-jit/src/table/types.rs @@ -57,12 +57,12 @@ pub struct TransitionTable { /// kNN reads (`Temper.Nearest`). Empty when the spec declared no `[[vector]]`. #[serde(default)] pub vectors: Vec, - /// Per-state-variable metadata for platform primitives (ADR-0045, ADR-0047). + /// Per-state-variable metadata for platform primitives (ADR-0166, ADR-0047). /// Keyed by state-variable name. Empty map when the IOA spec did not /// declare any per-field overrides. #[serde(default)] pub state_var_metadata: BTreeMap, - /// Composite-action metadata keyed by action name (ADR-0040). + /// Composite-action metadata keyed by action name (ADR-0161). #[serde(default)] pub composite_actions: BTreeMap, /// Pre-built index: action name → indices into `rules`. @@ -77,14 +77,14 @@ pub struct TransitionTable { /// Platform-primitive metadata for a single state variable. /// -/// - `overflow_inline_max_bytes` (ADR-0045): serialized-byte ceiling above +/// - `overflow_inline_max_bytes` (ADR-0166): serialized-byte ceiling above /// which the value is moved to the content-addressed blob store. `None` /// falls back to the crate-wide `DEFAULT_FIELD_INLINE_MAX` (128KB). /// - `overflow_ttl_seconds` (ADR-0047): TTL for overflow blobs written on /// behalf of this field. `None` = permanent (pre-ADR behavior). #[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)] pub struct StateVarMetadata { - /// Per-field inline byte ceiling for field overflow (ADR-0045). + /// Per-field inline byte ceiling for field overflow (ADR-0166). #[serde(default, skip_serializing_if = "Option::is_none")] pub overflow_inline_max_bytes: Option, /// Per-field TTL in seconds for overflow blobs (ADR-0047). diff --git a/crates/temper-platform/src/bearer_auth.rs b/crates/temper-platform/src/bearer_auth.rs index ea5ce2b2c..45b7ec05e 100644 --- a/crates/temper-platform/src/bearer_auth.rs +++ b/crates/temper-platform/src/bearer_auth.rs @@ -74,7 +74,7 @@ pub async fn bearer_auth_check( .as_ref() .is_some_and(|expected| constant_time_eq(token.as_bytes(), expected.as_bytes())); - // ADR-0043 guest override path: internal loopback callers may present the + // ADR-0165 guest override path: internal loopback callers may present the // platform API key while explicitly declaring the principal they are acting // as. Preserve those headers instead of collapsing the request into the // bootstrapped operator credential. diff --git a/crates/temper-server/src/blobs.rs b/crates/temper-server/src/blobs.rs index 5939ef1a9..9591dc68d 100644 --- a/crates/temper-server/src/blobs.rs +++ b/crates/temper-server/src/blobs.rs @@ -127,7 +127,7 @@ pub(crate) async fn hydrate_blob_refs_in_value(store: &BlobStore, value: &mut Va /// `BTreeMap` of blob keys to bytes for refs at or above the ceiling (the /// "deferred" set). Callers that hand `value` off to a WASM guest forward /// the deferred map as `blob_cache` so guests can resolve oversize fields -/// via `host_read_field_stream`. See ADR-0046. +/// via `host_read_field_stream`. See ADR-0169. #[cfg(test)] pub(crate) async fn hydrate_blob_refs_in_value_with_ceiling( store: &BlobStore, @@ -365,7 +365,7 @@ mod tests { /// End-to-end: ceiling-aware hydration inlines small blob refs and defers /// large ones into the returned map. This is the WASM-dispatch path from - /// ADR-0046. + /// ADR-0169. #[tokio::test] async fn hydrate_with_ceiling_inlines_small_and_defers_large() { let (store, _dir) = open_store().await; @@ -425,7 +425,7 @@ mod tests { /// Per-field `overflow_inline_max_bytes` in the spec overrides the mode /// default. Declaring a 1024-byte ceiling forces a 4KB field into the /// overflow path even though the default 128KB ceiling would keep it - /// inline. ADR-0045 Phase 4b. + /// inline. ADR-0166 Phase 4b. #[tokio::test] async fn per_field_inline_max_override_forces_overflow() { use crate::entity_actor::effects::sync_fields_with_metadata; diff --git a/crates/temper-server/src/entity_actor/actor.rs b/crates/temper-server/src/entity_actor/actor.rs index cbf46c9a7..c598e9e98 100644 --- a/crates/temper-server/src/entity_actor/actor.rs +++ b/crates/temper-server/src/entity_actor/actor.rs @@ -641,7 +641,7 @@ impl EntityActor { // action already persisted the blob, INSERT OR IGNORE // is a no-op. If the prior server died between emitting // the event and persisting the blob, this is the - // recovery path. See ADR-0040, ADR-0045. + // recovery path. See ADR-0040, ADR-0166. if !overflow_blobs.is_empty() && let Err(e) = Self::persist_overflow_blobs(blob_store, &overflow_blobs).await @@ -948,7 +948,7 @@ impl Actor for EntityActor { return Ok(()); } - // Captured BEFORE the action applies. The retry path (ADR-0046) + // Captured BEFORE the action applies. The retry path (ADR-0168) // updates these in lockstep with replay so postconditions hold // across the race window. let mut event_count_before = state.total_event_count; @@ -956,7 +956,7 @@ impl Actor for EntityActor { let field_sync_mode = Self::field_sync_mode_for_backend(self.event_backend, self.blob_store.as_ref()); - // `result` and `event` are `mut` so that a successful ADR-0046 + // `result` and `event` are `mut` so that a successful ADR-0168 // retry can replace them with values re-evaluated against the // caught-up state. The downstream telemetry and reply use // whichever pair last succeeded in persist. @@ -1000,7 +1000,7 @@ impl Actor for EntityActor { } // Persist to Postgres (if configured). On - // `ConcurrencyViolation` enter the ADR-0046 retry cycle — + // `ConcurrencyViolation` enter the ADR-0168 retry cycle — // replay events, re-evaluate the action against the caught-up // state, and retry the persist up to two more times. Other // error variants fail immediately (same as before). @@ -1019,7 +1019,7 @@ impl Actor for EntityActor { expected: _, actual, }) => { - // ADR-0046 Sub-Decision 3: dedicated APM span + // ADR-0168 Sub-Decision 3: dedicated APM span // covering the retry cycle. `attempts` and // `outcome` are recorded at the end so Datadog // APM can filter and chart conflict-handling @@ -1039,17 +1039,17 @@ impl Actor for EntityActor { entity = %state.entity_id, action = %name, actual_seq = actual, - "persist hit optimistic-concurrency violation; entering ADR-0046 retry" + "persist hit optimistic-concurrency violation; entering ADR-0168 retry" ); - // 2 retries + 1 initial = 3 total attempts (ADR-0046). + // 2 retries + 1 initial = 3 total attempts (ADR-0168). const MAX_RETRIES: u32 = 2; let mut retry_idx: u32 = 0; let mut retry_final: Option<( crate::runtime_metrics::ConcurrencyRetryOutcome, Option, )> = None; - // ADR-0046 Sub-Decision 4: track the most + // ADR-0168 Sub-Decision 4: track the most // recent authoritative sequence across retries // so the post-replay assertion catches a // divergent replay even on a multi-conflict @@ -1077,7 +1077,7 @@ impl Actor for EntityActor { ) .await?; - // ADR-0046 Sub-Decision 4: replay must at + // ADR-0168 Sub-Decision 4: replay must at // minimum reach the sequence the store // reported. Reaching further is fine (a // later writer may have appended during @@ -1150,7 +1150,7 @@ impl Actor for EntityActor { tokio::time::sleep(std::time::Duration::from_millis( backoff_ms, )) - .await; // determinism-ok: rare retry backoff (ADR-0046) + .await; // determinism-ok: rare retry backoff (ADR-0168) match self .persist_event( @@ -1218,7 +1218,7 @@ impl Actor for EntityActor { // 1-based; `retry_idx` counts completed retries. let total_attempts = u64::from(1 + retry_idx); if let Some((outcome, err_msg)) = retry_final { - // Close the ADR-0046 APM span with the + // Close the ADR-0168 APM span with the // final attempt count + outcome so APM // views can filter by either. retry_span.record("attempts", total_attempts); diff --git a/crates/temper-server/src/entity_actor/effects.rs b/crates/temper-server/src/entity_actor/effects.rs index 1dd7aac5f..f4c36b862 100644 --- a/crates/temper-server/src/entity_actor/effects.rs +++ b/crates/temper-server/src/entity_actor/effects.rs @@ -730,7 +730,7 @@ pub fn apply_new_state_fallback(state: &mut EntityState, from_status: &str, new_ /// rest of `entity_state` (counters, booleans, lists, other fields) while /// covering p99 of observed oversize-field traffic. /// -/// See ADR-0045. +/// See ADR-0166. pub const DEFAULT_FIELD_INLINE_MAX: usize = 131_072; // 128 KB /// Sync all state variables into the `fields` JSON object. @@ -740,7 +740,7 @@ pub const DEFAULT_FIELD_INLINE_MAX: usize = 131_072; // 128 KB /// the effective per-field inline ceiling are either truncated or projected /// through blob refs, depending on `mode`. When `state_var_metadata` is /// `Some`, per-field `overflow_inline_max_bytes` and `overflow_ttl_seconds` -/// overrides are consulted (ADR-0045, ADR-0047). +/// overrides are consulted (ADR-0166, ADR-0047). pub fn sync_fields( state: &mut EntityState, params: &serde_json::Value, @@ -1782,7 +1782,7 @@ params = ["NewCommitSha"] #[test] fn field_over_legacy_32k_stays_inline_under_new_ceiling() { - // Regression test for ADR-0045: fields in the 32KB-128KB band that + // Regression test for ADR-0166: fields in the 32KB-128KB band that // previously overflowed now stay inline. let mut state = make_state("Session", "s-1"); let mid = "z".repeat(80 * 1024); // 80 KB — above old 32KB cap, below new 128KB diff --git a/crates/temper-server/src/runtime_metrics.rs b/crates/temper-server/src/runtime_metrics.rs index c56d5476d..f6f5d1c08 100644 --- a/crates/temper-server/src/runtime_metrics.rs +++ b/crates/temper-server/src/runtime_metrics.rs @@ -137,7 +137,7 @@ fn metrics() -> &'static RuntimeMetrics { .with_description( "WASM integration dispatches that fell back to the default timeout because the \ spec did not set `timeout_secs`. Apps firing this frequently should wire an \ - explicit timeout in their integration config. See ADR-0045.", + explicit timeout in their integration config. See ADR-0167.", ) .build(), entity_concurrency_retry_total: meter @@ -146,7 +146,7 @@ fn metrics() -> &'static RuntimeMetrics { "Entity-actor persist attempts that hit an optimistic concurrency conflict \ and either recovered, exhausted the retry budget, or found the action no \ longer legal after replay. Treat sustained activity as a canary for an \ - unknown scheduler race — not a retry budget to raise. See ADR-0046.", + unknown scheduler race — not a retry budget to raise. See ADR-0168.", ) .build(), entity_concurrency_retry_attempts: meter @@ -154,7 +154,7 @@ fn metrics() -> &'static RuntimeMetrics { .with_description( "Number of persist attempts a single action consumed before success or \ exhaustion. Value of 1 is the no-retry happy path; anything higher is a \ - canary. See ADR-0046.", + canary. See ADR-0168.", ) .build(), dispatch_ask_attempts: meter @@ -522,7 +522,7 @@ pub fn record_process_resident_memory_bytes(bytes: u64) { /// Record a WASM integration dispatch that fell back to the default timeout /// because the integration spec did not set `timeout_secs`. /// -/// See ADR-0045. +/// See ADR-0167. pub fn record_wasm_default_timeout_used(tenant: &str, entity_type: &str, module: &str) { metrics().wasm_integration_default_timeout_used_total.add( 1, @@ -536,7 +536,7 @@ pub fn record_wasm_default_timeout_used(tenant: &str, entity_type: &str, module: /// Possible outcomes for an entity-actor concurrency retry cycle. /// -/// See ADR-0046. +/// See ADR-0168. #[derive(Debug, Clone, Copy)] pub enum ConcurrencyRetryOutcome { /// The action persisted successfully (possibly after one or more retries). @@ -562,7 +562,7 @@ impl ConcurrencyRetryOutcome { /// Record the outcome of an entity-actor concurrency retry cycle plus the /// number of attempts consumed. Attempts is 1-based (1 = no retries). /// -/// See ADR-0046. +/// See ADR-0168. pub fn record_entity_concurrency_retry( entity_type: &str, outcome: ConcurrencyRetryOutcome, diff --git a/crates/temper-server/src/state/dispatch/wasm.rs b/crates/temper-server/src/state/dispatch/wasm.rs index 708869e1f..e524e5594 100644 --- a/crates/temper-server/src/state/dispatch/wasm.rs +++ b/crates/temper-server/src/state/dispatch/wasm.rs @@ -548,7 +548,7 @@ impl crate::state::ServerState { .integration_config .insert("temper_api_url".to_string(), api_url); } - // ADR-0046: inline-hydrate blob refs below the 128KB ceiling; defer + // ADR-0169: inline-hydrate blob refs below the 128KB ceiling; defer // oversize refs into a blob_cache the WASM guest can read via // host_read_field_stream. No-op on tenants without a Turso store. let blob_cache = instrument_wasm_dispatch_phase( @@ -608,7 +608,7 @@ impl crate::state::ServerState { // // When no explicit `timeout_secs` is configured, fall back to the // platform default (`WasmResourceLimits::default().max_duration`, 120s - // per ADR-0045). The fallback is observable: + // per ADR-0167). The fallback is observable: // - `tracing::warn!` for human debugging // - counter `temper_wasm_integration_default_timeout_used_total` for alerting // - span attribute `wasm.timeout_source = default` for APM correlation diff --git a/crates/temper-server/tests/dst_concurrency_retry.rs b/crates/temper-server/tests/dst_concurrency_retry.rs index e527ddc60..d68d1b43f 100644 --- a/crates/temper-server/tests/dst_concurrency_retry.rs +++ b/crates/temper-server/tests/dst_concurrency_retry.rs @@ -1,4 +1,4 @@ -//! DST tests for the ADR-0046 optimistic-concurrency retry path. +//! DST tests for the ADR-0168 optimistic-concurrency retry path. //! //! Uses `SimEventStore::inject_concurrency_violations` to deterministically //! queue `ConcurrencyViolation` errors on specific append calls, then verifies @@ -8,7 +8,7 @@ //! 2. Violations for every attempt → retry budget exhausts cleanly and the //! caller sees a distinct error. //! -//! These tests cover ADR-0046 Rollout Phase 0 "DST race test" follow-up. +//! These tests cover ADR-0168 Rollout Phase 0 "DST race test" follow-up. use std::collections::BTreeMap; use std::sync::{Arc, RwLock}; @@ -201,7 +201,7 @@ async fn dst_retry_exhausts_under_sustained_violation() { // // The single-violation success path should hold across many seeds. This // catches any hidden wall-clock ordering assumption and is the DST "race -// coverage" ask from ADR-0046 Rollout Phase 0. +// coverage" ask from ADR-0168 Rollout Phase 0. #[tokio::test] async fn dst_retry_succeeds_after_one_violation_many_seeds() { for seed in 0..25u64 { diff --git a/crates/temper-spec/src/automaton/toml_parser/mod.rs b/crates/temper-spec/src/automaton/toml_parser/mod.rs index d1511ed96..5f9f9cd82 100644 --- a/crates/temper-spec/src/automaton/toml_parser/mod.rs +++ b/crates/temper-spec/src/automaton/toml_parser/mod.rs @@ -39,7 +39,7 @@ enum Section { /// skips the body; triggers are extracted via serde in the second pass /// and merged into their action by name. ActionTrigger, - /// ADR-0040: nested composite-action metadata blocks. Hand-rolled parser + /// ADR-0161: nested composite-action metadata blocks. Hand-rolled parser /// skips the body; metadata is extracted via serde in the second pass. CompositeActionMetadata, } @@ -191,7 +191,7 @@ impl ParseState { "name" => state_var.name = value.to_string(), "type" => state_var.var_type = value.to_string(), "initial" => state_var.initial = value.to_string(), - // ADR-0045 / ADR-0047: per-field overflow knobs. + // ADR-0166 / ADR-0047: per-field overflow knobs. "overflow_inline_max_bytes" => { if let Ok(v) = value.parse::() { state_var.overflow_inline_max_bytes = Some(v); @@ -521,7 +521,7 @@ struct ParsedCompositeActionMetadata { } /// Extract nested `[[action.cedar_gate]]` and `[[action.sub_writes]]` -/// sections via serde (ADR-0040). +/// sections via serde (ADR-0161). fn extract_action_composite_metadata( source: &str, ) -> Result, AutomatonParseError> diff --git a/crates/temper-spec/src/automaton/types.rs b/crates/temper-spec/src/automaton/types.rs index 34cf56049..b484c9ed7 100644 --- a/crates/temper-spec/src/automaton/types.rs +++ b/crates/temper-spec/src/automaton/types.rs @@ -127,7 +127,7 @@ pub struct StateVar { /// Initial value (as a string, parsed by type). pub initial: String, /// Optional per-field inline ceiling in bytes for the field-overflow - /// primitive (ADR-0045). Values above this size are moved to the blob + /// primitive (ADR-0166). Values above this size are moved to the blob /// store; values at or below stay inline in `fields`. When `None`, the /// crate-wide `DEFAULT_FIELD_INLINE_MAX` applies. #[serde(default, skip_serializing_if = "Option::is_none")] @@ -220,10 +220,10 @@ pub struct Action { /// source). Kind-specific fields are validated at parse time. #[serde(default, rename = "triggers")] pub triggers: Vec, - /// Composite-action Cedar gate declaration (ADR-0040). + /// Composite-action Cedar gate declaration (ADR-0161). #[serde(default, skip_serializing_if = "Option::is_none")] pub cedar_gate: Option, - /// Declared sub-write contract for Composite actions (ADR-0040). + /// Declared sub-write contract for Composite actions (ADR-0161). #[serde(default, rename = "sub_writes")] pub sub_writes: Vec, } diff --git a/crates/temper-store-postgres/migrations/0003_published_artifacts.sql b/crates/temper-store-postgres/migrations/0003_published_artifacts.sql index c1f3942ec..6a84308a3 100644 --- a/crates/temper-store-postgres/migrations/0003_published_artifacts.sql +++ b/crates/temper-store-postgres/migrations/0003_published_artifacts.sql @@ -1,6 +1,6 @@ -- 0003_published_artifacts.sql -- --- Persist ADR-0082 generic PublishedArtifact metadata on the canonical +-- Persist ADR-0173 generic PublishedArtifact metadata on the canonical -- Postgres storage backend. The table is a rebuildable read model for public -- artifact provenance; application entities remain the publication authority. diff --git a/crates/temper-wasm-sdk/src/context.rs b/crates/temper-wasm-sdk/src/context.rs index 7af7a30a3..ad5b5fbe0 100644 --- a/crates/temper-wasm-sdk/src/context.rs +++ b/crates/temper-wasm-sdk/src/context.rs @@ -39,7 +39,7 @@ pub struct SubWrite { pub params: Value, } -/// Builder for ADR-0040 Composite action integration results. +/// Builder for ADR-0161 Composite action integration results. /// /// The builder only produces the `sub_writes` data envelope. The WASM module /// does not dispatch actions; it returns this data from a spec-declared @@ -671,7 +671,7 @@ impl Context { /// for blob-ref fields the return bytes are the original decoded payload; /// for other JSON values the return bytes are the JSON serialization. /// - /// See ADR-0046. + /// See ADR-0169. pub fn read_field_bytes(&self, field_name: &str) -> Result, String> { // Probe with a zero-length buffer to get the required size. let needed = unsafe { diff --git a/crates/temper-wasm-sdk/src/host.rs b/crates/temper-wasm-sdk/src/host.rs index 0457d27f9..2c63fab31 100644 --- a/crates/temper-wasm-sdk/src/host.rs +++ b/crates/temper-wasm-sdk/src/host.rs @@ -146,7 +146,7 @@ unsafe extern "C" { /// blob-ref envelopes. Returns bytes written, needed size if > buf_len, /// -1 if field not found, -2 if blob ref pre-fetch missing, -3 on error. /// - /// See ADR-0046. + /// See ADR-0169. pub fn host_read_field( field_name_ptr: i32, field_name_len: i32, diff --git a/crates/temper-wasm/src/engine/host_functions.rs b/crates/temper-wasm/src/engine/host_functions.rs index abe0d711b..86f3e8a43 100644 --- a/crates/temper-wasm/src/engine/host_functions.rs +++ b/crates/temper-wasm/src/engine/host_functions.rs @@ -232,7 +232,7 @@ struct HostHttpBatchResponse { /// Resolve an entity-state field against the invocation context JSON and the /// per-invocation blob cache. Plain strings come back as UTF-8 bytes (unquoted); -/// blob-ref envelopes come back as the decoded blob payload. See ADR-0046. +/// blob-ref envelopes come back as the decoded blob payload. See ADR-0169. pub(crate) fn resolve_field_bytes( context_json: &str, blob_cache: &BTreeMap>, @@ -1307,7 +1307,7 @@ pub(super) fn link_host_functions(linker: &mut Linker) -> Result<(), // -2 — field is a blob ref; pre-fetch did not populate blob_cache. // -3 — generic host error (memory access, JSON parse). // - // See ADR-0046. + // See ADR-0169. linker .func_wrap( "env", diff --git a/crates/temper-wasm/src/engine/mod.rs b/crates/temper-wasm/src/engine/mod.rs index 63a5a359b..6dac9151c 100644 --- a/crates/temper-wasm/src/engine/mod.rs +++ b/crates/temper-wasm/src/engine/mod.rs @@ -189,7 +189,7 @@ pub(crate) struct HostState { /// `context_json`. Populated by the dispatcher before the invocation /// enters the blocking WASM thread, so `host_read_field_stream` can resolve /// blob refs synchronously. Keyed by blob key (e.g. - /// `field-overflow/sha256/.json`). See ADR-0046. + /// `field-overflow/sha256/.json`). See ADR-0169. pub(crate) blob_cache: BTreeMap>, /// Guest-created observability spans scoped to this invocation. pub(crate) guest_spans: GuestSpanRegistry, @@ -343,7 +343,7 @@ impl WasmEngine { } /// Invoke a cached WASM module with pre-fetched blob-ref bytes available to - /// the guest via `host_read_field_stream`. See ADR-0046. + /// the guest via `host_read_field_stream`. See ADR-0169. /// /// `blob_cache` maps blob keys (e.g. `field-overflow/sha256/.json`) to /// their decoded bytes. Keys correspond to oversize blob refs present in diff --git a/crates/temper-wasm/src/engine/tests.rs b/crates/temper-wasm/src/engine/tests.rs index 8cf060639..acb15a05c 100644 --- a/crates/temper-wasm/src/engine/tests.rs +++ b/crates/temper-wasm/src/engine/tests.rs @@ -232,7 +232,7 @@ fn resource_limits_default() { let limits = WasmResourceLimits::default(); assert_eq!(limits.max_fuel, 1_000_000_000); assert_eq!(limits.max_memory, 64 * 1024 * 1024); - // ADR-0045: raised from 30s to cover HTTP-fronted integrations under load. + // ADR-0167: raised from 30s to cover HTTP-fronted integrations under load. assert_eq!(limits.max_duration, std::time::Duration::from_secs(120)); assert_eq!(limits.max_response_bytes, 1024 * 1024); } diff --git a/crates/temper-wasm/src/host_trait.rs b/crates/temper-wasm/src/host_trait.rs index 9851b398b..b3990ead1 100644 --- a/crates/temper-wasm/src/host_trait.rs +++ b/crates/temper-wasm/src/host_trait.rs @@ -468,7 +468,7 @@ impl ProductionWasmHost { /// Create with pre-loaded secrets and default HTTP timeout. /// /// The default timeout matches `WasmResourceLimits::default().max_duration` - /// (120s per ADR-0045). + /// (120s per ADR-0167). pub fn new(secrets: BTreeMap) -> Self { Self::with_timeout(secrets, crate::WasmResourceLimits::default().max_duration) } @@ -883,7 +883,7 @@ impl WasmHost for ProductionWasmHost { })?; let status = resp.status().as_u16(); - // Loud auth failure logging for internal API calls (ADR-0043). + // Loud auth failure logging for internal API calls (ADR-0165). if is_internal && (status == 401 || status == 403) { let (module, agent) = self .invocation_context diff --git a/crates/temper-wasm/src/types.rs b/crates/temper-wasm/src/types.rs index 54c2c43b0..9e4f86bee 100644 --- a/crates/temper-wasm/src/types.rs +++ b/crates/temper-wasm/src/types.rs @@ -115,7 +115,7 @@ pub struct WasmResourceLimits { pub max_memory: usize, /// Maximum execution duration. Default: 120 seconds. /// - /// Raised from 30s in ADR-0045 to cover HTTP-fronted integrations under load. + /// Raised from 30s in ADR-0167 to cover HTTP-fronted integrations under load. pub max_duration: std::time::Duration, /// Maximum HTTP response body size. Default: 1 MB. pub max_response_bytes: usize, @@ -313,7 +313,7 @@ mod tests { let limits = WasmResourceLimits::default(); assert_eq!(limits.max_fuel, 1_000_000_000); assert_eq!(limits.max_memory, 64 * 1024 * 1024); - // ADR-0045: raised from 30s to cover HTTP-fronted integrations under load. + // ADR-0167: raised from 30s to cover HTTP-fronted integrations under load. assert_eq!(limits.max_duration, std::time::Duration::from_secs(120)); assert_eq!(limits.max_response_bytes, 1024 * 1024); } diff --git a/docs/adrs/0047-blob-ttl-and-sweep.md b/docs/adrs/0047-blob-ttl-and-sweep.md index 533fb6070..7187992ae 100644 --- a/docs/adrs/0047-blob-ttl-and-sweep.md +++ b/docs/adrs/0047-blob-ttl-and-sweep.md @@ -6,14 +6,14 @@ - Supersedes: — - Related: - ADR-0040: Blob-Backed Overflow for Large Entity Field Values - - ADR-0045: Field-Overflow Inline Ceiling - - ADR-0046: WASM Host Function for Blob-Ref Field Reads + - ADR-0166: Field-Overflow Inline Ceiling + - ADR-0169: WASM Host Function for Blob-Ref Field Reads - `crates/temper-store-turso/src/schema.rs` (blobs table) - `crates/temper-store-turso/src/store/blobs.rs` (`put_blob`, new `put_blob_with_ttl`, `sweep_expired_blobs`) ## Context -ADR-0040 introduced content-addressed overflow blobs for oversize entity fields. ADR-0045 raised the inline ceiling to 128KB. ADR-0046 plumbed blob-ref bytes into the WASM invocation context. The combined system is functionally correct but has no lifecycle policy — every blob written to `field-overflow/sha256/...` lives forever. +ADR-0040 introduced content-addressed overflow blobs for oversize entity fields. ADR-0166 raised the inline ceiling to 128KB. ADR-0169 plumbed blob-ref bytes into the WASM invocation context. The combined system is functionally correct but has no lifecycle policy — every blob written to `field-overflow/sha256/...` lives forever. The growth model is "one row per unique large value". Content-addressed dedupe helps, but across a paw-agent deployment that processes many distinct large payloads (judge inputs, tool-call dumps, web_fetch results once Phase 5 migrates off File entities), the `blobs` table grows without bound. Long-running production tenants already see multi-GB blob tables in practice. diff --git a/docs/adrs/0048-dispatch-retry-and-error-taxonomy.md b/docs/adrs/0048-dispatch-retry-and-error-taxonomy.md index 7461960f8..2b44b4cf5 100644 --- a/docs/adrs/0048-dispatch-retry-and-error-taxonomy.md +++ b/docs/adrs/0048-dispatch-retry-and-error-taxonomy.md @@ -4,7 +4,7 @@ - Date: 2026-04-17 - Deciders: Temper core maintainers - Related: - - ADR-0046: Optimistic-concurrency retry (pattern reference; different scope) + - ADR-0168: Optimistic-concurrency retry (pattern reference; different scope) - ADR-0028: Memory-bounded lazy hydration and passivation (interaction with cold-start latency) - `crates/temper-server/src/state/dispatch/actions.rs` (primary change site) - `crates/temper-runtime/src/actor/actor_ref.rs` @@ -22,7 +22,7 @@ Two production incidents on 2026-04-17 demonstrate the hole this leaves: The production evidence is unambiguous: callers already retry; the retry logic just lives in the wrong place, gets rewritten per call-site, and leaks as 500s to end users before anyone catches it. -ADR-0046 added optimistic-concurrency retry *inside* the actor for persistence conflicts. That pattern is correct; this ADR applies the same shape *outside* the actor, for reaching the actor. +ADR-0168 added optimistic-concurrency retry *inside* the actor for persistence conflicts. That pattern is correct; this ADR applies the same shape *outside* the actor, for reaching the actor. ## Decision diff --git a/docs/adrs/0051-admission-control-in-dispatch.md b/docs/adrs/0051-admission-control-in-dispatch.md index 283af73c1..f39fac3e6 100644 --- a/docs/adrs/0051-admission-control-in-dispatch.md +++ b/docs/adrs/0051-admission-control-in-dispatch.md @@ -4,8 +4,8 @@ - Date: 2026-04-17 - Deciders: Temper core maintainers - Related: - - ADR-0033 (tenant-database-isolation.md): tenant model this ADR reuses - - ADR-0045 (wasm-default-timeout.md): module-specific gate precedent + - ADR-0160 (tenant-database-isolation.md): tenant model this ADR reuses + - ADR-0167 (wasm-default-timeout.md): module-specific gate precedent - ADR-0048: Dispatch retry (runs after admission grants) - `crates/temper-server/src/state/mod.rs:217` (existing per-tenant entity index) - `crates/temper-server/src/state/admission.rs` (new) diff --git a/docs/adrs/0058-query-plane-hot-field-opt-out-and-stable-projections.md b/docs/adrs/0058-query-plane-hot-field-opt-out-and-stable-projections.md index 0bd88b1f1..ccc73f5c5 100644 --- a/docs/adrs/0058-query-plane-hot-field-opt-out-and-stable-projections.md +++ b/docs/adrs/0058-query-plane-hot-field-opt-out-and-stable-projections.md @@ -4,7 +4,7 @@ - Date: 2026-04-24 - Deciders: Temper core maintainers - Related: - - ADR-0046: Optimistic concurrency retry + - ADR-0168: Optimistic concurrency retry - ADR-0056: Durable state timeouts and silent-exit prevention - openpaw ADR-0026: durable query plane and bounded actor residency - `crates/temper-spec/src/automaton/types.rs` diff --git a/docs/adrs/0060-bounded-warm-restart-and-digest-aware-app-reconcile.md b/docs/adrs/0060-bounded-warm-restart-and-digest-aware-app-reconcile.md index 30e1cd8ac..787633f97 100644 --- a/docs/adrs/0060-bounded-warm-restart-and-digest-aware-app-reconcile.md +++ b/docs/adrs/0060-bounded-warm-restart-and-digest-aware-app-reconcile.md @@ -5,9 +5,9 @@ - Deciders: Temper core maintainers - Related: - ADR-0027: OS App Catalog - - ADR-0032: Platform Store Trait and Sim Platform DST + - ADR-0158: Platform Store Trait and Sim Platform DST - ADR-0048: Dispatch Retry and Error Taxonomy - - ADR-0057: Native Immutable File Read Plane for TemperFS + - ADR-0170: Native Immutable File Read Plane for TemperFS - `crates/temper-platform/src/os_apps/mod.rs` - `crates/temper-server/src/platform_store.rs` - `crates/temper-store-turso/src/store/specs.rs` diff --git a/docs/adrs/0061-agent-context-read-consumer-contract.md b/docs/adrs/0061-agent-context-read-consumer-contract.md index a52cf95bf..e02666641 100644 --- a/docs/adrs/0061-agent-context-read-consumer-contract.md +++ b/docs/adrs/0061-agent-context-read-consumer-contract.md @@ -5,13 +5,13 @@ - Deciders: Temper core maintainers - Related: - ADR-0029: TemperFS - A Governed File System on Temper Primitives - - ADR-0057: Native Immutable File Read Plane for TemperFS + - ADR-0170: Native Immutable File Read Plane for TemperFS - `crates/temper-server/src/api/files.rs` - `crates/temper-server/src/state/file_reads.rs` ## Context -ADR-0057 added the native TemperFS read plane for content-heavy consumers: +ADR-0170 added the native TemperFS read plane for content-heavy consumers: - `POST /api/files/read-text-batch` for current `File` head reads - `POST /api/files/read-version-text-batch` for immutable `FileVersion` reads @@ -39,7 +39,7 @@ The intended contract is: ## Consequences -- Platform work from ADR-0057 remains the single clean read primitive for agent +- Platform work from ADR-0170 remains the single clean read primitive for agent context prep and future filesystem-shaped consumers. - OpenPaw regressions can be detected by checking whether the active context preparation module uses batch current-file/version reads rather than a serial diff --git a/docs/adrs/0062-delta-os-app-reconcile-and-wasm-artifacts.md b/docs/adrs/0062-delta-os-app-reconcile-and-wasm-artifacts.md index 772bf4ae9..461f5ae4c 100644 --- a/docs/adrs/0062-delta-os-app-reconcile-and-wasm-artifacts.md +++ b/docs/adrs/0062-delta-os-app-reconcile-and-wasm-artifacts.md @@ -6,8 +6,8 @@ - Related: - ADR-0027: OS App Catalog - ADR-0029: Temper Filesystem - - ADR-0032: Platform Store Trait and Sim Platform DST - - ADR-0057: Native Immutable File Read Plane + - ADR-0158: Platform Store Trait and Sim Platform DST + - ADR-0170: Native Immutable File Read Plane - ADR-0060: Bounded Warm Restart and Digest-Aware App Reconcile - `crates/temper-platform/src/os_apps/reconcile.rs` - `crates/temper-platform/src/os_apps/mod.rs` diff --git a/docs/adrs/0065-postgres-platform-store-and-canonical-schema.md b/docs/adrs/0065-postgres-platform-store-and-canonical-schema.md index 46628f029..89c56dd21 100644 --- a/docs/adrs/0065-postgres-platform-store-and-canonical-schema.md +++ b/docs/adrs/0065-postgres-platform-store-and-canonical-schema.md @@ -4,7 +4,7 @@ - Date: 2026-04-28 - Deciders: Temper core maintainers - Related: - - ADR-0033: Multi-tenant isolation + - ADR-0160: Multi-tenant isolation - ADR-0058: Query-plane hot field opt-out and stable projections - ADR-0063: Object store for blob bytes - `crates/temper-store-postgres` diff --git a/docs/adrs/0069-http-endpoint.md b/docs/adrs/0069-http-endpoint.md index 5d5772a87..1cb4e3c56 100644 --- a/docs/adrs/0069-http-endpoint.md +++ b/docs/adrs/0069-http-endpoint.md @@ -6,7 +6,7 @@ - Related: - ADR-0002: wasm-integration-for-agent-generated-api-calls (WASM integration shape) - ADR-0012: oauth2-enablement-webhooks-timers-secret-templates (inbound Webhook receiver — action-centric, not streaming) - - ADR-0032: host-connect-call (outbound streaming host call; this is the inbound dual) + - ADR-0157: host-connect-call (outbound streaming host call; this is the inbound dual) - `crates/temper-server/src/router.rs` (axum router to extend) - `crates/temper-server/src/webhooks/receiver.rs` (existing inbound receiver — useful contrast) diff --git a/docs/adrs/0070-postgres-multitenant-isolation.md b/docs/adrs/0070-postgres-multitenant-isolation.md index 9d1d46309..9ec0357ea 100644 --- a/docs/adrs/0070-postgres-multitenant-isolation.md +++ b/docs/adrs/0070-postgres-multitenant-isolation.md @@ -4,7 +4,7 @@ - Date: 2026-04-29 - Deciders: Temper core maintainers - Related: - - ADR-0033: tenant isolation + - ADR-0160: tenant isolation - ADR-0065: Postgres Platform Store and Canonical Schema - ADR-0066: StorageStack Backend Selection - `crates/temper-store-postgres/src/schema.rs` diff --git a/docs/adrs/0085-published-artifacts-postgres-metadata.md b/docs/adrs/0085-published-artifacts-postgres-metadata.md index 865307cb0..39c6d29ec 100644 --- a/docs/adrs/0085-published-artifacts-postgres-metadata.md +++ b/docs/adrs/0085-published-artifacts-postgres-metadata.md @@ -4,7 +4,7 @@ Status: Accepted ## Context -ADR-0082 introduced generic published artifacts as a rebuildable read model for +ADR-0173 introduced generic published artifacts as a rebuildable read model for public TemperFS bytes. The implementation persisted that read model through the Turso store path, but production now runs on the Postgres storage stack. Live TemperPaw verification on 2026-05-13 showed `POST /api/files/publish-artifact` diff --git a/docs/adrs/0088-native-file-value-write-fast-path.md b/docs/adrs/0088-native-file-value-write-fast-path.md index ec0402db7..31cc6f9ff 100644 --- a/docs/adrs/0088-native-file-value-write-fast-path.md +++ b/docs/adrs/0088-native-file-value-write-fast-path.md @@ -4,7 +4,7 @@ - Date: 2026-05-15 - Deciders: Temper core maintainers - Related: - - ADR-0057: Native immutable file read plane + - ADR-0170: Native immutable file read plane - ADR-0063: Object store for blob bytes - ADR-0081: Latency observability acceleration program - ADR-0083: Trace budget and fanout summarization diff --git a/docs/adrs/0100-wasm-invocation-phase-observability.md b/docs/adrs/0100-wasm-invocation-phase-observability.md index 92b20b49c..deb9add02 100644 --- a/docs/adrs/0100-wasm-invocation-phase-observability.md +++ b/docs/adrs/0100-wasm-invocation-phase-observability.md @@ -4,7 +4,7 @@ - Date: 2026-05-18 - Deciders: Temper core maintainers - Related: - - ADR-0083: WASM Host Span Hint Datadog Fields + - ADR-0175: WASM Host Span Hint Datadog Fields - ADR-0086: WASM Host Boundary Observability - ADR-0087: WASM Guest Observability Host API - ADR-0099: Local WASM TData Host Path diff --git a/docs/adrs/0101-workflow-root-drain-attribution.md b/docs/adrs/0101-workflow-root-drain-attribution.md index d2e42463c..4fd2c3698 100644 --- a/docs/adrs/0101-workflow-root-drain-attribution.md +++ b/docs/adrs/0101-workflow-root-drain-attribution.md @@ -5,14 +5,14 @@ - Deciders: Temper core maintainers - Related: - ADR-0059: Workflow Trace Context Propagation - - ADR-0084: Long-Lived Workflow Root Spans + - ADR-0176: Long-Lived Workflow Root Spans - ADR-0098: Background WASM Trace Retention - ADR-0100: WASM Invocation Phase Observability - `crates/temper-server/src/workflow_tracing.rs` ## Context -ADR-0084 keeps workflow root spans open across asynchronous entity actions. To +ADR-0176 keeps workflow root spans open across asynchronous entity actions. To avoid dropping final post-dispatch telemetry, the root span currently remains open for a fixed two-second grace period after the root entity reaches a terminal state. @@ -83,7 +83,7 @@ OTS trajectory cost where trace-proven, and projection correctness proof. - Datadog traces explain why workflow roots include a two-second tail. - Latency slicing can distinguish product work from observability grace. -- The trace-retention behavior from ADR-0084 remains intact. +- The trace-retention behavior from ADR-0176 remains intact. ### Negative @@ -117,7 +117,7 @@ OTS trajectory cost where trace-proven, and projection correctness proof. ## Alternatives Considered 1. **Remove the drain** - Rejected because final post-dispatch telemetry could - detach from the workflow root, undoing the trace-shape gains of ADR-0084. + detach from the workflow root, undoing the trace-shape gains of ADR-0176. 2. **Only document the caveat in the report** - Rejected because future Datadog users and agents would still see misleading root spans unless the trace itself explains the drain. diff --git a/docs/adrs/0106-wasm-integration-envelope-attribution.md b/docs/adrs/0106-wasm-integration-envelope-attribution.md index 3124816d3..9597260bb 100644 --- a/docs/adrs/0106-wasm-integration-envelope-attribution.md +++ b/docs/adrs/0106-wasm-integration-envelope-attribution.md @@ -4,7 +4,7 @@ - Date: 2026-05-19 - Deciders: Temper core maintainers - Related: - - ADR-0083: WASM Host Span Hint Datadog Fields + - ADR-0175: WASM Host Span Hint Datadog Fields - ADR-0086: WASM Host Boundary Observability - ADR-0087: WASM Guest Observability Host API - ADR-0100: WASM Invocation Phase Observability diff --git a/docs/adrs/0116-configurable-wasm-host-call-deadline.md b/docs/adrs/0116-configurable-wasm-host-call-deadline.md index c5063b812..4ddcb103b 100644 --- a/docs/adrs/0116-configurable-wasm-host-call-deadline.md +++ b/docs/adrs/0116-configurable-wasm-host-call-deadline.md @@ -4,7 +4,7 @@ - Date: 2026-05-21 - Deciders: Temper core maintainers - Related: - - ADR-0045: WASM default timeout + - ADR-0167: WASM default timeout - ADR-0086: WASM host boundary observability - `crates/temper-wasm/src/engine/host_functions.rs` - `crates/temper-wasm/src/engine/mod.rs` diff --git a/docs/adrs/0031-temper-native-agent.md b/docs/adrs/0156-temper-native-agent.md similarity index 99% rename from docs/adrs/0031-temper-native-agent.md rename to docs/adrs/0156-temper-native-agent.md index 3c7b9f03b..9e7399277 100644 --- a/docs/adrs/0031-temper-native-agent.md +++ b/docs/adrs/0156-temper-native-agent.md @@ -1,4 +1,4 @@ -# ADR-0031: Temper-Native Agent — Spec-Driven Agent Loop via IOA + WASM +# ADR-0156: Temper-Native Agent — Spec-Driven Agent Loop via IOA + WASM - Status: Accepted - Date: 2026-03-16 diff --git a/docs/adrs/0032-host-connect-call.md b/docs/adrs/0157-host-connect-call.md similarity index 98% rename from docs/adrs/0032-host-connect-call.md rename to docs/adrs/0157-host-connect-call.md index 75b45d6e3..22a283c6b 100644 --- a/docs/adrs/0032-host-connect-call.md +++ b/docs/adrs/0157-host-connect-call.md @@ -1,10 +1,10 @@ -# ADR-0032: host_connect_call — Connect Protocol Support for WASM Modules +# ADR-0157: host_connect_call — Connect Protocol Support for WASM Modules - Status: Accepted - Date: 2026-03-17 - Deciders: Temper core maintainers - Related: - - ADR-0031: temper-native-agent (agent architecture) + - ADR-0156: temper-native-agent (agent architecture) - `crates/temper-wasm/src/host_trait.rs` (WasmHost trait) - `crates/temper-wasm/src/engine.rs` (host function linking) - `crates/temper-wasm/src/authorized_host.rs` (Cedar authz gate) diff --git a/docs/adrs/0032-platform-store-trait-and-sim-platform-dst.md b/docs/adrs/0158-platform-store-trait-and-sim-platform-dst.md similarity index 99% rename from docs/adrs/0032-platform-store-trait-and-sim-platform-dst.md rename to docs/adrs/0158-platform-store-trait-and-sim-platform-dst.md index 657fdd33d..a382763cf 100644 --- a/docs/adrs/0032-platform-store-trait-and-sim-platform-dst.md +++ b/docs/adrs/0158-platform-store-trait-and-sim-platform-dst.md @@ -1,4 +1,4 @@ -# ADR-0032: PlatformStore Trait and Simulation-Level Platform DST +# ADR-0158: PlatformStore Trait and Simulation-Level Platform DST - Status: Proposed - Date: 2026-03-16 diff --git a/docs/adrs/0033-sandbox-fsync.md b/docs/adrs/0159-sandbox-fsync.md similarity index 98% rename from docs/adrs/0033-sandbox-fsync.md rename to docs/adrs/0159-sandbox-fsync.md index 4eab5c0ba..a1610ff9e 100644 --- a/docs/adrs/0033-sandbox-fsync.md +++ b/docs/adrs/0159-sandbox-fsync.md @@ -1,11 +1,11 @@ -# ADR-0033: Sandbox Fsync to TemperFS +# ADR-0159: Sandbox Fsync to TemperFS - Status: Accepted - Date: 2026-03-17 - Deciders: Temper core maintainers - Related: - ADR-0029: TemperFS (workspace, file, blob storage) - - ADR-0031: Temper-native agent (IOA spec-driven agent loop) + - ADR-0156: Temper-native agent (IOA spec-driven agent loop) - `os-apps/temper-agent/wasm/tool_runner/src/lib.rs` - `os-apps/temper-fs/wasm/blob_adapter/src/lib.rs` diff --git a/docs/adrs/0033-tenant-database-isolation.md b/docs/adrs/0160-tenant-database-isolation.md similarity index 99% rename from docs/adrs/0033-tenant-database-isolation.md rename to docs/adrs/0160-tenant-database-isolation.md index 553f43ea9..afae40161 100644 --- a/docs/adrs/0033-tenant-database-isolation.md +++ b/docs/adrs/0160-tenant-database-isolation.md @@ -1,4 +1,4 @@ -# ADR-0033: Tenant Database Isolation + Turso Secrets +# ADR-0160: Tenant Database Isolation + Turso Secrets - Status: Accepted - Date: 2026-03-17 diff --git a/docs/adrs/0040-composite-action-kernel-primitive.md b/docs/adrs/0161-composite-action-kernel-primitive.md similarity index 99% rename from docs/adrs/0040-composite-action-kernel-primitive.md rename to docs/adrs/0161-composite-action-kernel-primitive.md index d97e8540a..2a693809d 100644 --- a/docs/adrs/0040-composite-action-kernel-primitive.md +++ b/docs/adrs/0161-composite-action-kernel-primitive.md @@ -1,4 +1,4 @@ -# ADR-0040: Composite-action kernel primitive +# ADR-0161: Composite-action kernel primitive - Status: Proposed - Date: 2026-05-18 @@ -6,7 +6,7 @@ - Supersedes: (none — extends ADR-0019 and related WASM-integration ADRs) - Related: - ADR-0002: WASM integration for agent-generated API calls - - ADR-0033: Tenant database isolation + - ADR-0160: Tenant database isolation - ADR-0039: Latency observability acceleration program - `nerdsane/temper-git` RFC-0003: Genesis app registry - `nerdsane/temper-git` RFC-0002: push and clone (the missing diff --git a/docs/adrs/0040-segmented-event-history-bounded-replay.md b/docs/adrs/0162-segmented-event-history-bounded-replay.md similarity index 96% rename from docs/adrs/0040-segmented-event-history-bounded-replay.md rename to docs/adrs/0162-segmented-event-history-bounded-replay.md index fa9f82a2c..ae63ab5ae 100644 --- a/docs/adrs/0040-segmented-event-history-bounded-replay.md +++ b/docs/adrs/0162-segmented-event-history-bounded-replay.md @@ -1,4 +1,4 @@ -# ADR-0040: Segmented Event History And Bounded Replay +# ADR-0162: Segmented Event History And Bounded Replay ## Status diff --git a/docs/adrs/0041-governance-decision-callbacks.md b/docs/adrs/0163-governance-decision-callbacks.md similarity index 99% rename from docs/adrs/0041-governance-decision-callbacks.md rename to docs/adrs/0163-governance-decision-callbacks.md index d7ae60303..293e9fa44 100644 --- a/docs/adrs/0041-governance-decision-callbacks.md +++ b/docs/adrs/0163-governance-decision-callbacks.md @@ -1,4 +1,4 @@ -# ADR-0041: GovernanceDecision Callback Mechanism +# ADR-0163: GovernanceDecision Callback Mechanism ## Status diff --git a/docs/adrs/0041-runtime-action-observability-metadata.md b/docs/adrs/0164-runtime-action-observability-metadata.md similarity index 98% rename from docs/adrs/0041-runtime-action-observability-metadata.md rename to docs/adrs/0164-runtime-action-observability-metadata.md index 1eecd9031..6c23b3199 100644 --- a/docs/adrs/0041-runtime-action-observability-metadata.md +++ b/docs/adrs/0164-runtime-action-observability-metadata.md @@ -1,4 +1,4 @@ -# ADR-0041: Runtime Action Observability Metadata +# ADR-0164: Runtime Action Observability Metadata - Status: Accepted - Date: 2026-06-08 diff --git a/docs/adrs/0043-wasm-host-injected-auth.md b/docs/adrs/0165-wasm-host-injected-auth.md similarity index 99% rename from docs/adrs/0043-wasm-host-injected-auth.md rename to docs/adrs/0165-wasm-host-injected-auth.md index e47d85069..4b5fd4af3 100644 --- a/docs/adrs/0043-wasm-host-injected-auth.md +++ b/docs/adrs/0165-wasm-host-injected-auth.md @@ -1,4 +1,4 @@ -# ADR-0043: WASM Host-Injected Auth Headers for Internal API Calls +# ADR-0165: WASM Host-Injected Auth Headers for Internal API Calls - Status: Accepted - Date: 2026-04-15 diff --git a/docs/adrs/0045-field-overflow-inline-ceiling.md b/docs/adrs/0166-field-overflow-inline-ceiling.md similarity index 99% rename from docs/adrs/0045-field-overflow-inline-ceiling.md rename to docs/adrs/0166-field-overflow-inline-ceiling.md index 8160ecabc..434146071 100644 --- a/docs/adrs/0045-field-overflow-inline-ceiling.md +++ b/docs/adrs/0166-field-overflow-inline-ceiling.md @@ -1,4 +1,4 @@ -# ADR-0045: Field-Overflow Inline Ceiling +# ADR-0166: Field-Overflow Inline Ceiling - Status: Accepted - Date: 2026-04-16 diff --git a/docs/adrs/0045-wasm-default-timeout.md b/docs/adrs/0167-wasm-default-timeout.md similarity index 98% rename from docs/adrs/0045-wasm-default-timeout.md rename to docs/adrs/0167-wasm-default-timeout.md index ca87e48d4..7fe86c5ce 100644 --- a/docs/adrs/0045-wasm-default-timeout.md +++ b/docs/adrs/0167-wasm-default-timeout.md @@ -1,4 +1,4 @@ -# ADR-0045: Raise WASM Integration Default Timeout to 120s +# ADR-0167: Raise WASM Integration Default Timeout to 120s - Status: Accepted - Date: 2026-04-16 diff --git a/docs/adrs/0046-optimistic-concurrency-retry.md b/docs/adrs/0168-optimistic-concurrency-retry.md similarity index 99% rename from docs/adrs/0046-optimistic-concurrency-retry.md rename to docs/adrs/0168-optimistic-concurrency-retry.md index 8e0d4e45a..a7389b407 100644 --- a/docs/adrs/0046-optimistic-concurrency-retry.md +++ b/docs/adrs/0168-optimistic-concurrency-retry.md @@ -1,4 +1,4 @@ -# ADR-0046: Optimistic Concurrency Retry in Entity Actor Persistence +# ADR-0168: Optimistic Concurrency Retry in Entity Actor Persistence - Status: Accepted - Date: 2026-04-16 diff --git a/docs/adrs/0046-wasm-field-stream-host-fn.md b/docs/adrs/0169-wasm-field-stream-host-fn.md similarity index 97% rename from docs/adrs/0046-wasm-field-stream-host-fn.md rename to docs/adrs/0169-wasm-field-stream-host-fn.md index 4cfec8ec4..d77f03ec1 100644 --- a/docs/adrs/0046-wasm-field-stream-host-fn.md +++ b/docs/adrs/0169-wasm-field-stream-host-fn.md @@ -1,4 +1,4 @@ -# ADR-0046: WASM Host Function for Blob-Ref Field Reads +# ADR-0169: WASM Host Function for Blob-Ref Field Reads > **Implementation note:** the shipped host function is `host_read_field(field_name_ptr, field_name_len, buf_ptr, buf_len) -> i32`, a direct memory-buffer write matching the `host_get_context` pattern. The ADR text below references an earlier stream-based draft (`host_read_field_stream`) — that shape was dropped during implementation because Temper's host has no stream-read-back primitive (streams are one-way: host → HTTP / hash / cache, never into WASM memory). The behavioral contract (plain vs. blob-ref resolution, return codes `-1`/`-2`/`-3`, inline-ceiling split, pre-fetched `blob_cache`) is identical; only the byte transport changes. Return shape matches `host_get_context`: if `needed > buf_len` the caller resizes and retries. @@ -8,7 +8,7 @@ - Supersedes: — - Related: - ADR-0040: Blob-Backed Overflow for Large Entity Field Values - - ADR-0045: Field-Overflow Inline Ceiling + - ADR-0166: Field-Overflow Inline Ceiling - `crates/temper-wasm/src/engine/host_functions.rs` - `crates/temper-wasm/src/stream.rs` - `crates/temper-server/src/state/dispatch/wasm.rs` @@ -18,7 +18,7 @@ ## Context -ADR-0040 introduced blob-backed field overflow for oversize entity values. OData reads hydrate blob refs transparently via `hydrate_blob_refs_in_value` (`temper-server/src/blobs.rs:131`). ADR-0045 raised the inline ceiling to 128KB so that the common-case oversize field (Session.user_message et al.) stays inline and is directly readable by WASM guests. +ADR-0040 introduced blob-backed field overflow for oversize entity values. OData reads hydrate blob refs transparently via `hydrate_blob_refs_in_value` (`temper-server/src/blobs.rs:131`). ADR-0166 raised the inline ceiling to 128KB so that the common-case oversize field (Session.user_message et al.) stays inline and is directly readable by WASM guests. That still leaves the > ceiling case: any field whose serialized value exceeds `DEFAULT_FIELD_INLINE_MAX` (128KB) lives in `fields` as a `{"__temper_blob_ref": "...", "__temper_blob_size": N, "__temper_blob_encoding": "json"}` reference object. The OData path resolves these automatically; the WASM invocation context path does not. `crates/temper-server/src/state/dispatch/wasm.rs` serializes `entity_state` straight into `WasmInvocationContext` with no hydration pass, so a WASM module that reads `fields["big_output"].as_str()` sees the ref envelope, not the bytes. @@ -105,7 +105,7 @@ Module authors don't branch: one call site, correct behavior either way. This is ## Rollout Plan -1. **Phase 1 (landed — ADR-0045)** — inline ceiling raised; paw-agent consumers unaware of blob refs. +1. **Phase 1 (landed — ADR-0166)** — inline ceiling raised; paw-agent consumers unaware of blob refs. 2. **Phase 2 (this ADR)** — host function + SDK helpers + dispatcher prefetch. Infrastructure only; no consumer migrated yet. Ships behind the ADR with tests only. 3. **Phase 3 (separate, OpenPaw)** — `workspace_provisioner` and `llm_caller` migrated to `ctx.read_field_string`. Unblocks openpaw#58 for the > 128KB tail. @@ -147,7 +147,7 @@ Module authors don't branch: one call site, correct behavior either way. This is ## Alternatives Considered 1. **Transparent hydration at handoff.** Walk and inline every blob ref before the WASM call. Simplest possible API (module code unchanged). Rejected because an unbounded field size becomes an unbounded context size — exactly the pathology the ceiling was designed to prevent. Leaves no path for > 128KB fields except the ceiling itself. -2. **Pure stream host function with no ceiling-gated prefetch.** Every oversize field read requires an explicit host call, including ones that would have fit under a reasonable ceiling. More consistent, but 9 existing WASM modules would need to branch on ref-vs-plain for every field read. ADR-0045 + this hybrid keeps the churn at two modules (migrated in Phase 3). +2. **Pure stream host function with no ceiling-gated prefetch.** Every oversize field read requires an explicit host call, including ones that would have fit under a reasonable ceiling. More consistent, but 9 existing WASM modules would need to branch on ref-vs-plain for every field read. ADR-0166 + this hybrid keeps the churn at two modules (migrated in Phase 3). 3. **Make the host function async via `block_on`.** Avoids the prefetch step. Rejected because `spawn_blocking` runs the wasmtime task on a thread without a tokio runtime handle, and installing one inside the sandbox violates DST's single-threaded-simulation rule. 4. **Chunked read API (`host_read_field_chunk(field, offset, len)`).** Useful for very-large payloads. Deferred — the current API is strictly simpler and can compose with chunking later by layering on the SDK side without a new host function. diff --git a/docs/adrs/0057-native-immutable-file-read-plane.md b/docs/adrs/0170-native-immutable-file-read-plane.md similarity index 98% rename from docs/adrs/0057-native-immutable-file-read-plane.md rename to docs/adrs/0170-native-immutable-file-read-plane.md index 903c95f3b..e91b1fb8f 100644 --- a/docs/adrs/0057-native-immutable-file-read-plane.md +++ b/docs/adrs/0170-native-immutable-file-read-plane.md @@ -1,4 +1,4 @@ -# ADR-0057: Native Immutable File Read Plane for TemperFS +# ADR-0170: Native Immutable File Read Plane for TemperFS - Status: Accepted - Date: 2026-04-23 diff --git a/docs/adrs/0081-llmobs-agent-workflow-hierarchy.md b/docs/adrs/0171-llmobs-agent-workflow-hierarchy.md similarity index 99% rename from docs/adrs/0081-llmobs-agent-workflow-hierarchy.md rename to docs/adrs/0171-llmobs-agent-workflow-hierarchy.md index e1ae26dd1..1022fe79e 100644 --- a/docs/adrs/0081-llmobs-agent-workflow-hierarchy.md +++ b/docs/adrs/0171-llmobs-agent-workflow-hierarchy.md @@ -1,4 +1,4 @@ -# ADR-0081: LLMObs Agent Workflow Hierarchy +# ADR-0171: LLMObs Agent Workflow Hierarchy - Status: Accepted - Date: 2026-05-12 diff --git a/docs/adrs/0081-postgres-actor-runtime-serve-flag.md b/docs/adrs/0172-postgres-actor-runtime-serve-flag.md similarity index 99% rename from docs/adrs/0081-postgres-actor-runtime-serve-flag.md rename to docs/adrs/0172-postgres-actor-runtime-serve-flag.md index df1ff3959..94686d043 100644 --- a/docs/adrs/0081-postgres-actor-runtime-serve-flag.md +++ b/docs/adrs/0172-postgres-actor-runtime-serve-flag.md @@ -1,4 +1,4 @@ -# ADR-0081: Postgres Actor Runtime Serve Flag +# ADR-0172: Postgres Actor Runtime Serve Flag - Status: Accepted - Date: 2026-05-11 diff --git a/docs/adrs/0082-generic-published-artifacts.md b/docs/adrs/0173-generic-published-artifacts.md similarity index 97% rename from docs/adrs/0082-generic-published-artifacts.md rename to docs/adrs/0173-generic-published-artifacts.md index a9e55d1b3..8aa770b97 100644 --- a/docs/adrs/0082-generic-published-artifacts.md +++ b/docs/adrs/0173-generic-published-artifacts.md @@ -1,4 +1,4 @@ -# ADR-0082: Generic Published Artifacts +# ADR-0173: Generic Published Artifacts Status: Accepted diff --git a/docs/adrs/0082-postgres-dbm-sqlcommenter-attribution.md b/docs/adrs/0174-postgres-dbm-sqlcommenter-attribution.md similarity index 98% rename from docs/adrs/0082-postgres-dbm-sqlcommenter-attribution.md rename to docs/adrs/0174-postgres-dbm-sqlcommenter-attribution.md index d5dc3dfe0..3970e481c 100644 --- a/docs/adrs/0082-postgres-dbm-sqlcommenter-attribution.md +++ b/docs/adrs/0174-postgres-dbm-sqlcommenter-attribution.md @@ -1,4 +1,4 @@ -# ADR-0082: Postgres DBM SQLCommenter Attribution +# ADR-0174: Postgres DBM SQLCommenter Attribution Date: 2026-05-12 diff --git a/docs/adrs/0083-wasm-host-span-hint-datadog-fields.md b/docs/adrs/0175-wasm-host-span-hint-datadog-fields.md similarity index 98% rename from docs/adrs/0083-wasm-host-span-hint-datadog-fields.md rename to docs/adrs/0175-wasm-host-span-hint-datadog-fields.md index e601a0181..4149880bd 100644 --- a/docs/adrs/0083-wasm-host-span-hint-datadog-fields.md +++ b/docs/adrs/0175-wasm-host-span-hint-datadog-fields.md @@ -1,4 +1,4 @@ -# ADR-0083: WASM Host Span Hints Must Be Datadog-Visible +# ADR-0175: WASM Host Span Hints Must Be Datadog-Visible Date: 2026-05-12 diff --git a/docs/adrs/0084-long-lived-workflow-root-spans.md b/docs/adrs/0176-long-lived-workflow-root-spans.md similarity index 97% rename from docs/adrs/0084-long-lived-workflow-root-spans.md rename to docs/adrs/0176-long-lived-workflow-root-spans.md index 393dc471d..594fbd7e5 100644 --- a/docs/adrs/0084-long-lived-workflow-root-spans.md +++ b/docs/adrs/0176-long-lived-workflow-root-spans.md @@ -1,4 +1,4 @@ -# ADR-0084: Long-Lived Workflow Root Spans +# ADR-0176: Long-Lived Workflow Root Spans - Status: Accepted - Date: 2026-05-12 @@ -7,7 +7,7 @@ - ADR-0052: Instrumentation as policy - ADR-0057: Canonical Dispatch Traces and Selective Wide-Event Projection - ADR-0059: Workflow Trace Context Propagation - - ADR-0083: WASM Host Span Hints Must Be Datadog-Visible + - ADR-0175: WASM Host Span Hints Must Be Datadog-Visible - `crates/temper-server/src/state/dispatch/actions.rs` - `crates/temper-server/src/workflow_tracing.rs` @@ -126,7 +126,7 @@ no-exporter test runs and non-traced dispatch paths. - Durable span storage or cross-process span recovery. - New workflow orchestration outside entity transitions. -- Inside-WASM guest-created APM spans; ADR-0083 still owns that limitation and +- Inside-WASM guest-created APM spans; ADR-0175 still owns that limitation and follow-up path. ## Alternatives Considered diff --git a/docs/adrs/TEMPLATE.md b/docs/adrs/TEMPLATE.md index 878d9c820..a8faf6f81 100644 --- a/docs/adrs/TEMPLATE.md +++ b/docs/adrs/TEMPLATE.md @@ -1,3 +1,10 @@ + + # ADR-NNNN: Title - Status: Proposed | Accepted | Superseded | Deprecated