feat: distinguish legacy-host-load from typed-IaC conformance evidence#648
Merged
Conversation
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
- Add PluginCompatibilityModeLegacyHostLoad = "legacy-host-load" constant with documentation that it is advisory-only and never satisfies IaC registry readiness - Update ValidateCompatibilityEvidence to accept legacy-host-load mode (valid to store/name) while keeping typed-iac as the only mode satisfying IaC compatibility decisions - Add manifestAdvertisesIaCProvider helper to registry_compatibility.go - Enforce in updateRegistryCompatibilityIndex: IaC provider manifests (capabilities.iacProvider.name != "") must supply typed-iac evidence; legacy-host-load is rejected with an actionable error - Update findCompatibilityEvidence comment to document that typed-iac-only filtering is intentional (legacy-host-load never matches) - Add tests: legacy-host-load valid in model, rejected for IaC manifests, ignored by resolver even with RequiredFromEngine set - Update docs/WFCTL.md to document both conformance modes Agent-Logs-Url: https://github.com/GoCodeAlone/workflow/sessions/27f85922-fcfd-4094-87aa-ca4e3fd211a8 Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix registry compatibility to distinguish legacy host-load from typed-IaC
feat: distinguish legacy-host-load from typed-IaC conformance evidence
May 13, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refines how plugin compatibility evidence is interpreted in wfctl by explicitly distinguishing advisory legacy host-load evidence from strict typed-IaC conformance evidence, and enforcing that typed-IaC evidence is required for registry readiness when a manifest advertises an iacProvider capability.
Changes:
- Introduces a new compatibility evidence mode constant
legacy-host-loadand updates evidence validation to accept it as a storable, named mode (while keepingtyped-iacas the only IaC-readiness mode). - Enforces at registry index update time that manifests advertising
iacProvidercannot be indexed with non-typed-iacevidence, with an actionable error message. - Adds/updates tests and documentation to clarify behavior, plus small formatting cleanups in a couple of Go test/struct definitions.
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| plugin/external/sdk/iacserver_test.go | Go formatting tweak for an embedded gRPC stub type used in a registration/no-panic test. |
| docs/WFCTL.md | Documents conformance modes and clarifies typed-IaC readiness requirements. |
| cmd/wfctl/registry_compatibility.go | Rejects non-typed IaC evidence for IaC provider manifests; adds manifestAdvertisesIaCProvider helper. |
| cmd/wfctl/registry_compatibility_test.go | Adds coverage for IaC vs non-IaC manifest enforcement and helper manifest writer. |
| cmd/wfctl/plugin_compat_resolver.go | Documents intentional exclusion of legacy evidence from IaC readiness decisions. |
| cmd/wfctl/plugin_compat_resolver_test.go | Adds test confirming legacy evidence never satisfies required IaC evidence. |
| cmd/wfctl/plugin_compat_model.go | Adds legacy-host-load mode constant and updates evidence mode validation logic. |
| cmd/wfctl/plugin_compat_model_test.go | Adds tests ensuring legacy-host-load is accepted and unknown modes are rejected. |
| cmd/wfctl/deploy_providers.go | Minor struct field alignment/formatting change. |
Comment on lines
+559
to
+572
| | `--mode` | `typed-iac` | Conformance mode. `typed-iac` checks strict typed IaC plugin launch/contract compatibility and is the only mode that satisfies typed-IaC registry readiness for manifests advertising `iacProvider` capability. | | ||
| | `--artifact` | _(none)_ | Release artifact tar.gz to test instead of a local plugin directory | | ||
| | `--build-package` | `.` | Go package to build when testing a source directory, for example `./cmd/plugin` | | ||
| | `--engine-version` | build version or `WFCTL_ENGINE_VERSION` | Workflow engine version recorded in evidence | | ||
| | `--format` | `text` | Output format: `text` or `json` | | ||
| | `--output` | _(none)_ | Write JSON evidence to a file | | ||
| | `--timeout` | `30s` | Plugin launch/check timeout | | ||
|
|
||
| **Conformance modes and compatibility evidence:** | ||
|
|
||
| | Mode | Description | Satisfies IaC readiness? | | ||
| |------|-------------|--------------------------| | ||
| | `typed-iac` | Verifies the plugin binary completes the Workflow go-plugin handshake and registers `pb.IaCProviderRequired` and typed services. | **Yes** — required for manifests with `iacProvider` capability in first-party registries. | | ||
| | `legacy-host-load` | Advisory-only smoke evidence for legacy `sdk.Serve` module plugins that can load and expose metadata/contracts but have not migrated to `sdk.ServeIaCPlugin`. | **No** — never satisfies typed-IaC registry readiness; rejected at index-update time for IaC provider manifests. | |
Contributor
|
@copilot apply changes based on the comments in this thread |
…-mode flag The docs table previously listed legacy-host-load in a "Conformance modes" section that could be misread as a valid --mode flag for wfctl plugin conformance. The CLI hard-rejects any mode other than typed-iac. Rename the section to "Compatibility evidence modes" and explicitly state: - wfctl plugin conformance only generates typed-iac evidence - legacy-host-load is an evidence/index mode from legacy tooling; it cannot be passed as --mode to the conformance command - The How-produced column now makes the source of each evidence mode clear Agent-Logs-Url: https://github.com/GoCodeAlone/workflow/sessions/27e4f5c0-448f-4c10-aff6-10dc8c66a108 Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
Contributor
Author
Fixed in eb0b4b4. The docs section was renamed from "Conformance modes" to "Compatibility evidence modes" with an explicit note that |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A plugin can pass legacy host-load smoke checks and still fail
wfctl plugin conformance --mode typed-iac. These evidence types are not interchangeable — legacy evidence must not satisfy typed-IaC registry readiness for manifests advertisingiacProvidercapability.Changes
New evidence mode constant (
plugin_compat_model.go)PluginCompatibilityModeLegacyHostLoad = "legacy-host-load"as an explicit named modeValidateCompatibilityEvidencenow acceptslegacy-host-load(storable/named) alongsidetyped-iac; unknown modes still rejectedtyped-iacremains the only mode that satisfies IaC registry readinessIaC manifest enforcement at index-update time (
registry_compatibility.go)manifestAdvertisesIaCProvider(*RegistryManifest) bool— checkscapabilities.iacProvider.name != ""updateRegistryCompatibilityIndexrejectslegacy-host-loadevidence for any manifest withiacProvidercapability with an actionable error:legacy-host-loadevidence without restrictionResolver guard documented (
plugin_compat_resolver.go)findCompatibilityEvidencealready filtered totyped-iaconly; comment now documents this as intentional enforcement, not incidental filteringDocs (
docs/WFCTL.md)