Treat published_seam ingress as an external queue provider under ClosedWorld conformance

[ElonSG]

Motivation

Graph conformance was asymmetric between flat and composed packages for declared external-ingress queues. A package that declares one of its consumed queues in M.spec.published_seam is declaring it a PUBLIC EXTERNAL INGRESS — produced by an external host/composer, not by anything in the package's own [event_deps] closure.

• crates/fkst-framework/src/host_conformance.rs:747-751 runs ValidationScope::PartialGraph for a single-root graph (flat package) but ValidationScope::ClosedWorld for a composed/multi-root graph.
• Under PartialGraph a consumed-queue-with-no-producer is a warning; under ClosedWorld it is a hard error (validation.rs).
• So a flat package (e.g. github-proxy: github_pr_comment_request) with a published-seam ingress passes, but the same declared ingress in a composed package hard-fails ClosedWorld — even though published_seam explicitly declares it external. That asymmetry blocked any composed package with a legitimate external ingress seam (observed with the browser-qa composed package: browser-qa.browser_qa_request).

published_seam should mean the same thing in flat and composed packages.

Change (narrow)

Treat a consumed queue that is declared in its own consuming department's published_seam as satisfying the producer requirement (a narrowly-scoped external-seam provider), even under ClosedWorld. Every other missing-producer gap remains a hard error, and PartialGraph behavior is unchanged.

• config.rs: DepartmentDecl gains #[serde(default)] published_seam (serde default → no other construction site is forced to change).
• validation.rs: the per-queue producer computation counts an external-seam provider when the queue is in a consuming department's published_seam (mirrors the existing built_in_provider_for_queue pattern).
• sdk_graph.rs + supervise construction sites: carry the already-resolved M.spec.published_seam into the common graph model.

Verification

• cargo test -p fkst-common: unit 25 passed / 0 failed (includes the new ClosedWorld published-seam test), integration 29 passed / 0 failed.
• Behavior invariants (all PASS): (a) ClosedWorld accepts a consumed queue declared in that department's published_seam; (b) ClosedWorld still hard-fails a consumed queue with no producer and no published_seam; (c) PartialGraph still emits a warning and succeeds.
• End-to-end on a real composed package (browser-qa on fkst-packages): composed conformance browser-qa.browser_qa_request has no producer violation count went 2 → 0 (original engine BIN → this BIN), with no package-side change.
• cargo build -p fkst-framework: succeeds.

Note: the full fkst-framework suite's observe_cli::observe_json_reports_live_subscriber_status_for_pending_queues is a pre-existing environment-dependent (observe-socket) flaky, unrelated to this change; all fkst-framework targets compile and the focused graph-scan test passes. Substrate CI is the full-suite gate.

This unblocks composed packages that legitimately expose an external ingress seam and removes a real flat-vs-composed conformance inconsistency.

🤖 Generated with Claude Code

⟦AI:FKST⟧

[codecov]

Codecov Report

❌ Patch coverage is 97.97980% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fkst-framework/src/self_test.rs	0.00%	1 Missing ⚠️
crates/fkst-framework/src/supervise/graph_scan.rs	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[ElonSG]

sshx review record

Out-of-band fix via sshx (the autonomous pipeline blocked on child-fatal-walking-skeleton for the browser-qa composed package; it could not self-fix a graph-conformance defect). Design vetted cross-model (ChatGPT Pro oracle → recommended engine-layer over a package-side raiser as the natural owner; a package raiser would put PR-lifecycle policy in a reusable QA leaf).

Thinking / meta-judge

• Root confirmed at source: host_conformance.rs:747-751 picks PartialGraph for single-root (flat) graphs and ClosedWorld for composed/multi-root. A declared external-ingress published_seam on a consumed queue passes for flat packages (PartialGraph → warning) but hard-fails for composed packages (ClosedWorld → error) — an asymmetry, since published_seam explicitly declares the queue external.
• Natural owner = engine (make published_seam mean the same thing in both scopes), not a package-side producer.

Review triplet (independent, context-isolated)

• correctness → approve: exemption is correctly conjunctive (a department exempts a queue only if it BOTH consumes it AND lists it in its own published_seam, validation.rs:222-230); a false-negative would require the contradictory intent of expecting an internal producer while declaring the queue external; fanout/feedback/isolated checks unaffected; existing configs (empty published_seam default) byte-identical.
• tests → approve: the three gate conditions met — positive exemption test, the critical negative guard (ClosedWorld still hard-errors an undeclared missing producer, validation.rs:576-600), determinism (pure config units, no sockets).
• architecture → comment (non-blocking): exemption narrow + correct; published_seam on DepartmentDecl is the right layer (same category as consumes/produces, and validation.rs re-checks self-consumption rather than trusting the field); blast radius is test-only except the single production line graph_scan.rs:289; validate_published_seam (seam ⊆ consumes + namespace ownership) intact, so the exemption cannot launder a foreign/sibling queue.

Advisories addressed

• Added a cross-department regression test (closed_world_published_seam_does_not_exempt_other_departments_queue) locking the same-department constraint that all reviewers flagged (commit 01454e7). cargo test -p fkst-common: 26 unit + 29 integration, 0 failed.
• Correction to the "partial-graph behavior unchanged" wording: precisely, PartialGraph is unchanged for every queue NOT declared as a published_seam. For a consumed queue that IS declared in its own department's published_seam, the previously-emitted "no producer in this partial graph" warning is now correctly suppressed (a declared external ingress genuinely has an external provider) — this is the more-correct semantics and only affects queues that opt in via the new field.

Verification

• cargo test -p fkst-common: 26 unit / 29 integration, 0 failed (includes positive, negative-guard, cross-department, and PartialGraph tests).
• Behavior invariants: (a) ClosedWorld accepts a consumed queue declared in that department's published_seam; (b) ClosedWorld still hard-fails an undeclared missing producer; (c) PartialGraph unchanged for non-seam queues.
• End-to-end on the real composed package browser-qa (fkst-packages, clean PR head): browser-qa.browser_qa_request has no producer violation count went 2 → 0 (original engine BIN → this BIN), no package-side change.
• Substrate CI on the first commit: all checks green (including verify, the full suite).

⟦AI:FKST⟧