kobako 0.23.0 → 0.26.0

data/README.md

@@ -151,7 +151,7 @@ Build the crate as a `cdylib` for `wasm32-wasip1`, then bake the canonical boot
 
 ### Services
 
-`bind` any Ruby object as a Service at a constant-path name; the guest reaches it as a `MyService::KV` (or top-level `File`) proxy and invokes its public methods through the Transport wire. See [`docs/behavior/registration.md`](docs/behavior/registration.md) B-08..B-12.
+`bind` any Ruby object as a Service at a constant-path name; the guest reaches it as a `MyService::KV` (or top-level `File`) proxy and invokes the public methods its own class defines through the Transport wire. See [`SV-006`](docs/spec/behavior/services.md) and [`SV-007`](docs/spec/behavior/services.md).
 
 ```ruby
 class User
@@ -175,7 +175,7 @@ Each `::`-separated path segment must match `/\A[A-Z]\w*\z/`. Symbol kwargs trav
 
 ### Per-Invocation Bindings
 
-A setup-time `bind` fixes one object for the Sandbox's life. When the object belongs to a single run instead — the current request, the acting user, a per-tenant store — declare the path at setup and fill it per invocation. `bind(path)` with no object reserves the name as a *fillable*: the guest sees the constant, while an unfilled dispatch fails closed as `Kobako::ServiceError`. The optional `#eval` / `#run` block fills it ([`docs/behavior/registration.md`](docs/behavior/registration.md) B-62..B-63).
+A setup-time `bind` fixes one object for the Sandbox's life. When the object belongs to a single run instead — the current request, the acting user, a per-tenant store — declare the path at setup and fill it per invocation. `bind(path)` with no object reserves the name as a *fillable*: the guest sees the constant, while an unfilled dispatch fails closed as `Kobako::ServiceError`. The optional `#eval` / `#run` block fills it ([`SV-017`](docs/spec/behavior/services.md), [`SV-024`](docs/spec/behavior/services.md)).
 
 ```ruby
 sandbox.bind("Req::Current")  # declared, unfilled — stands for Kobako::Unresolved
@@ -187,7 +187,7 @@ sandbox.eval("Req::Current.user_id") { |ctx| ctx.bind("Req::Current", request) }
 
 ### Output Capture
 
-Guest writes through `puts` / `print` / `p` / `$stdout` / `$stderr` are buffered per-channel and read off the run's Execution, independently of its `#value` ([`docs/behavior/lifecycle.md`](docs/behavior/lifecycle.md) B-04). Each invocation captures its own; overflow is clipped at the cap and flagged by `#stdout_truncated?` / `#stderr_truncated?`.
+Guest writes through `puts` / `print` / `p` / `$stdout` / `$stderr` are buffered per-channel and read off the run's Execution, independently of its `#value` ([`S-023`](docs/spec/behavior/sandbox.md), [`S-028`](docs/spec/behavior/sandbox.md)). Each invocation captures its own; overflow is clipped at the cap and flagged by `#stdout_truncated?` / `#stderr_truncated?`.
 
 ```ruby
 execution = sandbox.eval(<<~RUBY)
@@ -232,7 +232,7 @@ Each of these carries the failed run's Execution on `#execution`, so a rescue re
 
 ### Resource Limits
 
-Each invocation enforces a wall-clock `timeout` and a per-invocation linear-memory `memory_limit`; exhaustion raises a `TrapError` subclass. Pass `nil` to `timeout` / `memory_limit` to disable that cap. Read [`Execution#usage`](lib/kobako/execution.rb) for actual consumption — populated on every outcome, so a rescued trap reports it just as a completed run does ([`docs/behavior/lifecycle.md`](docs/behavior/lifecycle.md) B-35).
+Each invocation enforces a wall-clock `timeout` and a per-invocation linear-memory `memory_limit`; exhaustion raises a `TrapError` subclass. Pass `nil` to `timeout` / `memory_limit` to disable that cap. Read [`Execution#usage`](lib/kobako/execution.rb) for actual consumption — populated on every outcome, so a rescued trap reports it just as a completed run does ([`S-058`](docs/spec/behavior/sandbox.md), [`S-061`](docs/spec/behavior/sandbox.md)).
 
 ```ruby
 sandbox = Kobako::Sandbox.new(
@@ -256,9 +256,9 @@ Beyond the four caps, `profile:` requests the Sandbox's isolation posture on the
 
 ### Concurrency
 
-A Sandbox keeps no state from any run, so concurrent Threads may invoke distinct Sandboxes or share a single one; each invocation owns its Handles, captures, and usage either way ([`docs/behavior/runtime.md`](docs/behavior/runtime.md) B-22). One Thread still runs one invocation at a time. Sharing a Sandbox adds a single obligation: an object bound once at setup is reached by every Thread and must itself be thread-safe, while an object supplied per invocation — `ctx.bind`, or an Extension `provider:` — carries no such requirement.
+A Sandbox keeps no state from any run, so concurrent Threads may invoke distinct Sandboxes or share a single one; each invocation owns its Handles, captures, and usage either way ([`RT-001`](docs/spec/behavior/runtime.md), [`RT-002`](docs/spec/behavior/runtime.md)). One Thread still runs one invocation at a time. Sharing a Sandbox adds a single obligation: an object bound once at setup is reached by every Thread and must itself be thread-safe, while an object supplied per invocation — `ctx.bind`, or an Extension `provider:` — carries no such requirement.
 
-By default an invocation holds Ruby's GVL for its whole span, so guest execution across Threads serializes. `gvl: :release` drops the GVL for the guest span and re-acquires it for each guest→host dispatch, running guest code in parallel across Threads (B-64).
+By default an invocation holds Ruby's GVL for its whole span, so guest execution across Threads serializes. `gvl: :release` drops the GVL for the guest span and re-acquires it for each guest→host dispatch, running guest code in parallel across Threads ([`RT-024`](docs/spec/behavior/runtime.md), [`RT-026`](docs/spec/behavior/runtime.md)).
 
 ```ruby
 sandbox = Kobako::Sandbox.new(gvl: :release)
@@ -319,9 +319,9 @@ For workloads that must be isolated from each other (one Sandbox per tenant, per
 
 ### Pooling
 
-For hosts that serve many short invocations, `Kobako::Pool` keeps a bounded set of warm, identically set-up Sandboxes and hands each one to a single exclusive holder at a time ([`docs/behavior/runtime.md`](docs/behavior/runtime.md) B-46..B-48). Construction forwards every `Sandbox.new` keyword verbatim; the optional block is the per-Sandbox setup window and runs exactly once per constructed Sandbox.
+For hosts that serve many short invocations, `Kobako::Pool` keeps a bounded set of warm, identically set-up Sandboxes and hands each one to a single exclusive holder at a time ([`PL-003`](docs/spec/behavior/pool.md), [`PL-011`](docs/spec/behavior/pool.md)). Construction forwards every `Sandbox.new` keyword verbatim; the optional block is the per-Sandbox setup window and runs exactly once per constructed Sandbox.
 
-`Kobako::Pool` is experimental today and is best treated as a convenience for warm, pre-configured reuse rather than a throughput optimisation. B-49 bakes the shared boot state into the artifact and every dynamic script still compiles and runs per invocation, so all a pool actually saves is the host-side `Sandbox.new` — now under 3 µs, an order of magnitude below the invocation that follows it. For the workload kobako is built for — many small, short-lived Sandboxes running dynamic scripts — that is not a gain worth the coupling. What a Pool buys is warm setup and exclusive checkout, not isolation: a Sandbox holds no state from any run, so Threads sharing one are equally safe (see [Concurrency](#concurrency)).
+`Kobako::Pool` is experimental today and is best treated as a convenience for warm, pre-configured reuse rather than a throughput optimisation. The build bakes the shared boot state into the artifact ([`mruby.md`](docs/spec/behavior/mruby.md)) and every dynamic script still compiles and runs per invocation, so all a pool actually saves is the host-side `Sandbox.new` — now under 3 µs, an order of magnitude below the invocation that follows it. For the workload kobako is built for — many small, short-lived Sandboxes running dynamic scripts — that is not a gain worth the coupling. What a Pool buys is warm setup and exclusive checkout, not isolation: a Sandbox holds no state from any run, so Threads sharing one are equally safe (see [Concurrency](#concurrency)).
 
 ```ruby
 pool = Kobako::Pool.new(slots: 4) do |sandbox|
@@ -340,7 +340,7 @@ Sandboxes construct lazily on first demand. `#with` yields a Sandbox and returns
 
 ### Service Blocks
 
-A Service method can accept a guest-supplied block via `&blk` and `yield` into it. The block body runs inside the Wasm guest; `break` / `next` / exceptions follow normal Ruby semantics, scoped to the single dispatch. See [`docs/behavior/yield.md`](docs/behavior/yield.md) B-23..B-30.
+A Service method can accept a guest-supplied block via `&blk` and `yield` into it. The block body runs inside the Wasm guest; `break` / `next` / exceptions follow normal Ruby semantics, scoped to the single dispatch. See [`T-085`](docs/spec/behavior/transport-yield.md) and [`T-089`](docs/spec/behavior/transport-yield.md).
 
 ```ruby
 sandbox.bind("Seq::Map", ->(items, &blk) { items.map(&blk) })
@@ -351,7 +351,7 @@ sandbox.eval('Seq::Map.call([1, 2, 3]) { |x| x * 2 }').value
 
 ### Handle Management
 
-A non-wire-representable host object — returned from a Service (B-14), passed to `#run` (B-34), or handed back from the guest (B-37) — crosses the boundary as an opaque `Kobako::Handle` proxy and is restored to the original object before host code sees it; any other unrepresentable value raises `Kobako::SandboxError`. Handles are scoped to a single invocation ([`docs/behavior/dispatch.md`](docs/behavior/dispatch.md) B-13..B-21, B-34, B-37).
+A non-wire-representable host object — returned from a Service ([`T-001`](docs/spec/behavior/transport-dispatch.md)), passed to `#run` ([`T-066`](docs/spec/behavior/transport-dispatch.md)), or handed back from the guest ([`T-054`](docs/spec/behavior/transport-dispatch.md)) — crosses the boundary as an opaque `Kobako::Handle` proxy and is restored to the original object before host code sees it; any other unrepresentable value raises `Kobako::SandboxError`. Handles are scoped to a single invocation ([`T-038`](docs/spec/behavior/transport-dispatch.md)).
 
 ```ruby
 class Greeter
@@ -362,12 +362,12 @@ end
 sandbox.bind("Factory::Make", ->(name) { Greeter.new(name) })
 
 sandbox.eval('Factory::Make.call("Bob").greet').value  # => "hi, Bob"  (Handle round-trip inside guest)
-sandbox.eval('Factory::Make.call("Bob")').value        # => #<Greeter @name="Bob">  (B-37 restoration)
+sandbox.eval('Factory::Make.call("Bob")').value        # => #<Greeter @name="Bob">  (Handle restoration)
 ```
 
 A `break` value from a guest block is the one exception: it unwinds back to the guest Service call rather than to host code, so a Handle in it stays a Handle — restoring would just re-wrap the same object into a new id on the return trip.
 
-Each dispatch that hands back a non-wire-representable object allocates a *new* Handle — kobako never deduplicates by object identity (B-15, B-17). This is most visible with fluent / builder APIs. An `ActiveRecord::Relation` chain `spawn`s a fresh relation at each step, so every hop is an independent dispatch that binds its own Handle:
+Each dispatch that hands back a non-wire-representable object allocates a *new* Handle — kobako never deduplicates by object identity ([`T-007`](docs/spec/behavior/transport-dispatch.md), [`T-009`](docs/spec/behavior/transport-dispatch.md)). This is most visible with fluent / builder APIs. An `ActiveRecord::Relation` chain `spawn`s a fresh relation at each step, so every hop is an independent dispatch that binds its own Handle:
 
 ```
    guest chain                        host  (Catalog::Handles, one invocation)
@@ -383,11 +383,11 @@ Each dispatch that hands back a non-wire-representable object allocates a *new*
    all stay live until the invocation ends, then reset together
 ```
 
-This is deliberate, not a leak. Handle IDs run to 2³¹ − 1 per invocation and reset between invocations, so even deep chains stay far inside the range. Two consequences are worth keeping in mind: the same host object handed back twice yields two *different* Handles — the guest cannot tell they alias — and every intermediate Handle stays live until the invocation ends, since there is no per-Handle release (B-19).
+This is deliberate, not a leak. Handle IDs run to 2³¹ − 1 per invocation and reset between invocations, so even deep chains stay far inside the range. Two consequences are worth keeping in mind: the same host object handed back twice yields two *different* Handles — the guest cannot tell they alias — and every intermediate Handle stays live until the invocation ends, since there is no per-Handle release ([`transport-dispatch.md`](docs/spec/behavior/transport-dispatch.md)).
 
 ### Snippets & Entrypoints
 
-`Sandbox#preload` registers named mruby snippets that replay into every invocation's canonical boot state; `Sandbox#run(:Target, *args, **kwargs)` dispatches into a top-level `Object` constant defined by those snippets ([`docs/behavior/invocation.md`](docs/behavior/invocation.md) B-31..B-33).
+`Sandbox#preload` registers named mruby snippets that replay into every invocation's canonical boot state; `Sandbox#run(:Target, *args, **kwargs)` dispatches into a top-level `Object` constant defined by those snippets ([`S-053`](docs/spec/behavior/sandbox.md), [`S-045`](docs/spec/behavior/sandbox.md)).
 
 ```ruby
 sandbox = Kobako::Sandbox.new
@@ -428,7 +428,7 @@ Use the source form for snippets authored in your repo; use the bytecode form wh
 
 ### Extensions
 
-An Extension teaches the guest a native-style constant by pairing a guest idiom (`source`) with an optional host `backend`. `Sandbox#install` composes the two through the existing `#preload` and `#bind` verbs, adding no wire or Guest Binary surface: pure operations run in-guest with no round-trip, while the rest dispatch to the backend under the same isolation and reflection guarantees as any bound Service ([`docs/extensions.md`](docs/extensions.md), [`docs/behavior/extension.md`](docs/behavior/extension.md) B-55..B-57).
+An Extension teaches the guest a native-style constant by pairing a guest idiom (`source`) with an optional host `backend`. `Sandbox#install` composes the two through the existing `#preload` and `#bind` verbs, adding no wire or Guest Binary surface: pure operations run in-guest with no round-trip, while the rest dispatch to the backend under the same isolation and reflection guarantees as any bound Service ([`docs/extensions.md`](docs/extensions.md), [`EX-005`](docs/spec/behavior/extension.md), [`EX-006`](docs/spec/behavior/extension.md)).
 
 ```ruby
 FILE = <<~'MRUBY'
@@ -466,8 +466,9 @@ kobako ships no concrete Extension; the idiom and backend are yours. The [overla
 ## Security
 
 kobako isolates the guest, but **what it may reach is whatever you `bind`** — and `bind`
-exposes *every* public method of the object. So bind a purpose-built object scoped to the
-task, not a capable one whose other methods leak more than you intend.
+exposes every public method the object's own class defines. Inherited, mixed-in, and built-in
+methods stay out of reach, but the class's own surface does not, so bind a purpose-built
+object scoped to the task, not a capable one whose other methods leak more than you intend.
 
 ```ruby
 class ThemeReader          # only #color is reachable; AppConfig.secret_key is not
@@ -483,7 +484,7 @@ sandbox.eval('Cfg::Settings.color').value  # => "#3366ff"  — every other metho
 When a purpose-built wrapper is more than you need, an object can gate its own surface in
 place: a private `respond_to_guest?(name)` answers, per method, whether the guest may call
 it. Returning `false` for every name makes the object opaque — a credential the guest
-forwards to another Service but never reads — while a named subset becomes an allow-list.
+forwards to another Service but never reads — while permitting a named subset exposes exactly those.
 
 Guest code can name any `MyService::KV` path, but a forged name only resolves to
 something you bound — the real authorization gate is this host-side allowlist. Give each

data/ROADMAP.md

@@ -9,17 +9,17 @@ output capture, and a warm Sandbox pool.
 
 | Feature | Entry Points | Notes |
 |---------|-------------|-------|
-| ✅ [F-01 Sandbox instantiation](docs/behavior/lifecycle.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | B-22 (per-Thread isolation) is exercised only indirectly through the pool contention tests; no test cites it |
-| ✅ [F-02 Service binding](docs/behavior/registration.md) | [lib/kobako/catalog/services.rb](lib/kobako/catalog/services.rb) | — |
-| ✅ [F-04 Synchronous mruby source execution (`#eval`)](docs/behavior/lifecycle.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
-| ✅ [F-05 Guest-initiated Transport dispatch](docs/behavior/dispatch.md) | [lib/kobako/transport/dispatcher.rb](lib/kobako/transport/dispatcher.rb) | — |
-| ✅ [F-06 Capability Handle encoding and referencing](docs/behavior/dispatch.md) | [lib/kobako/catalog/handles.rb](lib/kobako/catalog/handles.rb) | — |
-| ✅ [F-07 Three-class error attribution and raising](docs/behavior/errors.md) | [lib/kobako/outcome.rb](lib/kobako/outcome.rb) | E-26 (guest-entry envelope decode failure) has no exercising test — not reachable through the public API |
-| ✅ [F-08 Guest output capture](docs/behavior/lifecycle.md) | [lib/kobako/capture.rb](lib/kobako/capture.rb) | — |
+| ✅ [F-01 Sandbox instantiation](docs/spec/behavior/sandbox.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
+| ✅ [F-02 Service binding](docs/spec/behavior/services.md) | [lib/kobako/catalog/services.rb](lib/kobako/catalog/services.rb) | — |
+| ✅ [F-04 Synchronous mruby source execution (`#eval`)](docs/spec/behavior/sandbox.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
+| ✅ [F-05 Guest-initiated Transport dispatch](docs/spec/behavior/transport-dispatch.md) | [lib/kobako/transport/dispatcher.rb](lib/kobako/transport/dispatcher.rb) | — |
+| ✅ [F-06 Capability Handle encoding and referencing](docs/spec/behavior/transport-dispatch.md) | [lib/kobako/catalog/handles.rb](lib/kobako/catalog/handles.rb) | — |
+| ✅ [F-07 Three-class error attribution and raising](docs/spec/behavior/outcome.md) | [lib/kobako/outcome.rb](lib/kobako/outcome.rb) | A guest-entry decode failure is exercised only through its payload half ([`CD-003`](docs/spec/behavior/codec.md)); a Run envelope that does not frame is not reachable through the public API |
+| ✅ [F-08 Guest output capture](docs/spec/behavior/sandbox.md) | [lib/kobako/capture.rb](lib/kobako/capture.rb) | — |
 | ✅ [F-09 Host–guest message codec](docs/wire-codec.md) | [crates/kobako-transport/](crates/kobako-transport/) (core envelope + ABI, one implementation), [lib/kobako/codec/](lib/kobako/codec/) (host payload codec) | The payload layer has a second implementation in `crates/kobako-codec`; the envelope layer is pinned by golden vectors instead |
-| ✅ [F-10 Reproducible build pipeline](SPEC.md#code-organization) | [tasks/wasm/build.rake](tasks/wasm/build.rake) | Verified by build-time gates (`rake anchors`, double-bake byte-identity, gemspec whitelist), not `test/` |
+| ✅ [F-10 Reproducible build pipeline](SPEC.md#code-organization) | [tasks/wasm/build.rake](tasks/wasm/build.rake) | Verified by build-time gates (double-bake byte-identity, gemspec whitelist), not `test/` |
 | ✅ [F-11 Multi-layer test and benchmark suite](SPEC.md#testing-style) | [test/](test/) | Benchmarks live in [benchmark/](benchmark/) with the gate in `tasks/bench/`; the anchor baseline advances only by deliberate re-bless |
-| ✅ [F-12 Guest block reception and yield re-entry](docs/behavior/yield.md) | [lib/kobako/transport/yielder.rb](lib/kobako/transport/yielder.rb) | — |
-| ✅ [F-13 Snippet preloading (`#preload`)](docs/behavior/invocation.md) | [lib/kobako/catalog/snippets.rb](lib/kobako/catalog/snippets.rb) | — |
-| ✅ [F-14 Synchronous entrypoint dispatch (`#run`)](docs/behavior/invocation.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
-| ✅ [F-15 Warm Sandbox pool checkout (`Kobako::Pool`)](docs/behavior/runtime.md) | [lib/kobako/pool.rb](lib/kobako/pool.rb) | — |
+| ✅ [F-12 Guest block reception and yield re-entry](docs/spec/behavior/transport-yield.md) | [lib/kobako/transport/yielder.rb](lib/kobako/transport/yielder.rb) | — |
+| ✅ [F-13 Snippet preloading (`#preload`)](docs/spec/behavior/sandbox.md) | [lib/kobako/catalog/snippets.rb](lib/kobako/catalog/snippets.rb) | — |
+| ✅ [F-14 Synchronous entrypoint dispatch (`#run`)](docs/spec/behavior/sandbox.md) | [lib/kobako/sandbox.rb](lib/kobako/sandbox.rb) | — |
+| ✅ [F-15 Warm Sandbox pool checkout (`Kobako::Pool`)](docs/spec/behavior/pool.md) | [lib/kobako/pool.rb](lib/kobako/pool.rb) | — |

data/crates/kobako-runtime/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.16.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.15.0...kobako-runtime-v0.16.0) (2026-09-15)
+
+
+### Miscellaneous Chores
+
+* **kobako-runtime:** Synchronize kobako crates versions
+
+## [0.15.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.14.0...kobako-runtime-v0.15.0) (2026-09-13)
+
+
+### Features
+
+* **spec:** declare what the guest answers when a value will not cross ([886a16f](https://github.com/elct9620/kobako/commit/886a16f173efe44766dd9884ac8bfed61113728a))
+
 ## [0.14.0](https://github.com/elct9620/kobako/compare/kobako-runtime-v0.13.1...kobako-runtime-v0.14.0) (2026-08-06)
 
 

data/crates/kobako-runtime/Cargo.toml

@@ -13,7 +13,7 @@
 
 [package]
 name = "kobako-runtime"
-version = "0.14.0"
+version = "0.16.0"
 edition = "2021"
 description = "Engine-neutral host runtime contract for embedding kobako Wasm guests."
 license = "Apache-2.0"
@@ -27,4 +27,4 @@ categories = ["wasm", "virtualization"]
 # in-tree builds (and the Ruby gem, which ships both crates) resolving
 # locally.
 [dependencies]
-kobako-transport = { version = "0.14.0", path = "../kobako-transport" }
+kobako-transport = { version = "0.16.0", path = "../kobako-transport" }

data/crates/kobako-runtime/README.md

@@ -26,7 +26,7 @@ map the neutral types onto their own language surface.
 
 ```toml
 [dependencies]
-kobako-runtime = "0.14.0" # x-release-please-version
+kobako-runtime = "0.16.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-runtime/src/profile.rs

@@ -4,8 +4,7 @@
 //! A rung on an ordered ladder: the host application requests the
 //! posture it wants, the runtime builds it and declares the posture it
 //! actually built, and the frontend refuses a declaration below the
-//! request — so the request is also the floor. The governing contract
-//! lives in the spec corpus (docs/behavior/security.md).
+//! request — so the request is also the floor.
 
 /// The ordered isolation ladder a runtime builds one rung of.
 ///
@@ -34,6 +33,7 @@ pub enum Profile {
 mod tests {
     use super::*;
 
+    // @behavior RT-014
     #[test]
     fn a_declaration_satisfies_any_floor_at_or_below_it() {
         assert!(Profile::Hermetic >= Profile::Hermetic);

data/crates/kobako-transport/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.16.0](https://github.com/elct9620/kobako/compare/kobako-transport-v0.15.0...kobako-transport-v0.16.0) (2026-09-15)
+
+
+### Miscellaneous Chores
+
+* **kobako-transport:** Synchronize kobako crates versions
+
+## [0.15.0](https://github.com/elct9620/kobako/compare/kobako-transport-v0.14.0...kobako-transport-v0.15.0) (2026-09-13)
+
+
+### Features
+
+* **spec:** declare the bytes both sides must already agree on ([3875755](https://github.com/elct9620/kobako/commit/3875755999550511837808dcd24a25086bedc926))
+
 ## [0.14.0](https://github.com/elct9620/kobako/compare/kobako-transport-v0.13.1...kobako-transport-v0.14.0) (2026-08-06)
 
 

data/crates/kobako-transport/Cargo.toml

@@ -12,7 +12,7 @@
 
 [package]
 name = "kobako-transport"
-version = "0.14.0"
+version = "0.16.0"
 edition = "2021"
 description = "The kobako core envelope — the fixed host↔guest wire frame every assembly shares."
 license = "Apache-2.0"

data/crates/kobako-transport/README.md

@@ -35,7 +35,7 @@ the golden vectors in this crate are derived from that document.
 
 ```toml
 [dependencies]
-kobako-transport = "0.14.0" # x-release-please-version
+kobako-transport = "0.16.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-transport/src/abi.rs

@@ -59,6 +59,7 @@ pub fn unpack_ptr_len(packed: u64) -> (u32, u32) {
 mod tests {
     use super::*;
 
+    // @behavior WE-001
     #[test]
     fn the_layout_is_high_ptr_low_len() {
         let packed = pack_ptr_len(0xAABB_CCDD, 0x1122_3344);
@@ -68,6 +69,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-002
     #[test]
     fn every_pair_round_trips() {
         for &(ptr, len) in &[

data/crates/kobako-transport/src/envelope/bytes.rs

@@ -151,6 +151,7 @@ impl Writer {
 mod tests {
     use super::*;
 
+    // @behavior WE-003
     #[test]
     fn round_trips_every_primitive() {
         let mut w = Writer::new();
@@ -181,6 +182,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-004
     #[test]
     fn u32_is_big_endian_on_the_wire() {
         let mut w = Writer::new();
@@ -192,6 +194,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-005
     #[test]
     fn a_length_running_past_the_end_is_refused() {
         // Declares 8 bytes but supplies 2.
@@ -203,6 +206,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-006
     #[test]
     fn a_count_larger_than_the_message_is_refused() {
         // Declares 0xffff_ffff elements in a 4-byte message.
@@ -214,6 +218,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-007
     #[test]
     fn non_utf8_in_a_text_field_is_refused() {
         let mut w = Writer::new();
@@ -226,6 +231,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-008
     #[test]
     fn trailing_bytes_after_a_self_delimiting_field_are_refused() {
         let mut w = Writer::new();

data/crates/kobako-transport/src/envelope/call.rs

@@ -82,6 +82,7 @@ impl<'a> Call<'a> {
 mod tests {
     use super::*;
 
+    // @behavior WE-009
     #[test]
     fn a_path_target_round_trips() {
         let call = Call {
@@ -98,6 +99,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-010
     #[test]
     fn a_handle_target_round_trips() {
         let call = Call {
@@ -114,6 +116,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-011
     #[test]
     fn the_payload_is_borrowed_not_interpreted() {
         // Bytes that are not valid msgpack: the envelope layer must carry
@@ -133,6 +136,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-012
     #[test]
     fn golden_layout_pins_the_path_kind_and_field_order() {
         let call = Call {
@@ -155,6 +159,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-013
     #[test]
     fn golden_layout_pins_the_handle_kind_and_its_bare_id() {
         let call = Call {
@@ -176,6 +181,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-014
     #[test]
     fn an_unknown_kind_is_refused() {
         let bytes = [9u8, 0, 0, 0, 0];
@@ -185,6 +191,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-015
     #[test]
     fn handle_id_zero_is_refused() {
         let call_bytes = {
@@ -198,6 +205,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-016
     #[test]
     fn a_non_boolean_block_flag_is_refused() {
         let bytes = {
@@ -211,6 +219,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-017
     #[test]
     fn a_truncated_call_is_refused() {
         let bytes = [KIND_PATH, 0, 0, 0, 4, b'a'];

data/crates/kobako-transport/src/envelope/error_record.rs

@@ -47,6 +47,7 @@ mod tests {
         }
     }
 
+    // @behavior WE-047
     #[test]
     fn round_trips_through_the_wire() {
         let mut w = Writer::new();
@@ -60,6 +61,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-048
     #[test]
     fn an_empty_backtrace_is_legal() {
         let record = ErrorRecord {
@@ -77,6 +79,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-049
     #[test]
     fn golden_layout_is_name_then_message_then_backtrace() {
         let record = ErrorRecord {

data/crates/kobako-transport/src/envelope/fault.rs

@@ -133,6 +133,7 @@ impl Fault {
 mod tests {
     use super::*;
 
+    // @behavior WE-038
     #[test]
     fn every_kind_round_trips_through_the_wire() {
         for kind in [
@@ -155,6 +156,7 @@ mod tests {
         }
     }
 
+    // @behavior WE-039
     #[test]
     fn a_kind_the_reader_does_not_know_degrades_to_undefined() {
         let encoded = vec![0xfe, 0, 0, 0, 1, b'x'];
@@ -167,6 +169,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-040
     #[test]
     fn a_field_the_reader_does_not_know_is_skipped() {
         let mut w = Writer::new();
@@ -182,6 +185,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-041
     #[test]
     fn golden_layout_is_kind_then_message() {
         let mut w = Writer::new();
@@ -196,6 +200,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-042 WE-043
     #[test]
     fn names_map_both_ways() {
         for kind in [

data/crates/kobako-transport/src/envelope/invocation_frames.rs

@@ -103,6 +103,7 @@ impl Snippets {
 mod tests {
     use super::*;
 
+    // @behavior WE-050
     #[test]
     fn empty_bindings_round_trip() {
         let encoded = Bindings::default().encode();
@@ -113,6 +114,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-051
     #[test]
     fn bindings_round_trip_every_path() {
         let bindings = Bindings {
@@ -126,6 +128,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-052
     #[test]
     fn snippets_round_trip_both_kinds_in_order() {
         let snippets = Snippets {
@@ -147,6 +150,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-053
     #[test]
     fn an_empty_snippet_table_round_trips() {
         let encoded = Snippets::default().encode();
@@ -157,6 +161,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-054
     #[test]
     fn golden_layout_pins_the_bindings_as_a_counted_list() {
         let bindings = Bindings {
@@ -172,6 +177,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-055
     #[test]
     fn golden_layout_pins_the_snippet_entry_shape() {
         let snippets = Snippets {
@@ -198,6 +204,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-056
     #[test]
     fn an_unknown_snippet_kind_is_refused() {
         let bytes = {
@@ -211,6 +218,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-057
     #[test]
     fn a_snippet_count_the_frame_cannot_satisfy_is_refused() {
         let bytes = [0xff, 0xff, 0xff, 0xff];
@@ -220,6 +228,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-058
     #[test]
     fn trailing_bytes_after_a_frame_are_refused() {
         let mut encoded = Bindings::default().encode();

data/crates/kobako-transport/src/envelope/outcome.rs

@@ -118,6 +118,7 @@ mod tests {
         }
     }
 
+    // @behavior WE-027
     #[test]
     fn an_ok_outcome_round_trips() {
         let outcome = Outcome::Ok(vec![0x2a]);
@@ -129,6 +130,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-028
     #[test]
     fn a_panic_round_trips() {
         let outcome = Outcome::Panic(panic_sample());
@@ -140,6 +142,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-029
     #[test]
     fn a_panic_carrying_available_names_round_trips() {
         let outcome = Outcome::Panic(Panic {
@@ -154,6 +157,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-030
     #[test]
     fn a_panic_offering_no_correction_decodes_as_an_empty_list() {
         let encoded = Outcome::Panic(panic_sample()).encode();
@@ -166,6 +170,7 @@ mod tests {
         }
     }
 
+    // @behavior WE-031
     #[test]
     fn attribution_reads_origin_alone() {
         let service = Panic {
@@ -180,6 +185,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-032
     #[test]
     fn bytes_past_the_available_list_are_refused() {
         let mut encoded = Outcome::Panic(panic_sample()).encode();
@@ -190,6 +196,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-033
     #[test]
     fn an_unrecognised_origin_attributes_to_the_sandbox() {
         // Written by hand: the origin field is an open set on the wire, so
@@ -207,6 +214,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-034
     #[test]
     fn golden_layout_pins_the_ok_tag() {
         assert_eq!(
@@ -216,6 +224,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-035
     #[test]
     fn golden_layout_pins_the_panic_field_order() {
         let panic = Panic {
@@ -243,6 +252,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-036
     #[test]
     fn a_zero_length_outcome_is_refused() {
         assert!(
@@ -251,6 +261,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-037
     #[test]
     fn an_unknown_outcome_tag_is_refused() {
         assert!(