@frockbot/architecture-checks 0.3.1 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/architecture-checks",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "private": false,
   "type": "module",
   "description": "Automated checks for the constitutional rules that can be enforced mechanically.",
@@ -9,21 +9,23 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/computer-core": "0.3.1",
-    "@frockbot/connection-core": "0.3.1",
-    "@frockbot/kernel-agent-loop": "0.3.1",
-    "@frockbot/kernel-composition": "0.3.1",
-    "@frockbot/kernel-contracts": "0.3.1",
-    "@frockbot/kernel-do": "0.3.1",
-    "@frockbot/plugin-authoring": "0.3.1",
-    "@frockbot/plugin-computer": "0.3.1",
-    "@frockbot/plugin-memory": "0.3.1",
-    "@frockbot/plugin-models": "0.3.1",
-    "@frockbot/plugin-prompt": "0.3.1",
-    "@frockbot/plugin-provider-foundation": "0.3.1",
-    "@frockbot/plugin-provider-ollama-cloud": "0.3.1",
-    "@frockbot/plugin-skills": "0.3.1",
-    "@frockbot/plugin-tools": "0.3.1",
+    "@frockbot/application-foundation": "0.3.2",
+    "@frockbot/computer-core": "0.3.2",
+    "@frockbot/connection-core": "0.3.2",
+    "@frockbot/kernel-agent-loop": "0.3.2",
+    "@frockbot/kernel-composition": "0.3.2",
+    "@frockbot/kernel-contracts": "0.3.2",
+    "@frockbot/kernel-do": "0.3.2",
+    "@frockbot/plugin-applets": "0.3.2",
+    "@frockbot/plugin-authoring": "0.3.2",
+    "@frockbot/plugin-computer": "0.3.2",
+    "@frockbot/plugin-memory": "0.3.2",
+    "@frockbot/plugin-models": "0.3.2",
+    "@frockbot/plugin-prompt": "0.3.2",
+    "@frockbot/plugin-provider-foundation": "0.3.2",
+    "@frockbot/plugin-provider-ollama-cloud": "0.3.2",
+    "@frockbot/plugin-skills": "0.3.2",
+    "@frockbot/plugin-tools": "0.3.2",
     "cordis": "4.0.0-rc.8"
   },
   "devDependencies": {

package/src/applet-boundaries.test.ts

@@ -0,0 +1,174 @@
+// The Applet rules of `AGENTS.md`, enforced where they are source-graph facts.
+//
+// The behavioural half — facet storage surviving a generation change and a
+// revert, a failed health check leaving the prior facet resident, delete
+// removing storage, versions, and entry, and the viewer token's scope — runs
+// against the real Durable Object in workerd:
+// `apps/cloudflare/test/applets.workerd.ts`. What is checked here is what only
+// the source can answer: that a facet exists nowhere but under the Applet
+// Durable Object, that an Applet's page carries no credential but its token,
+// and that the kernel's Applet records name no Package.
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+const repoRoot = resolve(import.meta.dirname, "..", "..", "..");
+
+function sourceFiles(...patterns: string[]): string[] {
+  const files: string[] = [];
+  for (const pattern of patterns) {
+    files.push(
+      ...new Bun.Glob(pattern).scanSync({ cwd: repoRoot, onlyFiles: true }),
+    );
+  }
+  return files
+    .filter((path) => !path.includes("node_modules/"))
+    .filter((path) => !path.includes("/dist/"))
+    .sort();
+}
+
+function read(path: string): string {
+  return readFileSync(join(repoRoot, path), "utf8");
+}
+
+describe("Applet boundaries", () => {
+  // Constitution — Package composition: "Composition Packages never own
+  // storage; facets exist only under the Applet Durable Object."
+  test("only the Applet Durable Object mounts a facet", () => {
+    const allowed = new Set([
+      "apps/cloudflare/src/applet-state.ts",
+      // The lane S1 spike, deliberately kept out of `test:workerd`.
+      "apps/cloudflare/test/spike-applet-facet-worker.ts",
+    ]);
+    const offenders: string[] = [];
+    for (const path of sourceFiles(
+      "packages/**/src/**/*.ts",
+      "apps/*/src/**/*.ts",
+      "apps/*/test/**/*.ts",
+      "applications/*/src/**/*.ts",
+    )) {
+      if (allowed.has(path)) continue;
+      const source = read(path);
+      if (/\bctx\.facets\.|\bstate\.facets\.|\bfacets\.get\(/.test(source)) {
+        offenders.push(path);
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  // Constitution — Package composition: the kernel "mounts the instance's
+  // server artifact ... through Worker Loader with `globalOutbound` disabled".
+  test("the Applet loader mounts with no egress and a two-key env", () => {
+    const source = read("apps/cloudflare/src/applet-state.ts");
+    expect(source).toContain("globalOutbound: null");
+    // Exactly `IDENTITY` and `CAPABILITIES`, and nothing else, is placed in the
+    // loaded worker's env. The workerd test asserts the same from inside.
+    const env = source.slice(source.indexOf("env: {"));
+    expect(env).toContain("IDENTITY:");
+    expect(env).toContain("CAPABILITIES:");
+    for (const forbidden of [
+      "APPLICATION_ARTIFACTS:",
+      "APPLET_STATES:",
+      "APPLETS:",
+      "SECRET_TOKEN",
+    ]) {
+      expect(env.slice(0, env.indexOf("limits:")).includes(forbidden)).toBe(
+        false,
+      );
+    }
+  });
+
+  // Spike finding 1 (`docs/research/spike-applet-facets.md` §7): a loader id is
+  // served from cache with the `env` it was first loaded with, process-wide, so
+  // two Applets of one User with identical code would otherwise share one
+  // IDENTITY and one CAPABILITIES stub.
+  test("the Applet loader id includes the Applet instance", () => {
+    const source = read("packages/kernel-do/src/applets.ts");
+    const start = source.indexOf("export function appletLoaderIdV1");
+    const digest = source.indexOf("JSON.stringify({", start);
+    const body = source.slice(digest, source.indexOf("})", digest));
+    for (const input of [
+      "contract",
+      "appletId",
+      "serverHash",
+      "bindingDigest",
+    ]) {
+      expect(body).toContain(`${input}: input.${input}`);
+    }
+  });
+
+  // Spike finding 2 (§5b): `ctx.storage.setAlarm` inside a facet throws, and the
+  // throw is not catchable by the Applet, so the kernel object owns the alarm.
+  test("the Applet capability surface is the alarm and the model, and nothing else", () => {
+    const source = read("apps/cloudflare/src/applet-state.ts");
+    const capabilities = source.slice(
+      source.indexOf("export class AppletCapabilities"),
+      source.indexOf("export class AppletState"),
+    );
+    const methods = [
+      ...capabilities.matchAll(/^ {2}(?:async )?([a-zA-Z]+)\(/gmu),
+    ].map((match) => match[1]);
+    expect(methods.toSorted()).toEqual(["invokeModel", "scheduleAlarm"]);
+  });
+
+  // Spike finding 4 (§8): "Stubs pointing to Durable Object facets are not
+  // serializable" — the kernel object forwards, and never hands the stub out.
+  test("no facet stub is returned across an RPC boundary", () => {
+    const source = read("apps/cloudflare/src/applet-state.ts");
+    // `#facet` is private, and every public method that uses it consumes it in
+    // place. A public method returning it would have to name it in a return.
+    expect(/return\s+(await\s+)?this\.#facet\(/.test(source)).toBe(false);
+  });
+
+  // Constitution — Architecture checks: "an open Applet's page carries no
+  // credential and reaches its facet only through a short-lived viewer token
+  // scoped to that Applet and User."
+  test("the viewer token is HMAC-signed, scoped, and short-lived", () => {
+    const source = read("packages/kernel-do/src/applets.ts");
+    expect(source).toContain('name: "HMAC", hash: "SHA-256"');
+    expect(source).toContain("APPLET_VIEWER_TOKEN_TTL_MS = 15 * 60_000");
+    // The claims are exactly the scope: User, Applet, generation, expiry.
+    const minted = source.slice(
+      source.indexOf("export async function mintAppletViewerTokenV1"),
+    );
+    const payload = minted.slice(
+      minted.indexOf("JSON.stringify({"),
+      minted.indexOf("}),"),
+    );
+    expect(payload).toContain("u: claims.u");
+    expect(payload).toContain("a: claims.a");
+    expect(payload).toContain("g: claims.g");
+    expect(payload).toContain("exp: claims.exp");
+    // Constant-time comparison: the signature check is the whole of the door.
+    expect(source).toContain("constantTimeEqualsV1(presented, expected)");
+  });
+
+  test("the socket route compares the token's Applet against the path", () => {
+    const source = read("apps/cloudflare/src/gateway.ts");
+    expect(source).toContain("if (claims.a !== appletId)");
+    // The token never travels on to the Durable Object; the verified claims do.
+    expect(source).toContain('forwarded.searchParams.delete("token")');
+  });
+
+  // Constitution — Minimal kernel: "The kernel imports no Package."
+  test("the kernel's Applet records import no Package", () => {
+    const source = read("packages/kernel-do/src/applets.ts");
+    expect(/from "@frockbot\/plugin-/.test(source)).toBe(false);
+    // The Applets Package's root ids are declared, not imported, and the TODO
+    // says why and names the lane that removes the duplication.
+    expect(source).toContain("TODO(lane C1)");
+  });
+
+  // ADR 0022 decision 4: an Applet's tools are Composition members, so an
+  // admitted Turn records the Applet generation it ran under.
+  test("Applet members are covered by the artifact set hash", () => {
+    const source = read("packages/kernel-composition/src/generation.ts");
+    const hash = source.slice(
+      source.indexOf("export function compositionArtifactSetHashV1"),
+    );
+    expect(hash.slice(0, hash.indexOf("\n}"))).toContain("applets");
+    // And a Bot cannot author, install, or remove one directly: no origin kind
+    // names an Applet.
+    expect(source).not.toContain('kind: "applet-install"');
+  });
+});

package/src/applets-package.test.ts

@@ -0,0 +1,161 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { decodeFrockBotManifest } from "@frockbot/kernel-composition";
+import { compileFoundationApplication } from "@frockbot/application-foundation/runtime";
+import { APPLETS_PACKAGE_ARTIFACT_V1 } from "@frockbot/application-foundation/generated/applets-artifact";
+import appletsManifest from "@frockbot/plugin-applets/manifest";
+
+/**
+ * `AGENTS.md`, Package composition:
+ *
+ * > Every Contribution kind is resolved from the manifest and an artifact,
+ * > never from a switch over Package identity. A first-party Package that
+ * > declares only Bot-authorable Contribution kinds ships as an artifact-backed
+ * > member and loads through the same path as a Bot-authored one.
+ *
+ * ADR 0022 decision 8 makes the Applets Package the standing proof of that
+ * sentence, and `docs/plans/applets.md` D6 makes it a hard requirement: "The
+ * Applets Package itself must be buildable inside a Bot with identical
+ * functionality. It therefore uses only Bot-authorable Contribution kinds."
+ *
+ * These checks are the cheap half — the manifest's shape and the application's
+ * declaration. The expensive half, authoring the same Package through
+ * `package_author` and mounting it, is
+ * `apps/cloudflare/test/applets-package.workerd.ts`, because it needs a real
+ * Worker Loader.
+ */
+
+const repoRoot = resolve(import.meta.dirname, "..", "..", "..");
+const APPLETS_SPECIFIER = "@frockbot/plugin-applets";
+
+const manifest = decodeFrockBotManifest(appletsManifest);
+
+describe("the Applets Package declares only what a Bot could declare", () => {
+  test("its manifest is v5 and its runtime is a Bot isolate", () => {
+    expect(manifest.schemaVersion).toBe(5);
+    expect(manifest.contributions.runtime).toEqual({
+      entry: "./package",
+      host: "bot-isolate",
+    });
+    expect(manifest.tools?.map((tool) => tool.name)).toEqual([
+      "applet_list",
+      "applet_create",
+      "applet_publish",
+      "applet_revert",
+      "applet_delete",
+      "applet_focus",
+      "applet_generations",
+    ]);
+  });
+
+  test("it contributes no backend and no client module", () => {
+    // A `backend` Contribution runs in the kernel's own Worker and a module
+    // `client` Contribution is compiled into the hosted bundle. Neither is
+    // something a Bot can author, so either one would make this the Package a
+    // Bot could not have written.
+    expect(manifest.contributions.backend).toBeUndefined();
+    expect(manifest.contributions.desktop).toBeUndefined();
+    expect(manifest.contributions.mobile).toBeUndefined();
+    const client = manifest.contributions.client;
+    expect(client).toBeDefined();
+    expect(client && "kind" in client && client.kind).toBe("iframe");
+    expect(client && "entry" in client).toBe(false);
+  });
+
+  test("its pages and entry are declarative, on Bot-authorable slots", () => {
+    const client = manifest.contributions.client;
+    if (!client || !("pages" in client)) throw new Error("no iframe client");
+    expect(
+      client.pages.map((page) => [page.id, page.mounts.map((m) => m.slot)]),
+    ).toEqual([
+      ["list", ["frockbot.surface:list"]],
+      ["canvas", ["frockbot.right-panel"]],
+    ]);
+    for (const page of client.pages) {
+      expect(page.artifact.mediaType).toBe("text/html");
+      expect(page.artifact.contentHash).toMatch(/^[0-9a-f]{64}$/);
+      expect(page.artifact.size).toBeGreaterThan(0);
+    }
+    expect(client.entries).toEqual([
+      {
+        id: "open",
+        slot: "frockbot.sidebar-actions",
+        order: 5,
+        label: "Applets",
+        icon: "applets",
+        opens: { kind: "surface", page: "list" },
+      },
+    ]);
+  });
+
+  test("it declares its own durable source root, User-scoped", () => {
+    expect(manifest.roots).toEqual([{ id: "source", scope: "user" }]);
+  });
+
+  test("the package ships no in-process entry point", () => {
+    const packageJson = JSON.parse(
+      readFileSync(
+        join(repoRoot, "packages/plugin-applets/package.json"),
+        "utf8",
+      ),
+    ) as { exports: Record<string, string> };
+    // `./root` is the durable-root addressing the kernel needs to reach the
+    // Applet's source, and `./manifest` is the manifest itself. Neither is a
+    // Contribution: an `./agent`, `./backend`, or `./client` export would be.
+    expect(Object.keys(packageJson.exports).toSorted()).toEqual([
+      "./manifest",
+      "./package.json",
+      "./root",
+    ]);
+  });
+});
+
+describe("the foundation member is artifact-backed", () => {
+  test("the application declares an artifact for it, and the plan carries it", async () => {
+    const application = JSON.parse(
+      readFileSync(
+        join(repoRoot, "applications/foundation/frockbot.application.json"),
+        "utf8",
+      ),
+    ) as { packages: Array<{ specifier: string; artifact?: unknown }> };
+    const declared = application.packages.find(
+      (entry) => entry.specifier === APPLETS_SPECIFIER,
+    );
+    expect(declared).toBeDefined();
+    expect(declared!.artifact).toEqual(APPLETS_PACKAGE_ARTIFACT_V1);
+
+    const plan = await compileFoundationApplication();
+    const member = plan.packages.find(
+      (pkg) => pkg.specifier === APPLETS_SPECIFIER,
+    );
+    expect(member?.artifact).toEqual(APPLETS_PACKAGE_ARTIFACT_V1);
+    expect(member?.artifact?.mediaType).toBe("application/javascript");
+    expect(member?.artifact?.contentHash).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  test("it is the only artifact-backed member, and it is not in either Contribution table", async () => {
+    const plan = await compileFoundationApplication();
+    const artifactBacked = plan.packages.filter(
+      (pkg) => pkg.artifact !== undefined,
+    );
+    expect(artifactBacked.map((pkg) => pkg.id)).toEqual(["applets"]);
+
+    // The tables are keyed by contribution specifier, and an artifact-backed
+    // member has none: it loads through the isolate host instead. If one ever
+    // appeared in a table, the member would mount twice.
+    const tables = [
+      readFileSync(
+        join(repoRoot, "applications/foundation/src/contributions.ts"),
+        "utf8",
+      ),
+      readFileSync(
+        join(repoRoot, "applications/foundation/src/client-contributions.ts"),
+        "utf8",
+      ),
+    ];
+    for (const table of tables) {
+      expect(table).not.toContain(APPLETS_SPECIFIER);
+    }
+  });
+});

package/src/contribution-resolution.test.ts

@@ -0,0 +1,164 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import {
+  foundationBackendContributions,
+  assertFoundationBackendContributionsResolvable,
+} from "@frockbot/application-foundation/contributions";
+import { compileFoundationApplication } from "@frockbot/application-foundation/runtime";
+
+/**
+ * `AGENTS.md`, Package composition:
+ *
+ * > Every Contribution kind is resolved from the manifest and an artifact,
+ * > never from a switch over Package identity.
+ *
+ * The application resolves a Contribution by looking the specifier its
+ * manifest declares up in one table. These checks hold the rule mechanically:
+ * no application or kernel module may compare a specifier against a Package's
+ * name, and every Contribution the application declares must reach the table
+ * (or an artifact, which loads through the isolate host instead).
+ */
+
+const repoRoot = resolve(import.meta.dirname, "..", "..", "..");
+const read = (path: string) => readFileSync(join(repoRoot, path), "utf8");
+
+/** The modules that own the table, and are therefore allowed to name Packages. */
+const tableModules = new Set([
+  "applications/foundation/src/contributions.ts",
+  "applications/foundation/src/client-contributions.ts",
+]);
+
+function resolutionModules(): string[] {
+  const files: string[] = ["apps/cloudflare/src/bot-state.ts"];
+  for (const entry of new Bun.Glob("applications/foundation/src/*.ts").scanSync(
+    repoRoot,
+  )) {
+    const path = entry.replaceAll("\\", "/");
+    const full = `applications/foundation/src/${path.split("/").pop()}`;
+    if (tableModules.has(full)) continue;
+    if (full.endsWith(".test.ts")) continue;
+    files.push(full);
+  }
+  return files.sort();
+}
+
+describe("Contribution resolution is manifest-driven", () => {
+  test("no application or Bot Durable Object module switches on a Package specifier", () => {
+    const files = resolutionModules();
+    // The check is only worth anything if it is reading the modules that
+    // actually resolve Contributions.
+    expect(files).toContain("apps/cloudflare/src/bot-state.ts");
+    expect(files).toContain("applications/foundation/src/runtime.ts");
+    expect(files).toContain("applications/foundation/src/user.ts");
+    expect(files).toContain("applications/foundation/src/client.ts");
+    expect(files).not.toContain("applications/foundation/src/contributions.ts");
+    const offenders: string[] = [];
+    for (const file of files) {
+      const source = read(file);
+      for (const [index, line] of source.split("\n").entries()) {
+        const at = `${file}:${index + 1}`;
+        // A comparison against a Package's own name is the switch this rule
+        // exists to forbid, in whichever shape it is written.
+        if (/\bspecifier\s*[=!]==?\s*["'`]@frockbot\//.test(line)) {
+          offenders.push(`${at}: compares a specifier against a Package name`);
+        }
+        if (/^\s*case\s+["'`]@frockbot\//.test(line)) {
+          offenders.push(`${at}: switches over a Package specifier`);
+        }
+        if (/\bswitch\s*\(\s*specifier\s*\)/.test(line)) {
+          offenders.push(`${at}: switches over a Contribution specifier`);
+        }
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  test("the kernel resolves a Contribution without naming a Package", () => {
+    const descriptors = read("packages/kernel-contracts/src/contributions.ts");
+    expect(descriptors).not.toContain("@frockbot/plugin-");
+    expect(descriptors).toContain("defineBackendContribution");
+    expect(descriptors).toContain("defineClientContribution");
+  });
+
+  test("every backend Contribution the application declares resolves through the table", async () => {
+    const plan = await compileFoundationApplication();
+    const table = foundationBackendContributions();
+    const declared: string[] = [];
+    for (const pkg of plan.packages) {
+      for (const backend of pkg.manifest.contributions.backend ?? []) {
+        const specifier = `${pkg.specifier}${backend.entry.slice(1)}`;
+        declared.push(specifier);
+        // An artifact-backed member loads through the isolate host; every
+        // other member is first-party in-process and must be in the table.
+        if (pkg.artifact) {
+          expect(table.has(specifier)).toBe(false);
+          continue;
+        }
+        expect(table.get(specifier)?.host).toBe(backend.host);
+      }
+    }
+    expect(declared.length).toBeGreaterThan(0);
+    // And the compile-time assertion agrees.
+    expect(() =>
+      assertFoundationBackendContributionsResolvable(plan),
+    ).not.toThrow();
+  });
+
+  test("a declared Contribution that is neither in the table nor artifact-backed fails to compile", async () => {
+    const plan = await compileFoundationApplication();
+    const broken = {
+      ...plan,
+      packages: plan.packages.map((pkg) =>
+        pkg.id === "admin"
+          ? {
+              ...pkg,
+              specifier: "@frockbot/plugin-not-in-the-table",
+            }
+          : pkg,
+      ),
+    };
+    expect(() =>
+      assertFoundationBackendContributionsResolvable(broken),
+    ).toThrow(
+      /neither in the application's Contribution table nor artifact-backed/,
+    );
+  });
+
+  test("every client Contribution the application declares exports a descriptor the table imports", async () => {
+    const plan = await compileFoundationApplication();
+    const table = read("applications/foundation/src/client-contributions.ts");
+    let checked = 0;
+    for (const pkg of plan.packages) {
+      const client = pkg.manifest.contributions.client;
+      if (!client || !("entry" in client)) continue;
+      const specifier = `${pkg.specifier}${client.entry.slice(1)}`;
+      const entryPath = packageEntryPath(pkg.specifier, client.entry);
+      const source = read(entryPath);
+      expect(
+        source.includes(`defineClientContribution`) &&
+          source.includes(JSON.stringify(specifier)),
+      ).toBe(true);
+      // The table imports the descriptor: by specifier, or (for the Computer
+      // Package, whose client entry the application reaches by path) by file.
+      expect(
+        table.includes(`"${specifier}"`) ||
+          table.includes(entryPath.replace("packages/", "").replace(".ts", "")),
+      ).toBe(true);
+      checked += 1;
+    }
+    expect(checked).toBeGreaterThan(0);
+  });
+});
+
+/** Where a Package's export subpath resolves on disk. */
+function packageEntryPath(specifier: string, entry: string): string {
+  const name = specifier.split("/").slice(0, 2).join("/");
+  const directory = `packages/${name.split("/")[1]}`;
+  const manifest = JSON.parse(read(`${directory}/package.json`)) as {
+    exports?: Record<string, string>;
+  };
+  const target = manifest.exports?.[entry];
+  if (!target) throw new Error(`${name} does not export "${entry}"`);
+  return `${directory}/${target.replace("./", "")}`;
+}

package/src/package-ui-boundaries.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { decodeFrockBotManifest } from "@frockbot/kernel-composition";
 import { authoredManifestV1 } from "@frockbot/plugin-authoring/shared";
 
 const repoRoot = resolve(import.meta.dirname, "..", "..", "..");
@@ -16,24 +17,30 @@ describe("non-first-party Package UI boundaries", () => {
         { name: "weather_lookup", description: "Weather", inputSchema: {} },
       ],
       ui: {
-        artifact: {
-          contentHash: "a".repeat(64),
-          size: 1,
-          mediaType: "text/html",
-          bundlerVersion: "frockbot-inline-html@1",
-        },
-        mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+        pages: [
+          {
+            id: "main",
+            artifact: {
+              contentHash: "a".repeat(64),
+              size: 1,
+              mediaType: "text/html",
+              bundlerVersion: "frockbot-inline-html@1",
+            },
+            mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+          },
+        ],
       },
     });
+    // The synthesized manifest crosses the kernel's own strict decoder.
+    expect(decodeFrockBotManifest(manifest).schemaVersion).toBe(5);
     const client = (manifest.contributions as Record<string, unknown>)
       .client as Record<string, unknown>;
     expect(client.kind).toBe("iframe");
     expect(client).not.toHaveProperty("entry");
+    expect(client).not.toHaveProperty("artifact");
     const host = read("packages/plugin-shell/src/client/PackageIframeHost.vue");
     expect(host).toContain("<iframe");
-    expect(host).toContain(
-      "/packages/${props.contribution.artifact.contentHash}.html",
-    );
+    expect(host).toContain("/packages/${props.page.artifact.contentHash}.html");
   });
 
   test("a page cannot read the app's cookies or storage", () => {

package/src/turn-boundaries.test.ts

@@ -332,6 +332,7 @@ describe("Turn boundaries", () => {
         "skills/own-bot/SKILL.md",
         "skills/own-user/SKILL.md",
         "managed/add-connector/SKILL.md",
+        "managed/applets/SKILL.md",
         "managed/export-bot-template/SKILL.md",
         "managed/import-bot-template/SKILL.md",
         "managed/learn-from-demonstration/SKILL.md",