Skip to content

[CHORE] Retire capsule-wire into the Salvo review bucket - #430

Open
justin13888 wants to merge 5 commits into
docs/reset-trackers-and-add-roadmap-398from
chore/retire-capsule-wire-400
Open

[CHORE] Retire capsule-wire into the Salvo review bucket#430
justin13888 wants to merge 5 commits into
docs/reset-trackers-and-add-roadmap-398from
chore/retire-capsule-wire-400

Conversation

@justin13888

@justin13888 justin13888 commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Description

capsule-wire was extracted by S-C27 so the Salvo server's response taxonomy could outlive
the transport. The transport swapped and the taxonomy did not come with it: on Kynos the status
is part of the return type, capsule-server's problem, limits and body modules carry the
coded-problem bodies, the size limits and the header census, and tests/conformance.rs asserts
both directions of the agreement the extraction existed to keep. Nothing live imports
capsule_wirecapsule-server declared it as a path dependency and used it zero times, one
rustdoc intra-doc link aside — while a third of the crate is a salvo_responses! adapter for a
framework S-C59 removed from the workspace.

So the crate leaves the active workspace and lands as review material beside its only real
consumers, at legacy-review/server-salvo/wire/ with its manifest disabled, per the convention
every other quarantined Salvo crate follows.

Summary

Three commits, each leaving the tree coherent:

  1. chore(wire)!: move capsule-wire into the Salvo review bucketgit mv capsule-wire legacy-review/server-salvo/wire, Cargo.tomlCargo.toml.disabled; both [workspace]
    member entries and capsule-server's path dependency dropped; capsule-server/src/lib.rs's
    module comment reworded so it no longer emits an intra-doc link to a crate that is no longer
    built; Cargo.lock regenerated (9 lines: the package stanza plus one edge).
  2. chore(xtask,ci): close the boundary capsule-wire leftcapsule-wire added to
    RETIRED_DEPENDENCIES, so a re-added path dependency in any member is a boundary violation
    rather than a review question; the capsule-wire/** line removed from CI's rust paths
    filter; a "Do not reuse" bullet in legacy-review/server-salvo/REVIEW.md.
  3. docs(slices,adr): record capsule-wire's retirement — ADR-0004 proposedaccepted
    with the Contract: line adr/README.md requires; S-C27 re-scoped to done-by-retirement
    with a Landed note; the salvo→kynos migration-register row amended; the module-map.md crate
    row and the ROADMAP.md package row removed; the three disabled Salvo manifests repointed at
    ../wire.

Two corrections to figures the issue and the tracker carried:

  • The issue says 42 salvo_responses! sites. Measured: 40 macro invocations — .rs files
    under legacy-review/server-salvo/ outside the moved crate — plus two use capsule_wire::…
    lines, which is the 42 capsule_wire references counted separately. The Landed note says
    40, matching the figure the salvo→kynos register row already carried. (An earlier revision of
    this pull request said 41: that count was taken with no --include, so it swept this change's
    own REVIEW.md bullet, which names the macro in prose. Corrected in 393d78d6.)
  • The salvo→kynos register row claimed architecture-check reports 63 boundary violations.
    It reports zero — the tree it counted is quarantined and is_ignored_directory skips
    legacy-review/. The clause is put into the past tense it belongs in; no new figure is
    asserted.

Validation

Git hooks are not installed in this checkout (.git/hooks holds only *.sample, no
core.hooksPath), so hk's pre-commit and pre-push steps did not run and every gate below was
invoked explicitly as its mise task. No --no-verify was used.

Command Outcome
cargo metadata --offline --no-deps --format-version 1 | grep -c '"name":"capsule-wire"' 0 — the package is out of the graph. (The plan's grep -c capsule-wire returns 1 in this checkout because the worktree directory is named Capsule-chore-retire-capsule-wire-400; the "name": form is the same assertion without the path artefact.)
grep -n 'capsule-wire' Cargo.lock no match
cargo check -p capsule-server --offline pass — compiles with the dependency gone
mise run architecture-check pass — "Rust architecture boundaries are intact". Run twice: after slice 2, and again after slice 3, the second time to prove nothing in the new ADR or SLICES.md text trips a retired-component name.
cargo nextest run -p xtask --offline pass — 100 tests run, 100 passed, 0 skipped
mise run check-docs-truth pass — cross-links 528/528, endpoint-census 84/84, module-paths 120/120, roadmap 46 packages all rows resolve
mise run lint-check-md pass — 172 files, 0 issues
mise run check-commits pass — "no errors in 9 commits" (convco)
mise run check-rust pass (exit 0) — fmt, clippy, i18n-check, i18n-guard, openapi-check-kynos, architecture-check, license-check, translate-readme-check, build-rust, build-check-wasm, build-ffi, lint-check-ffi, gen-bindings, verify-examples
mise run test-rust pass (exit 0) — cargo nextest run --workspace, then -p capsule-core --features ffi, then -p capsule-sdk --features ffi (160 tests run, 160 passed, 0 skipped)

mise run check-docs-truth was also run before the ROADMAP.md edit, deliberately, to
establish the mechanism rather than guess it: it reported
ROADMAP.md:44 capsule-wire is not declared by any manifest in the tree. A second deliberate
run with the row rewritten as | legacy-review/server-salvo/wire | review-bucket | … | reported
the same finding for that name — reviewBuckets in check-roadmap.mjs enumerates
legacy-review/<bucket>/ at depth one only, so a crate inside the existing server-salvo bucket
is not a package the check can key. That is the evidence behind decision 5.

CI on this pull request

Every failure below is classified against evidence, not asserted:

Job Result Classification
Rust (fmt + clippy + build), Rust (tests), Rust cross (android / linux-arm64 / windows), Kotlin, Docs, Docs truth, Commit lint, Detect changes pass
Markdown (lint) fail after 5s in the Setup Bun step: TypeError: fetch failed from oven-sh/setup-bun@v2. No repository file is read before that step. The same gate passes locally on this tree (172 files, 0 issues) and passed on the base pull request. flaky — infrastructure. Re-run once the workflow run finishes; a job cannot be re-run while its run is in progress.
Web (format + lint + test + build) fail in Install dependencies: bun install --frozen-lockfile in capsule-web reports lockfile had changes, but lockfile is frozen. capsule-web/bun.lock and capsule-web/package.json are byte-identical between master and this branch's base, and this change touches no web file. The job ran here only because the web paths filter includes .github/workflows/ci.yml, which this change edits, so it was skipping on the base pull request and this branch is the first to exercise it. pre-existing, and already owned elsewhere: the pull request for issue #416 carries a 15-line capsule-web/bun.lock fix and its Web job passes. Fixing it here would duplicate that lane's change and sits outside this lane's manifest.
Build Capsule.apk + :core JVM smoke fail pre-existing — the same workflow fails on master (run 33572237154), and ROADMAP.md records capsule-android as blocked because the app references a DI layer that is not in the tree (#389). Nothing here touches Kotlin or Gradle.

Risks and rollout

No persisted data, no deployed behaviour, no wire compatibility: nothing in the workspace
imported the crate, so no public API moves. git revert of the merge commit restores it, and
each commit reverts independently.

The one operational effect is CI's rust paths filter losing a line; the directory it named is
now inside legacy-review/, which no Rust gate descends into.

Related Issues

Closes #400

Contributor Checklist

  • I agree to the Contributor License Agreement for this and future contributions.
  • My code follows the project's style guidelines according to CONTRIBUTING.md.
  • Tests pass
  • No sensitive info / secrets
  • Docs updated if needed

Decisions taken

Issue 400 - wire: retire capsule-wire, which only retired code still uses
Plan:     A/rev1 (planned against f433d918; executed on the head of lane #398's branch), amended by the orchestrator for ADR-0004 ownership
Branch:   chore/retire-capsule-wire-400
Base:     docs/reset-trackers-and-add-roadmap-398 (head of PR #422), stacked; the PR targets that branch
Worktree: /var/mnt/scratch/golem/dev/Capsulsaurus/Capsule.worktrees/Capsule-chore-retire-capsule-wire-400
Cause:    -
Touches:  capsule-wire/** → legacy-review/server-salvo/wire/** (git mv; Cargo.toml → Cargo.toml.disabled), Cargo.toml (:12, :25 member entries), capsule-server/Cargo.toml (:47-49), capsule-server/src/lib.rs (:7 reword), Cargo.lock (regenerated), xtask/src/architecture.rs (RETIRED_DEPENDENCIES += "capsule-wire"), .github/workflows/ci.yml (:54 delete the capsule-wire filter line), capsule-docs/src/content/docs/design/module-map.md (:19 crate-table row deleted), SLICES.md (S-C27 row :257 + detail block append + the salvo→kynos register row ONLY), legacy-review/server-salvo/{auth,media,upload}/Cargo.toml.disabled (path → ../wire), legacy-review/server-salvo/REVIEW.md (one bullet), adr/0004-*.md (EDIT the file lane #398 created: Status proposed → accepted, add the Contract line)
Will not: change any salvo_responses! call site; touch SLICES.md prose, gates table or counts; touch planned-modules.txt; touch ROADMAP.md except the capsule-wire row's State (stabilizing → review-only) and Notes — that single row is this lane's
Lane:     serialised behind #398 (ADR-0004, SLICES.md S-C27 note, module-map.md, ROADMAP row). Forecast collision: .github/workflows/ci.yml with #416 (adjacent filter lines).
Settled:  Base = head of PR #418 → stacks on #398. ADR-0004 was created by #398 as `proposed` with no Contract line (orchestrator decision); this lane flips it.

Decisions taken.

1. Deliverable boundary — all six lands from the issue in one change.
   Taken:    The crate move, both manifests, the lock, the CI filter, the xtask list, module-map.md, SLICES.md S-C27, the ADR flip, the ROADMAP row.
   Rejected: Move-and-drop-only with the ADR as a follow-up - adr/README.md's Granularity section makes the retirement one ADR; it already exists (proposed) and flipping it is two lines.
   Reverses: git revert the merge commit.
   Filed:    -

2. Which xtask list capsule-wire joins.
   Taken:    RETIRED_DEPENDENCIES only (architecture.rs:20-34) - check_dependencies reads cargo metadata, so a re-added path dependency is a violation.
   Rejected: RETIRED_COMPONENT_NAMES as well - check_retired_references is a substring scan over live .md/.rs/.toml and ignored_path excludes legacy-review/ but not SLICES.md or adr/, so the ADR recording the retirement would fail the check that enforces it.
   Reverses: add "capsule-wire" to RETIRED_COMPONENT_NAMES and rename the crate in SLICES.md:2246 and the ADR title.

3. The three disabled manifests' dependency path.
   Taken:    Rewrite ../../capsule-wire → ../wire at auth:18, media:24, upload:20 so the quarantined tree stays internally consistent; check_legacy_manifests forbids only a file literally named Cargo.toml.
   Rejected: Leave them dangling - a reader reconstructing the Salvo build gets a path error with no clue where the crate went.
   Reverses: git checkout the three .disabled files from the base.

4. S-C27's status in SLICES.md.
   Taken:    `done` with a "done by retirement" Landed note, Owed → cleared - the row's Done-when (rg salvo capsule-api/*/src/models empty + byte-identical openapi.json) is vacuous now that capsule-api is gone and the SDK generates from the Kynos document.
   Rejected: Keep `part 1 done` - the Owed column would name a DTO move whose 39 ToSchema derives retired with the Salvo tree.
   Reverses: restore SLICES.md:257 and delete the appended Landed paragraph.

Decisions taken inside the manifest during delivery, in the same shape:

5. The ROADMAP.md capsule-wire row: deleted, not restated as `review-only`.
   Taken:    Delete the row. check-roadmap.mjs resolves every row's Package cell against a
             declared package, and reviewBuckets (:216-223) enumerates `legacy-review/<bucket>/`
             at depth ONE only. `legacy-review/server-salvo/wire` is a crate inside the existing
             `server-salvo` bucket, which already has its own row, so no spelling of a surviving
             row resolves. Both failures were observed, not reasoned about: the row left as
             `capsule-wire | cargo | … | review-only | — |` reports "capsule-wire is not declared
             by any manifest in the tree", and rewritten as
             `legacy-review/server-salvo/wire | review-bucket` reports the same for that name.
             Deleting it is also what the file's own contract says - "one row for every package
             the repository declares" - and it matches the precedent inside the bucket: auth,
             media, upload, service, entity, model, sync, testing and migration each carry a
             Cargo.toml.disabled and none has a row. Where the crate went is recorded in
             ADR-0004, the S-C27 Landed note and REVIEW.md.
   Rejected: (a) Keep the row as a review-bucket at `legacy-review/wire/` - it resolves, but it
             contradicts decision 3, whose `path = "../wire"` is only correct if the crate is a
             sibling of auth/media/upload, and it would assert the crate is an independently
             reviewable stack when its 40 consumers are all inside server-salvo.
             (b) Leave the row and accept a red `roadmap` check - the check is a hard gate.
   Reverses: restore ROADMAP.md:44 from the base; the check then fails until the crate is a
             depth-one bucket.
   Filed:    -

6. The stale architecture-check figure in the salvo→kynos register row.
   Taken:    Change "reports **63 boundary violations**" to "reported … while the Salvo tree was
             still in the workspace". The cell is inside this lane's manifest, the claim is false
             today (architecture-check prints "boundaries are intact" because is_ignored_directory
             skips legacy-review/), and it sits one clause from the sentence this change adds.
   Rejected: Leave it - a reader would meet a false present-tense claim about the very check this
             pull request extends, immediately beside the new sentence.
   Reverses: restore the clause; no gate depends on it.
   Filed:    -

7. Taking the moved base.
   Taken:    Base merged by merge commit with the ROADMAP capsule-wire row dropped from the
             base's block. The base's own rewordings of the `capsule-server` and `capsule-wasm`
             rows are kept, since those rows belong to that lane; the resolved `ROADMAP.md`
             differs from the base's copy by exactly one deleted line. The pull request's diff
             against its base is unchanged by the merge - the same 19 files, +26/-25 - so the
             base's SLICES.md prose, ROADMAP rows, check-roadmap.mjs rewrite and bun.lock never
             appear as this lane's changes.
   Rejected: Leaving the pull request conflicting - GitHub creates no `pull_request` workflow
             runs for a conflicting pull request, so no CI could run on the head at all.
             Rebasing - it rewrites already-pushed history.
   Reverses: git revert -m 1 be5a12ab
   Filed:    -

Unresolved review notes

  • SLICES.md's row-count paragraph is now one row stale, deliberately untouched. Flipping
    S-C27 from part 1 done to done moves it out of the part bucket, so
    **98 done / 57 done\* / 28 ready / 9 part / …** should read 99 done / … / 8 part, and the
    parenthetical that follows still names S-C27 among the rows "the table spells part and
    part 1 done". That paragraph is outside this lane's manifest — it belongs to the tracker lane
    this branch is stacked on — so it is left for whoever holds it rather than widened here. No gate
    reads it: check-docs-truth parses table cells and ### S-XXX headings only.
  • The Web job's red mark on this pull request is issue ci: close the gate holes — test job outside required, missing path filters, pre-push parity, and the Kotlin smoke test #416's capsule-web/bun.lock fix, not
    this change; it turns green either when that lane lands or when this branch is rebased onto it.
    It is listed here rather than fixed because the file is outside this lane's manifest.
  • ADR-0004's Context cites capsule-wire/src/salvo_adapter.rs, a path this change moves. Left as
    written: an ADR's Context is by definition the state before the decision, and the ADR edit was
    scoped to the Status flip and the Contract: line.

Blocker — this pull request is CONFLICTING, so GitHub runs no CI on it

The base branch gained six commits after this branch forked from 1043a414
(99dd4bc8, 0fe7e290, f0d5c3cc, adea7c2c, 46d5559f, 09b95705), and PR #430 is now
mergeable: CONFLICTING / mergeStateStatus: DIRTY. GitHub does not create pull_request
workflow runs for a conflicting pull request, which is why 393d78d6 carries only the
Cloudflare Pages check: no CI run exists for it, and none was cancelled — none was ever
created. A close/reopen of the pull request did not change that, as expected. The green CI
recorded above was observed on b54dc818, the previous head; the one-line count correction in
393d78d6 has not been through CI.
Every local gate was re-run on 393d78d6 and passed.

The conflict is one file and one row. git merge-tree against the current base reports
SLICES.md and adr/0004-capsule-wire-is-retired.md auto-merging and only ROADMAP.md
conflicting, as a delete-vs-modify on the capsule-wire row: this branch deletes it (decision
5), while adea7c2c reworded its Notes cell. The conflict block also picks up the base's
rewordings of the adjacent capsule-server and capsule-wasm rows.

Resolution, verified rather than asserted: take the base's side of the block — so its
capsule-server and capsule-wasm rewordings are preserved, since those rows belong to that
lane — and drop the single | capsule-wire | … line. Applied to the merge tree in a scratch
copy, node capsule-docs/scripts/docs-truth.mjs then reports cross-links 529/529,
endpoint-census 84/84, module-paths 120/120 and roadmap 46 packages, all rows resolve.

This lane does not perform that merge. It would carry the base lane's SLICES.md prose,
ROADMAP.md rows, check-roadmap.mjs rewrite and bun.lock onto this branch — all outside
this lane's manifest — and that base is still moving, so the merge would need redoing. The
integrator should land the base first, then merge or rebase this branch and resolve as above.

Decision 5 survives the base's gate rewrite. f0d5c3cc made manifestDirs recurse one
level for Package.swift/package.json/pyproject.toml, but left reviewBuckets enumerating
legacy-review/<bucket>/ at depth one, so a crate inside the server-salvo bucket is still not
a package the check can key, and deleting the row is still the only green option.

The Web failure classified above is already fixed on the base. 99dd4bc8 build(web): regenerate bun.lock for the package.json the v1 head changed is in the base now, so that job
should pass once this branch is merged onto it.

Blocker cleared (be5a12ab)

The base was merged by merge commit, resolved exactly as verified above, and the pull request is
MERGEABLE again. GitHub created workflow runs for the new head immediately — CI, Build Android
app and Build Apple client — which confirms the conflict, not a runner outage, was what
suppressed run creation on 393d78d6. The base did not move again: it is still 09b95705.
mise run check-docs-truth on the merged tree reports cross-links 529/529, endpoint-census
84/84, module-paths 120/120 and roadmap 46 packages all resolving; mise run lint-check-md
reports 172 files, 0 issues; mise run check-commits accepts the merge commit. The paragraphs
above are kept as the record of why the head sat without CI, not as a live claim.

`capsule-wire` carried the framework-free response taxonomy `S-C27`
extracted so the contract could outlive the transport. The transport
swapped and the taxonomy did not come with it: `capsule-server::problem`,
`::limits` and `::body` own it on Kynos, no live crate names `capsule_wire`,
and a third of the crate is a `salvo_responses!` adapter for a framework
that left the workspace with `S-C59`.

Its only real consumers are the 42 macro call sites under
`legacy-review/server-salvo/`, so the crate lands beside them at
`legacy-review/server-salvo/wire/` with its manifest disabled, per the
convention every other quarantined crate follows. `capsule-server` loses a
path dependency it never imported; the module comment states where the
taxonomy went instead of linking a crate that is no longer built.

BREAKING CHANGE: `capsule-wire` is no longer a workspace member and
`capsule-server` no longer depends on it. Nothing in the workspace imported
it, so no public API moves.
`architecture-check` reads `cargo metadata`, so listing `capsule-wire` in
`RETIRED_DEPENDENCIES` makes a re-added path dependency in any member a
boundary violation rather than a review question. It joins the list under
its retired arm, beside `capsule-media`.

It stays out of `RETIRED_COMPONENT_NAMES` deliberately:
`check_retired_references` is a substring scan over live `.md`/`.rs`/`.toml`
and `ignored_path` excludes `legacy-review/` but neither `SLICES.md` nor
`adr/`, so listing the name there would make the records of this retirement
fail the check that enforces it.

CI's `rust` paths filter loses the `capsule-wire/**` entry, which now names
a directory outside the workspace, and the Salvo review notes say which of
the moved crate's surfaces must not come back.
ADR-0004 flips from `proposed` to `accepted` and gains the `Contract:` line
`adr/README.md` requires of a landed decision — without it the record is
prose no reader can falsify.

`S-C27` becomes `done`, by retirement rather than by completion. Its part 2
was owed to the Kynos port; the port declined it, because the 39 `ToSchema`
derives the DTO move was waiting on retired with the Salvo tree instead of
moving. The row's own "Done when" — `rg salvo capsule-api/*/src/models`
empty plus a byte-identical `openapi.json` — is vacuous now that
`capsule-api` does not exist and the SDK generates from the Kynos document,
so leaving the row at `part 1 done` would name owed work nobody can do. The
salvo→kynos register row says the same, and its claim that
`architecture-check` reports 63 violations is put in the past tense it
belongs in: the check is clean because the tree it counted is quarantined.

`module-map.md`'s crate table and the `ROADMAP.md` package row drop
`capsule-wire`: both enumerate what the workspace declares, and the roadmap
check resolves rows against `[workspace] members` and the depth-one
`legacy-review/*/` buckets, neither of which now names it. The three
disabled Salvo manifests point at `../wire` so the quarantined tree stays
internally consistent for whoever reads it.
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 2, 2026

Copy link
Copy Markdown

Deploying capsule with  Cloudflare Pages  Cloudflare Pages

Latest commit: be5a12a
Status: ✅  Deploy successful!
Preview URL: https://b9b4a0e2.capsule-22k.pages.dev
Branch Preview URL: https://chore-retire-capsule-wire-40.capsule-22k.pages.dev

View logs

The Landed note said 41 `salvo_responses!` call sites. The count that
produced it was taken with no `--include`, so it swept the same change's new
`REVIEW.md` bullet, which names the macro in prose. Restricted to `.rs`
outside the moved crate the tree has 40 invocations — which is what the
salvo→kynos register row already says — plus two `use capsule_wire::…`
lines, giving the 42 `capsule_wire` references measured separately.
@justin13888 justin13888 closed this Sep 2, 2026
@justin13888 justin13888 reopened this Sep 2, 2026
…ire-capsule-wire-400

Resolution: `ROADMAP.md` takes the base's block — its rewordings of the
`capsule-server` and `capsule-wasm` rows, which belong to that lane — with the
single `capsule-wire` row dropped, since this branch retires that package.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant