feat!: migrate to per-domain WIT + wasm32-unknown-unknown (#14)

## Summary

Migrate this capsule to:

1. The per-domain WIT host ABI introduced in `astrid-runtime/astrid#752`
(paired with `astrid-runtime/sdk-rust#44`).
2. `wasm32-unknown-unknown` as the canonical build target — zero
`wasi:*` imports, every host call routed through audited `astrid:*`
interfaces.

## Changes

- `.cargo/config.toml` — `target = "wasm32-unknown-unknown"` with
`--cfg=getrandom_backend="custom"` rustflag so `getrandom 0.4` picks up
the SDK's `__getrandom_v03_custom` extern (routes entropy through
`astrid:sys/host.random-bytes`).
- `rust-toolchain.toml` — `targets = ["wasm32-unknown-unknown"]`.
- `[patch.crates-io]` — points `astrid-sdk*` / `astrid-sys` /
`astrid-types` at the in-tree workspaces so the polyrepo cross-cuts
resolve.
- Call-site updates for the new typed-`error-code` SDK surface where
touched.

## Pairs with

- `astrid-runtime/astrid#752` — kernel-side migration
- `astrid-runtime/sdk-rust#44` — SDK migration
- All other `unicity-astrid/capsule-*` PRs on `feat/per-domain-wit`

## Test Plan

- [x] `cargo build --target wasm32-unknown-unknown --release` clean
- [x] `cargo clippy --release -- -D warnings` clean
- [x] Loads + runs under the migrated kernel — verified end-to-end via
`astrid run "say hi"`

Author: joshuajbouw

.cargo/config.toml

@@ -1,2 +1,8 @@
 [build]
 target = "wasm32-unknown-unknown"
+
+[target.wasm32-unknown-unknown]
+# Activates astrid-sys's custom getrandom backend that routes to
+# `astrid:sys.random-bytes`. Without this, uuid v4 / HashMap RNG seed
+# init fail to link on `wasm32-unknown-unknown`.
+rustflags = ["--cfg=getrandom_backend=\"custom\""]

.github/workflows/ci.yml

@@ -8,7 +8,6 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  RUSTFLAGS: "-D warnings"
 
 jobs:
   check:
@@ -19,7 +18,7 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: wasm32-wasip1
+          targets: wasm32-unknown-unknown
           components: clippy, rustfmt
 
       - uses: Swatinem/rust-cache@v2
@@ -28,14 +27,14 @@ jobs:
         run: cargo fmt --all --check
 
       - name: Clippy
-        run: cargo clippy --target wasm32-wasip1 -- -D warnings
+        run: cargo clippy --target wasm32-unknown-unknown -- -D warnings
 
       - name: Build WASM
-        run: cargo build --release --target wasm32-wasip1
+        run: cargo build --release --target wasm32-unknown-unknown
 
       - name: Upload WASM artifact
         uses: actions/upload-artifact@v4
         with:
           name: capsule-wasm
-          path: target/wasm32-wasip1/release/*.wasm
+          path: target/wasm32-unknown-unknown/release/*.wasm
           if-no-files-found: error

Cargo.toml

@@ -9,7 +9,7 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-astrid-sdk = { version = "0.6.1", features = ["derive"] }
+astrid-sdk = { version = "0.7", features = ["derive"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 
@@ -19,3 +19,7 @@ lto = true
 codegen-units = 1
 strip = true
 panic = "abort"
+
+# Local-development override: point at the in-repo sdk-rust workspace.
+# This is removed once sdk-rust 0.7.0 ships to crates.io.
+# See CAPSULE_MIGRATION_GUIDE.md for context.

rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
 channel = "1.94.0"
-targets = ["wasm32-wasip1"]
+targets = ["wasm32-unknown-unknown"]
 components = ["rustfmt", "clippy"]

src/lib.rs

@@ -196,8 +196,18 @@ impl ContextEngine {
             config.hook_timeout_ms, config.keep_recent
         ));
 
-        let sub =
-            ipc::subscribe("context_engine.v1.*").map_err(|e| SysError::ApiError(e.to_string()))?;
+        // Subscribe to the two request topics this capsule serves. The
+        // pre-refactor wildcard (`context_engine.v1.*`) is not legal
+        // under the kernel ACL — the manifest's [subscribe] declares
+        // specific exact-topic permissions, and a wildcard request
+        // exceeds them. The dispatcher reads `result.messages[].topic`
+        // and routes on it; receiving both topics on one Subscription
+        // (which the wildcard enabled) was a convenience, not a
+        // requirement.
+        let compact_sub = ipc::subscribe("context_engine.v1.compact")
+            .map_err(|e| SysError::ApiError(e.to_string()))?;
+        let estimate_sub = ipc::subscribe("context_engine.v1.estimate_tokens")
+            .map_err(|e| SysError::ApiError(e.to_string()))?;
 
         // Subscribe to our own hook topics so we can drain them.
         let hook_sub = ipc::subscribe("context_engine.v1.hook.before_compaction")
@@ -212,24 +222,26 @@ impl ContextEngine {
         log::info("Context Engine capsule ready");
 
         loop {
-            // Block until a message arrives (up to 60s), eliminating busy-spin polling.
-            match ipc::recv(&sub, 60_000) {
-                Ok(result) => {
-                    dispatch_poll_result(&result, &config);
-                }
-                Err(_) => break,
+            // Block briefly on each request channel, then drain the
+            // hook fan-out channels to prevent backpressure. The
+            // pre-refactor single-wildcard subscription is fanned out
+            // here into two short polls so cancellation latency stays
+            // bounded by `HOOK_POLL_INTERVAL_MS * 2`.
+            const HOOK_POLL_INTERVAL_MS: u64 = 1_000;
+            // Timeout is normal — fall through. Real errors surface
+            // when recv returns on a closed subscription, in which
+            // case the loop exits when the host stops invoking run.
+            if let Ok(result) = compact_sub.recv(HOOK_POLL_INTERVAL_MS) {
+                dispatch_poll_result(&result, &config);
+            }
+            if let Ok(result) = estimate_sub.recv(HOOK_POLL_INTERVAL_MS) {
+                dispatch_poll_result(&result, &config);
             }
 
             // Drain hook topics to prevent backpressure.
-            let _ = ipc::poll(&hook_sub);
-            let _ = ipc::poll(&after_sub);
+            let _ = hook_sub.poll();
+            let _ = after_sub.poll();
         }
-
-        let _ = ipc::unsubscribe(&sub);
-        let _ = ipc::unsubscribe(&hook_sub);
-        let _ = ipc::unsubscribe(&after_sub);
-
-        Ok(())
     }
 }
 
@@ -407,12 +419,13 @@ fn fire_before_compaction(
     message_count: u32,
     config: &Config,
 ) -> MergedBeforeCompaction {
+    // `SystemTime::now()` panics on `wasm32-unknown-unknown`. Use the
+    // monotonic host clock (which works) plus a per-capsule atomic
+    // counter to produce a unique-enough request_id for the hook
+    // fan-out reply-topic suffix.
     let request_id = format!(
         "compact-{}-{}",
-        std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap_or_default()
-            .as_millis(),
+        astrid_sdk::time::monotonic().as_nanos(),
         REQUEST_COUNTER.fetch_add(1, Ordering::Relaxed)
     );
 
@@ -443,36 +456,39 @@ fn fire_before_compaction(
         log::error(format!(
             "Failed to publish context_engine.v1.hook.before_compaction event: {e}"
         ));
-        let _ = ipc::unsubscribe(&sub);
+        // `sub` drops here, releasing the subscription.
         return MergedBeforeCompaction {
             skip: false,
             protected_ids: HashSet::new(),
         };
     }
 
     // Block-wait for hook responses within the configured timeout.
+    // `std::time::Instant::now()` panics on `wasm32-unknown-unknown`;
+    // use the monotonic host clock via `astrid_sdk::time` instead.
     let mut responses: Vec<BeforeCompactionHookResponse> = Vec::new();
-    let deadline =
-        std::time::Instant::now() + std::time::Duration::from_millis(config.hook_timeout_ms);
-
-    while std::time::Instant::now() < deadline && responses.len() < MAX_HOOK_RESPONSES {
-        let remaining_ms = deadline
-            .saturating_duration_since(std::time::Instant::now())
-            .as_millis();
+    let start = astrid_sdk::time::monotonic();
+    let timeout_dur = std::time::Duration::from_millis(config.hook_timeout_ms);
+
+    while astrid_sdk::time::monotonic().saturating_sub(start) < timeout_dur
+        && responses.len() < MAX_HOOK_RESPONSES
+    {
+        let elapsed = astrid_sdk::time::monotonic().saturating_sub(start);
+        let remaining_ms = timeout_dur.saturating_sub(elapsed).as_millis();
         if remaining_ms == 0 {
             break;
         }
         let timeout = u64::try_from(remaining_ms).unwrap_or(u64::MAX);
 
-        match ipc::recv(&sub, timeout) {
+        match sub.recv(timeout) {
             Ok(result) => {
                 responses.extend(parse_hook_responses(&result));
             }
             _ => break,
         }
     }
 
-    let _ = ipc::unsubscribe(&sub);
+    // Subscription drops at scope exit; no manual unsubscribe needed.
 
     if !responses.is_empty() {
         log::info(format!(

src/tests.rs

@@ -19,6 +19,7 @@ fn make_poll_result(messages: Vec<(&str, serde_json::Value)>) -> ipc::PollResult
                 topic: topic.to_string(),
                 payload: serde_json::to_string(&payload).unwrap(),
                 source_id: "test".to_string(),
+                principal: ipc::PrincipalAttribution::System,
             })
             .collect(),
         dropped: 0,