feat!: migrate to per-domain WIT + wasm32-unknown-unknown (#18)

## Summary

Migrate this capsule to:

1. The per-domain WIT host ABI introduced in `astrid-runtime/astrid#752`
(paired with `astrid-runtime/sdk-rust#44`).
2. `wasm32-unknown-unknown` as the canonical build target — zero
`wasi:*` imports, every host call routed through audited `astrid:*`
interfaces.

## Changes

- `.cargo/config.toml` — `target = "wasm32-unknown-unknown"` with
`--cfg=getrandom_backend="custom"` rustflag so `getrandom 0.4` picks up
the SDK's `__getrandom_v03_custom` extern (routes entropy through
`astrid:sys/host.random-bytes`).
- `rust-toolchain.toml` — `targets = ["wasm32-unknown-unknown"]`.
- `[patch.crates-io]` — points `astrid-sdk*` / `astrid-sys` /
`astrid-types` at the in-tree workspaces so the polyrepo cross-cuts
resolve.
- Call-site updates for the new typed-`error-code` SDK surface where
touched.

## Pairs with

- `astrid-runtime/astrid#752` — kernel-side migration
- `astrid-runtime/sdk-rust#44` — SDK migration
- All other `unicity-astrid/capsule-*` PRs on `feat/per-domain-wit`

## Test Plan

- [x] `cargo build --target wasm32-unknown-unknown --release` clean
- [x] `cargo clippy --release -- -D warnings` clean
- [x] Loads + runs under the migrated kernel — verified end-to-end via
`astrid run "say hi"`

Author: joshuajbouw

.cargo/config.toml

@@ -1,2 +1,8 @@
 [build]
-target = "wasm32-wasip1"
+target = "wasm32-unknown-unknown"
+
+[target.wasm32-unknown-unknown]
+# Activates astrid-sys's custom getrandom backend that routes to
+# `astrid:sys.random-bytes`. Without this, uuid v4 / HashMap RNG seed
+# init fail to link on `wasm32-unknown-unknown`.
+rustflags = ["--cfg=getrandom_backend=\"custom\""]

.github/workflows/ci.yml

@@ -8,7 +8,6 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  RUSTFLAGS: "-D warnings"
 
 jobs:
   check:
@@ -19,7 +18,7 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: wasm32-wasip1
+          targets: wasm32-unknown-unknown
           components: clippy, rustfmt
 
       - uses: Swatinem/rust-cache@v2
@@ -28,14 +27,14 @@ jobs:
         run: cargo fmt --all --check
 
       - name: Clippy
-        run: cargo clippy --target wasm32-wasip1 -- -D warnings
+        run: cargo clippy --target wasm32-unknown-unknown -- -D warnings
 
       - name: Build WASM
-        run: cargo build --release --target wasm32-wasip1
+        run: cargo build --release --target wasm32-unknown-unknown
 
       - name: Upload WASM artifact
         uses: actions/upload-artifact@v4
         with:
           name: capsule-wasm
-          path: target/wasm32-wasip1/release/*.wasm
+          path: target/wasm32-unknown-unknown/release/*.wasm
           if-no-files-found: error

.github/workflows/release.yml

@@ -21,16 +21,16 @@ jobs:
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
-          targets: wasm32-wasip1
+          targets: wasm32-unknown-unknown
 
       - uses: Swatinem/rust-cache@v2
 
       - name: Build release WASM
-        run: cargo build --release --target wasm32-wasip1
+        run: cargo build --release --target wasm32-unknown-unknown
 
       - name: Prepare release asset
         run: |
-          WASM_FILE=$(find target/wasm32-wasip1/release -maxdepth 1 -name '*.wasm' -not -name '*.d' | head -1)
+          WASM_FILE=$(find target/wasm32-unknown-unknown/release -maxdepth 1 -name '*.wasm' -not -name '*.d' | head -1)
           if [ -z "$WASM_FILE" ]; then
             echo "Error: No .wasm file found"
             exit 1

Capsule.toml

@@ -16,6 +16,10 @@ capabilities = { net = ["*"] }
 
 [publish]
 "llm.v1.stream.openai-compat" = { wit = "@unicity-astrid/wit/llm/stream-event" }
+# Exact topic for the post-#752 registry fan-out (registry subscribes to
+# the unsuffixed name). The `.*` wildcard below stays for any future
+# call-site that wants per-provider response correlation routing.
+"llm.v1.response.describe" = { wit = "@unicity-astrid/wit/llm/describe-response" }
 "llm.v1.response.describe.*" = { wit = "@unicity-astrid/wit/llm/describe-response" }
 
 [subscribe]

Cargo.toml

@@ -9,7 +9,7 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-astrid-sdk = { version = "0.6.1", features = ["derive"] }
+astrid-sdk = { version = "0.7", features = ["derive"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 uuid = { version = "1.0", features = ["serde"] }

README.md

@@ -47,8 +47,8 @@ The capsule reads these environment variables during `astrid init`:
 ## Development
 
 ```bash
-rustup target add wasm32-wasip1
-cargo build --target wasm32-wasip1 --release
+rustup target add wasm32-unknown-unknown
+cargo build --target wasm32-unknown-unknown --release
 ```
 
 ## License

rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
 channel = "1.94.0"
-targets = ["wasm32-wasip1"]
+targets = ["wasm32-unknown-unknown"]
 components = ["rustfmt", "clippy"]

src/lib.rs

@@ -64,8 +64,18 @@ impl OpenAICompatProvider {
 
     /// Returns provider metadata for IPC-based provider discovery.
     ///
-    /// Called by the registry capsule via `hooks::trigger("llm.v1.request.describe")`.
-    /// Returns the provider's model ID, capabilities, and IPC routing topics.
+    /// The registry capsule publishes a `llm.v1.request.describe` envelope
+    /// and drains responses on `llm.v1.response.describe` for a bounded
+    /// window. Each provider capsule subscribes to the request topic and
+    /// publishes its capability descriptor on the response topic. This
+    /// replaces the pre-#752 `hooks::trigger` fan-out path that returned
+    /// interceptor results through kernel-mediated dispatch — under the
+    /// new ABI the interceptor return value is no longer fanned out, so
+    /// the provider must publish explicitly.
+    ///
+    /// The return value is kept (same shape) so other interceptor callers
+    /// continue to see the descriptor; the explicit `ipc::publish_json`
+    /// is what registry's new fan-out actually consumes.
     #[astrid::interceptor("llm_describe")]
     pub fn llm_describe(&self, _payload: serde_json::Value) -> Result<serde_json::Value, SysError> {
         let model = env::var("model").unwrap_or_else(|_| "unknown".into());
@@ -77,7 +87,7 @@ impl OpenAICompatProvider {
             .ok()
             .and_then(|v| v.parse::<u64>().ok())
             .unwrap_or(8_192);
-        Ok(serde_json::json!({
+        let response = serde_json::json!({
             "providers": [{
                 "id": "openai-compat",
                 "description": format!("OpenAI-compatible provider (default model: {model})"),
@@ -87,7 +97,9 @@ impl OpenAICompatProvider {
                 "context_window": context_window,
                 "max_output_tokens": max_output,
             }]
-        }))
+        });
+        ipc::publish_json("llm.v1.response.describe", &response)?;
+        Ok(response)
     }
 }
 
@@ -178,39 +190,35 @@ impl OpenAICompatProvider {
             .header("authorization", format!("Bearer {api_key}"))
             .json(&request_body)?;
 
-        let resp = http::stream_start(&req)?;
+        let stream = http::stream_start(&req)?;
 
-        if resp.status != 200 {
-            // Drain the error body for the error message.
+        if stream.status() != 200 {
+            // Drain the error body for the error message. Stream drops at
+            // scope exit; no manual close required.
             let mut error_body = String::new();
-            while let Some(chunk) = http::stream_read(&resp.handle)? {
+            while let Some(chunk) = stream.read_chunk()? {
                 error_body.push_str(&String::from_utf8_lossy(&chunk));
                 if error_body.len() > 4096 {
                     error_body.truncate(4096);
                     break;
                 }
             }
-            let _ = http::stream_close(&resp.handle);
             return Err(SysError::ApiError(format!(
                 "API error ({}): {error_body}",
-                resp.status
+                stream.status()
             )));
         }
 
-        let result = Self::parse_sse_stream_live(request_id, &resp.handle);
-        let _ = http::stream_close(&resp.handle);
-        result
+        Self::parse_sse_stream_live(request_id, &stream)
+        // `stream` drops here, releasing the kernel-side HTTP stream.
     }
 
     /// Stream SSE chunks in real-time, publishing IPC events as they arrive.
-    fn parse_sse_stream_live(
-        request_id: Uuid,
-        stream: &http::HttpStreamHandle,
-    ) -> Result<(), SysError> {
+    fn parse_sse_stream_live(request_id: Uuid, stream: &http::HttpStream) -> Result<(), SysError> {
         let mut active_tools: Vec<(String, String)> = Vec::new();
         let mut line_buffer = String::new();
 
-        while let Some(chunk) = http::stream_read(stream)? {
+        while let Some(chunk) = stream.read_chunk()? {
             let chunk_str = String::from_utf8_lossy(&chunk);
             line_buffer.push_str(&chunk_str);