F-157: Widget pack install — OCI pull + cosign verification#10

Merged

fdatoo merged 33 commits into

mainfrom

f157-widget-pack-install

May 9, 2026

Commits on May 9, 2026

feat(pkl): full §15.2 PackManifest; relocate WidgetInstance into widgets.pkl

fdatoo
and
claude
committed
docs(design): F-157 §3.1 — drop ContainerInstance from widgets.pkl re-export
fdatoo
committed
feat(config): add widgetPackPolicy to Pkl + proto + decoder

fdatoo
and
claude
committed
refactor(config): move widgetPackPolicyJSON to evaluator_decode.go

fdatoo
and
claude
committed
feat(proto): add WidgetPackService

fdatoo
and
claude
committed
docs(design): F-157 §5 — note SignatureStatus reuse + EXPIRED mapping
fdatoo
committed
feat(widgetpack): on-disk Store with persistence + Subscribe

fdatoo
and
claude
committed
fix(widgetpack): Store correctness — Remove rollback, event aliasing, stale log
fdatoo
committed
feat(widgetpack): real cosign keyless verification via sigstore-go

fdatoo
and
claude
committed
fix(widgetpack): trust policy polish — pattern validation, doc, nil checks
fdatoo
committed
feat(widgetpack): OCI artifact pull via oras-go

fdatoo
and
claude
committed
fix(widgetpack): OCI fetcher polish — retry, tidy, referrer doc
fdatoo
committed
docs(design): F-157 §6.3 — note OCI 1.1 Referrers limitation (F-289)
fdatoo
committed
feat(config): expose SwitchyardSchemeReaderOption + add manifest property to widgets.pkl

fdatoo
and
claude
committed
feat(widgetpack): Pkl-evaluator-driven manifest validation

fdatoo
and
claude
committed
fix(widgetpack): sandbox EvalManifest for untrusted input

fdatoo
and
claude
committed
fix(widgetpack): errcheck-clean rc.Close in readBlob
fdatoo
committed
feat(widgetpack): bundle HTTP handler with immutable cache

fdatoo
and
claude
committed
fix(widgetpack): bundle handler polish — request context, test hygiene

fdatoo
and
claude
committed
feat(widgetpack): full §15.4 install flow

fdatoo
and
claude
committed
fix(widgetpack): propagate Store.List error in checkCollisions
fdatoo
committed
feat(widgetpack): Uninstall with reference check

fdatoo
and
claude
committed
test(widgetpack): assert ErrPackNotFound identity in Uninstall test
fdatoo
committed
feat(widgetpack): WidgetPackService Connect handler

fdatoo
and
claude
committed
fix(widgetpack): drop nil-installer Service contract
fdatoo
committed
feat(api): widget_pack procedure-catalog registrar (inert until F-184)

fdatoo
and
claude
committed
feat(daemon): wire WidgetPackService + bundle handler

fdatoo
and
claude
committed
test(widgetpack): check err before resp.Body in serve_test
fdatoo
committed
feat(cli): wire switchyard widget {install,list,uninstall} to RPC

fdatoo
and
claude
committed
test(widgetpack): end-to-end integration against in-process registry

fdatoo
and
claude
committed
feat(dashboard): wire widgetpack.Store into dashboard catalog

fdatoo
and
claude
committed
refactor(widgetpack): drop unused dataDir + SetDashboardLister race

fdatoo
and
claude
committed
fix(driverkit): go mod tidy — drop stale otel indirect dep

fdatoo
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

F-157: Widget pack install — OCI pull + cosign verification#10

F-157: Widget pack install — OCI pull + cosign verification#10
fdatoo merged 33 commits into
mainfrom
f157-widget-pack-install

Commits on May 9, 2026

feat(pkl): full §15.2 PackManifest; relocate WidgetInstance into widgets.pkl

docs(design): F-157 §3.1 — drop ContainerInstance from widgets.pkl re-export

feat(config): add widgetPackPolicy to Pkl + proto + decoder

refactor(config): move widgetPackPolicyJSON to evaluator_decode.go

feat(proto): add WidgetPackService

docs(design): F-157 §5 — note SignatureStatus reuse + EXPIRED mapping

feat(widgetpack): on-disk Store with persistence + Subscribe

fix(widgetpack): Store correctness — Remove rollback, event aliasing, stale log

feat(widgetpack): real cosign keyless verification via sigstore-go

fix(widgetpack): trust policy polish — pattern validation, doc, nil checks

feat(widgetpack): OCI artifact pull via oras-go

fix(widgetpack): OCI fetcher polish — retry, tidy, referrer doc

docs(design): F-157 §6.3 — note OCI 1.1 Referrers limitation (F-289)

feat(config): expose SwitchyardSchemeReaderOption + add manifest property to widgets.pkl

feat(widgetpack): Pkl-evaluator-driven manifest validation

fix(widgetpack): sandbox EvalManifest for untrusted input

fix(widgetpack): errcheck-clean rc.Close in readBlob

feat(widgetpack): bundle HTTP handler with immutable cache

fix(widgetpack): bundle handler polish — request context, test hygiene

feat(widgetpack): full §15.4 install flow

fix(widgetpack): propagate Store.List error in checkCollisions

feat(widgetpack): Uninstall with reference check

test(widgetpack): assert ErrPackNotFound identity in Uninstall test

feat(widgetpack): WidgetPackService Connect handler

fix(widgetpack): drop nil-installer Service contract

feat(api): widget_pack procedure-catalog registrar (inert until F-184)

feat(daemon): wire WidgetPackService + bundle handler

test(widgetpack): check err before resp.Body in serve_test

feat(cli): wire switchyard widget {install,list,uninstall} to RPC

test(widgetpack): end-to-end integration against in-process registry

feat(dashboard): wire widgetpack.Store into dashboard catalog

refactor(widgetpack): drop unused dataDir + SetDashboardLister race

fix(driverkit): go mod tidy — drop stale otel indirect dep