feat(sdk): provider SDKs for TypeScript, Python, and Go — all conformant#43
Merged
Conversation
Add sdk/typescript: a zero-dependency TS SDK for building Context Graph Protocol
providers. Its example provider passes all 7 conformance checks under the same
Rust suite that judges the reference provider — the first independent (non-Rust)
implementation to clear that bar, which is a GOVERNANCE.md freeze criterion
("≥2 independent implementations pass conformance").
- src/types.ts — wire types mirrored from schema/contextgraph-envelope.schema.json.
- src/provider.ts — runStdioProvider(): the stdio lifecycle loop (handshake,
query with correlation-id echo, verify, shutdown, malformed-input tolerance).
- src/budget.ts — budgetTokens() = ceil(utf8_len/4) (B3).
- examples/example-docs.ts — honest reference provider; passes green.
- .github/scripts/conformance-external.sh — run the suite against ANY external
provider command; the reusable, language-neutral oracle for every SDK.
- CI: `sdk (typescript)` job builds the SDK and asserts conformance is green.
Part of #17 (provider SDKs). Python and Go follow, validated the same way; Go is
gated on a Go toolchain (not yet available locally) so it will not be presented
as working until it passes the same suite.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @macanderson, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
Add sdk/python: a zero-dependency (stdlib-only) Python SDK for building Context Graph Protocol providers. Its example provider passes all 7 conformance checks under the same Rust suite (Rust, TypeScript, now Python — three independent implementations that clear the freeze bar). - contextgraph_sdk/types.py — TypedDicts mirrored from the JSON schema. - contextgraph_sdk/provider.py — run_stdio_provider(): the stdio lifecycle loop (handshake, query with correlation-id echo, verify, shutdown, malformed-input tolerance). - contextgraph_sdk/budget.py — budget_tokens() = ceil(utf8_len/4) (B3). - examples/example_docs.py — honest reference provider; passes green. - CI: `sdk (python)` job asserts the Python provider stays conformant.
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
Add sdk/go: a zero-dependency (stdlib-only) Go SDK for building Context Graph Protocol providers. Its example provider passes all 7 conformance checks under the same Rust suite (Rust, TypeScript, Python, now Go — four independent implementations that clear the freeze bar). `go vet` and `go build` are clean. - contextgraph/types.go — wire structs mirrored from the JSON schema. - contextgraph/provider.go — RunStdioProvider(): the stdio lifecycle loop (handshake, query with correlation-id echo, verify, shutdown, malformed-input tolerance); the Verifier interface is the optional context/verify surface. - contextgraph/budget.go — BudgetTokens() = ceil(utf8_len/4) (B3). - examples/example-docs/main.go — honest reference provider; passes green. - CI: `sdk (go)` job vets, builds, and asserts the Go provider stays conformant.
macanderson
changed the title
…ahead of prior async `query`/`verify` handlers' pending replies, silently dropping their `frames`/`verified` output.
This commit fixes the issue reported at sdk/typescript/src/provider.ts:111
## Bug
`runStdioProvider` dispatched each stdin line fire-and-forget:
```ts
rl.on("line", (line) => { void handleLine(provider, line); });
```
`handleLine` is `async` and `await`s `provider.query(...)` / `provider.verify(...)` **before** calling `writeEnvelope(...)`. readline emits all buffered lines synchronously within one tick, so when a host pipelines requests (handshake, query, verify, shutdown), the `query`/`verify` handlers suspend at their `await` — deferring their `writeEnvelope` reply to a later microtask — while the following `shutdown` handler runs and calls `process.exit(0)` synchronously (line 111), terminating the process before those queued replies are written.
### Impact
The `frames` and `verified` replies are **silently lost**. This affects pipelined hosts, which the SDK explicitly enables by advertising `correlation: true`, and any request handler doing real async work whose reply a shutdown can preempt.
### Reproduction (confirmed)
Built the shipped example and piped `handshake`, `query`, `shutdown` (one JSON envelope per line):
* **Before fix:** output was only `handshake_ack` — the `frames` reply was dropped.
* **After fix:** all replies (`handshake_ack`, `frames`, `verified`) are emitted.
The EOF path (`rl.on("close", () => process.exit(0))`) did not exhibit this because `close` fires on a later tick, letting microtasks drain — only the synchronous `shutdown` branch raced.
## Fix
Serialize line handling through a promise queue so each line's handler is chained after the previous one resolves:
```ts
let queue: Promise<void> = Promise.resolve();
rl.on("line", (line) => {
queue = queue.then(() => handleLine(provider, line)).catch(() => {});
});
```
Now a later `shutdown` handler only runs — and calls `process.exit(0)` — after all prior handlers have resolved and their replies have been written. The `.catch(() => {})` keeps the chain alive if one handler rejects, so a single failing line never drops replies for subsequent lines (matching the prior independent-per-line robustness). EOF behavior and malformed-input tolerance are preserved.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: macanderson <mac@macanderson.com>
macanderson
marked this pull request as ready for review
July 23, 2026 19:34
There was a problem hiding this comment.
Sorry @macanderson, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
This was referenced Jul 23, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Provider SDKs in TypeScript, Python, and Go (
sdk/). Each is azero-dependency SDK for building Context Graph Protocol providers, and each one's
example provider passes the full Rust conformance suite — four independent
implementations (Rust + these three) now clear the bar, which is a
GOVERNANCE.mdfreeze criterion ("≥2 independent implementations passconformance").
They're judged by the same Rust suite that judges the reference provider,
driven language-neutrally by
contextgraph-inspect stdio -- <program>.sdk/typescriptsdk (typescript)CI jobsdk/pythonsdk (python)CI jobsdk/gosdk (go)CI jobEach SDK gives you
runStdioProvider/run_stdio_provider/RunStdioProvider— the stdiolifecycle loop (handshake, query with correlation-
idecho, verify, shutdown,and staying alive with a typed error on malformed input).
budgetTokens/budget_tokens/BudgetTokens— the B3 cost,ceil(utf8_len/4).Shared infrastructure
.github/scripts/conformance-external.sh— reusable, language-neutral oracle:run the conformance suite against any external provider command. Every SDK
is validated through it, in CI.
sdk (typescript|python|go)) build each SDK and assert itsexample provider stays green.
Scope note
conformance-red.shproves the suite catches cheaters using the Rust fixture,so an SDK provider only has to be honest (pass the 7 green checks) — it does
not reimplement the ~14 misbehaviour modes. That keeps each SDK small and focused.
Closes the SDK half of #17. #14 (host-side conformance) remains queued.