[moetemp]

What changed?

This PR adds @nexus.guard, which makes a resource class call a support function each time code takes one of its methods.

/// @nexus.guard python="check_stream_call"
resource %stream {
  constructor(ref: stream-ref, created: option<bool>);
}

_support.check_stream_call(target="workflow", method="append")

• The class of each target calls the guard with its target and the method name. The guard refuses a call by raising.
• The methods stay async def. The check sits in a __getattribute__ that a type checker doesn't see, so a misspelled method is still an error.
• Only Python takes a guard. The stream sample guards its Stream.

Why?

A Workflow Stream works only in Workflow code, and a client Stream only outside it. A plain function, such as the predicate of a take, can't await. Its stream.append(x) makes a coroutine that never runs, so the write is lost with no error. A check inside the async def can't catch that, because its body never runs.

How did you test it?

cargo validate passes. The stream tests check that a call with no await raises at its line, and that inspect.iscoroutinefunction is still true for a guarded method. Unit tests cover the parser, the catalog and the set of guarded names.

Link to a test plan if any -

• Unit Tests
• Staging
• End to End Tests