chore: merge nerdsane/temper main (#513 to #521)

[rita-aga]

Merges nerdsane/temper main (1be4b7b) into arni-labs/temper main (37b3437). The two split after nerdsane nerdsane#509 (029f53e); this brings in everything nerdsane merged since:

• feat(spec): bind action parameters to authenticated subjects nerdsane/temper#513: bind action parameters to the authenticated caller (source on a parameter)
• feat(server): admit HTTP integrations through spec-declared actions nerdsane/temper#514: HTTP integrations go through spec-declared actions, authorized before WASM HTTP runs
• feat(cli): strengthen default application verification nerdsane/temper#515: verify checks complete application packages by default; CSDL schema aliases resolve
• feat(postgres): support explicitly configured storage schemas nerdsane/temper#517: storage in an explicitly configured Postgres schema
• feat(observe): export settings from the standard OpenTelemetry variables, and an event time on log records nerdsane/temper#520: telemetry export from the standard OTEL_* variables; exported log records get an event time
• feat(secrets): seed secrets from TEMPER_SECRET_ environment variables when temper serve starts nerdsane/temper#521: temper serve seeds secrets from TEMPER_SECRET_* variables

The arni-labs fixes (#1 to #7) are kept as they are. Merge it with a merge commit (not squash) so the next sync from nerdsane starts from this point.

Overlap

The merge had no conflicts. Only three files changed on both sides, in separate places:

• temper-jit/src/table/builder.rs: arni-labs added spawn copy, nerdsane added param_sources.
• temper-server/src/registry_bootstrap.rs: arni-labs converts old-syntax stored specs on the platform-store path, nerdsane qualifies the Postgres restore queries with the configured schema.
• Cargo.lock: cedar-policy-core added to temper-authz.

Authenticated parameter binding (nerdsane#513) only applies to actions whose spec declares a parameter source. Existing arni-labs specs declare none, so it does not change spawn copying or current apps.

Verification (local, merge commit 15ebecb)

This is the first PR on the fork to get a GitHub Actions run; these also ran locally with the CI commands:

• cargo fmt --check: pass
• cargo clippy --workspace --all-targets -- -D warnings: pass
• cargo nextest run --workspace -E 'not test(dst_)': 3554 passed, 65 skipped (#[ignore])
• DST core suites: 26 passed. DST platform boot, cedar, index, rollback and random: 29 passed
• observe-gated tests (spec_validate_endpoint, observe::, api::repl::): pass
• cargo test --doc --workspace: pass
• readability ratchet and storage dispatch boundary: pass
• GEPA end-to-end with the five test WASM modules built: 11 passed, including ignored ones
• pre-push gate (fmt, clippy, ratchet, cargo test --workspace): pass

Existing flaky test

temper-wasm http_stream_outbound::outbound_streaming_1mib_roundtrip fails now and then: the 1 MiB echo comes back short (950272 of 1048576 bytes in one failure). This is not from the merge. It failed 3 of 12 runs on arni-labs main (37b3437) and 2 of 8 on this merge, and neither side changed temper-wasm since the fork point. It blocked the first push here through the pre-push cargo test --workspace. It may be a real early end-of-stream in outbound streaming, so it needs its own investigation.

Not covered

This does not change production. TemperPaw main pins arni-labs/temper by revision (37b3437 in its Cargo.lock), so TemperPaw and production move only when that pin is bumped and released. Before bumping it, check that the Katagami and TemperPaw apps still pass temper verify under nerdsane#515's stricter defaults, and that their WASM HTTP integrations call declared actions (nerdsane#514).

🤖 Generated with Claude Code

https://claude.ai/code/session_015CNkWvhUF4HU5howkdn5Ep

Confidence Score: 4/5

The PR appears safe to merge, with two non-blocking improvements to package checks and test cleanup.

Findings

1.  Test listeners never stop ▶
2.  Unusable modules pass verification ▶

Fix with agent prompt

### Issue 1
crates/temper-observe/tests/otel_export/listener.rs:39-44
`Listener::start` moves the socket into a detached thread that waits forever in `incoming()`. Each `run_scenario` creates another listener, but dropping `Listener` stops none of them. The sampler test alone leaves nine threads and listening sockets alive until the process exits. Keep a shutdown handle and join the thread when the listener is dropped.

### Issue 2
crates/temper-cli/src/verify/package.rs:37-43
The new compiled-module check only calls `is_file()`. An empty file or a text file named `probe.wasm` satisfies it, so an otherwise valid application can pass `temper verify` with an unusable module. Read and validate the referenced WASM bytes, and add a malformed-module regression test so authors catch this during verification rather than later.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This merge adds authenticated action parameters, declared HTTP admission actions, stricter application verification, explicit PostgreSQL schemas, OpenTelemetry export settings, and environment-seeded secrets.

• No blocking behavioral defect was established.
• Two non-blocking improvements remain: stop test listeners and check referenced WASM contents.
• rita-aga explicitly identified outbound_streaming_1mib_roundtrip as a pre-existing flaky test and deferred its investigation; it is not reported here.
• Review evidence comes from code inspection. No tests were executed during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Request[Authenticated HTTP request] --> Route[Declared endpoint]
  Route --> Admission[Declared OData actions]
  Admission --> Checks[Cedar, trusted parameters, and IOA checks]
  Checks --> Result{Actions succeed?}
  Result -->|No| Reject[Return rejection]
  Result -->|Yes| Transport{Endpoint type}
  Transport --> WASM[Run WASM with action responses]
  Transport --> Native[Call host-installed transport]
  WASM --> Response[HTTP response]
  Native --> Response

Loading

_{Reviews (1) · Last reviewed commit: "Merge nerdsane/temper main into arni-lab..."}

[greptile-apps]

Test listeners never stop

Listener::start moves the socket into a detached thread that waits forever in incoming(). Each run_scenario creates another listener, but dropping Listener stops none of them. The sampler test alone leaves nine threads and listening sockets alive until the process exits. Keep a shutdown handle and join the thread when the listener is dropped.

Prompt To Fix With AI

This is a comment left during a code review.
Path: crates/temper-observe/tests/otel_export/listener.rs
Line: 39-44

Comment:
**Test listeners never stop**

`Listener::start` moves the socket into a detached thread that waits forever in `incoming()`. Each `run_scenario` creates another listener, but dropping `Listener` stops none of them. The sampler test alone leaves nine threads and listening sockets alive until the process exits. Keep a shutdown handle and join the thread when the listener is dropped.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Unusable modules pass verification

The new compiled-module check only calls is_file(). An empty file or a text file named probe.wasm satisfies it, so an otherwise valid application can pass temper verify with an unusable module. Read and validate the referenced WASM bytes, and add a malformed-module regression test so authors catch this during verification rather than later.

Prompt To Fix With AI

This is a comment left during a code review.
Path: crates/temper-cli/src/verify/package.rs
Line: 37-43

Comment:
**Unusable modules pass verification**

The new compiled-module check only calls `is_file()`. An empty file or a text file named `probe.wasm` satisfies it, so an otherwise valid application can pass `temper verify` with an unusable module. Read and validate the referenced WASM bytes, and add a malformed-module regression test so authors catch this during verification rather than later.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[rita-aga]

CI run 37395914236 (the fork's first): every job passes except two. Both failures already exist on arni-labs main, and this merge changes neither file.

• Integrity & DST Patterns / No unwrap() in production code: flags crates/temper-platform/src/os_apps/mod_test/policy_reinstall/{faults.rs,mod.rs}. Those test files came in with arni-labs fix(os-apps): reinstalling an app replaces its previous Cedar #7 (e02af69) and are identical on main. The scanner treats src/**/mod_test/ as production code. fix(os-apps): reinstalling an app replaces its previous Cedar #7 never had a CI run.
• Tests / temper-spec::migration_differential (all_migrations_preserve_integrations, git_show_ignores_inherited_git_dir_from_other_repo): git show 53e2304^:... fails with "invalid object name". Commit 53e2304 exists only on nerdsane side branches (for example codex/startup-fs-idempotency), not in main history. The fork has no copies of those branches, so this fails on any arni-labs CI run. Neither side changed the test file.

Everything else passed: compile and lint, all four DST/platform suites, spec verification L0 to L3, instrumentation hygiene, and the other 3102 workspace tests. Locally, both of these pass because that clone also has the nerdsane branches.