sdk

Repository dossier

Polyglot client SDKs — TS · Rust · Go · Python

On track

Branch: master
Commit: 13b5e1b1f85df8ce07234454b8ebfeadd06d95f2
Worktree: Clean
SDK: TypeScript 0.5.0; Rust 0.1.0; Go and Python contract peers

stack

TypeScript · Rust · Go · Python

green (exact-head SDK CI run 29755780234: four-language tests and coverage, type contract, conformance, and reusable dispatch caller)

deploy

not applicable (polyglot library family)

coverage

TypeScript 76.07%; Rust 76.06%; Go 71.51%; Python 83.81%; all upward-only ratchets pass

What it is. The polyglot client runtime — session().can() in TypeScript, Rust, Go, and Python (that order is fixed; there is no Ruby). The surface apps consume, hand-written in all four languages, each with SpiceDB, Keto, and MemStore backends and byte-identical safeId encoding.

What’s proven. All four SDKs resolve GP.Family ALLOW/DENY identically on real SpiceDB and real Ory Keto — 10/10 cells in the committed conformance matrix, with Go and Python also verifying real OIDC tokens through pure-stdlib RS256. @frauthy/sdk-ts@0.4.0 is published.

Where it falls short. Observability is one-language deep: only TS has an OTLP exporter — Rust, Go, and Python ship zero instrumentation. The Python SDK is synchronous against an async-first spec. The Rust SDK constructs a StubProvider unconditionally — it cannot verify a real token via config. Config-based constructors error out in Go and Python. There is no codegen pipeline (the codegen script is an echo), no publish automation outside TS, and TS canAll returns a bare boolean where the spec requires a BatchResult.

The plan. sdk/specs/GAP-CLOSURE-2026-07-12.md (SDK-1 … SDK-11): OTLP ports to the other three languages first (it unblocks OBSERVE-EVERYWHERE), the Python async migration, Rust OIDC ported from Go’s stdlib implementation, then constructors, publish automation, and the conformance-manifest runner.

full spec: sdk/specs/GAP-CLOSURE-2026-07-12.md

Gap ledger

0 open · 11 closed

Severity

Include closed gaps

11 results

11 gap records
Evidence ID	Gap	Severity	Effort	Status
`SDK-1`	OTLP telemetry missing in Rust, Go, Python (TS-only)	High	`M`	Closed in v7
`SDK-2`	Python SDK sync-only; spec requires async-first	High	`L`	Closed in v20
`SDK-3`	No framework adapters outside TS (axum/actix, chi/net-http, FastAPI/Django)	High	`M`	Closed in v21
`SDK-4`	Rust has no real OIDC provider (hardcoded StubProvider)	High	`M`	Closed in v20
`SDK-5`	No codegen pipeline or generated types (codegen script is a no-op echo)	High	`L`	Closed in v20
`SDK-6`	No publish automation for Rust/Go/PythonHuman gate	High	`S`	Closed in v20
`SDK-7`	Go New(config) and Python from_config() always error	Critical	`S`	Closed in v3
`SDK-8`	TS canAll() returns boolean instead of BatchResult	Critical	`S`	Closed in v3
`SDK-9`	No consistency-token per-call override wiring	Medium	`M`	Closed in v20
`SDK-10`	No coverage gates in CI	Medium	`S`	Closed in v10
`SDK-11`	No conformance-suite runner (hand-written tests instead of protocol manifest)	High	`M`	Closed in v20

Change history

v37 · 2026-07-28
canonical Dagger remote-delivery foundation
SDK master e534667 passed CI run 30410120101. The canonical Dagger profile removes engine OTLP variables before both Go and Python repository tests so each SDK's documented telemetry defaults remain deterministic.
Root, Protocol, Research, Market, Sandbox, Cloud, Admin, SDK, Site, and Infrastructure produced green hosted evidence during this migration. Brand's replacement canonical-action run remained non-terminal when polling stopped; no success is claimed for it.
This burst performed no Cloudflare, Neon, DNS, Terraform apply, package publication, GitHub environment mutation, or 1Password write. Site and Infrastructure production changes remain review- and evidence-gated.
v36 · 2026-07-20
Authenticated Admin and evidence-bound CI mesh
Every sibling caller is pinned to reviewed DevOps dispatch workflow commit `d39572723b2815bd1175546210325959883c3200`, waits for its real terminal CI DAG, and removes the legacy inline `FRAUTHY_CI_TOKEN` / `peter-evans` sender.
No secret was created, copied, printed, or persisted. No Cloudflare or Neon account was assumed to exist; no Terraform apply, DNS change, deployment, image publication, or SDK/UI package publication occurred.
All implementation used isolated worktrees. Active UI and product checkouts, including untracked Project Management UI work, were preserved.
v35 · 2026-07-20
Terraform-owned topology and Dagger master delivery
No Cloudflare or Neon account was assumed to exist. No Terraform apply, DNS mutation, Pages deployment, database creation, secret write, container publication, or SDK/UI package publication occurred.
Active product and UI worktrees were preserved. This program used isolated worktrees and exact-master ancestry checks so concurrent work was not overwritten.
v34 · 2026-07-19
Infrastructure-owned Site Pages contract
No live Cloudflare API mutation, Terraform apply, Pages deployment, GitHub secret write, DNS change, or cache pruning occurred in this version.
v33 · 2026-07-19
Authenticated workspace installs and gated Site delivery
Active Root, Site, and Project Management UI checkouts were preserved. The untracked `research/packages/ui/ui` tree and all product UI SDK surfaces were untouched.
v32 · 2026-07-16
Site typed content architecture
No public UI SDK package changed or was published. The active Site, Brand, and Research UI checkouts were not modified; implementation and ledger ingestion used isolated latest-master worktrees.
v31 · 2026-07-16
Site production quality gates and interactive GP.Family lab
No package was published, no production deployment occurred, and no active Brand or Research UI checkout was modified. Work was performed in isolated latest-master worktrees to preserve concurrent frontend changes.
v30 · 2026-07-16
Portal quality program assessment
No gaps are open; maintain cross-language contract parity and upward-only coverage.
v29 · 2026-07-15
CI mesh completion and Market container contract
This burst stayed outside the concurrent frontend program's ownership: no Brand, Site UI, Admin web, Cloud web, Market web, DevOps Portal, Research UI, or product `packages/ui` implementation was changed.
v23 · 2026-07-15
Cloud runtime contract moved to Cloudflare
Runtime hosting decisions are now standardized on Cloudflare. Provider-specific deployment and persistence requirements should use Cloudflare primitives; prior Kubernetes/AWS/provider-selection placeholders are no longer authoritative.
v21 · 2026-07-14
SDK framework adapters complete the polyglot surface
Rust now ships feature-gated Axum and Actix Web adapters with native extractors and authorization layers.
Go now ships net/http middleware plus Chi-compatible authentication and permission guards without adding a Chi runtime dependency.
Python now ships dependency-free ASGI middleware and lazy optional integrations for FastAPI and Django while preserving the core SDK's zero-runtime-dependency contract.
SDK-3 was implemented entirely inside the Gap Closure-owned SDK repository; no concurrent UI Federation path was touched.
v20 · 2026-07-14
SDK async, consistency, codegen, conformance, and release contract
Python is async-first with an explicit sync facade, and every SDK forwards per-call consistency semantics.
Deterministic IR codegen and the GP.Family manifest now execute across TypeScript, Rust, Go, and Python in required CI.
SDK-3 framework adapters are the sole remaining SDK gap and stay isolated from the concurrent UI federation program.
v19 · 2026-07-14
Wave 14 Protocol platform and app initialization
Wave 14 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI code, tests, documentation, its gap checklist, and this Research ledger event changed; no UI-owned surface, product packages/ui, Portal, registry publication, release tag, or concurrent UI branch was touched.
v18 · 2026-07-14
Wave 13 Protocol mapping completion
Wave 13 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol mapping/lifecycle code, tests, dependency metadata, its gap checklist, and this Research ledger event changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v17 · 2026-07-14
Frontend SDK federation prerelease gate
Frontend SDK Federation automated prerelease gate complete: seven Internal @frauthy/*-ui packages at 1.0.0-next.0, exact immutable tags and registry versions, seven verified Brand Portal libraries, 240 public components, and 634 catalog previews. Stable 1.0.0 promotion remains blocked only on the planned manual VoiceOver, NVDA, and TalkBack/touch-AT evidence.
v16 · 2026-07-14
Wave 12 Protocol LSP completion
Wave 12 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol LSP code/tests/documentation and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v15 · 2026-07-14
Wave 11 Protocol async contracts
Wave 11 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol core/backend contracts, Protocol tests/documentation, and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v14 · 2026-07-14
Wave 10 Protocol dev runner
Wave 10 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI, Protocol documentation, and the Research ledger changed; no UI-owned, package publication, registry, or tag path was touched.
v13 · 2026-07-14
Wave 9 Protocol-SDK type contract
Commit fecf7be vendors the exact Protocol a12565a manifest with commit and SHA-256 provenance, verifies TypeScript, Rust, Go, and Python mirrors offline, and compares byte-for-byte with a sibling Protocol checkout when present.
CanonicalClaims.raw is now aligned across all four SDKs. Each OIDC adapter preserves the original verified token payload, and each language suite asserts the behavior rather than merely compiling the added field.
Wave 9 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol and core SDK are wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, product UI, registry publication, or tag path changed.
v12 · 2026-07-14
Wave 8 Protocol release readiness
Wave 8 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol is wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, or product UI path changed.
v11 · 2026-07-14
Wave 7 branch protection
Wave 7 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
v10 · 2026-07-14
Wave 6 Protocol and SDK coverage gates
Actions run 29352210984 passed all four language suites and retained eight producer/gate artifacts. The component checklist now reflects the authoritative DevOps ratchet contract.
Wave 6 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
GitHub Actions billing is restored; all Protocol, SDK, and DevOps master workflows in this wave received runners and completed successfully.
v9 · 2026-07-14
Wave 5 coverage producers verified
GitHub Packages authentication was verified through the local gh credential. Brand packages are available at 1.0.0-next.1 and all seven product UI packages at 1.0.0-next.0 with internal visibility.
Verification remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v8 · 2026-07-14
Wave 5 Cloud and Market coverage producers
Local gates passed: Cloud 208 tests with 30 live-service tests gated, Market 176 tests with 29 live-service tests gated, and DevOps 132 tests; all three typechecks passed.
GitHub marked the DevOps, Cloud, and Market jobs failed without starting a runner because recent account payments failed or the spending limit must be increased. This is recorded as a human-gated infrastructure blocker, not as code verification.
Wave 5 remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v7 · 2026-07-13
Wave 4 Rust telemetry and real CI enforcement
Rust sessions now carry authentication and mapping context into can and lookupResources, emit the same five-span lifecycle as the other SDKs, and support deterministic custom exporters. The Rust suite passed 57/57 with Clippy clean.
Wave 4 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, product packages/ui, web composition, DevOps Portal, Research UI, or Sandbox UI path was changed.
GitHub Packages publication and UI release coordination remain owned by the concurrent Frontend SDK Federation.
v6 · 2026-07-13
Wave 3 cross-backend verification and observability
Go and Python now emit the real five-span Frauthy lifecycle from can and lookupResources, with deterministic mock-exporter coverage and a live Go network-export test. SDK-1 remains open because this wave did not complete equivalent Rust session wiring.
Wave 3 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v5 · 2026-07-12
Wave 2 deconflicted backend and CI mesh
SDK adopted the shared private CI-mesh contract. No additional SDK gap is claimed closed by this coordination work.
Wave 2 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v4 · 2026-07-12
Wave 1 remote CI gate
Python JWT tamper coverage now flips decoded signature bytes, removing a Python-version-dependent base64url pad-bit false negative. SDK master is 3926b45.
Remote gate complete: SDK CI, infrastructure CI/image build, sandbox tokenless integration, and the manually-dispatched SDK staleness workflow are green.
v3 · 2026-07-12
Wave 1 deconflicted backend lanes
Go New() and Python from_config() now construct real SpiceDB/Keto clients; TypeScript canAll() now returns the cross-language BatchResult shape in v0.5.0.
Rust, Go, and Python OTLP exporters plus real Rust OIDC verification landed, but SDK-1 and SDK-4 remain open until their remaining endpoint-level acceptance tests are added.
Wave 1 was deconflicted from the concurrent Frontend SDK Federation. Brand, site, root, research UI, and all owned web/portal surfaces were intentionally untouched.
v1 · 2026-07-12
Baseline — workspace-wide gap audit
Seeded from the 2026-07-12 twelve-agent audit of all eleven repos plus the Cuitty capability catalog. Eleven gap-closure specs written; orchestration plan at root/specs/06-GAP-CLOSURE-ORCHESTRATION.md.