feat: LogosCore as a shell, over core_service, with core_service's contract

[dlipicar]

Phase 7 of the runtime-control plan: logos::host::LogosCore can act as a shell, a named consumer of the runtime, instead of reaching modules through the C API and a mirrored token store.

Stacked on #168 (feat/runtime-delegate-export). It also merges #167 (feat/core-token-listener, d9617aa), because the apps moving to this API still use #167's token listener during the transition. The diff therefore shows #167's two files as well.

What changes in logos_host_core.h

• Protected input. Config gains:

  • bundledModulesDirs
  • placementPolicyJson
  • shellName

  This is the input feat: one token authority, core_service embedded in liblogos, and the shell binding logos-liblogos#227 takes before start. If liblogos refuses one, the constructor cleans up and throws std::invalid_argument.

• The shell binding. With a shellName, start() takes liblogos' shell binding. It gets one only when capability_module runs in-process as the token authority. From then on:

  • loadModule, unloadModule, refreshModules, knownModules, loadedModules and allStats/stats go through core_service as that identity, with per-call deadlines (120 s for lifecycle calls, 15 s for queries). LogosLoadDeps maps onto loadModule's new deps argument.
  • admitConsumer(name) returns the credential capability minted for a UI plugin; retireConsumer(name) ends that consumer.
  • shellCredential() hands the shell identity to a co-process or to a Qt LogosAPI.
  • shellBinding() is for calls and subscriptions this class does not wrap.

  Without a binding, the C API serves exactly as before, so a host can set shellName whatever mode the runtime runs in.

• Deprecated: tokenListener. Once capability_module is the authority, core saves no tokens.

• Mirror. logos_core_set_bundled_modules_dirs, logos_core_set_placement_policy, logos_core_set_shell_identity, logos_core_take_shell_binding and logos_consumer_*. As with feat: let a host observe the tokens core saves #167, a host needs the liblogos that exports them (#227).

cpp/core_service.lidl

This is core_service's contract: every method and its scope, the answer shapes, and the moduleStateChanged and module_event events. It is installed at share/logos/core_service.lidl. logos-cpp-generator --lidl parses it and generates a client.

Tests

tests/sdk/test_logos_host_core.cpp stubs the new entry points and adds seven cases:

• the protected input lands before start, and the binding is taken after it;
• a refused setting throws after cleanup;
• lifecycle calls go through core_service with the right arguments, and the C API is bypassed;
• an error answer is a failed load;
• without a binding, the C API serves;
• consumers are admitted and retired through core_service;
• the binding is released before cleanup.

macOS: checks.tests passes 394/394.

🤖 Generated with Claude Code

[github-actions]

📊 cpp-sdk doc-test report

The real accounts module, run through a logoscore daemon with the whole stack built against this commit of the C++ SDK — rendered alongside the commands actually run and their output (updated each run, commit b82a0db):

• ubuntu-latest report
• macos-latest report

Pages can take a minute to update after the run finishes.