A deadline that only interrupts caller-cancelled transport work returns
the context stop to the runner. Joined independent failures remain
visible instead of being hidden by cancellation. Simulated-time tests
check blocked reads and writes through the runner, preserve an
independent joined failure, and enforce earlier caller deadlines.
The assembly consumes its router queue and validates physical targets
before single or grouped output writes. Contiguous steady coils share
one write and a complete readback. Transport failures fail the batch,
while feedback mismatches fail only the affected members. Pulses avoid
transient feedback, and analog commands enforce exact voltage bounds.
The shared ledger stores outcomes before any feedback or result send.
Duplicate deliveries replay those outcomes without another physical
action, including after a publication failure or device reconnect.
The M31 driver validates settings, verifies every output mode and pulse
width before online, and establishes an input baseline without events.
Later reads publish state and timed input transitions through the shared
publisher. Offline recovery uses bounded backoff without duplicate
publication mechanics. Publication and cleanup errors return to the
runner, and cancellation closes the owned connection.
A serialized client implements the six Modbus functions that the M31
assembly needs. Transaction and response checks reject malformed or
unrelated replies before they become physical feedback. Caller context
cancellation and independent transport deadlines bound every exchange.
In-memory stream tests exercise the wire without a device or broker.
M31 topology validates the host, expansion models, and hardware pulse
settings. Each I/O family advances its own address range, so mixed
assemblies keep stable capability names without coupling analog and
digital offsets. Descriptors expose physical access and omit transient
pulse feedback.
The router parses each delivery once and keeps singles and ordered
batches in one bounded queue per device. Expiry, ownership, and caller
cancellation limit intake and queue backpressure. The device consumer
checks physical access and expiry again before work.
A shared per-device ledger retains the first 256 results with stable
metadata. Duplicate requests replay that result after uncertain delivery
without another action. Insertion order bounds memory, and callers
cannot mutate stored timestamps. The command and framework documents
state the signal behavior and the memory-only safety limits.
The shared publisher sends protocol publications through a small caller
transport. Retained values suppress equal payloads, while command
correlation and causation keep their evidence. Changed telemetry stays
non-retained at QoS 0 and supplies the latest five-minute or reconnect
snapshot at QoS 1. Repeats preserve observation times with fresh IDs.
All sends use the caller context and a five-second limit. The publisher
returns background failures to the runner without its own logging.
The runner starts the supplied integrations, forwards reconnect notices,
and waits for each worker to stop. It alone logs failures and preserves
independent errors joined with cancellation. The command waits for a
signal with an empty integration list and completes cleanup before exit.
Incoming publication dispatch passes its validated address to the shared
payload parser, so each topic is parsed once. Typed parsers keep their
operation, envelope, and payload checks. Their tests cover valid data,
wrong operations, and invalid envelopes without changing the existing
wire contract or rejected inputs.
Builders share payload validation with parsers without encoding and
parsing a publication for validation. Batch members use the shared
metadata and value checks without envelope encoding. Access flag
presence is a JSON input check, separate from typed descriptor checks.
Nil raw values still encode as null without changing caller data, and
the attribution limit measures the text that JSON encodes.
Typed publications and subscription helpers own the wire layout. The
public API exposes parsed addresses but no low-level topic or envelope
construction, which the driver framework does not need. Timing constants
have their own file, and batch fields and operation names use the normal
layout and words without changing the wire contract.
Typed builders and parsers cover every wire operation, including ordered
command batches and expiring hub diagnostics. Publications carry their
delivery rules and command response metadata, so callers need no topic
or envelope construction. Strict closed payloads reject unsupported
fields while event objects keep complete application data.
bin/check fails on a Go comment line over 80 columns, counted as
bin/reflow counts them, with tabs as 8 columns. gofumpt does not wrap
comments, and the line length linter would also count code lines, so a
long comment line passed every check.
The protocol package validates versioned topics, message metadata, and
subscription filters. Canonical IDs and fixed publication intervals let
callers share one wire contract without a broker dependency. Tests use
testify, with its dependencies pinned in the Nix package.
OneHouse starts as a program that prints its name, with the rules and
tools for all later work. The program gives the Nix package a binary
that the install check can run, so the build pipeline is tested before
the first feature.
The agent guide and its skills hold the rules for Go code,
documentation, checks, commits, and issues. The scripts in bin/ format
and check the repository with the tools from the pinned flake, and the
commit hook rejects a message that breaks the message rules.
projects / onehouse / log