Problem. The RuntimeTypes lattice (#99/#110/#111) made the cow backend swappable but mandatory: type Cow: CowApi is a required lattice member, HostState.cow a required field, bindings.rs targets the shepherd:cow world, KNOWN_CAPABILITIES and the metrics namespace carry cow entries, and the SDK Host supertrait bounds on CowApiHost. An embedder can replace the orderbook pool but cannot build a runtime without one. ADR-0010 (PR #132) decides the opposite: nexum-runtime is domain-free and shepherd is the distribution that composes the cow extension at the root.
Scope. Complete M0's seam work by inverting the cow dependency: retarget the runtime bindgen to nexum:host/event-module, add a linker-extension hook and an Ext slot on the lattice, move the cow backend plus its WIT impl plus the cowprotocol dependency into a composition-root extension crate, make the capability-name mapping registry-extensible, and split CowApiHost out of the SDK supertrait. Behaviour-preserving throughout: the shepherd distribution keeps working identically, metrics names and engine.toml stay compatible (deprecation fallback for the orderbook_url location).
Sub-issues. Listed as native sub-issues.
Notes. Landmines from the code-trajectory review: capability elision means the extension's capability prefix must register before module boot or boots fail with CapabilityViolation (move both in one PR); the seam must not assume synchronous single-caller access because the later pool router serializes per-adapter calls (wasmtime Store is not Sync); shepherd_cow_api_* metric names and the [chains.N] orderbook_url key are operator contracts. This epic is the head of the critical path: M0 then M1 (intent core) precede the grant-evidence milestones by owner decision, with the legacy cow path retained as evidence fallback until the adapter path passes. The extension crate created here is a stepping stone: the M1 adapter port dissolves it into the cow venue adapter.
Problem. The RuntimeTypes lattice (#99/#110/#111) made the cow backend swappable but mandatory:
type Cow: CowApiis a required lattice member,HostState.cowa required field, bindings.rs targets the shepherd:cow world, KNOWN_CAPABILITIES and the metrics namespace carry cow entries, and the SDKHostsupertrait bounds onCowApiHost. An embedder can replace the orderbook pool but cannot build a runtime without one. ADR-0010 (PR #132) decides the opposite: nexum-runtime is domain-free and shepherd is the distribution that composes the cow extension at the root.Scope. Complete M0's seam work by inverting the cow dependency: retarget the runtime bindgen to nexum:host/event-module, add a linker-extension hook and an
Extslot on the lattice, move the cow backend plus its WIT impl plus the cowprotocol dependency into a composition-root extension crate, make the capability-name mapping registry-extensible, and splitCowApiHostout of the SDK supertrait. Behaviour-preserving throughout: the shepherd distribution keeps working identically, metrics names and engine.toml stay compatible (deprecation fallback for the orderbook_url location).Sub-issues. Listed as native sub-issues.
Notes. Landmines from the code-trajectory review: capability elision means the extension's capability prefix must register before module boot or boots fail with CapabilityViolation (move both in one PR); the seam must not assume synchronous single-caller access because the later pool router serializes per-adapter calls (wasmtime Store is not Sync);
shepherd_cow_api_*metric names and the[chains.N] orderbook_urlkey are operator contracts. This epic is the head of the critical path: M0 then M1 (intent core) precede the grant-evidence milestones by owner decision, with the legacy cow path retained as evidence fallback until the adapter path passes. The extension crate created here is a stepping stone: the M1 adapter port dissolves it into the cow venue adapter.