[trissim]

P928: provide the Neovim that the editor actually launches

6 files, +324/-9 against current main. Typed-pair correction 6222aaa is included in published head 8b62482; matching Core head is fed5b840e3b32f8aec862bfbef1e2ae6d6cc6cb9. One Neovim requirement replaces two independent provisioning decisions: the bare PATH launch and CI's eight-line version/download/extract/PATH recipe. Paired Core PR: OpenHCSDev/agent-comms#3650. Neither half is independently installable; qualify and land the matched pair. This is SAME P928/c9ee087a2096, not the unfinished P3 geometry work.

Before / after

Before, NeovimEditing started literal nvim, while only CI supplied a release. A laptop without that staff setup could advertise the native editor and fail to start it.

After, Neovim(RuntimePreparation, Executable) owns the release, trusted archive metadata, preparation, exact executable and launch arguments. Runtime child creation uses its prepared command. Toad metadata declares one implementation in agent_comms.runtime_preparation; Core's ToadPackage declares the distribution identity and a TargetProbe loads that entry point only inside the target interpreter. Core does not import future Toad source.

CI invokes python -m toad.neovim_runtime, the same owner, after its existing native preparation. No curl recipe, second version constant, PATH discovery, fallback editor, key-time download, compatibility alias or separate installer registry.

Artifact lifecycle

Official Neovim v0.12.4 tar archives have declared sizes and trusted SHA-256 digests from the official release metadata. Download is bounded by the declared size and a socket timeout. The existing Toad Platform supplies the OS identity; a nominal architecture family decodes external machine aliases once. ReleaseArchive declares platform: type[Platform] and architecture: type[Architecture] beside its trusted size/digest. Its name is derived from that typed pair; Neovim.archive selects the pair itself. The four literal filename identities and f-string/name lookup are deleted (MEMB-4, paper1 Theorems 4.6/4.7). Each supported pair is declared once, not inferred again from a filename.

Preparation stages beside the final artifact, verifies the archive before data-filtered extraction, checks extracted bytes/links/path coverage and executable permissions against the trusted archive/declaration, then publishes the completed directory with one rename. Reuse verifies the retained archive and complete extracted tree; corruption refuses without overwriting the evidence. A concurrent completed publication is verified, not trusted blindly. Runtime launch resolves only the declared prefix path and never prepares it.

Standard and editor behavior

Architecture decoding is an instance default factory, not an import-time requirement: importing the editor for Standard does not require a supported native architecture. Standard retains its existing EditingMode implementation, without a child, preparation or executable lookup. FIFO input, cancellation, app-key priority, atomic document/cursor projection and child retirement are unchanged.

The existing real chooser/retirement/saved-Standard control now also asserts the actual Standard editor identity and ordinary text entry after reopening. P3 patch files are excluded.

Authored controls — UNRUN by author

tests/model/test_neovim_preparation.py: fresh official preparation and real executable version; reuse without republication; incomplete/corrupt archive refusal; same-size SHA corruption refusal; corrupt extracted executable refusal; runtime command points at the prepared executable and refuses absence without preparing/searching.

tests/textual/test_prompt_enter_insert.py: real selected-profile submission/cursor and chooser/retirement/saved-Standard controls, with native Standard typing strengthened here. Existing application-binding controls remain required.

A parametrized control derives all four supported pairs from Neovim.archives and asserts selection retains that very declaration; a Windows counterexample refuses without preparing anything. These additional controls are also UNRUN. Known old-head CI red: run 41017637133 cannot import the Core contract while #3650 is unmerged; no green result is claimed for this corrected head. Root must qualify the pair, land Core first, relock Toad to that Core main, and land Toad immediately after; neither half is an independently installable delivery.

Core companion adds real distribution-metadata boundary controls (valid nominal implementation, missing/duplicate entry points, malformed/abstract/unrelated classes), not patched loaders.

No author tests/checkers/collection/import probes/provider input/UI/install/profile. Root alone runs the combined controls and the actual installer -> installed editor -> Standard/native switch -> shortcuts -> submission -> retirement journey. Product provisioning and installed acceptance remain OPEN. Prior #1343 controls and manual host installation are not this result.

Source evidence and assumptions

Retained accepted NRA map: 902 production modules, zero parse omissions, 374 relevant sites; original coverage exclusions include the audit submodule and dynamic/workflow/Lua resolution. The main installer split was reconciled semantically: RuntimeStack.prepare_runtime now owns the family call; fresh UnbuiltRuntime.complete calls install_native -> prepare_runtime, and reused RuntimeResolution.complete calls prepare_runtime. The superseded upgrade.py build body is not restored.

Assumed: supported official assets are Linux/macOS on x86_64/arm64; Windows, other OSes and architectures explicitly refuse native provisioning. These platform paths are source support, not four verified installations. Trusted digests authenticate these exact official release bytes; this does not claim an independent upstream signature audit. The runtime prefix is user-owned and rename staging shares its filesystem. Artifacts follow that prefix's lifetime: reuse means an existing target prefix, not a new cross-prefix cache. Actual provider/editor and provisioning acceptance belong to root, still unrun.

Historical engine: #1320 merge 36719ff; Textual tracks main (no second pin). P3 remains separately retained at 4ef5a1a568d4a3f29d49f5a0a3c587003a69c871 on work/vim-neovim--P928--textual; no P3 completion claim.

CI used to receive the editor's executable as a party favour. The installed app was not on the guest list.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.