Seams as Synthesized Providers: Interception, Typed Remote Clients, A2A Transport and Safe Adapter Synthesis

Pitch

A seam and a remote client are the same operation today, "synthesize a provider from a service declaration and put it in the row table", and a mock is designed to join it. Interception and remoteness therefore become admission facts that the unchanged checker already knows how to judge. Adapter synthesis is a separate path (src/revl/adapt.py) that the paper proposes to unify, not a caller of the same function.

Abstract

Middleware systems add interception, remote calls and interface adaptation as separate mechanisms: filter chains with a next() to forget, stub generators whose output is trusted, and adapters written by hand. Each has its own failure class and its own place in the trust story. We describe a composition language in which interception and remote providers are callers of one function, synthesize_provider(service, kind, params), over a table of named composition rows. The function emits ordinary source from a service declaration, and the ordinary compiler then checks it, so a synthesizer bug cannot make the checker admit ill-typed or out-of-bound code; it can still emit well-typed code with the wrong behaviour, which the checker does not catch. An interception row addresses a provision edge, is derived rather than written (no next()), has two kinds (observe, decide) and no rewrite. A remote row is a synthesized provider whose transport failure is declared to be provider withdrawal (the runtime cascade is not yet wired); it synthesizes no inverse, so the language's LIFO teardown guarantee is untouched, and its returns are untrusted by construction. A named wire, through a2a, binds A2A 1.0.0 and refuses every other transport by name. Safe adapter synthesis is a closed catalogue of total transformations under five safety clauses, proposed rather than applied silently, and admitted by the same gate as hand-written code. We report what is shipped (the seam row, the remote row, the A2A binding with its boundary gates, the adapter predicate with a 100-pair return-type dichotomy sweep), what is not (the full observer value, the widening of the emission bound, rename mapping), and where the documentation lags the code. We give no performance numbers.

Problem and claim

Interception, remote stubs and adapters each break a property that a checked composition language is trying to keep. A middleware chain lets a plugin forget to call the next handler or call it with other arguments. A generated remote client usually looks like a local call and is trusted as if it were one. An adapter written by hand, or inferred silently by a resolver, can change meaning without any reviewable artifact.

The claim is structural. If each of these is a synthesizer caller over a row table, then three consequences follow and can be checked in the tree. First, soundness is inherited: the synthesized text is compiled by the ordinary compiler, so G2 (one provider per key and realm), G3 and G4 (emission bounds) run unchanged (the function that returns the source is src/revl/synthesize.py:1652-1670; the gate code itself is not at that path and was not checked here). Second, the interesting decisions become small refusals with names: rewrite has no spelling, a remote method with no declared emission bound is not remotable, an address with userinfo is refused, an unknown transport is refused. Third, remoteness stops being a wiring fact. A consumer's source is identical whether its provider is local or remote.

The claim is not that revl has a unified synthesizer for four kinds today. The synthesizer function ships three kinds (remote, seam, host; src/revl/synthesize.py:117). The config overlay and the mock-requires driver are separate code paths. The paper must say "one synthesizer, three callers, with the overlay and mock designed to join" or fix the code first.

Contributions

1. Interception as an edge-addressed row: a seam row names a (key, realm) provision edge, its forwarder is derived from the service declaration so there is no next() to forget, the observer never receives the inner handle, observe and decide exist and rewrite has no spelling, with the refusal argument stated (src/revl/parser.py:6162, docs/design/424-dsh-language-gaps.md:369-420).
2. The remote row as an admission fact: the provider is synthesized, transport failure is declared withdrawal by default (the runtime cascade is not yet wired, docs/composition-rows.md:341-346), every method must declare an emission bound, no inverse is synthesized so G7's LIFO teardown has nothing to walk, an address with userinfo or a path is refused, and the returned value is Untrusted[T] (docs/composition-rows.md:263-320, src/revl/synthesize.py:1-80).
3. A named wire with a boundary: through a2a maps the canonical envelope onto A2A 1.0.0 message/send, refuses other transports by name, and joins gates that Untrusted[T] cannot give (correlation identity, envelope shape, scrubbing of peer-authored text from caller-visible failures) (docs/design/439-a2a-transport-binding.md:45-80, docs/design/439-a2a-transport-binding.md:199-300; src/revl/a2a_boundary.py:129, src/revl/a2a_boundary.py:197, src/revl/a2a_boundary.py:259, src/revl/a2a_boundary.py:413).
4. Safe adapter synthesis: a decidable predicate over two service declarations and an opt-in map, a closed refusal enum, a catalogue-version-pinned derivation hash, adapters proposed by revl adapt and the resolver rather than applied silently, and a standing test that the predicate and the gate never disagree (src/revl/adapt.py:56-120, src/revl/adapt.py:704-743; tests/test_296_synthesis_catalogue.py:175-300).
5. The unifying observation, with the caveat above: seam, remote and host providers are callers of one function over the row table, and config and mock are designed to join it (adapter synthesis is separate) (docs/design/424-dsh-language-gaps.md:681-700, src/revl/synthesize.py:1-30).

Related work

Evidence on main

Tree: revl main at commit 45bec431f. Counts are def test_ functions; no test was run for this extract.

Numbers that exist

• Test function counts: seam row 18, remote row 23, B1 interposition 5 + 4, A2A transport 112, A2A boundary 14, A2A task 12, A2A importer 71, adapter tests 296-series 34 (7 + 17 + 10) plus 35 in the adapter-named files (26 + 6 + 3). Counts of tests, not coverage.
• The dichotomy sweep covers 10 return types squared = 100 ordered pairs for the no-opt-in half (_RETURNS, tests/test_296_synthesis_catalogue.py:180-185). The test asserts at least 8 admitted and at least 8 refused; the actual split is not stored in the tree and was not computed here.
• No latency, size or user-study numbers exist for any of these constructs.

Paper outline

1. Introduction. Three failure classes (forgotten next(), trusted stubs, silent adapters) and the one-function answer.
2. Background: services, providers, emission bounds, the row table and G2/G3/G4/G7 in the form this paper needs.
3. The synthesizer: signature, why soundness is inherited, the kinds, what it refuses.
4. Interception: edge unit, derived forwarder, observe and decide, why no rewrite, distinct-key cost, the through fallback and the widening not taken.
5. Remote providers: admission facts, withdrawal, no inverse, untrusted returns, addresses.
6. The A2A binding: envelope mapping, boundary gates, why Untrusted[T] is not enough, version honesty.
7. Safe adapter synthesis: predicate, clauses, catalogue, proposed-not-silent, dichotomy test.
8. Evaluation: refusal catalogue per construct, dichotomy sweep, expressiveness study (if produced).
9. Related work, limits.

Threats to validity and limits

• Documentation lags code in at least three places named above. A reader of docs/composition-rows.md will see "not built" for a shipped construct.
• The seam's emission bound is not widened. The forwarder must fit inside the wrapped service's own declared bound, so inserting a seam currently requires a service that already declares a wide emission[...] (test test_a_narrow_service_bound_refuses_the_forwarder). The design note itself calls the widening a decision to be taken rather than accepted (docs/design/424-dsh-language-gaps.md:721-745) and says the cost is a weakening of transitive purity for plain fn methods across a seamed edge.
• Interposition is distinct-key only. The wrapped provider must be re-keyed in its own source; the same-key shape compiles and its body is silently discarded by the reference driver (docs/composition-rows.md:739-748). A third party still cannot intercept an unmodified provider.
• The A2A binding covers a text and inline-bytes subset, one round trip to a terminal state for the simple form, root-endpoint only; DataPart, uri file replies, streaming, push and durable task ids are open (docs/design/439-a2a-transport-binding.md:466-700).
• A remote row says nothing about the peer. There is deliberately no "verified remote" badge (docs/composition-rows.md:295-300).
• The adapter predicate reads only declarations, never bodies; defaults come only from an absence-shaped table; "Str to empty string" is refused by design. Name-only method matching in v1.
• "Total" and "never stuck" for adapters is argued from the catalogue (S1), not mechanized here. The dichotomy sweep is evidence against predicate/gate disagreement on 100 return pairs, not a proof.
• Seam runtime behaviour is checked on generated source only, and the withdrawal cascade on transport failure is not confirmed.
• Comparison with middleware, AOP and stub-generator literature is from general knowledge and marked for citation checking. No head-to-head experiment exists.

Fact-check

Claims in this draft were checked against revl main at commit 45bec431f: 33 checked, 11 corrected.

Cite this draft

@misc{revlp32,
  author       = {Thomas Moussajee},
  title        = {Seams as Synthesized Providers: Interception, Typed Remote Clients, A2A Transport and Safe Adapter Synthesis},
  year         = {2026},
  howpublished = {\url{https://inso1337.github.io/revl/research/P32.html}},
  note         = {Research draft, not peer reviewed. Written against revl commit 45bec431f. Licensed CC BY 4.0.}
}

Text licensed CC BY 4.0, author Thomas Moussajee.