prometeu-runtime/discussion/workflow/plans/PLN-0076-capabilities-and-abi-domain-split.md

id	ticket	title	status	created	ref_decisions	tags
PLN-0076	render-frame-packet-boundary	Capabilities and ABI Domain Split	open	2026-05-25	DEC-0030	gfx renderer runtime frame-composer architecture ui pipeline

Briefing

Source decision: DEC-0030.

Split render capabilities and syscall metadata so composer, gfx2d, and gfxui are independently addressable and enforceable according to AppMode.

Target

Capability gates reject wrong-domain render syscalls, and metadata no longer treats the old primitive gfx.* ABI as the single render surface.

Scope

• Add or rename capability flags for COMPOSER, GFX2D, and GFXUI.
• Update syscall metadata for all render-domain calls.
• Enforce domain availability by AppMode::Game and AppMode::Shell.
• Update resolver and capability tests.
• Preserve composer.* as Game 2D high-level composition.

Out of Scope

• Implementing command buffers.
• PBS stdlib author-facing wrappers.
• Host rendering.
• Backward compatibility for the old primitive gfx.* ABI.

Execution Sequence

1. Locate capability definitions, syscall registry metadata, and resolver tests.
2. Introduce separate render capability identifiers for composer, gfx2d, and gfxui.
3. Update metadata for existing composer calls and new or renamed primitive domains.
4. Add app-mode checks so Game exposes composer and gfx2d, while Shell exposes gfxui.
5. Replace stale tests that assume one graphics capability.
6. Run resolver and runtime syscall tests.

Acceptance Criteria

• Wrong-domain calls fail before mutating render state.
• Game mode cannot use gfxui.*.
• Shell mode cannot use composer.* or gfx2d.*.
• Capability metadata uses the split domain names.
• No compatibility promise remains for the old primitive gfx.* ABI.

Tests / Validation

• Add resolver tests for all three capabilities.
• Add app-mode enforcement tests for allowed and rejected calls.
• Run affected unit and integration tests.

Risks

• A large rename can hide semantic mistakes; verify every syscall maps to the correct domain responsibility.
• Author-facing stdlib names may still use gfx; keep this plan focused on ABI metadata.

Affected Artifacts

• Syscall metadata and resolver modules under crates/
• Capability tests