The only interface is a named, declared operation, and the shipped command line cannot call one

Status

In progress

Found while

SAPE-12

Triage

Fix in 1.0.0

Component

server

What was measured

The operator shell dispatches on help/?, ls, declare, and get/scan/count — internal/cli/shell.go. Searching every non-test file in internal/cli for the string "invoke" returns nothing.

get, scan and count are not invocations. They are the ad-hoc typed access an operator is allowed — the shape a declaration may have, typed at a prompt. They do not run anything anybody declared.

Found by following SAPE-12's own worked example from a cold start. The module installs: nine operations, three collections, all reported by name. Then m> invoke library:books.get answers there is no "invoke" here; type help, and the trail ends. A stranger who has just succeeded at the hard part — key, signature, trust list, install into a database that did not exist — has nowhere to go without writing Go or Node.

Why this is Fix in 1.0.0 and not a convenience

The triage question on this board is: does it lose data, break a promise on a public surface, or stop somebody installing and running the thing? The third one, plainly. Installing works; running does not.

But there is a second reason, and it is the one that decided it. This project's entire argument is the sentence at the top of every page: the only interface is a named, declared operation. A database that makes that claim and ships a command line that cannot call one is not merely missing a feature. It is the first thing a reader would quote back.

SAPE-11 made the catalogue carry each operation's cost envelope to an operator's terminal, so the shell can already show an operation, its limit, its collections and what escapes its projection. It shows the menu and cannot take the order.

What it needs

1. An invoke that calls the declared operation over the wire, on the path that already exists — not a re-implementation, and not an ad-hoc access wearing the name.
2. Arguments read from the declaration's own input, coerced by declared type, so an operator does not have to guess a JSON encoding.
3. Refusals by name: a missing required argument, an argument the declaration does not name, and a value of the wrong type each say which argument and what was expected. An unknown argument dropped in silence is the failure mode this project keeps finding; this is not the place to add another.
4. Namespaced names must work. library:books.get is one name containing a colon, and the argument syntax must not make that colon ambiguous — the kind of thing that breaks a week after shipping unless a test says otherwise.

Out of scope

• Output formats, piping, or a machine-readable mode. The clients exist for that.
• Command history or line editing.
• Anything about who is allowed to invoke what. That is scopes, and scopes shipped in SAPE-21.

The rest of the list this came from

Following that page cold produced eight things a stranger still has to guess. This is the largest. Two more are worth reading next to it, and both are about an author being told too late:

• seal and verify do not validate declarations. An index field with no missing rule seals cleanly and verifies as trusted yes — then install refuses it. An author can sign and publish a bundle nobody can install, and hear about it from an operator.
• The cost envelope is not readable before installation. SAPE-8's envelope is derived inside a store, and a bundle you have not installed is not in one. verify prints what a bundle declares, not what it would cost. The only true pre-install read is to install it somewhere disposable first.