feat: add C++ streaming Responses pilot

cpp/CMakeLists.txt

@@ -0,0 +1,80 @@
+cmake_minimum_required(VERSION 3.25)
+project(uos_cpp_pilot VERSION 0.1.0 LANGUAGES CXX)
+set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
+set(CMAKE_SKIP_RPATH ON)
+set(CMAKE_BUILD_RPATH "")
+set(CMAKE_INSTALL_RPATH "")
+set(Boost_USE_STATIC_LIBS ON)
+find_package(Boost 1.81.0 EXACT CONFIG REQUIRED COMPONENTS json system)
+find_package(OpenSSL 3 REQUIRED)
+find_package(Threads REQUIRED)
+if(NOT CMAKE_CROSSCOMPILING)
+  foreach(target Boost::headers Boost::json Boost::system Boost::container)
+    if(TARGET ${target})
+      set_property(TARGET ${target} PROPERTY INTERFACE_INCLUDE_DIRECTORIES "$ENV{UOS_CPP_TOOLCHAIN_DIR}/host-tools/include")
+    endif()
+  endforeach()
+endif()
+add_library(pilot_core src/core.cpp src/project_input.cpp src/project_tools.cpp src/payload_policy.cpp src/translator.cpp src/fixture_state.cpp src/fixture_control.cpp)
+target_include_directories(pilot_core PUBLIC include)
+target_link_libraries(pilot_core PUBLIC Boost::json Boost::system OpenSSL::SSL OpenSSL::Crypto Threads::Threads)
+add_executable(uos_cpp_pilot src/main.cpp src/server.cpp src/session.cpp src/upstream.cpp src/transport.cpp)
+target_link_libraries(uos_cpp_pilot PRIVATE pilot_core)
+execute_process(COMMAND git rev-parse HEAD WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}/.." OUTPUT_VARIABLE UOS_COMMIT OUTPUT_STRIP_TRAILING_WHITESPACE RESULT_VARIABLE UOS_GIT_RESULT)
+execute_process(COMMAND git status --porcelain --untracked-files=normal -- cpp docs/DECISIONS.md WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}/.." OUTPUT_VARIABLE UOS_DIRTY OUTPUT_STRIP_TRAILING_WHITESPACE)
+if(UOS_GIT_RESULT EQUAL 0 AND UOS_DIRTY STREQUAL "")
+  set(UOS_IDENTITY_SHA "${UOS_COMMIT}")
+  set(UOS_IDENTITY_DEPLOYMENT "cpp-${UOS_COMMIT}")
+  set(UOS_IDENTITY_DIRTY 0)
+else()
+  set(UOS_IDENTITY_SHA "unknown")
+  set(UOS_IDENTITY_DEPLOYMENT "cpp-dirty")
+  set(UOS_IDENTITY_DIRTY 1)
+endif()
+target_compile_definitions(uos_cpp_pilot PRIVATE UOS_GIT_SHA="${UOS_IDENTITY_SHA}" UOS_DEPLOYMENT_ID="${UOS_IDENTITY_DEPLOYMENT}" UOS_BUILD_DIRTY=${UOS_IDENTITY_DIRTY})
+
+foreach(target pilot_core uos_cpp_pilot)
+  target_compile_options(${target} PRIVATE -Wall -Wextra -Wconversion -Wshadow -Werror=return-type -ffile-prefix-map=${PROJECT_SOURCE_DIR}=uos-cpp-pilot -ffile-prefix-map=$ENV{UOS_CPP_TOOLCHAIN_DIR}=uos-sdk -fdebug-prefix-map=${CMAKE_BINARY_DIR}=uos-cpp-build)
+  if(UOS_SANITIZE)
+    target_compile_options(${target} PRIVATE -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)
+    target_link_options(${target} PRIVATE -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)
+  endif()
+endforeach()
+install(TARGETS uos_cpp_pilot RUNTIME DESTINATION bin)
+enable_testing()
+add_executable(protocol_tests tests/protocol_tests.cpp)
+target_link_libraries(protocol_tests PRIVATE pilot_core)
+if(UOS_SANITIZE)
+  target_compile_options(protocol_tests PRIVATE -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)
+  target_link_options(protocol_tests PRIVATE -fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer)
+endif()
+add_test(NAME protocol COMMAND protocol_tests)
+set_tests_properties(protocol PROPERTIES TIMEOUT 30 RUN_SERIAL TRUE)
+
+if(UOS_BUN_EXECUTABLE)
+  add_test(NAME socket COMMAND "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/../scripts/test-network.ts" -- "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/tests/conformance.ts" "$<TARGET_FILE:uos_cpp_pilot>" "${UOS_RUNTIME_PREFIX}")
+  set_tests_properties(socket PROPERTIES TIMEOUT 45 RUN_SERIAL TRUE)
+endif()
+
+if(UOS_BUN_EXECUTABLE)
+  add_test(NAME disconnect COMMAND "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/../scripts/test-network.ts" -- "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/tests/conformance.ts" "$<TARGET_FILE:uos_cpp_pilot>" "${UOS_RUNTIME_PREFIX}" --disconnect)
+  set_tests_properties(disconnect PROPERTIES TIMEOUT 30 RUN_SERIAL TRUE)
+endif()
+
+if(UOS_BUN_EXECUTABLE)
+  add_test(NAME control COMMAND "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/../scripts/test-network.ts" -- "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/tests/conformance.ts" "$<TARGET_FILE:uos_cpp_pilot>" "${UOS_RUNTIME_PREFIX}" --control)
+  set_tests_properties(control PROPERTIES TIMEOUT 30 RUN_SERIAL TRUE)
+endif()
+
+if(UOS_BUN_EXECUTABLE)
+  add_test(NAME recovery COMMAND "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/../scripts/test-network.ts" -- "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/tests/recovery.ts" "$<TARGET_FILE:uos_cpp_pilot>" "${UOS_RUNTIME_PREFIX}")
+  set_tests_properties(recovery PROPERTIES TIMEOUT 90 RUN_SERIAL TRUE)
+endif()
+
+if(UOS_BUN_EXECUTABLE)
+  add_test(NAME resources COMMAND "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/../scripts/test-network.ts" -- "${UOS_BUN_EXECUTABLE}" --no-env-file --no-install "${PROJECT_SOURCE_DIR}/tests/resources.ts" "$<TARGET_FILE:uos_cpp_pilot>" "${UOS_RUNTIME_PREFIX}")
+  set_tests_properties(resources PROPERTIES TIMEOUT 45 RUN_SERIAL TRUE)
+endif()

cpp/CMakePresets.json

@@ -0,0 +1,84 @@
+{
+  "version": 6,
+  "configurePresets": [
+    {
+      "name": "pi-release",
+      "generator": "Ninja",
+      "binaryDir": "${sourceDir}/../.data/cpp-build/pi-release",
+      "cacheVariables": {
+        "CMAKE_MAKE_PROGRAM": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr/bin/ninja",
+        "Boost_DIR": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr/lib/aarch64-linux-gnu/cmake/Boost-1.81.0",
+        "CMAKE_PREFIX_PATH": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr",
+        "CMAKE_CXX_COMPILER_LAUNCHER": "/usr/bin/python3;${sourceDir}/tools/compiler-limit.py",
+        "CMAKE_FIND_USE_PACKAGE_REGISTRY": "OFF",
+        "CMAKE_FIND_USE_SYSTEM_PACKAGE_REGISTRY": "OFF",
+        "CMAKE_TOOLCHAIN_FILE": "$env{UOS_CPP_TOOLCHAIN_DIR}/probe/pi-arm64.cmake",
+        "CMAKE_BUILD_TYPE": "Release",
+        "CMAKE_CXX_FLAGS_RELEASE": "-O2 -DNDEBUG -g1",
+        "CMAKE_CXX_FLAGS": "-B$env{UOS_CPP_TOOLCHAIN_DIR}/host-tools/bin/",
+        "CMAKE_AR": "$env{UOS_CPP_TOOLCHAIN_DIR}/host-tools/bin/ar",
+        "CMAKE_RANLIB": "$env{UOS_CPP_TOOLCHAIN_DIR}/host-tools/bin/ranlib",
+        "CMAKE_LINKER": "$env{UOS_CPP_TOOLCHAIN_DIR}/host-tools/bin/ld",
+        "CMAKE_STRIP": "$env{UOS_CPP_TOOLCHAIN_DIR}/host-tools/bin/strip",
+        "OPENSSL_INCLUDE_DIR": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr/include",
+        "OPENSSL_SSL_LIBRARY": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr/lib/aarch64-linux-gnu/libssl.so",
+        "OPENSSL_CRYPTO_LIBRARY": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr/lib/aarch64-linux-gnu/libcrypto.so",
+        "CMAKE_CROSSCOMPILING_EMULATOR": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/lib/ld-linux-aarch64.so.1;--library-path;$env{UOS_CPP_TOOLCHAIN_DIR}/root/lib/aarch64-linux-gnu:$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr/lib/aarch64-linux-gnu"
+      }
+    },
+    {
+      "name": "native-asan",
+      "generator": "Ninja",
+      "binaryDir": "${sourceDir}/../.data/cpp-build/native-asan",
+      "cacheVariables": {
+        "CMAKE_MAKE_PROGRAM": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr/bin/ninja",
+        "Boost_DIR": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr/lib/aarch64-linux-gnu/cmake/Boost-1.81.0",
+        "CMAKE_PREFIX_PATH": "$env{UOS_CPP_TOOLCHAIN_DIR}/root/usr",
+        "CMAKE_CXX_COMPILER_LAUNCHER": "/usr/bin/python3;${sourceDir}/tools/compiler-limit.py",
+        "CMAKE_FIND_USE_PACKAGE_REGISTRY": "OFF",
+        "CMAKE_FIND_USE_SYSTEM_PACKAGE_REGISTRY": "OFF",
+        "CMAKE_CXX_COMPILER": "/usr/bin/g++",
+        "CMAKE_BUILD_TYPE": "Debug",
+        "CMAKE_CXX_FLAGS_DEBUG": "-O0 -g1",
+        "UOS_SANITIZE": "ON",
+        "OPENSSL_INCLUDE_DIR": "/usr/include",
+        "OPENSSL_SSL_LIBRARY": "/usr/lib/libssl.so",
+        "OPENSSL_CRYPTO_LIBRARY": "/usr/lib/libcrypto.so"
+      }
+    }
+  ],
+  "buildPresets": [
+    {
+      "name": "pi-release",
+      "configurePreset": "pi-release",
+      "jobs": 1
+    },
+    {
+      "name": "native-asan",
+      "configurePreset": "native-asan",
+      "jobs": 1
+    }
+  ],
+  "testPresets": [
+    {
+      "name": "pi-release",
+      "configurePreset": "pi-release",
+      "execution": {
+        "jobs": 1
+      },
+      "output": {
+        "outputOnFailure": true
+      }
+    },
+    {
+      "name": "native-asan",
+      "configurePreset": "native-asan",
+      "execution": {
+        "jobs": 1
+      },
+      "output": {
+        "outputOnFailure": true
+      }
+    }
+  ]
+}

cpp/README.md

@@ -0,0 +1,65 @@
+# C++ direct DeepSeek fixture pilot
+
+This isolated C++20 candidate serves an authenticated streamed loopback `POST /v1/responses` for direct `deepseek-flash`, using the TypeScript Chat translation as its oracle. It is a fixture candidate, with a separate synthetic authority and storage codec. It grants no production standby, credential, database, provider-spend or activation authority.
+
+PR1 is merged at `db1d78cf9037775ba29b8aa72e89f2b2dbd6ba80`, tree `26b895d911b50f3ffcc3c139aa2869aec05706d8`. Its underlying deployed handler is `d94fef52ccc76e0d5aa019154f11e47d5e10fba6`. The C++ implementation contract and acceptance matrix remain the gate authority; a successful build or health response does not establish acceptance.
+
+The runtime has one Asio IO thread, one provider attempt per request, two active permits, no waiting queue, and at most eight header-reading sockets. It preserves source dispatch-quota reservation/defer/release order, full history, tool-call IDs, reasoning and usage missingness. The captured namespace replay uses the bare original name; the immediate peer-FIN vector is interruption, with no response, dispatch or charge. Those source quirks are retained deliberately.
+
+The reduced profile caps headers at16KiB, ingress at4MiB, an upstream SSE frame at1MiB, and the full terminal at2MiB. JSON depth64 and named allocation/node/event limits apply. These are declared pilot capacities; they do not claim the production32MiB ingress or unbounded cumulative output contracts. The request-owned first-frame/inactivity deadline does not authorize provider retry or quota failover.
+
+## Reproducible offline build
+
+Use the controller-qualified Debian ARM64 SDK manifest `9dde9684e06dcbbdc5433fd26c8517cb0ff0b63c2a80e2501f05f6ce27eb52f5`. It contains GCC12.2, Boost1.81, OpenSSL3, CMake3.25 and Ninja1.11. No dependency downloads, installs or application compilation occur at runtime. The builder's installed GCC16 is used only for the native sanitizer preset.
+
+```sh
+python3 cpp/tools/build.py /absolute/qualified-sdk pi-release checkpoint
+python3 cpp/tools/build.py /absolute/qualified-sdk pi-release test
+python3 cpp/tools/build.py /absolute/qualified-sdk native-asan checkpoint
+python3 cpp/tools/build.py /absolute/qualified-sdk native-asan test
+python3 cpp/tools/build.py /absolute/qualified-sdk pi-release tidy
+```
+
+The driver creates one reusable directory per preset under `.data/cpp-build`, a task-local CMake executable view, disk-backed compiler scratch, and full command/resource logs under `.data/cpp-evidence`. Its view executes the same qualified SDK binaries through their pinned loader with `--argv0`, so generated archive, regeneration, test and install commands use that same loader. The SDK itself stays read-only; no global library path changes are required.
+
+Build jobs remain1. The first512MiB compiler virtual-memory limit was measured insufficient for the transport translation unit. The owner authorized768MiB for the compiler and bounded build cgroup; this is distinct from the candidate's provisional96MiB service-memory acceptance target. The one-second build sampler reports a lower-bound disk peak, enforces the additional768MiB/aggregate2GB storage envelope and refuses filesystem free space below2GiB. Native ASan runtime requires its shadow address space and does not inherit the compiler VM cap.
+
+The Pi release uses the SDK compiler/sysroot, static Boost.JSON/System and dynamic target OpenSSL/libstdc++/libc. CTest launches that binary through the same target loader on the VPS; actual Pi execution remains a separate acceptance surface. The native sanitizer preset uses host Linux headers and only the SDK's Boost header subtree.
+
+## Private fixture configuration
+
+Create an owned mode700 state directory and a private JSON configuration. The only runtime command is `uos_cpp_pilot --config /path/to/config.json`. A minimal synthetic configuration is:
+
+```json
+{
+  "fixture_mode": true,
+  "token": "synthetic-secret",
+  "upstream_key": "synthetic-provider-secret",
+  "upstream_origin": "http://127.0.0.1:12345",
+  "state_directory": "/private/task/fixture-state",
+  "usage_limit": 50,
+  "port": 0
+}
+```
+
+Read the `ready` stdout event for the actual loopback endpoint. Plain HTTP upstreams require the explicit fixture mode and loopback address. Ordinary TLS transport fixes the provider origin, verifies certificate chain and hostname, sends SNI, and uses the configured CA file. No request body can choose an upstream URL, credential, filesystem path or provider.
+
+The journal owns an exclusive lock and records source quota transitions separately from semantic terminal, physical delivery and internal settlement. Each committed journal frame is checksummed and fsynced before publication. Snapshots use file fsync, atomic rename and directory fsync with a high-water sequence. Restart never dispatches a generation. A reserved lease is not reclaimed merely because a process disappeared; an ambiguous dispatched request remains charged. The codec is `uos-cpp-fixture-state-v1`, not Bun or Deno KV.
+
+## Async owners
+
+`Runtime` owns the IO loop dependencies, acceptor, authority, control descriptors and graceful-drain deadline. Each `Session` owns its HTTP parser/buffer, socket, request arenas, upstream, cancellation state, permit and delivery facts. A downstream wait callback owns the session until it completes; teardown cancels and joins that wait before the permit and buffers are released. Each write retains its complete owned wire buffer until completion, and upstream reads pause until downstream events drain.
+
+`Transport` owns resolver/TLS/socket/timer state across each await. Timer callbacks use weak ownership and cannot dereference a destroyed transport. `Upstream` separately owns HTTP response framing and the current bounded body buffer. JSON arenas outlive every value using them. Synchronous fixture durability occurs on this same IO thread; its fsync latency is measured and cannot be preempted by an Asio timer.
+
+The optional inherited fixture-control channel has no HTTP route. It requires actual owned anonymous pipe descriptors with exact read/write direction; an arbitrary child-process `pipe` abstraction must not be assumed to provide them. Fixed framed commands control only synthetic revocation, bounded readback and finite crash fences. Ordinary runtime has no armed fence or channel.
+
+## Qualification status
+
+The first Pi-release checkpoint built and passed the pure protocol smoke plus the shared real-socket two-turn tool loop and schema-refusal accounting. It was a dirty working-tree checkpoint, not a final release identity. Real disconnect, pinned native client, extended boundaries, control/crash recovery, sanitizer/tidy and independent Pi resource/soak evidence remain to be bound to the final source and binary. Buffered/nonstream requests are UNSUPPORTED pilot scope: false or missing `stream` is rejected with HTTP400 `invalid_request_error`/`param: stream` before provider dispatch, preserving eager reserve/release accounting when quota exists. TypeScript buffered behavior is unchanged; this is not buffered parity or a general OpenAI replacement.
+
+The shared TypeScript producer and client remain in `tests/helpers/responses-conformance-*.ts`. The C++ adapter adds no translation or expected-output repair: it starts the actual candidate, records its real socket output and checks the private checksummed quota journal independently. Official event field reference: <https://developers.openai.com/api/reference/resources/responses/streaming-events#response.function_call_arguments.delta>.
+
+The24MiB request budget includes named JSON allocations plus conservative external capacity reservations: four times observed ingress bytes plus256KiB during projection and8MiB plus tool-name metadata during relay. These reservations allocate no backing arrays and are reported as capacity budget, separately from actual arena/cgroup peaks. Namespace labels share one immutable owner rather than multiplying a large label per nested tool.
+
+The accepted downstream socket requests a fixed16KiB `SO_SNDBUF` (Linux commonly reports32KiB); the actual value and same-loop upstream-read/downstream-write pending/start/completion counters are available only through inherited `READ_STATE`. They are process-epoch observations, not durable quota counters. This bounded profile seam supports observed slow-reader pressure without adding a public API or environment setting. The ASan Session translation unit exceeded the measured768MiB build VM cap; the controller authorized a1GiB compiler/task retry after fresh2GiB host headroom, with the service96MiB target unchanged.

cpp/include/pilot/control.hpp

@@ -0,0 +1,30 @@
+#pragma once
+#include "pilot/state.hpp"
+#include <boost/asio/awaitable.hpp>
+#include <boost/asio/io_context.hpp>
+#include <boost/asio/posix/stream_descriptor.hpp>
+#include <boost/asio/steady_timer.hpp>
+#include <functional>
+namespace pilot {
+  namespace asio=boost::asio;
+  class Control:public std::enable_shared_from_this<Control> {
+    State& state_;
+    IoCounters& counters_;
+    asio::posix::stream_descriptor input_,output_;
+    asio::steady_timer fence_timer_,send_gate_,write_deadline_;
+    std::function<void()> stop_;
+    bool enabled_=false,armed_=false,held_=false,stopped_=false,sending_=false,send_waiter_=false;
+    std::uint64_t last_id_=0,fence_id_=0,ordinal_=0;
+    std::size_t commands_=0;
+    std::string phase_,request_id_,key_id_;
+    asio::awaitable<void> send(json::object message);
+    asio::awaitable<json::object> read_frame();
+    public: Control(asio::io_context& io,Config const& config,State& state,IoCounters& counters,std::function<void()> stop);
+    asio::awaitable<void> run();
+    asio::awaitable<void> fence(std::uint64_t ordinal,std::string_view phase,std::string_view request_id="");
+    void stop();
+    bool enabled() const {
+      return enabled_;
+    }
+  };
+}