chore(subc): bump subc-protocol 0.5 + subc-transport 0.2.2

Paired re-pin to the live wire (single subc-protocol 0.5.0 in the tree,
no diamond split). Wire-proven against a real 0.5.0 daemon: auth,
ModuleHello with launch_nonce echo, HelloAck/storage tolerance, RouteBind
reconcile, status + read tool dispatch, and config_divergence reject.

- Echo SUBC_LAUNCH_NONCE in ModuleHelloBody so a reserved module_id's
  HELLO is accepted (absent for non-reserved/self-connect).
- Drop the construct-only, never-read ConfigBinding from the manifest
  (removed from the 0.5 manifest; Bindings is now storage/vault_grants/
  identity).
- Test harness: ModuleHelloAckBody.storage (added in 0.5) and drop the
  RouteBind.config tier (removed in 0.5; already a no-op for AFT, which
  reads config from disk, not the wire).

Co-authored-by: Alfonso <289616620+alfonso-aft@users.noreply.github.com>

Author: ualtinok

Cargo.lock

@@ -114,8 +114,8 @@ htmd = "0.5.4"
 # codec (Frame + read_frame/write_frame) lands via subc-protocol/subc-transport
 # bumps when the Hello-onward control loop is wired. tokio runs ONLY at the
 # --subc transport edge; AFT's command core stays synchronous.
-subc-protocol = "0.4.0"
-subc-transport = "0.2.1"
+subc-protocol = "0.5"
+subc-transport = "0.2.2"
 tokio = { version = "1", features = ["rt", "net", "io-util", "time", "sync", "macros"] }
 
 [target.'cfg(unix)'.dependencies]

crates/aft/Cargo.toml

@@ -31,9 +31,8 @@ use crate::protocol::{ProgressKind, PushFrame, RawRequest, Response};
 use crate::runtime_drain;
 
 use subc_protocol::manifest::{
-    Bindings, Concurrency, ConfigBinding, ConfigSource, ExecutionMode, IdentityBinding,
-    IdentityScope, ModuleManifest, ProviderRole, StorageBinding, StorageKind, StorageScope, Tool,
-    TrustTier,
+    Bindings, Concurrency, ExecutionMode, IdentityBinding, IdentityScope, ModuleManifest,
+    ProviderRole, StorageBinding, StorageKind, StorageScope, Tool, TrustTier,
 };
 use subc_protocol::session::{ModuleControlRequest, ModuleControlResponse};
 use subc_protocol::{
@@ -898,10 +897,13 @@ where
     W: AsyncWrite + Unpin + Send + 'static,
 {
     // ModuleHello: register as a tool provider. control_ops:None = full baseline.
+    // Echo the one-time launch nonce the daemon injected via SUBC_LAUNCH_NONCE so a
+    // reserved module_id's HELLO is accepted; absent for non-reserved/self-connect.
     let hello = ModuleHelloBody {
         manifest: build_manifest(),
         protocol_ver: PROTOCOL_VERSION,
         control_ops: None,
+        launch_nonce: std::env::var("SUBC_LAUNCH_NONCE").ok(),
     };
     let hello_frame = Frame::build(
         FrameType::Hello,
@@ -2322,11 +2324,6 @@ fn build_manifest() -> ModuleManifest {
                 scope: StorageScope::Project,
                 owns_schema: true,
             },
-            config: ConfigBinding {
-                source: ConfigSource::SubcMediated,
-                tiers: vec!["user".to_string(), "project".to_string()],
-                expansion: std::collections::BTreeMap::new(),
-            },
             vault_grants: Vec::new(),
             identity: IdentityBinding {
                 requires: vec![IdentityScope::Project],

crates/aft/src/subc.rs

@@ -1436,6 +1436,7 @@ async fn drive_s1_rejection_daemon(
                 negotiated_ver: PROTOCOL_VERSION,
                 subc_ops: Vec::new(),
                 subc_capabilities: Vec::new(),
+                storage: None,
             })
             .expect("hello ack body"),
         )
@@ -1454,11 +1455,6 @@ async fn drive_s1_rejection_daemon(
             harness: "mcp:generic".to_string(),
             session: "s1-session".to_string(),
         },
-        config: vec![user_config_tier(json!({
-            "callgraph_store": false,
-            "search_index": false,
-            "semantic_search": false,
-        }))],
     };
     send_frame(
         &mut stream,
@@ -1558,6 +1554,7 @@ async fn open_fake_daemon_session(input: FakeDaemonInput) -> FakeDaemonSession {
                 negotiated_ver: PROTOCOL_VERSION,
                 subc_ops: Vec::new(),
                 subc_capabilities: Vec::new(),
+                storage: None,
             })
             .expect("hello ack body"),
         )
@@ -2798,7 +2795,6 @@ async fn send_route_bind_with_session_and_doc(
             harness: "opencode".to_string(),
             session: session.to_string(),
         },
-        config: vec![user_config_tier(doc)],
     };
     send_frame(
         stream,
@@ -3895,14 +3891,6 @@ fn is_callgraph_building(response: &Value) -> bool {
     response.get("code").and_then(Value::as_str) == Some("callgraph_building")
 }
 
-fn user_config_tier(doc: Value) -> subc_protocol::session::ConfigTier {
-    subc_protocol::session::ConfigTier {
-        tier: "user".to_string(),
-        source: "/tmp/aft-subc-bridge-test-user.jsonc".to_string(),
-        doc: doc.to_string(),
-    }
-}
-
 fn control_flags() -> Flags {
     Flags::new(false, Priority::Passive, false)
 }