cx-platform-connector

Why reach for it

A connector is a declaration, and the plan it makes is pure. cx-platform-connector describes an external system as data — a gateway, its verbs, a binding — and plans every request without resolving anything, so a credential cannot reach a URL, a header, a log line or an audit record even in principle. sync carries the watermarks and cursors that make a repeated walk exact.

The corpus grades the attack classes by name: a control character in a cursor is refused before it can reach a header; a secret written into a gateway row or a feature document is refused at validation with its code; the plan carries a handle marker, never a value; a cursor that repeats is a cycle, not a loop. The positive twins are there too — a clean cursor rides as a query parameter, and only there.

sync is the other half: a watermark per source and tenant, a capture mode (polling diff or provider delta), an overlap window, and the one legal non-advance — an empty run that moves the sequence number and the stall counter and never the cursor — so \"nothing is changing\" and \"the cursor is stuck\" are readable apart without reading the store twice. The reference connectors and their design document ship in this repository's reference/ directory.

What it gives you

Two modules: the connector kit and sync. Both are pure over their declarations — the effect happens in the runtime that executes a plan, never in the plan — so the case below, like the attack cases beside it, runs with no grant at all.

Try it

A request planned from a gateway, a verb and a binding whose credential is a handle: the plan names the scheme and the handle and puts nothing in the headers. The secret was never in reach.

        [?lib 'cx-platform/connector']
[?let [= $g [gateway name=acme-api kind=http auth=client-credentials]]
      [= $v [verb name=list-contacts effect=observe via=acme-api path='/v3/contacts' [intent [do :list-contacts]]]]
      [= $b [binding base-url='https://api.example.test' credential='handle:acme/prod']]
      [= $req [$connector:plan $g $v $b [do 'acme/list-contacts']]]
      [= $a [$first $req/auth]]
  [probe [scheme $a@scheme] [handle [$string $a@handle]] [headers [$count $req/headers/*]]]]
      

        $ cx prog.cx
[probe [scheme :client-credentials] [handle handle:acme/prod] [headers 0]]
      

Status

The connector kit ships as a package: its two modules are bundled into the platform build from the pin, and the front door's link step reads the reference connectors' documents from the same checkout.

Links

• github.com/cx-home/cx-platform-connector — the repository
• README — what it is, how to install it, what it pins
• spec/03-approved — the specification, the only truth
• spec/03-approved/platform — the specification, the only truth
• conformance — the conformance corpus, the executable truth
• conformance/platform — the conformance corpus, the executable truth