Use the combination selected for each installation

Your application ships as one program containing every accepted implementation. Each installation receives a signed list telling it which implementation to use for every specified function. You do not build a separate program for every possible combination.

1. Vendor the current Rust runtime

polyform vendor-runtime

This writes the official runtime source, license, and provenance record to vendor/polyform-runtime. The runtime is not currently published on crates.io; vendoring makes the dependency explicit and reproducible.

[dependencies]
polyform-runtime = { path = "vendor/polyform-runtime" }

2. Load the verified release and register

polyform install OWNER/PROJECT verifies the program and writes a .polyform-trust.json file beside it. Generated application code supplies that file, its compiled implementation list, and a durable local state path to the runtime:

use polyform_runtime::{Client, ReleaseTrust};

let trust = ReleaseTrust::from_file("my-app.polyform-trust.json")?;
let client = Client::register(
    "https://omalled.com/polyform",
    Some(installation_id),
    "balanced",
    trust,
    compiled_implementations(),
    "my-app.composition-state.json",
)?;

The runtime accepts one active implementation ID for every function only after verifying the release-key delegation and the server's signature. IDs not present in the installed program are rejected.

3. Call the selected implementation

let selected = client.composition.implementations
    .get("decode_filename")
    .map(String::as_str)
    .unwrap_or("decode_filename.strict_utf8");

let result = match selected {
    "decode_filename.strict_utf8" => strict_utf8(bytes, flags),
    "decode_filename.table_driven" => table_driven(bytes, flags),
    other => return Err(format!("unknown implementation: {other}")),
};

The generated code adds this registration and dispatch structure. Private helpers remain part of their own implementation and are not selected separately.

4. Receive replacements safely

if client.refresh()? {
    // Use the new combination for later calls.
}

Call refresh between units of work—for example, when the app starts, before a new job, or every few minutes. Each request uses a fresh nonce. Older versions, forged responses, and silent attempts to restore a quarantined implementation are rejected, leaving the current composition unchanged.